7 * ternlogi <https://bugs.libre-soc.org/show_bug.cgi?id=745>
8 * grev <https://bugs.libre-soc.org/show_bug.cgi?id=755>
9 * GF2^M <https://bugs.libre-soc.org/show_bug.cgi?id=782>
16 pseudocode: [[openpower/isa/bitmanip]]
18 this extension amalgamates bitmanipulation primitives from many sources, including RISC-V bitmanip, Packed SIMD, AVX-512 and OpenPOWER VSX. Vectorisation and SIMD are removed: these are straight scalar (element) operations making them suitable for embedded applications.
19 Vectorisation Context is provided by [[openpower/sv]].
21 When combined with SV, scalar variants of bitmanip operations found in VSX are added so that VSX may be retired as "legacy" in the far future (10 to 20 years). Also, VSX is hundreds of opcodes, requires 128 bit pathways, and is wholly unsuited to low power or embedded scenarios.
23 ternlogv is experimental and is the only operation that may be considered a "Packed SIMD". It is added as a variant of the already well-justified ternlog operation (done in AVX512 as an immediate only) "because it looks fun". As it is based on the LUT4 concept it will allow accelerated emulation of FPGAs. Other vendors of ISAs are buying FPGA companies to achieve similar objectives.
25 general-purpose Galois Field 2^M operations are added so as to avoid huge custom opcode proliferation across many areas of Computer Science. however for convenience and also to avoid setup costs, some of the more common operations (clmul, crc32) are also added. The expectation is that these operations would all be covered by the same pipeline.
27 note that there are brownfield spaces below that could incorporate some of the set-before-first and other scalar operations listed in [[sv/vector_ops]], and
28 the [[sv/av_opcodes]] as well as [[sv/setvl]]
32 * <https://en.wikiversity.org/wiki/Reed%E2%80%93Solomon_codes_for_coders>
33 * <https://maths-people.anu.edu.au/~brent/pd/rpb232tr.pdf>
37 two major opcodes are needed
39 ternlog has its own major opcode
42 | ------ |--| --------- |
47 2nd major opcode for other bitmanip: minor opcode allocation
50 | ------ |--| --------- |
55 | 011 | | gf/cl madd* |
62 | dest | src1 | subop | op |
63 | ---- | ---- | ----- | -------- |
64 | RT | RA | .. | bmatflip |
68 | dest | src1 | src2 | subop | op |
69 | ---- | ---- | ---- | ----- | -------- |
70 | RT | RA | RB | or | bmatflip |
71 | RT | RA | RB | xor | bmatflip |
72 | RT | RA | RB | | grev |
73 | RT | RA | RB | | clmul* |
74 | RT | RA | RB | | gorc |
75 | RT | RA | RB | shuf | shuffle |
76 | RT | RA | RB | unshuf| shuffle |
77 | RT | RA | RB | width | xperm |
78 | RT | RA | RB | type | av minmax |
79 | RT | RA | RB | | av abs avgadd |
80 | RT | RA | RB | type | vmask ops |
89 TODO: convert all instructions to use RT and not RS
91 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|name|
92 | -- | -- | --- | --- | --- |-----|----- | -----|--|----|
93 | NN | BT | BA | BB | BC |m0-2 | imm | 10 |m3|crternlog|
95 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
96 | -- | -- | --- | --- | ----- | -------- |--| ------ |
97 | NN | RT | RA |itype/| im0-4 | im5-7 00 |0 | xpermi |
98 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
99 | NN | | | | | ..... 01 |0 | crternlog |
100 | NN | RT | RA | RB | RC | mode 010 |Rc| bitmask* |
101 | NN | RS | RA | RB | RC | 00 011 |0 | gfbmadd |
102 | NN | RS | RA | RB | RC | 00 011 |1 | gfbmaddsub |
103 | NN | RS | RA | RB | RC | 01 011 |0 | clmadd |
104 | NN | RS | RA | RB | RC | 01 011 |1 | clmaddsub |
105 | NN | RS | RA | RB | RC | 10 011 |0 | gfpmadd |
106 | NN | RS | RA | RB | RC | 10 011 |1 | gfpmaddsub |
107 | NN | RS | RA | RB | RC | 11 011 | | rsvd |
108 | NN | RT | RA | RB | sh0-4 | sh5 1 111 |Rc| bmrevi |
110 ops (note that av avg and abs as well as vec scalar mask
111 are included here [[sv/vector_ops]], and
112 the [[sv/av_opcodes]])
114 TODO: convert from RA, RB, and RC to correct field names of RT, RA, and RB, and
115 double check that instructions didn't need 3 inputs.
