7 * ternlogi <https://bugs.libre-soc.org/show_bug.cgi?id=745>
8 * grev <https://bugs.libre-soc.org/show_bug.cgi?id=755>
9 * GF2^M <https://bugs.libre-soc.org/show_bug.cgi?id=782>
16 pseudocode: [[openpower/isa/bitmanip]]
18 this extension amalgamates bitmanipulation primitives from many sources, including RISC-V bitmanip, Packed SIMD, AVX-512 and OpenPOWER VSX. Vectorisation and SIMD are removed: these are straight scalar (element) operations making them suitable for embedded applications.
19 Vectorisation Context is provided by [[openpower/sv]].
21 When combined with SV, scalar variants of bitmanip operations found in VSX are added so that VSX may be retired as "legacy" in the far future (10 to 20 years). Also, VSX is hundreds of opcodes, requires 128 bit pathways, and is wholly unsuited to low power or embedded scenarios.
23 ternlogv is experimental and is the only operation that may be considered a "Packed SIMD". It is added as a variant of the already well-justified ternlog operation (done in AVX512 as an immediate only) "because it looks fun". As it is based on the LUT4 concept it will allow accelerated emulation of FPGAs. Other vendors of ISAs are buying FPGA companies to achieve similar objectives.
25 general-purpose Galois Field 2^M operations are added so as to avoid huge custom opcode proliferation across many areas of Computer Science. however for convenience and also to avoid setup costs, some of the more common operations (clmul, crc32) are also added. The expectation is that these operations would all be covered by the same pipeline.
27 note that there are brownfield spaces below that could incorporate some of the set-before-first and other scalar operations listed in [[sv/vector_ops]], and
28 the [[sv/av_opcodes]] as well as [[sv/setvl]]
32 * <https://en.wikiversity.org/wiki/Reed%E2%80%93Solomon_codes_for_coders>
33 * <https://maths-people.anu.edu.au/~brent/pd/rpb232tr.pdf>
37 two major opcodes are needed
39 ternlog has its own major opcode
42 | ------ |--| --------- |
47 2nd major opcode for other bitmanip: minor opcode allocation
50 | ------ |--| --------- |
55 | 011 | | gf/cl madd* |
62 | dest | src1 | subop | op |
63 | ---- | ---- | ----- | -------- |
64 | RT | RA | .. | bmatflip |
68 | dest | src1 | src2 | subop | op |
69 | ---- | ---- | ---- | ----- | -------- |
70 | RT | RA | RB | or | bmatflip |
71 | RT | RA | RB | xor | bmatflip |
72 | RT | RA | RB | | grev |
73 | RT | RA | RB | | clmul* |
74 | RT | RA | RB | | gorc |
75 | RT | RA | RB | shuf | shuffle |
76 | RT | RA | RB | unshuf| shuffle |
77 | RT | RA | RB | width | xperm |
78 | RT | RA | RB | type | av minmax |
79 | RT | RA | RB | | av abs avgadd |
80 | RT | RA | RB | type | vmask ops |
89 TODO: convert all instructions to use RT and not RS
91 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|name|
92 | -- | -- | --- | --- | --- |-----|----- | -----|--|----|
93 | NN | BT | BA | BB | BC |m0-2 | imm | 10 |m3|crternlog|
95 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
96 | -- | -- | --- | --- | ----- | -------- |--| ------ |
97 | NN | RT | RA |itype/| im0-4 | im5-7 00 |0 | xpermi |
98 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
99 | NN | | | | | ..... 01 |0 | crternlog |
100 | NN | RT | RA | RB | RC | mode 010 |Rc| bitmask* |
101 | NN | | | | | 00 011 | | rsvd |
102 | NN | | | | | 01 011 |0 | svshape |
103 | NN | | | | | 01 011 |1 | rsvd |
104 | NN | | | | | 10 011 |Rc| svstep |
105 | NN | | | | | 11 011 |Rc| setvl |
106 | NN | RT | RA | RB | sh0-4 | sh5 1 111 |Rc| bmrevi |
108 ops (note that av avg and abs as well as vec scalar mask
109 are included here [[sv/vector_ops]], and
110 the [[sv/av_opcodes]])
112 TODO: convert from RA, RB, and RC to correct field names of RT, RA, and RB, and
113 double check that instructions didn't need 3 inputs.
