5 * ternlogi <https://bugs.libre-soc.org/show_bug.cgi?id=745>
6 * grev <https://bugs.libre-soc.org/show_bug.cgi?id=755>
7 * remove Rc=1 from ternlog due to conflicts in encoding as well
8 as saving space <https://bugs.libre-soc.org/show_bug.cgi?id=753#c5>
9 * GF2^M <https://bugs.libre-soc.org/show_bug.cgi?id=782>
15 pseudocode: <https://libre-soc.org/openpower/isa/bitmanip/>
17 this extension amalgamates bitmanipulation primitives from many sources, including RISC-V bitmanip, Packed SIMD, AVX-512 and OpenPOWER VSX. Vectorisation and SIMD are removed: these are straight scalar (element) operations making them suitable for embedded applications.
18 Vectorisation Context is provided by [[openpower/sv]].
20 When combined with SV, scalar variants of bitmanip operations found in VSX are added so that VSX may be retired as "legacy" in the far future (10 to 20 years). Also, VSX is hundreds of opcodes, requires 128 bit pathways, and is wholly unsuited to low power or embedded scenarios.
22 ternlogv is experimental and is the only operation that may be considered a "Packed SIMD". It is added as a variant of the already well-justified ternlog operation (done in AVX512 as an immediate only) "because it looks fun". As it is based on the LUT4 concept it will allow accelerated emulation of FPGAs. Other vendors of ISAs are buying FPGA companies to achieve similar objectives.
24 general-purpose Galois Field 2^M operations are added so as to avoid huge custom opcode proliferation across many areas of Computer Science. however for convenience and also to avoid setup costs, some of the more common operations (clmul, crc32) are also added. The expectation is that these operations would all be covered by the same pipeline.
26 note that there are brownfield spaces below that could incorporate some of the set-before-first and other scalar operations listed in [[sv/vector_ops]], and
27 the [[sv/av_opcodes]] as well as [[sv/setvl]]
31 * <https://en.wikiversity.org/wiki/Reed%E2%80%93Solomon_codes_for_coders>
32 * <https://maths-people.anu.edu.au/~brent/pd/rpb232tr.pdf>
36 two major opcodes are needed
38 ternlog has its own major opcode
41 | ------ |--| --------- |
46 2nd major opcode for other bitmanip: minor opcode allocation
49 | ------ |--| --------- |
54 | 011 | | gf/cl madd* |
61 | dest | src1 | subop | op |
62 | ---- | ---- | ----- | -------- |
63 | RT | RA | .. | bmatflip |
67 | dest | src1 | src2 | subop | op |
68 | ---- | ---- | ---- | ----- | -------- |
69 | RT | RA | RB | or | bmatflip |
70 | RT | RA | RB | xor | bmatflip |
71 | RT | RA | RB | | grev |
72 | RT | RA | RB | | clmul* |
73 | RT | RA | RB | | gorc |
74 | RT | RA | RB | shuf | shuffle |
75 | RT | RA | RB | unshuf| shuffle |
76 | RT | RA | RB | width | xperm |
77 | RT | RA | RB | type | minmax |
78 | RT | RA | RB | | av abs avgadd |
79 | RT | RA | RB | type | vmask ops |
88 TODO: convert all instructions to use RT and not RS
90 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|name|
91 | -- | -- | --- | --- | --- |-----|----- | -----|--|----|
92 | NN | BT | BA | BB | BC |m0-2 | imm | 10 |m3|crternlog|
94 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
95 | -- | -- | --- | --- | ----- | -------- |--| ------ |
96 | NN | RT | RA |itype/| im0-4 | im5-7 00 |0 | xpermi |
97 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
98 | NN | | | | | ..... 01 |0 | crternlog |
99 | NN | RT | RA | RB | RC | mode 010 |Rc| bitmask* |
100 | NN | RS | RA | RB | RC | 00 011 |0 | gfbmadd |
101 | NN | RS | RA | RB | RC | 00 011 |1 | gfbmaddsub |
102 | NN | RS | RA | RB | RC | 01 011 |0 | clmadd |
103 | NN | RS | RA | RB | RC | 01 011 |1 | clmaddsub |
104 | NN | RS | RA | RB | RC | 10 011 |0 | gfpmadd |
105 | NN | RS | RA | RB | RC | 10 011 |1 | gfpmaddsub |
106 | NN | RS | RA | RB | RC | 11 011 | | rsvd |
107 | NN | RT | RA | RB | sh0-4 | sh5 1 111 |Rc| bmrevi |
109 ops (note that av avg and abs as well as vec scalar mask
112 TODO: convert from RA, RB, and RC to correct field names of RT, RA, and RB, and
113 double check that instructions didn't need 3 inputs.