117 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
118 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
119 | NN | RS | me | sh | SH | ME 0 | nn00 110 |Rc| bmopsi |
120 | NN | RS | RB | sh | SH | 0 1 | nn00 110 |Rc| bmopsi |
121 | NN | RT | RA | RB | 1 | 00 | 0001 110 |Rc| cldiv |
122 | NN | RT | RA | RB | 1 | 01 | 0001 110 |Rc| clmod |
123 | NN | RT | RA | RB | 1 | 10 | 0001 110 |Rc| clmul |
124 | NN | RT | RB | RB | 1 | 11 | 0001 110 |Rc| clinv |
125 | NN | RA | RB | RC | 0 | 00 | 0001 110 |Rc| vec sbfm |
126 | NN | RA | RB | RC | 0 | 01 | 0001 110 |Rc| vec sofm |
127 | NN | RA | RB | RC | 0 | 10 | 0001 110 |Rc| vec sifm |
128 | NN | RA | RB | RC | 0 | 11 | 0001 110 |Rc| vec cprop |
129 | NN | RT | RA | RB | 1 | itype | 0101 110 |Rc| xperm |
130 | NN | RA | RB | RC | 0 | itype | 0101 110 |Rc| av minmax |
131 | NN | RA | RB | RC | 1 | 00 | 0101 110 |Rc| av abss |
132 | NN | RA | RB | RC | 1 | 01 | 0101 110 |Rc| av absu|
133 | NN | RA | RB | | 1 | 10 | 0101 110 |Rc| av avgadd |
134 | NN | RA | RB | RC | 1 | 11 | 0101 110 |Rc| grevw |
135 | NN | RA | RB | | | | 1001 110 |Rc| rsvd |
136 | NN | RA | RB | RC | 0 | 00 | 1101 110 |Rc| bmator |
137 | NN | RA | RB | RC | 1 | 00 | 1101 110 |Rc| bmatxor |
138 | NN | RA | RB | sh | 0 | 01 | 1101 110 |Rc| grevwi |
139 | NN | RA | RB | RC | 1 | 01 | 1101 110 |Rc| grev |
140 | NN | RA | RB | sh | SH | 10 | 1101 110 |Rc| grevi |
141 | NN | RA | RB | RC | 0 | 11 | 1101 110 |Rc| clmulr |
142 | NN | RA | RB | RC | 1 | 11 | 1101 110 |Rc| clmulh |
143 | NN | RA | RB | RC | | | --10 110 |Rc| rsvd |
144 | NN | | | | | | --11 110 |Rc| setvl |
148 Similar to FPGA LUTs: for every bit perform a lookup into a table using an 8bit immediate, or in another register.
150 Like the x86 AVX512F [vpternlogd/vpternlogq](https://www.felixcloutier.com/x86/vpternlogd:vpternlogq) instructions.
154 | 0.5|6.10|11.15|16.20| 21..28|29.30|31|
155 | -- | -- | --- | --- | ----- | --- |--|
156 | NN | RT | RA | RB | im0-7 | 00 |Rc|
159 idx = c << 2 | b << 1 | a
160 return imm[idx] # idx by LSB0 order
163 RT[i] = lut3(imm, RB[i], RA[i], RT[i])
167 also, another possible variant involving swizzle-like selection
168 and masking, this only requires 3 64 bit registers (RA, RS, RB) and
171 Note however that unless XLEN matches sz, this instruction
172 is a Read-Modify-Write: RS must be read as a second operand
173 and all unmodified bits preserved. SVP64 may provide limited
174 alternative destination for RS from RS-as-source, but again
175 all unmodified bits must still be copied.
177 | 0.5|6.10|11.15|16.20|21.28 | 29.30 |31|
178 | -- | -- | --- | --- | ---- | ----- |--|
179 | NN | RS | RA | RB |idx0-3| 01 |sz|
181 SZ = (1+sz) * 8 # 8 or 16
182 raoff = MIN(XLEN, idx0 * SZ)
183 rboff = MIN(XLEN, idx1 * SZ)
184 rcoff = MIN(XLEN, idx2 * SZ)
185 rsoff = MIN(XLEN, idx3 * SZ)
187 for i in range(MIN(XLEN, SZ)):
191 res = lut3(imm, ra, rb, rc)
196 another mode selection would be CRs not Ints.