115 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
116 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
117 | NN | RS | me | sh | SH | ME 0 | nn00 110 |Rc| bmopsi |
118 | NN | RS | RB | sh | SH | 0 1 | nn00 110 |Rc| bmopsi |
119 | NN | RT | RA | RB | 1 | 00 | 0001 110 |Rc| cldiv |
120 | NN | RT | RA | RB | 1 | 01 | 0001 110 |Rc| clmod |
121 | NN | RT | RA | RB | 1 | 10 | 0001 110 |Rc| |
122 | NN | RT | RB | RB | 1 | 11 | 0001 110 |Rc| clinv |
123 | NN | RA | RB | RC | 0 | 00 | 0001 110 |Rc| vec sbfm |
124 | NN | RA | RB | RC | 0 | 01 | 0001 110 |Rc| vec sofm |
125 | NN | RA | RB | RC | 0 | 10 | 0001 110 |Rc| vec sifm |
126 | NN | RA | RB | RC | 0 | 11 | 0001 110 |Rc| vec cprop |
127 | NN | RT | RA | RB | 0 | | 0101 110 |Rc| rsvd |
128 | NN | RT | RA | RB | 1 | itype | 0101 110 |Rc| xperm |
129 | NN | RA | RB | RC | 0 | itype | 1001 110 |Rc| av minmax |
130 | NN | RA | RB | RC | 1 | 00 | 1001 110 |Rc| av abss |
131 | NN | RA | RB | RC | 1 | 01 | 1001 110 |Rc| av absu|
132 | NN | RA | RB | | 1 | 10 | 1001 110 |Rc| av avgadd |
133 | NN | RA | RB | | 1 | 11 | 1001 110 |Rc| rsvd |
134 | NN | RT | | | | | 1101 110 |Rc| svremap |
135 | NN | RA | RB | RC | 0 | 00 | 0010 110 |Rc| gorc |
136 | NN | RA | RB | sh | SH | 00 | 1010 110 |Rc| gorci |
137 | NN | RA | RB | RC | 0 | 00 | 0110 110 |Rc| gorcw |
138 | NN | RA | RB | sh | 0 | 00 | 1110 110 |Rc| gorcwi |
139 | NN | RA | RB | RC | 1 | 00 | 1110 110 |Rc| bmator |
140 | NN | RA | RB | RC | 0 | 01 | 0010 110 |Rc| grev |
141 | NN | RA | RB | RC | 1 | 01 | 0010 110 |Rc| clmul |
142 | NN | RA | RB | sh | SH | 01 | 1010 110 |Rc| grevi |
143 | NN | RA | RB | RC | 0 | 01 | 0110 110 |Rc| grevw |
144 | NN | RA | RB | sh | 0 | 01 | 1110 110 |Rc| grevwi |
145 | NN | RA | RB | RC | 1 | 01 | 1110 110 |Rc| bmatxor |
146 | NN | RA | RB | RC | | 10 | --10 110 |Rc| rsvd |
147 | NN | RA | RB | RC | 0 | 11 | 1110 110 |Rc| clmulr |
148 | NN | RA | RB | RC | 1 | 11 | 1110 110 |Rc| clmulh |
149 | NN | | | | | | --11 110 |Rc| rsvd |
153 Similar to FPGA LUTs: for every bit perform a lookup into a table using an 8bit immediate, or in another register.
155 Like the x86 AVX512F [vpternlogd/vpternlogq](https://www.felixcloutier.com/x86/vpternlogd:vpternlogq) instructions.
159 | 0.5|6.10|11.15|16.20| 21..28|29.30|31|
160 | -- | -- | --- | --- | ----- | --- |--|
161 | NN | RT | RA | RB | im0-7 | 00 |Rc|
164 idx = c << 2 | b << 1 | a
165 return imm[idx] # idx by LSB0 order
168 RT[i] = lut3(imm, RB[i], RA[i], RT[i])
172 also, another possible variant involving swizzle-like selection
173 and masking, this only requires 3 64 bit registers (RA, RS, RB) and
176 Note however that unless XLEN matches sz, this instruction
177 is a Read-Modify-Write: RS must be read as a second operand
178 and all unmodified bits preserved. SVP64 may provide limited
179 alternative destination for RS from RS-as-source, but again
180 all unmodified bits must still be copied.