115 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
116 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
117 | NN | RT | RA | RB | 0 | | 0000 110 |Rc| rsvd |
118 | NN | RT | RA | RB | 1 | itype | 0000 110 |Rc| xperm |
119 | NN | RA | RB | RC | 0 | itype | 0100 110 |Rc| minmax |
120 | NN | RA | RB | RC | 1 | 00 | 0100 110 |Rc| av avgadd |
121 | NN | RA | RB | RC | 1 | 01 | 0100 110 |Rc| av abs |
122 | NN | RA | RB | | 1 | 10 | 0100 110 |Rc| rsvd |
123 | NN | RA | RB | | 1 | 11 | 0100 110 |Rc| rsvd |
124 | NN | RA | RB | sh | SH | itype | 1000 110 |Rc| bmopsi |
125 | NN | RT | RA | RB | | | 1100 110 |Rc| srsvd |
126 | NN | RT | RA | RB | 1 | 00 | 0001 110 |Rc| cldiv |
127 | NN | RT | RA | RB | 1 | 01 | 0001 110 |Rc| clmod |
128 | NN | RT | RA | RB | 1 | 10 | 0001 110 |Rc| |
129 | NN | RT | RB | RB | 1 | 11 | 0001 110 |Rc| clinv |
130 | NN | RA | RB | RC | 0 | 00 | 0001 110 |Rc| vec sbfm |
131 | NN | RA | RB | RC | 0 | 01 | 0001 110 |Rc| vec sofm |
132 | NN | RA | RB | RC | 0 | 10 | 0001 110 |Rc| vec sifm |
133 | NN | RA | RB | RC | 0 | 11 | 0001 110 |Rc| vec cprop |
134 | NN | RA | RB | | 0 | | 0101 110 |Rc| rsvd |
135 | NN | RA | RB | RC | 0 | 00 | 0010 110 |Rc| gorc |
136 | NN | RA | RB | sh | SH | 00 | 1010 110 |Rc| gorci |
137 | NN | RA | RB | RC | 0 | 00 | 0110 110 |Rc| gorcw |
138 | NN | RA | RB | sh | 0 | 00 | 1110 110 |Rc| gorcwi |
139 | NN | RA | RB | RC | 1 | 00 | 1110 110 |Rc| bmator |
140 | NN | RA | RB | RC | 0 | 01 | 0010 110 |Rc| grev |
141 | NN | RA | RB | RC | 1 | 01 | 0010 110 |Rc| clmul |
142 | NN | RA | RB | sh | SH | 01 | 1010 110 |Rc| grevi |
143 | NN | RA | RB | RC | 0 | 01 | 0110 110 |Rc| grevw |
144 | NN | RA | RB | sh | 0 | 01 | 1110 110 |Rc| grevwi |
145 | NN | RA | RB | RC | 1 | 01 | 1110 110 |Rc| bmatxor |
146 | NN | RA | RB | RC | | 10 | --10 110 |Rc| rsvd |
147 | NN | RA | RB | RC | 0 | 11 | 1110 110 |Rc| clmulr |
148 | NN | RA | RB | RC | 1 | 11 | 1110 110 |Rc| clmulh |
149 | NN | | | | | | --11 110 |Rc| setvl |
153 Similar to FPGA LUTs: for every bit perform a lookup into a table using an 8bit immediate, or in another register.
155 Like the x86 AVX512F [vpternlogd/vpternlogq](https://www.felixcloutier.com/x86/vpternlogd:vpternlogq) instructions.
159 | 0.5|6.10|11.15|16.20| 21..28|29.30|31|
160 | -- | -- | --- | --- | ----- | --- |--|
161 | NN | RT | RA | RB | im0-7 | 00 |Rc|
164 idx = c << 2 | b << 1 | a
165 return imm[idx] # idx by LSB0 order
168 RT[i] = lut3(imm, RB[i], RA[i], RT[i])
172 also, another possible variant involving swizzle-like selection
173 and masking, this only requires 3 64 bit registers (RA, RS, RB) and
176 Note however that unless XLEN matches sz, this instruction
177 is a Read-Modify-Write: RS must be read as a second operand
178 and all unmodified bits preserved. SVP64 may provide limited
179 alternative destination for RS from RS-as-source, but again
180 all unmodified bits must still be copied.