198 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|
199 | -- | -- | --- | --- | --- |-----|----- | -----|--|
200 | NN | BT | BA | BB | BC |m0-2 | imm | 10 |m3|
204 if not mask[i] continue
205 crregs[BT][i] = lut3(imm,
214 the [[sv/av_opcodes]]
216 signed and unsigned min/max for integer. this is sort-of partly synthesiseable in [[sv/svp64]] with pred-result as long as the dest reg is one of the sources, but not both signed and unsigned. when the dest is also one of the srces and the mv fails due to the CR bittest failing this will only overwrite the dest where the src is greater (or less).
218 signed/unsigned min/max gives more flexibility.
221 uint_xlen_t min(uint_xlen_t rs1, uint_xlen_t rs2)
222 { return (int_xlen_t)rs1 < (int_xlen_t)rs2 ? rs1 : rs2;
224 uint_xlen_t max(uint_xlen_t rs1, uint_xlen_t rs2)
225 { return (int_xlen_t)rs1 > (int_xlen_t)rs2 ? rs1 : rs2;
227 uint_xlen_t minu(uint_xlen_t rs1, uint_xlen_t rs2)
228 { return rs1 < rs2 ? rs1 : rs2;
230 uint_xlen_t maxu(uint_xlen_t rs1, uint_xlen_t rs2)
231 { return rs1 > rs2 ? rs1 : rs2;
238 based on RV bitmanip, covered by ternlog bitops
241 uint_xlen_t cmix(uint_xlen_t RA, uint_xlen_t RB, uint_xlen_t RC) {
242 return (RA & RB) | (RC & ~RB);
249 based on RV bitmanip singlebit set, instruction format similar to shift
250 [[isa/fixedshift]]. bmext is actually covered already (shift-with-mask rldicl but only immediate version).
251 however bitmask-invert is not, and set/clr are not covered, although they can use the same Shift ALU.
253 bmext (RB) version is not the same as rldicl because bmext is a right shift by RC, where rldicl is a left rotate. for the immediate version this does not matter, so a bmexti is not required.
254 bmrev however there is no direct equivalent and consequently a bmrevi is required.
256 bmset (register for mask amount) is particularly useful for creating
257 predicate masks where the length is a dynamic runtime quantity.
258 bmset(RA=0, RB=0, RC=mask) will produce a run of ones of length "mask" in a single instruction without needing to initialise or depend on any other registers.
260 | 0.5|6.10|11.15|16.20|21.25| 26..30 |31| name |
261 | -- | -- | --- | --- | --- | ------- |--| ----- |
262 | NN | RS | RA | RB | RC | mode 010 |Rc| bm* |
264 Immediate-variant is an overwrite form:
266 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
267 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
268 | NN | RS | RB | sh | SH | itype | 1000 110 |Rc| bm*i |
274 mask_a = ((1 << x) - 1) & ((1 << 64) - 1)
275 mask_b = ((1 << y) - 1) & ((1 << 64) - 1)
280 mask_a = ((1 << x) - 1) & ((1 << 64) - 1)
281 mask_b = (~((1 << y) - 1)) & ((1 << 64) - 1)
282 return mask_a ^ mask_b
285 uint_xlen_t bmset(RS, RB, sh)
287 int shamt = RB & (XLEN - 1);
289 return RS | (mask << shamt);
292 uint_xlen_t bmclr(RS, RB, sh)
294 int shamt = RB & (XLEN - 1);
296 return RS & ~(mask << shamt);
299 uint_xlen_t bminv(RS, RB, sh)
301 int shamt = RB & (XLEN - 1);
303 return RS ^ (mask << shamt);
306 uint_xlen_t bmext(RS, RB, sh)
308 int shamt = RB & (XLEN - 1);
310 return mask & (RS >> shamt);
314 bitmask extract with reverse. can be done by bit-order-inverting all of RB and getting bits of RB from the opposite end.
316 when RA is zero, no shift occurs. this makes bmextrev useful for
317 simply reversing all bits of a register.