182 | 0.5|6.10|11.15|16.20|21.28 | 29.30 |31|
183 | -- | -- | --- | --- | ---- | ----- |--|
184 | NN | RS | RA | RB |idx0-3| 01 |sz|
186 SZ = (1+sz) * 8 # 8 or 16
187 raoff = MIN(XLEN, idx0 * SZ)
188 rboff = MIN(XLEN, idx1 * SZ)
189 rcoff = MIN(XLEN, idx2 * SZ)
190 rsoff = MIN(XLEN, idx3 * SZ)
192 for i in range(MIN(XLEN, SZ)):
196 res = lut3(imm, ra, rb, rc)
201 another mode selection would be CRs not Ints.
203 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|
204 | -- | -- | --- | --- | --- |-----|----- | -----|--|
205 | NN | BT | BA | BB | BC |m0-2 | imm | 10 |m3|
209 if not mask[i] continue
210 crregs[BT][i] = lut3(imm,
219 the [[sv/av_opcodes]]
221 signed and unsigned min/max for integer. this is sort-of partly synthesiseable in [[sv/svp64]] with pred-result as long as the dest reg is one of the sources, but not both signed and unsigned. when the dest is also one of the srces and the mv fails due to the CR bittest failing this will only overwrite the dest where the src is greater (or less).
223 signed/unsigned min/max gives more flexibility.
226 uint_xlen_t min(uint_xlen_t rs1, uint_xlen_t rs2)
227 { return (int_xlen_t)rs1 < (int_xlen_t)rs2 ? rs1 : rs2;
229 uint_xlen_t max(uint_xlen_t rs1, uint_xlen_t rs2)
230 { return (int_xlen_t)rs1 > (int_xlen_t)rs2 ? rs1 : rs2;
232 uint_xlen_t minu(uint_xlen_t rs1, uint_xlen_t rs2)
233 { return rs1 < rs2 ? rs1 : rs2;
235 uint_xlen_t maxu(uint_xlen_t rs1, uint_xlen_t rs2)
236 { return rs1 > rs2 ? rs1 : rs2;
243 based on RV bitmanip, covered by ternlog bitops
246 uint_xlen_t cmix(uint_xlen_t RA, uint_xlen_t RB, uint_xlen_t RC) {
247 return (RA & RB) | (RC & ~RB);
254 based on RV bitmanip singlebit set, instruction format similar to shift
255 [[isa/fixedshift]]. bmext is actually covered already (shift-with-mask rldicl but only immediate version).
256 however bitmask-invert is not, and set/clr are not covered, although they can use the same Shift ALU.
258 bmext (RB) version is not the same as rldicl because bmext is a right shift by RC, where rldicl is a left rotate. for the immediate version this does not matter, so a bmexti is not required.
259 bmrev however there is no direct equivalent and consequently a bmrevi is required.
261 bmset (register for mask amount) is particularly useful for creating
262 predicate masks where the length is a dynamic runtime quantity.
263 bmset(RA=0, RB=0, RC=mask) will produce a run of ones of length "mask" in a single instruction without needing to initialise or depend on any other registers.
265 | 0.5|6.10|11.15|16.20|21.25| 26..30 |31| name |
266 | -- | -- | --- | --- | --- | ------- |--| ----- |
267 | NN | RS | RA | RB | RC | mode 010 |Rc| bm* |
269 Immediate-variant is an overwrite form:
271 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
272 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
273 | NN | RS | RB | sh | SH | itype | 1000 110 |Rc| bm*i |
279 mask_a = ((1 << x) - 1) & ((1 << 64) - 1)
280 mask_b = ((1 << y) - 1) & ((1 << 64) - 1)
285 mask_a = ((1 << x) - 1) & ((1 << 64) - 1)
286 mask_b = (~((1 << y) - 1)) & ((1 << 64) - 1)
287 return mask_a ^ mask_b
290 uint_xlen_t bmset(RS, RB, sh)
292 int shamt = RB & (XLEN - 1);
294 return RS | (mask << shamt);
297 uint_xlen_t bmclr(RS, RB, sh)
299 int shamt = RB & (XLEN - 1);
301 return RS & ~(mask << shamt);
304 uint_xlen_t bminv(RS, RB, sh)
306 int shamt = RB & (XLEN - 1);
308 return RS ^ (mask << shamt);
311 uint_xlen_t bmext(RS, RB, sh)
313 int shamt = RB & (XLEN - 1);
315 return mask & (RS >> shamt);
319 bitmask extract with reverse. can be done by bit-order-inverting all of RB and getting bits of RB from the opposite end.
321 when RA is zero, no shift occurs. this makes bmextrev useful for
322 simply reversing all bits of a register.