182 | 0.5|6.10|11.15|16.20|21.28 | 29.30 |31|
183 | -- | -- | --- | --- | ---- | ----- |--|
184 | NN | RS | RA | RB |idx0-3| 01 |sz|
186 SZ = (1+sz) * 8 # 8 or 16
187 raoff = MIN(XLEN, idx0 * SZ)
188 rboff = MIN(XLEN, idx1 * SZ)
189 rcoff = MIN(XLEN, idx2 * SZ)
190 rsoff = MIN(XLEN, idx3 * SZ)
192 for i in range(MIN(XLEN, SZ)):
196 res = lut3(imm, ra, rb, rc)
201 another mode selection would be CRs not Ints.
203 | 0.5|6.8 | 9.11|12.14|15.17|18.20|21.28 | 29.30|31|
204 | -- | -- | --- | --- | --- |-----|----- | -----|--|
205 | NN | BT | BA | BB | BC |m0-2 | imm | 10 |m3|
209 if not mask[i] continue
210 crregs[BT][i] = lut3(imm,
218 signed and unsigned min/max for integer. this is sort-of partly synthesiseable in [[sv/svp64]] with pred-result as long as the dest reg is one of the sources, but not both signed and unsigned. when the dest is also one of the srces and the mv fails due to the CR bittest failing this will only overwrite the dest where the src is greater (or less).
220 signed/unsigned min/max gives more flexibility.
223 uint_xlen_t min(uint_xlen_t rs1, uint_xlen_t rs2)
224 { return (int_xlen_t)rs1 < (int_xlen_t)rs2 ? rs1 : rs2;
226 uint_xlen_t max(uint_xlen_t rs1, uint_xlen_t rs2)
227 { return (int_xlen_t)rs1 > (int_xlen_t)rs2 ? rs1 : rs2;
229 uint_xlen_t minu(uint_xlen_t rs1, uint_xlen_t rs2)
230 { return rs1 < rs2 ? rs1 : rs2;
232 uint_xlen_t maxu(uint_xlen_t rs1, uint_xlen_t rs2)
233 { return rs1 > rs2 ? rs1 : rs2;
240 based on RV bitmanip, covered by ternlog bitops
243 uint_xlen_t cmix(uint_xlen_t RA, uint_xlen_t RB, uint_xlen_t RC) {
244 return (RA & RB) | (RC & ~RB);
251 based on RV bitmanip singlebit set, instruction format similar to shift
252 [[isa/fixedshift]]. bmext is actually covered already (shift-with-mask rldicl but only immediate version).
253 however bitmask-invert is not, and set/clr are not covered, although they can use the same Shift ALU.
255 bmext (RB) version is not the same as rldicl because bmext is a right shift by RC, where rldicl is a left rotate. for the immediate version this does not matter, so a bmexti is not required.
256 bmrev however there is no direct equivalent and consequently a bmrevi is required.
258 bmset (register for mask amount) is particularly useful for creating
259 predicate masks where the length is a dynamic runtime quantity.
260 bmset(RA=0, RB=0, RC=mask) will produce a run of ones of length "mask" in a single instruction without needing to initialise or depend on any other registers.