321 rev[0:msb] = rb[msb:0];
324 uint_xlen_t bmextrev(RA, RB, sh)
327 if (RA != 0) shamt = (GPR(RA) & (XLEN - 1));
328 shamt = (XLEN-1)-shamt; # shift other end
329 bra = bitreverse(RB) # swap LSB-MSB
331 return mask & (bra >> shamt);
335 | 0.5|6.10|11.15|16.20|21.26| 27..30 |31| name |
336 | -- | -- | --- | --- | --- | ------- |--| ------ |
337 | NN | RT | RA | RB | sh | 1 011 |Rc| bmrevi |
342 generalised reverse combined with a pair of LUT2s and allowing
343 a constant `0b0101...0101` when RA=0, and an option to invert
344 (including when RA=0, giving a constant 0b1010...1010 as the
345 initial value) provides a wide range of instructions
346 and a means to set regular 64 bit patterns in one
349 the two LUT2s are applied left-half (when not swapping)
350 and right-half (when swapping) so as to allow a wider
353 <img src="/openpower/sv/grevlut2x2.jpg" width=700 />
355 * A value of `0b11001010` for the immediate provides
356 the functionality of a standard "grev".
357 * `0b11101110` provides gorc
359 grevlut should be arranged so as to produce the constants
360 needed to put into bext (bitextract) so as in turn to
361 be able to emulate x86 pmovmask instructions <https://www.felixcloutier.com/x86/pmovmskb>.
362 This only requires 2 instructions (grevlut, bext).
364 Note that if the mask is required to be placed
365 directly into CR Fields (for use as CR Predicate
366 masks rather than a integer mask) then sv.ori
367 may be used instead, bearing in mind that sv.ori
368 is a 64-bit instruction, and `VL` must have been
369 set to the required length:
371 sv.ori./elwid=8 r10.v, r10.v, 0
373 The following settings provide the required mask constants:
375 | RA | RB | imm | iv | result |
376 | ------- | ------- | ---------- | -- | ---------- |
377 | 0x555.. | 0b10 | 0b01101100 | 0 | 0x111111... |
378 | 0x555.. | 0b110 | 0b01101100 | 0 | 0x010101... |
379 | 0x555.. | 0b1110 | 0b01101100 | 0 | 0x00010001... |
380 | 0x555.. | 0b10 | 0b11000110 | 1 | 0x88888... |
381 | 0x555.. | 0b110 | 0b11000110 | 1 | 0x808080... |
382 | 0x555.. | 0b1110 | 0b11000110 | 1 | 0x80008000... |
384 Better diagram showing the correct ordering of shamt (RB). A LUT2
385 is applied to all locations marked in red using the first 4
386 bits of the immediate, and a separate LUT2 applied to all
387 locations in green using the upper 4 bits of the immediate.
389 <img src="/openpower/sv/grevlut.png" width=700 />
391 demo code [[openpower/sv/grevlut.py]]
396 return imm[idx] # idx by LSB0 order
398 dorow(imm8, step_i, chunksize):
400 if (j&chunk_size) == 0
404 step_o[j] = lut2(imm, step_i[j], step_i[j ^ chunk_size])
407 uint64_t grevlut64(uint64_t RA, uint64_t RB, uint8 imm, bool iv)
409 uint64_t x = 0x5555_5555_5555_5555;
410 if (RA != 0) x = GPR(RA);
415 if (shamt & step) x = dorow(imm, x, step)
421 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
422 | -- | -- | --- | --- | ----- | -------- |--| ------ |
423 | NN | RT | RA | s0-4 | im0-4 | im5-7 1 iv |s5| grevlogi |
424 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
429 based on RV bitmanip, this is also known as a butterfly network. however
430 where a butterfly network allows setting of every crossbar setting in
431 every row and every column, generalised-reverse (grev) only allows
432 a per-row decision: every entry in the same row must either switch or
435 <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/8/8c/Butterfly_Network.jpg/474px-Butterfly_Network.jpg" />
438 uint64_t grev64(uint64_t RA, uint64_t RB)
442 if (shamt & 1) x = ((x & 0x5555555555555555LL) << 1) |
443 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
444 if (shamt & 2) x = ((x & 0x3333333333333333LL) << 2) |
445 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
446 if (shamt & 4) x = ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
447 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
448 if (shamt & 8) x = ((x & 0x00FF00FF00FF00FFLL) << 8) |
449 ((x & 0xFF00FF00FF00FF00LL) >> 8);
450 if (shamt & 16) x = ((x & 0x0000FFFF0000FFFFLL) << 16) |
451 ((x & 0xFFFF0000FFFF0000LL) >> 16);
452 if (shamt & 32) x = ((x & 0x00000000FFFFFFFFLL) << 32) |
453 ((x & 0xFFFFFFFF00000000LL) >> 32);
461 based on RV bitmanip.