326 rev[0:msb] = rb[msb:0];
329 uint_xlen_t bmextrev(RA, RB, sh)
332 if (RA != 0) shamt = (GPR(RA) & (XLEN - 1));
333 shamt = (XLEN-1)-shamt; # shift other end
334 bra = bitreverse(RB) # swap LSB-MSB
336 return mask & (bra >> shamt);
340 | 0.5|6.10|11.15|16.20|21.26| 27..30 |31| name |
341 | -- | -- | --- | --- | --- | ------- |--| ------ |
342 | NN | RT | RA | RB | sh | 1 011 |Rc| bmrevi |
347 generalised reverse combined with a pair of LUT2s and allowing
348 a constant `0b0101...0101` when RA=0, and an option to invert
349 (including when RA=0, giving a constant 0b1010...1010 as the
350 initial value) provides a wide range of instructions
351 and a means to set regular 64 bit patterns in one
354 the two LUT2s are applied left-half (when not swapping)
355 and right-half (when swapping) so as to allow a wider
358 <img src="/openpower/sv/grevlut2x2.jpg" width=700 />
360 * A value of `0b11001010` for the immediate provides
361 the functionality of a standard "grev".
362 * `0b11101110` provides gorc
364 grevlut should be arranged so as to produce the constants
365 needed to put into bext (bitextract) so as in turn to
366 be able to emulate x86 pmovmask instructions <https://www.felixcloutier.com/x86/pmovmskb>.
367 This only requires 2 instructions (grevlut, bext).
369 Note that if the mask is required to be placed
370 directly into CR Fields (for use as CR Predicate
371 masks rather than a integer mask) then sv.ori
372 may be used instead, bearing in mind that sv.ori
373 is a 64-bit instruction, and `VL` must have been
374 set to the required length:
376 sv.ori./elwid=8 r10.v, r10.v, 0
378 The following settings provide the required mask constants:
380 | RA | RB | imm | iv | result |
381 | ------- | ------- | ---------- | -- | ---------- |
382 | 0x555.. | 0b10 | 0b01101100 | 0 | 0x111111... |
383 | 0x555.. | 0b110 | 0b01101100 | 0 | 0x010101... |
384 | 0x555.. | 0b1110 | 0b01101100 | 0 | 0x00010001... |
385 | 0x555.. | 0b10 | 0b11000110 | 1 | 0x88888... |
386 | 0x555.. | 0b110 | 0b11000110 | 1 | 0x808080... |
387 | 0x555.. | 0b1110 | 0b11000110 | 1 | 0x80008000... |
389 Better diagram showing the correct ordering of shamt (RB). A LUT2
390 is applied to all locations marked in red using the first 4
391 bits of the immediate, and a separate LUT2 applied to all
392 locations in green using the upper 4 bits of the immediate.
394 <img src="/openpower/sv/grevlut.png" width=700 />
396 demo code [[openpower/sv/grevlut.py]]
401 return imm[idx] # idx by LSB0 order
403 dorow(imm8, step_i, chunksize):
405 if (j&chunk_size) == 0
409 step_o[j] = lut2(imm, step_i[j], step_i[j ^ chunk_size])
412 uint64_t grevlut64(uint64_t RA, uint64_t RB, uint8 imm, bool iv)
414 uint64_t x = 0x5555_5555_5555_5555;
415 if (RA != 0) x = GPR(RA);
420 if (shamt & step) x = dorow(imm, x, step)
426 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
427 | -- | -- | --- | --- | ----- | -------- |--| ------ |
428 | NN | RT | RA | s0-4 | im0-4 | im5-7 1 iv |s5| grevlogi |
429 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
434 based on RV bitmanip, this is also known as a butterfly network. however
435 where a butterfly network allows setting of every crossbar setting in
436 every row and every column, generalised-reverse (grev) only allows
437 a per-row decision: every entry in the same row must either switch or
440 <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/8/8c/Butterfly_Network.jpg/474px-Butterfly_Network.jpg" />
443 uint64_t grev64(uint64_t RA, uint64_t RB)
447 if (shamt & 1) x = ((x & 0x5555555555555555LL) << 1) |
448 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
449 if (shamt & 2) x = ((x & 0x3333333333333333LL) << 2) |
450 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
451 if (shamt & 4) x = ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
452 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
453 if (shamt & 8) x = ((x & 0x00FF00FF00FF00FFLL) << 8) |
454 ((x & 0xFF00FF00FF00FF00LL) >> 8);
455 if (shamt & 16) x = ((x & 0x0000FFFF0000FFFFLL) << 16) |
456 ((x & 0xFFFF0000FFFF0000LL) >> 16);
457 if (shamt & 32) x = ((x & 0x00000000FFFFFFFFLL) << 32) |
458 ((x & 0xFFFFFFFF00000000LL) >> 32);
466 based on RV bitmanip.