262 | 0.5|6.10|11.15|16.20|21.25| 26..30 |31| name |
263 | -- | -- | --- | --- | --- | ------- |--| ----- |
264 | NN | RS | RA | RB | RC | mode 010 |Rc| bm* |
266 Immediate-variant is an overwrite form:
268 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
269 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
270 | NN | RS | RB | sh | SH | itype | 1000 110 |Rc| bm*i |
276 mask_a = ((1 << x) - 1) & ((1 << 64) - 1)
277 mask_b = ((1 << y) - 1) & ((1 << 64) - 1)
282 mask_a = ((1 << x) - 1) & ((1 << 64) - 1)
283 mask_b = (~((1 << y) - 1)) & ((1 << 64) - 1)
284 return mask_a ^ mask_b
287 uint_xlen_t bmset(RS, RB, sh)
289 int shamt = RB & (XLEN - 1);
290 return RS | MASK(shamt, sh)
293 uint_xlen_t bmclr(RS, RB, sh)
295 int shamt = RB & (XLEN - 1);
296 return RS & ~MASK(shamt, sh)
299 uint_xlen_t bminv(RS, RB, sh)
301 int shamt = RB & (XLEN - 1);
302 return RS ^ MASK(shamt, sh)
305 uint_xlen_t bmext(RS, RB, sh)
307 int shamt = RB & (XLEN - 1);
309 return mask & (RS >> shamt);
313 bitmask extract with reverse. can be done by bit-order-inverting all of RB and getting bits of RB from the opposite end.
315 when RA is zero, no shift occurs. this makes bmextrev useful for
316 simply reversing all bits of a register.
320 rev[0:msb] = rb[msb:0];
323 uint_xlen_t bmextrev(RA, RB, sh)
326 if (RA != 0) shamt = (GPR(RA) & (XLEN - 1));
327 shamt = (XLEN-1)-shamt; # shift other end
328 bra = bitreverse(RB) # swap LSB-MSB
330 return mask & (bra >> shamt);
334 | 0.5|6.10|11.15|16.20|21.26| 27..30 |31| name |
335 | -- | -- | --- | --- | --- | ------- |--| ------ |
336 | NN | RT | RA | RB | sh | 1 011 |Rc| bmrevi |
341 generalised reverse combined with a pair of LUT2s and allowing
342 a constant `0b0101...0101` when RA=0, and an option to invert
343 (including when RA=0, giving a constant 0b1010...1010 as the
344 initial value) provides a wide range of instructions
345 and a means to set regular 64 bit patterns in one
348 the two LUT2s are applied left-half (when not swapping)
349 and right-half (when swapping) so as to allow a wider
352 <img src="/openpower/sv/grevlut2x2.jpg" width=700 />
354 * A value of `0b11001010` for the immediate provides
355 the functionality of a standard "grev".
356 * `0b11101110` provides gorc
358 grevlut should be arranged so as to produce the constants
359 needed to put into bext (bitextract) so as in turn to
360 be able to emulate x86 pmovmask instructions <https://www.felixcloutier.com/x86/pmovmskb>.
361 This only requires 2 instructions (grevlut, bext).
363 Note that if the mask is required to be placed
364 directly into CR Fields (for use as CR Predicate
365 masks rather than a integer mask) then sv.ori
366 may be used instead, bearing in mind that sv.ori
367 is a 64-bit instruction, and `VL` must have been
368 set to the required length:
370 sv.ori./elwid=8 r10.v, r10.v, 0
372 The following settings provide the required mask constants:
374 | RA | RB | imm | iv | result |
375 | ------- | ------- | ---------- | -- | ---------- |
376 | 0x555.. | 0b10 | 0b01101100 | 0 | 0x111111... |
377 | 0x555.. | 0b110 | 0b01101100 | 0 | 0x010101... |
378 | 0x555.. | 0b1110 | 0b01101100 | 0 | 0x00010001... |
379 | 0x555.. | 0b10 | 0b11000110 | 1 | 0x88888... |
380 | 0x555.. | 0b110 | 0b11000110 | 1 | 0x808080... |
381 | 0x555.. | 0b1110 | 0b11000110 | 1 | 0x80008000... |
383 Better diagram showing the correct ordering of shamt (RB). A LUT2
384 is applied to all locations marked in red using the first 4
385 bits of the immediate, and a separate LUT2 applied to all
386 locations in green using the upper 4 bits of the immediate.