463 RA contains a vector of indices to select parts of RB to be
464 copied to RT. The immediate-variant allows up to an 8 bit
465 pattern (repeated) to be targetted at different parts of RT
468 uint_xlen_t xpermi(uint8_t imm8, uint_xlen_t RB, int sz_log2)
471 uint_xlen_t sz = 1LL << sz_log2;
472 uint_xlen_t mask = (1LL << sz) - 1;
473 uint_xlen_t RA = imm8 | imm8<<8 | ... | imm8<<56;
474 for (int i = 0; i < XLEN; i += sz) {
475 uint_xlen_t pos = ((RA >> i) & mask) << sz_log2;
477 r |= ((RB >> pos) & mask) << i;
481 uint_xlen_t xperm(uint_xlen_t RA, uint_xlen_t RB, int sz_log2)
484 uint_xlen_t sz = 1LL << sz_log2;
485 uint_xlen_t mask = (1LL << sz) - 1;
486 for (int i = 0; i < XLEN; i += sz) {
487 uint_xlen_t pos = ((RA >> i) & mask) << sz_log2;
489 r |= ((RB >> pos) & mask) << i;
493 uint_xlen_t xperm_n (uint_xlen_t RA, uint_xlen_t RB)
494 { return xperm(RA, RB, 2); }
495 uint_xlen_t xperm_b (uint_xlen_t RA, uint_xlen_t RB)
496 { return xperm(RA, RB, 3); }
497 uint_xlen_t xperm_h (uint_xlen_t RA, uint_xlen_t RB)
498 { return xperm(RA, RB, 4); }
499 uint_xlen_t xperm_w (uint_xlen_t RA, uint_xlen_t RB)
500 { return xperm(RA, RB, 5); }
508 uint32_t gorc32(uint32_t RA, uint32_t RB)
512 if (shamt & 1) x |= ((x & 0x55555555) << 1) | ((x & 0xAAAAAAAA) >> 1);
513 if (shamt & 2) x |= ((x & 0x33333333) << 2) | ((x & 0xCCCCCCCC) >> 2);
514 if (shamt & 4) x |= ((x & 0x0F0F0F0F) << 4) | ((x & 0xF0F0F0F0) >> 4);
515 if (shamt & 8) x |= ((x & 0x00FF00FF) << 8) | ((x & 0xFF00FF00) >> 8);
516 if (shamt & 16) x |= ((x & 0x0000FFFF) << 16) | ((x & 0xFFFF0000) >> 16);
519 uint64_t gorc64(uint64_t RA, uint64_t RB)
523 if (shamt & 1) x |= ((x & 0x5555555555555555LL) << 1) |
524 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
525 if (shamt & 2) x |= ((x & 0x3333333333333333LL) << 2) |
526 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
527 if (shamt & 4) x |= ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
528 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
529 if (shamt & 8) x |= ((x & 0x00FF00FF00FF00FFLL) << 8) |
530 ((x & 0xFF00FF00FF00FF00LL) >> 8);
531 if (shamt & 16) x |= ((x & 0x0000FFFF0000FFFFLL) << 16) |
532 ((x & 0xFFFF0000FFFF0000LL) >> 16);
533 if (shamt & 32) x |= ((x & 0x00000000FFFFFFFFLL) << 32) |
534 ((x & 0xFFFFFFFF00000000LL) >> 32);
539 # Introduction to Carry-less and GF arithmetic
541 * obligatory xkcd <https://xkcd.com/2595/>
543 There are three completely separate types of Galois-Field-based
544 arithmetic that we implement which are not well explained even in introductory literature. A slightly oversimplified explanation
545 is followed by more accurate descriptions:
547 * `GF(2)` carry-less binary arithmetic. this is not actually a Galois Field,
548 but is accidentally referred to as GF(2) - see below as to why.
549 * `GF(p)` modulo arithmetic with a Prime number, these are "proper" Galois Fields
550 * `GF(2^N)` carry-less binary arithmetic with two limits: modulo a power-of-2
551 (2^N) and a second "reducing" polynomial (similar to a prime number), these
552 are said to be GF(2^N) arithmetic.