468 RA contains a vector of indices to select parts of RB to be
469 copied to RT. The immediate-variant allows up to an 8 bit
470 pattern (repeated) to be targetted at different parts of RT
473 uint_xlen_t xpermi(uint8_t imm8, uint_xlen_t RB, int sz_log2)
476 uint_xlen_t sz = 1LL << sz_log2;
477 uint_xlen_t mask = (1LL << sz) - 1;
478 uint_xlen_t RA = imm8 | imm8<<8 | ... | imm8<<56;
479 for (int i = 0; i < XLEN; i += sz) {
480 uint_xlen_t pos = ((RA >> i) & mask) << sz_log2;
482 r |= ((RB >> pos) & mask) << i;
486 uint_xlen_t xperm(uint_xlen_t RA, uint_xlen_t RB, int sz_log2)
489 uint_xlen_t sz = 1LL << sz_log2;
490 uint_xlen_t mask = (1LL << sz) - 1;
491 for (int i = 0; i < XLEN; i += sz) {
492 uint_xlen_t pos = ((RA >> i) & mask) << sz_log2;
494 r |= ((RB >> pos) & mask) << i;
498 uint_xlen_t xperm_n (uint_xlen_t RA, uint_xlen_t RB)
499 { return xperm(RA, RB, 2); }
500 uint_xlen_t xperm_b (uint_xlen_t RA, uint_xlen_t RB)
501 { return xperm(RA, RB, 3); }
502 uint_xlen_t xperm_h (uint_xlen_t RA, uint_xlen_t RB)
503 { return xperm(RA, RB, 4); }
504 uint_xlen_t xperm_w (uint_xlen_t RA, uint_xlen_t RB)
505 { return xperm(RA, RB, 5); }
513 uint32_t gorc32(uint32_t RA, uint32_t RB)
517 if (shamt & 1) x |= ((x & 0x55555555) << 1) | ((x & 0xAAAAAAAA) >> 1);
518 if (shamt & 2) x |= ((x & 0x33333333) << 2) | ((x & 0xCCCCCCCC) >> 2);
519 if (shamt & 4) x |= ((x & 0x0F0F0F0F) << 4) | ((x & 0xF0F0F0F0) >> 4);
520 if (shamt & 8) x |= ((x & 0x00FF00FF) << 8) | ((x & 0xFF00FF00) >> 8);
521 if (shamt & 16) x |= ((x & 0x0000FFFF) << 16) | ((x & 0xFFFF0000) >> 16);
524 uint64_t gorc64(uint64_t RA, uint64_t RB)
528 if (shamt & 1) x |= ((x & 0x5555555555555555LL) << 1) |
529 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
530 if (shamt & 2) x |= ((x & 0x3333333333333333LL) << 2) |
531 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
532 if (shamt & 4) x |= ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
533 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
534 if (shamt & 8) x |= ((x & 0x00FF00FF00FF00FFLL) << 8) |
535 ((x & 0xFF00FF00FF00FF00LL) >> 8);
536 if (shamt & 16) x |= ((x & 0x0000FFFF0000FFFFLL) << 16) |
537 ((x & 0xFFFF0000FFFF0000LL) >> 16);
538 if (shamt & 32) x |= ((x & 0x00000000FFFFFFFFLL) << 32) |
539 ((x & 0xFFFFFFFF00000000LL) >> 32);
544 # Introduction to Carry-less and GF arithmetic
546 * obligatory xkcd <https://xkcd.com/2595/>
548 There are three completely separate types of Galois-Field-based
549 arithmetic that we implement which are not well explained even in introductory literature. A slightly oversimplified explanation
550 is followed by more accurate descriptions:
552 * `GF(2)` carry-less binary arithmetic. this is not actually a Galois Field,
553 but is accidentally referred to as GF(2) - see below as to why.
554 * `GF(p)` modulo arithmetic with a Prime number, these are "proper" Galois Fields
555 * `GF(2^N)` carry-less binary arithmetic with two limits: modulo a power-of-2
556 (2^N) and a second "reducing" polynomial (similar to a prime number), these
557 are said to be GF(2^N) arithmetic.