388 <img src="/openpower/sv/grevlut.png" width=700 />
390 demo code [[openpower/sv/grevlut.py]]
395 return imm[idx] # idx by LSB0 order
397 dorow(imm8, step_i, chunksize):
399 if (j&chunk_size) == 0
403 step_o[j] = lut2(imm, step_i[j], step_i[j ^ chunk_size])
406 uint64_t grevlut64(uint64_t RA, uint64_t RB, uint8 imm, bool iv)
408 uint64_t x = 0x5555_5555_5555_5555;
409 if (RA != 0) x = GPR(RA);
414 if (shamt & step) x = dorow(imm, x, step)
420 | 0.5|6.10|11.15|16.20 |21..25 | 26....30 |31| name |
421 | -- | -- | --- | --- | ----- | -------- |--| ------ |
422 | NN | RT | RA | s0-4 | im0-4 | im5-7 1 iv |s5| grevlogi |
423 | NN | RT | RA | RB | im0-4 | im5-7 00 |1 | grevlog |
428 based on RV bitmanip, this is also known as a butterfly network. however
429 where a butterfly network allows setting of every crossbar setting in
430 every row and every column, generalised-reverse (grev) only allows
431 a per-row decision: every entry in the same row must either switch or
434 <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/8/8c/Butterfly_Network.jpg/474px-Butterfly_Network.jpg" />
437 uint64_t grev64(uint64_t RA, uint64_t RB)
441 if (shamt & 1) x = ((x & 0x5555555555555555LL) << 1) |
442 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
443 if (shamt & 2) x = ((x & 0x3333333333333333LL) << 2) |
444 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
445 if (shamt & 4) x = ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
446 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
447 if (shamt & 8) x = ((x & 0x00FF00FF00FF00FFLL) << 8) |
448 ((x & 0xFF00FF00FF00FF00LL) >> 8);
449 if (shamt & 16) x = ((x & 0x0000FFFF0000FFFFLL) << 16) |
450 ((x & 0xFFFF0000FFFF0000LL) >> 16);
451 if (shamt & 32) x = ((x & 0x00000000FFFFFFFFLL) << 32) |
452 ((x & 0xFFFFFFFF00000000LL) >> 32);
460 based on RV bitmanip.
462 RA contains a vector of indices to select parts of RB to be
463 copied to RT. The immediate-variant allows up to an 8 bit
464 pattern (repeated) to be targetted at different parts of RT
467 uint_xlen_t xpermi(uint8_t imm8, uint_xlen_t RB, int sz_log2)
470 uint_xlen_t sz = 1LL << sz_log2;
471 uint_xlen_t mask = (1LL << sz) - 1;
472 uint_xlen_t RA = imm8 | imm8<<8 | ... | imm8<<56;
473 for (int i = 0; i < XLEN; i += sz) {
474 uint_xlen_t pos = ((RA >> i) & mask) << sz_log2;
476 r |= ((RB >> pos) & mask) << i;
480 uint_xlen_t xperm(uint_xlen_t RA, uint_xlen_t RB, int sz_log2)
483 uint_xlen_t sz = 1LL << sz_log2;
484 uint_xlen_t mask = (1LL << sz) - 1;
485 for (int i = 0; i < XLEN; i += sz) {
486 uint_xlen_t pos = ((RA >> i) & mask) << sz_log2;
488 r |= ((RB >> pos) & mask) << i;
492 uint_xlen_t xperm_n (uint_xlen_t RA, uint_xlen_t RB)
493 { return xperm(RA, RB, 2); }
494 uint_xlen_t xperm_b (uint_xlen_t RA, uint_xlen_t RB)
495 { return xperm(RA, RB, 3); }
496 uint_xlen_t xperm_h (uint_xlen_t RA, uint_xlen_t RB)
497 { return xperm(RA, RB, 4); }
498 uint_xlen_t xperm_w (uint_xlen_t RA, uint_xlen_t RB)
499 { return xperm(RA, RB, 5); }
507 uint32_t gorc32(uint32_t RA, uint32_t RB)
511 if (shamt & 1) x |= ((x & 0x55555555) << 1) | ((x & 0xAAAAAAAA) >> 1);
512 if (shamt & 2) x |= ((x & 0x33333333) << 2) | ((x & 0xCCCCCCCC) >> 2);
513 if (shamt & 4) x |= ((x & 0x0F0F0F0F) << 4) | ((x & 0xF0F0F0F0) >> 4);
514 if (shamt & 8) x |= ((x & 0x00FF00FF) << 8) | ((x & 0xFF00FF00) >> 8);