554 further detailed and more precise explanations are provided below
556 * **Polynomials with coefficients in `GF(2)`**
557 (aka. Carry-less arithmetic -- the `cl*` instructions).
558 This isn't actually a Galois Field, but its coefficients are. This is
559 basically binary integer addition, subtraction, and multiplication like
560 usual, except that carries aren't propagated at all, effectively turning
561 both addition and subtraction into the bitwise xor operation. Division and
562 remainder are defined to match how addition and multiplication works.
563 * **Galois Fields with a prime size**
564 (aka. `GF(p)` or Prime Galois Fields -- the `gfp*` instructions).
565 This is basically just the integers mod `p`.
566 * **Galois Fields with a power-of-a-prime size**
567 (aka. `GF(p^n)` or `GF(q)` where `q == p^n` for prime `p` and
569 We only implement these for `p == 2`, called Binary Galois Fields
570 (`GF(2^n)` -- the `gfb*` instructions).
571 For any prime `p`, `GF(p^n)` is implemented as polynomials with
572 coefficients in `GF(p)` and degree `< n`, where the polynomials are the
573 remainders of dividing by a specificly chosen polynomial in `GF(p)` called
574 the Reducing Polynomial (we will denote that by `red_poly`). The Reducing
575 Polynomial must be an irreducable polynomial (like primes, but for
576 polynomials), as well as have degree `n`. All `GF(p^n)` for the same `p`
577 and `n` are isomorphic to each other -- the choice of `red_poly` doesn't
578 affect `GF(p^n)`'s mathematical shape, all that changes is the specific
579 polynomials used to implement `GF(p^n)`.
581 Many implementations and much of the literature do not make a clear
582 distinction between these three categories, which makes it confusing
583 to understand what their purpose and value is.
585 * carry-less multiply is extremely common and is used for the ubiquitous
586 CRC32 algorithm. [TODO add many others, helps justify to ISA WG]
587 * GF(2^N) forms the basis of Rijndael (the current AES standard) and
588 has significant uses throughout cryptography
589 * GF(p) is the basis again of a significant quantity of algorithms
590 (TODO, list them, jacob knows what they are), even though the
591 modulo is limited to be below 64-bit (size of a scalar int)
593 # Instructions for Carry-less Operations
595 aka. Polynomials with coefficients in `GF(2)`
597 Carry-less addition/subtraction is simply XOR, so a `cladd`
598 instruction is not provided since the `xor[i]` instruction can be used instead.
600 These are operations on polynomials with coefficients in `GF(2)`, with the
601 polynomial's coefficients packed into integers with the following algorithm:
604 [[!inline pagenames="gf_reference/pack_poly.py" raw="yes"]]
607 ## Carry-less Multiply Instructions
610 see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
611 <https://www.felixcloutier.com/x86/pclmulqdq> and
612 <https://en.m.wikipedia.org/wiki/Carry-less_product>
614 They are worth adding as their own non-overwrite operations
615 (in the same pipeline).
617 ### `clmul` Carry-less Multiply
620 [[!inline pagenames="gf_reference/clmul.py" raw="yes"]]
623 ### `clmulh` Carry-less Multiply High
626 [[!inline pagenames="gf_reference/clmulh.py" raw="yes"]]
629 ### `clmulr` Carry-less Multiply (Reversed)
631 Useful for CRCs. Equivalent to bit-reversing the result of `clmul` on
635 [[!inline pagenames="gf_reference/clmulr.py" raw="yes"]]
638 ## `clmadd` Carry-less Multiply-Add
641 clmadd RT, RA, RB, RC
645 (RT) = clmul((RA), (RB)) ^ (RC)
648 ## `cltmadd` Twin Carry-less Multiply-Add (for FFTs)
650 Used in combination with SV FFT REMAP to perform a full Discrete Fourier
651 Transform of Polynomials over GF(2) in-place. Possible by having 3-in 2-out,
652 to avoid the need for a temp register. RS is written to as well as RT.
654 Note: Polynomials over GF(2) are a Ring rather than a Field, so, because the
655 definition of the Inverse Discrete Fourier Transform involves calculating a
656 multiplicative inverse, which may not exist in every Ring, therefore the
657 Inverse Discrete Fourier Transform may not exist. (AFAICT the number of inputs
658 to the IDFT must be odd for the IDFT to be defined for Polynomials over GF(2).