559 further detailed and more precise explanations are provided below
561 * **Polynomials with coefficients in `GF(2)`**
562 (aka. Carry-less arithmetic -- the `cl*` instructions).
563 This isn't actually a Galois Field, but its coefficients are. This is
564 basically binary integer addition, subtraction, and multiplication like
565 usual, except that carries aren't propagated at all, effectively turning
566 both addition and subtraction into the bitwise xor operation. Division and
567 remainder are defined to match how addition and multiplication works.
568 * **Galois Fields with a prime size**
569 (aka. `GF(p)` or Prime Galois Fields -- the `gfp*` instructions).
570 This is basically just the integers mod `p`.
571 * **Galois Fields with a power-of-a-prime size**
572 (aka. `GF(p^n)` or `GF(q)` where `q == p^n` for prime `p` and
574 We only implement these for `p == 2`, called Binary Galois Fields
575 (`GF(2^n)` -- the `gfb*` instructions).
576 For any prime `p`, `GF(p^n)` is implemented as polynomials with
577 coefficients in `GF(p)` and degree `< n`, where the polynomials are the
578 remainders of dividing by a specificly chosen polynomial in `GF(p)` called
579 the Reducing Polynomial (we will denote that by `red_poly`). The Reducing
580 Polynomial must be an irreducable polynomial (like primes, but for
581 polynomials), as well as have degree `n`. All `GF(p^n)` for the same `p`
582 and `n` are isomorphic to each other -- the choice of `red_poly` doesn't
583 affect `GF(p^n)`'s mathematical shape, all that changes is the specific
584 polynomials used to implement `GF(p^n)`.
586 Many implementations and much of the literature do not make a clear
587 distinction between these three categories, which makes it confusing
588 to understand what their purpose and value is.
590 * carry-less multiply is extremely common and is used for the ubiquitous
591 CRC32 algorithm. [TODO add many others, helps justify to ISA WG]
592 * GF(2^N) forms the basis of Rijndael (the current AES standard) and
593 has significant uses throughout cryptography
594 * GF(p) is the basis again of a significant quantity of algorithms
595 (TODO, list them, jacob knows what they are), even though the
596 modulo is limited to be below 64-bit (size of a scalar int)
598 # Instructions for Carry-less Operations
600 aka. Polynomials with coefficients in `GF(2)`
602 Carry-less addition/subtraction is simply XOR, so a `cladd`
603 instruction is not provided since the `xor[i]` instruction can be used instead.
605 These are operations on polynomials with coefficients in `GF(2)`, with the
606 polynomial's coefficients packed into integers with the following algorithm:
609 [[!inline pagenames="gf_reference/pack_poly.py" raw="yes"]]
612 ## Carry-less Multiply Instructions
615 see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
616 <https://www.felixcloutier.com/x86/pclmulqdq> and
617 <https://en.m.wikipedia.org/wiki/Carry-less_product>
619 They are worth adding as their own non-overwrite operations
620 (in the same pipeline).
622 ### `clmul` Carry-less Multiply
625 [[!inline pagenames="gf_reference/clmul.py" raw="yes"]]
628 ### `clmulh` Carry-less Multiply High
631 [[!inline pagenames="gf_reference/clmulh.py" raw="yes"]]
634 ### `clmulr` Carry-less Multiply (Reversed)
636 Useful for CRCs. Equivalent to bit-reversing the result of `clmul` on
640 [[!inline pagenames="gf_reference/clmulr.py" raw="yes"]]
643 ## `clmadd` Carry-less Multiply-Add
646 clmadd RT, RA, RB, RC
650 (RT) = clmul((RA), (RB)) ^ (RC)
653 ## `cltmadd` Twin Carry-less Multiply-Add (for FFTs)
655 Used in combination with SV FFT REMAP to perform a full Discrete Fourier
656 Transform of Polynomials over GF(2) in-place. Possible by having 3-in 2-out,
657 to avoid the need for a temp register. RS is written to as well as RT.
659 Note: Polynomials over GF(2) are a Ring rather than a Field, so, because the
660 definition of the Inverse Discrete Fourier Transform involves calculating a
661 multiplicative inverse, which may not exist in every Ring, therefore the
662 Inverse Discrete Fourier Transform may not exist. (AFAICT the number of inputs
663 to the IDFT must be odd for the IDFT to be defined for Polynomials over GF(2).