515 if (shamt & 16) x |= ((x & 0x0000FFFF) << 16) | ((x & 0xFFFF0000) >> 16);
518 uint64_t gorc64(uint64_t RA, uint64_t RB)
522 if (shamt & 1) x |= ((x & 0x5555555555555555LL) << 1) |
523 ((x & 0xAAAAAAAAAAAAAAAALL) >> 1);
524 if (shamt & 2) x |= ((x & 0x3333333333333333LL) << 2) |
525 ((x & 0xCCCCCCCCCCCCCCCCLL) >> 2);
526 if (shamt & 4) x |= ((x & 0x0F0F0F0F0F0F0F0FLL) << 4) |
527 ((x & 0xF0F0F0F0F0F0F0F0LL) >> 4);
528 if (shamt & 8) x |= ((x & 0x00FF00FF00FF00FFLL) << 8) |
529 ((x & 0xFF00FF00FF00FF00LL) >> 8);
530 if (shamt & 16) x |= ((x & 0x0000FFFF0000FFFFLL) << 16) |
531 ((x & 0xFFFF0000FFFF0000LL) >> 16);
532 if (shamt & 32) x |= ((x & 0x00000000FFFFFFFFLL) << 32) |
533 ((x & 0xFFFFFFFF00000000LL) >> 32);
539 # Instructions for Carry-less Operations aka. Polynomials with coefficients in `GF(2)`
541 Carry-less addition/subtraction is simply XOR, so a `cladd`
542 instruction is not provided since the `xor[i]` instruction can be used instead.
544 These are operations on polynomials with coefficients in `GF(2)`, with the
545 polynomial's coefficients packed into integers with the following algorithm:
547 [[!inline pagenames="openpower/sv/bitmanip/pack_poly.py" raw="true" feeds="no" actions="yes"]]
549 ## Carry-less Multiply Instructions
552 see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
553 <https://www.felixcloutier.com/x86/pclmulqdq> and
554 <https://en.m.wikipedia.org/wiki/Carry-less_product>
556 They are worth adding as their own non-overwrite operations
557 (in the same pipeline).
559 ### `clmul` Carry-less Multiply
561 [[!inline pagenames="openpower/sv/bitmanip/clmul.py" raw="true" feeds="no" actions="yes"]]
563 ### `clmulh` Carry-less Multiply High
565 [[!inline pagenames="openpower/sv/bitmanip/clmulh.py" raw="true" feeds="no" actions="yes"]]
567 ### `clmulr` Carry-less Multiply (Reversed)
569 Useful for CRCs. Equivalent to bit-reversing the result of `clmul` on
572 [[!inline pagenames="openpower/sv/bitmanip/clmulr.py" raw="true" feeds="no" actions="yes"]]
574 ## `clmadd` Carry-less Multiply-Add
577 clmadd RT, RA, RB, RC
581 (RT) = clmul((RA), (RB)) ^ (RC)
584 ## `cltmadd` Twin Carry-less Multiply-Add (for FFTs)
587 cltmadd RT, RA, RB, RC
590 TODO: add link to explanation for where `RS` comes from.
593 temp = clmul((RA), (RB)) ^ (RC)
598 ## `cldivrem` Carry-less Division and Remainder
600 `cldivrem` isn't an actual instruction, but is just used in the pseudo-code
601 for other instructions.
603 [[!inline pagenames="openpower/sv/bitmanip/cldivrem.py" raw="true" feeds="no" actions="yes"]]
605 ## `cldiv` Carry-less Division
614 q, r = cldivrem(n, d, width=XLEN)
618 ## `clrem` Carry-less Remainder
627 q, r = cldivrem(n, d, width=XLEN)
631 # Instructions for Binary Galois Fields `GF(2^m)`
635 * <https://courses.csail.mit.edu/6.857/2016/files/ffield.py>
636 * <https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture7.pdf>
637 * <https://foss.heptapod.net/math/libgf2/-/blob/branch/default/src/libgf2/gf2.py>
639 Binary Galois Field addition/subtraction is simply XOR, so a `gfbadd`
640 instruction is not provided since the `xor[i]` instruction can be used instead.
642 ## `GFBREDPOLY` SPR -- Reducing Polynomial
644 In order to save registers and to make operations orthogonal with standard
645 arithmetic, the reducing polynomial is stored in a dedicated SPR `GFBREDPOLY`.