659 TODO: check with someone who knows for sure if that's correct.)
662 cltmadd RT, RA, RB, RC
665 TODO: add link to explanation for where `RS` comes from.
670 # read all inputs before writing to any outputs in case
671 # an input overlaps with an output register.
672 (RT) = clmul(a, (RB)) ^ c
676 ## `cldivrem` Carry-less Division and Remainder
678 `cldivrem` isn't an actual instruction, but is just used in the pseudo-code
679 for other instructions.
682 [[!inline pagenames="gf_reference/cldivrem.py" raw="yes"]]
685 ## `cldiv` Carry-less Division
694 q, r = cldivrem(n, d, width=XLEN)
698 ## `clrem` Carry-less Remainder
707 q, r = cldivrem(n, d, width=XLEN)
711 # Instructions for Binary Galois Fields `GF(2^m)`
715 * <https://courses.csail.mit.edu/6.857/2016/files/ffield.py>
716 * <https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture7.pdf>
717 * <https://foss.heptapod.net/math/libgf2/-/blob/branch/default/src/libgf2/gf2.py>
719 Binary Galois Field addition/subtraction is simply XOR, so a `gfbadd`
720 instruction is not provided since the `xor[i]` instruction can be used instead.
722 ## `GFBREDPOLY` SPR -- Reducing Polynomial
724 In order to save registers and to make operations orthogonal with standard
725 arithmetic, the reducing polynomial is stored in a dedicated SPR `GFBREDPOLY`.
726 This also allows hardware to pre-compute useful parameters (such as the
727 degree, or look-up tables) based on the reducing polynomial, and store them
728 alongside the SPR in hidden registers, only recomputing them whenever the SPR
729 is written to, rather than having to recompute those values for every
732 Because Galois Fields require the reducing polynomial to be an irreducible
733 polynomial, that guarantees that any polynomial of `degree > 1` must have
734 the LSB set, since otherwise it would be divisible by the polynomial `x`,
735 making it reducible, making whatever we're working on no longer a Field.
736 Therefore, we can reuse the LSB to indicate `degree == XLEN`.
739 [[!inline pagenames="gf_reference/decode_reducing_polynomial.py" raw="yes"]]
742 ## `gfbredpoly` -- Set the Reducing Polynomial SPR `GFBREDPOLY`
744 unless this is an immediate op, `mtspr` is completely sufficient.
747 [[!inline pagenames="gf_reference/gfbredpoly.py" raw="yes"]]
750 ## `gfbmul` -- Binary Galois Field `GF(2^m)` Multiplication
757 [[!inline pagenames="gf_reference/gfbmul.py" raw="yes"]]
760 ## `gfbmadd` -- Binary Galois Field `GF(2^m)` Multiply-Add
763 gfbmadd RT, RA, RB, RC
767 [[!inline pagenames="gf_reference/gfbmadd.py" raw="yes"]]
770 ## `gfbtmadd` -- Binary Galois Field `GF(2^m)` Twin Multiply-Add (for FFT)
772 Used in combination with SV FFT REMAP to perform a full `GF(2^m)` Discrete
773 Fourier Transform in-place. Possible by having 3-in 2-out, to avoid the need
774 for a temp register. RS is written to as well as RT.
777 gfbtmadd RT, RA, RB, RC
780 TODO: add link to explanation for where `RS` comes from.
785 # read all inputs before writing to any outputs in case
786 # an input overlaps with an output register.