664 TODO: check with someone who knows for sure if that's correct.)
667 cltmadd RT, RA, RB, RC
670 TODO: add link to explanation for where `RS` comes from.
675 # read all inputs before writing to any outputs in case
676 # an input overlaps with an output register.
677 (RT) = clmul(a, (RB)) ^ c
681 ## `cldivrem` Carry-less Division and Remainder
683 `cldivrem` isn't an actual instruction, but is just used in the pseudo-code
684 for other instructions.
687 [[!inline pagenames="gf_reference/cldivrem.py" raw="yes"]]
690 ## `cldiv` Carry-less Division
699 q, r = cldivrem(n, d, width=XLEN)
703 ## `clrem` Carry-less Remainder
712 q, r = cldivrem(n, d, width=XLEN)
716 # Instructions for Binary Galois Fields `GF(2^m)`
720 * <https://courses.csail.mit.edu/6.857/2016/files/ffield.py>
721 * <https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture7.pdf>
722 * <https://foss.heptapod.net/math/libgf2/-/blob/branch/default/src/libgf2/gf2.py>
724 Binary Galois Field addition/subtraction is simply XOR, so a `gfbadd`
725 instruction is not provided since the `xor[i]` instruction can be used instead.
727 ## `GFBREDPOLY` SPR -- Reducing Polynomial
729 In order to save registers and to make operations orthogonal with standard
730 arithmetic, the reducing polynomial is stored in a dedicated SPR `GFBREDPOLY`.
731 This also allows hardware to pre-compute useful parameters (such as the
732 degree, or look-up tables) based on the reducing polynomial, and store them
733 alongside the SPR in hidden registers, only recomputing them whenever the SPR
734 is written to, rather than having to recompute those values for every
737 Because Galois Fields require the reducing polynomial to be an irreducible
738 polynomial, that guarantees that any polynomial of `degree > 1` must have
739 the LSB set, since otherwise it would be divisible by the polynomial `x`,
740 making it reducible, making whatever we're working on no longer a Field.
741 Therefore, we can reuse the LSB to indicate `degree == XLEN`.
744 [[!inline pagenames="gf_reference/decode_reducing_polynomial.py" raw="yes"]]
747 ## `gfbredpoly` -- Set the Reducing Polynomial SPR `GFBREDPOLY`
749 unless this is an immediate op, `mtspr` is completely sufficient.
752 [[!inline pagenames="gf_reference/gfbredpoly.py" raw="yes"]]
755 ## `gfbmul` -- Binary Galois Field `GF(2^m)` Multiplication
762 [[!inline pagenames="gf_reference/gfbmul.py" raw="yes"]]
765 ## `gfbmadd` -- Binary Galois Field `GF(2^m)` Multiply-Add
768 gfbmadd RT, RA, RB, RC
772 [[!inline pagenames="gf_reference/gfbmadd.py" raw="yes"]]
775 ## `gfbtmadd` -- Binary Galois Field `GF(2^m)` Twin Multiply-Add (for FFT)
777 Used in combination with SV FFT REMAP to perform a full `GF(2^m)` Discrete
778 Fourier Transform in-place. Possible by having 3-in 2-out, to avoid the need
779 for a temp register. RS is written to as well as RT.
782 gfbtmadd RT, RA, RB, RC
785 TODO: add link to explanation for where `RS` comes from.
790 # read all inputs before writing to any outputs in case
791 # an input overlaps with an output register.