787 (RT) = gfbmadd(a, (RB), c)
788 # use gfbmadd again since it reduces the result
789 (RS) = gfbmadd(a, 1, c) # "a * 1 + c"
792 ## `gfbinv` -- Binary Galois Field `GF(2^m)` Inverse
799 [[!inline pagenames="gf_reference/gfbinv.py" raw="yes"]]
802 # Instructions for Prime Galois Fields `GF(p)`
804 ## `GFPRIME` SPR -- Prime Modulus For `gfp*` Instructions
806 ## `gfpadd` Prime Galois Field `GF(p)` Addition
813 [[!inline pagenames="gf_reference/gfpadd.py" raw="yes"]]
816 the addition happens on infinite-precision integers
818 ## `gfpsub` Prime Galois Field `GF(p)` Subtraction
825 [[!inline pagenames="gf_reference/gfpsub.py" raw="yes"]]
828 the subtraction happens on infinite-precision integers
830 ## `gfpmul` Prime Galois Field `GF(p)` Multiplication
837 [[!inline pagenames="gf_reference/gfpmul.py" raw="yes"]]
840 the multiplication happens on infinite-precision integers
842 ## `gfpinv` Prime Galois Field `GF(p)` Invert
848 Some potential hardware implementations are found in:
849 <https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.5233&rep=rep1&type=pdf>
852 [[!inline pagenames="gf_reference/gfpinv.py" raw="yes"]]
855 ## `gfpmadd` Prime Galois Field `GF(p)` Multiply-Add
858 gfpmadd RT, RA, RB, RC
862 [[!inline pagenames="gf_reference/gfpmadd.py" raw="yes"]]
865 the multiplication and addition happens on infinite-precision integers
867 ## `gfpmsub` Prime Galois Field `GF(p)` Multiply-Subtract
870 gfpmsub RT, RA, RB, RC
874 [[!inline pagenames="gf_reference/gfpmsub.py" raw="yes"]]
877 the multiplication and subtraction happens on infinite-precision integers
879 ## `gfpmsubr` Prime Galois Field `GF(p)` Multiply-Subtract-Reversed
882 gfpmsubr RT, RA, RB, RC
886 [[!inline pagenames="gf_reference/gfpmsubr.py" raw="yes"]]
889 the multiplication and subtraction happens on infinite-precision integers
891 ## `gfpmaddsubr` Prime Galois Field `GF(p)` Multiply-Add and Multiply-Sub-Reversed (for FFT)
893 Used in combination with SV FFT REMAP to perform
894 a full Number-Theoretic-Transform in-place. Possible by having 3-in 2-out,
895 to avoid the need for a temp register. RS is written
899 gfpmaddsubr RT, RA, RB, RC
902 TODO: add link to explanation for where `RS` comes from.
908 # read all inputs before writing to any outputs in case
909 # an input overlaps with an output register.
910 (RT) = gfpmadd(factor1, factor2, term)
911 (RS) = gfpmsubr(factor1, factor2, term)
917 uint64_t bmatflip(uint64_t RA)
925 uint64_t bmatxor(uint64_t RA, uint64_t RB)
928 uint64_t RBt = bmatflip(RB);
929 uint8_t u[8]; // rows of RA
930 uint8_t v[8]; // cols of RB
931 for (int i = 0; i < 8; i++) {
936 for (int i = 0; i < 64; i++) {
937 if (pcnt(u[i / 8] & v[i % 8]) & 1)
942 uint64_t bmator(uint64_t RA, uint64_t RB)
945 uint64_t RBt = bmatflip(RB);
946 uint8_t u[8]; // rows of RA
947 uint8_t v[8]; // cols of RB
948 for (int i = 0; i < 8; i++) {
953 for (int i = 0; i < 64; i++) {
954 if ((u[i / 8] & v[i % 8]) != 0)
962 # Already in POWER ISA
964 ## count leading/trailing zeros with mask
970 do i = 0 to 63 if((RB)i=1) then do
971 if((RS)i=1) then break end end count ← count + 1
977 pdepd VRT,VRA,VRB, identical to RV bitmamip bdep, found already in v3.1 p106
980 if VSR[VRB+32].dword[i].bit[63-m]=1 then do
981 result = VSR[VRA+32].dword[i].bit[63-k]
982 VSR[VRT+32].dword[i].bit[63-m] = result
988 uint_xlen_t bdep(uint_xlen_t RA, uint_xlen_t RB)
991 for (int i = 0, j = 0; i < XLEN; i++)
994 r |= uint_xlen_t(1) << i;
1004 other way round: identical to RV bext: pextd, found in v3.1 p196
1007 uint_xlen_t bext(uint_xlen_t RA, uint_xlen_t RB)
1010 for (int i = 0, j = 0; i < XLEN; i++)
1011 if ((RB >> i) & 1) {
1013 r |= uint_xlen_t(1) << j;
1022 found in v3.1 p106 so not to be added here
1032 if((RB)63-i==1) then do
1033 result63-ptr1 = (RS)63-i
1039 ## bit to byte permute
1041 similar to matrix permute in RV bitmanip, which has XOR and OR variants,
1042 these perform a transpose. TODO this looks VSX is there a scalar variant
1047 b = VSR[VRB+32].dword[i].byte[k].bit[j]
1048 VSR[VRT+32].dword[i].byte[j].bit[k] = b
1052 see [[bitmanip/appendix]]