792 (RT) = gfbmadd(a, (RB), c)
793 # use gfbmadd again since it reduces the result
794 (RS) = gfbmadd(a, 1, c) # "a * 1 + c"
797 ## `gfbinv` -- Binary Galois Field `GF(2^m)` Inverse
804 [[!inline pagenames="gf_reference/gfbinv.py" raw="yes"]]
807 # Instructions for Prime Galois Fields `GF(p)`
809 ## `GFPRIME` SPR -- Prime Modulus For `gfp*` Instructions
811 ## `gfpadd` Prime Galois Field `GF(p)` Addition
818 [[!inline pagenames="gf_reference/gfpadd.py" raw="yes"]]
821 the addition happens on infinite-precision integers
823 ## `gfpsub` Prime Galois Field `GF(p)` Subtraction
830 [[!inline pagenames="gf_reference/gfpsub.py" raw="yes"]]
833 the subtraction happens on infinite-precision integers
835 ## `gfpmul` Prime Galois Field `GF(p)` Multiplication
842 [[!inline pagenames="gf_reference/gfpmul.py" raw="yes"]]
845 the multiplication happens on infinite-precision integers
847 ## `gfpinv` Prime Galois Field `GF(p)` Invert
853 Some potential hardware implementations are found in:
854 <https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.5233&rep=rep1&type=pdf>
857 [[!inline pagenames="gf_reference/gfpinv.py" raw="yes"]]
860 ## `gfpmadd` Prime Galois Field `GF(p)` Multiply-Add
863 gfpmadd RT, RA, RB, RC
867 [[!inline pagenames="gf_reference/gfpmadd.py" raw="yes"]]
870 the multiplication and addition happens on infinite-precision integers
872 ## `gfpmsub` Prime Galois Field `GF(p)` Multiply-Subtract
875 gfpmsub RT, RA, RB, RC
879 [[!inline pagenames="gf_reference/gfpmsub.py" raw="yes"]]
882 the multiplication and subtraction happens on infinite-precision integers
884 ## `gfpmsubr` Prime Galois Field `GF(p)` Multiply-Subtract-Reversed
887 gfpmsubr RT, RA, RB, RC
891 [[!inline pagenames="gf_reference/gfpmsubr.py" raw="yes"]]
894 the multiplication and subtraction happens on infinite-precision integers
896 ## `gfpmaddsubr` Prime Galois Field `GF(p)` Multiply-Add and Multiply-Sub-Reversed (for FFT)
898 Used in combination with SV FFT REMAP to perform
899 a full Number-Theoretic-Transform in-place. Possible by having 3-in 2-out,
900 to avoid the need for a temp register. RS is written
904 gfpmaddsubr RT, RA, RB, RC
907 TODO: add link to explanation for where `RS` comes from.
913 # read all inputs before writing to any outputs in case
914 # an input overlaps with an output register.
915 (RT) = gfpmadd(factor1, factor2, term)
916 (RS) = gfpmsubr(factor1, factor2, term)
922 uint64_t bmatflip(uint64_t RA)
930 uint64_t bmatxor(uint64_t RA, uint64_t RB)
933 uint64_t RBt = bmatflip(RB);
934 uint8_t u[8]; // rows of RA
935 uint8_t v[8]; // cols of RB
936 for (int i = 0; i < 8; i++) {
941 for (int i = 0; i < 64; i++) {
942 if (pcnt(u[i / 8] & v[i % 8]) & 1)
947 uint64_t bmator(uint64_t RA, uint64_t RB)
950 uint64_t RBt = bmatflip(RB);
951 uint8_t u[8]; // rows of RA
952 uint8_t v[8]; // cols of RB
953 for (int i = 0; i < 8; i++) {
958 for (int i = 0; i < 64; i++) {
959 if ((u[i / 8] & v[i % 8]) != 0)
967 # Already in POWER ISA
969 ## count leading/trailing zeros with mask
975 do i = 0 to 63 if((RB)i=1) then do
976 if((RS)i=1) then break end end count ← count + 1
982 pdepd VRT,VRA,VRB, identical to RV bitmamip bdep, found already in v3.1 p106
985 if VSR[VRB+32].dword[i].bit[63-m]=1 then do
986 result = VSR[VRA+32].dword[i].bit[63-k]
987 VSR[VRT+32].dword[i].bit[63-m] = result
993 uint_xlen_t bdep(uint_xlen_t RA, uint_xlen_t RB)
996 for (int i = 0, j = 0; i < XLEN; i++)
999 r |= uint_xlen_t(1) << i;
1009 other way round: identical to RV bext: pextd, found in v3.1 p196
1012 uint_xlen_t bext(uint_xlen_t RA, uint_xlen_t RB)
1015 for (int i = 0, j = 0; i < XLEN; i++)
1016 if ((RB >> i) & 1) {
1018 r |= uint_xlen_t(1) << j;
1027 found in v3.1 p106 so not to be added here
1037 if((RB)63-i==1) then do
1038 result63-ptr1 = (RS)63-i
1044 ## bit to byte permute
1046 similar to matrix permute in RV bitmanip, which has XOR and OR variants,
1047 these perform a transpose. TODO this looks VSX is there a scalar variant
1052 b = VSR[VRB+32].dword[i].byte[k].bit[j]
1053 VSR[VRT+32].dword[i].byte[j].bit[k] = b
1057 see [[bitmanip/appendix]]