646 This also allows hardware to pre-compute useful parameters (such as the
647 degree, or look-up tables) based on the reducing polynomial, and store them
648 alongside the SPR in hidden registers, only recomputing them whenever the SPR
649 is written to, rather than having to recompute those values for every
652 Because Galois Fields require the reducing polynomial to be an irreducible
653 polynomial, that guarantees that any polynomial of `degree > 1` must have
654 the LSB set, since otherwise it would be divisible by the polynomial `x`,
655 making it reducible, making whatever we're working on no longer a Field.
656 Therefore, we can reuse the LSB to indicate `degree == XLEN`.
659 def decode_reducing_polynomial(GFBREDPOLY, XLEN):
660 """returns the decoded coefficient list in LSB to MSB order,
661 len(retval) == degree + 1"""
662 v = GFBREDPOLY & ((1 << XLEN) - 1) # mask to XLEN bits
663 if v == 0 or v == 2: # GF(2)
664 return [0, 1] # degree = 1, poly = x
666 degree = floor_log2(v)
668 # all reducing polynomials of degree > 1 must have the LSB set,
669 # because they must be irreducible polynomials (meaning they
670 # can't be factored), if the LSB was clear, then they would
671 # have `x` as a factor. Therefore, we can reuse the LSB clear
672 # to instead mean the polynomial has degree XLEN.
675 v |= 1 # LSB must be set
676 return [(v >> i) & 1 for i in range(1 + degree)]
679 ## `gfbredpoly` -- Set the Reducing Polynomial SPR `GFBREDPOLY`
681 unless this is an immediate op, `mtspr` is completely sufficient.
683 ## `gfbmul` -- Binary Galois Field `GF(2^m)` Multiplication
690 (RT) = gfbmul((RA), (RB))
693 ## `gfbmadd` -- Binary Galois Field `GF(2^m)` Multiply-Add
696 gfbmadd RT, RA, RB, RC
700 (RT) = gfbadd(gfbmul((RA), (RB)), (RC))
703 ## `gfbtmadd` -- Binary Galois Field `GF(2^m)` Twin Multiply-Add (for FFT)
706 gfbtmadd RT, RA, RB, RC
709 TODO: add link to explanation for where `RS` comes from.
712 temp = gfbadd(gfbmul((RA), (RB)), (RC))
717 ## `gfbinv` -- Binary Galois Field `GF(2^m)` Inverse
727 # Instructions for Prime Galois Fields `GF(p)`
732 def int_to_gfp(int_value, prime):
733 return int_value % prime # follows Python remainder semantics
736 ## `GFPRIME` SPR -- Prime Modulus For `gfp*` Instructions
738 ## `gfpadd` Prime Galois Field `GF(p)` Addition
745 (RT) = int_to_gfp((RA) + (RB), GFPRIME)
748 the addition happens on infinite-precision integers
750 ## `gfpsub` Prime Galois Field `GF(p)` Subtraction
757 (RT) = int_to_gfp((RA) - (RB), GFPRIME)
760 the subtraction happens on infinite-precision integers
762 ## `gfpmul` Prime Galois Field `GF(p)` Multiplication
769 (RT) = int_to_gfp((RA) * (RB), GFPRIME)
772 the multiplication happens on infinite-precision integers
774 ## `gfpinv` Prime Galois Field `GF(p)` Invert
780 Some potential hardware implementations are found in:
781 <https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.90.5233&rep=rep1&type=pdf>
784 (RT) = gfpinv((RA), GFPRIME)
787 the multiplication happens on infinite-precision integers
789 ## `gfpmadd` Prime Galois Field `GF(p)` Multiply-Add
792 gfpmadd RT, RA, RB, RC
796 (RT) = int_to_gfp((RA) * (RB) + (RC), GFPRIME)
799 the multiplication and addition happens on infinite-precision integers
801 ## `gfpmsub` Prime Galois Field `GF(p)` Multiply-Subtract
804 gfpmsub RT, RA, RB, RC
808 (RT) = int_to_gfp((RA) * (RB) - (RC), GFPRIME)
811 the multiplication and subtraction happens on infinite-precision integers
813 ## `gfpmsubr` Prime Galois Field `GF(p)` Multiply-Subtract-Reversed
816 gfpmsubr RT, RA, RB, RC
820 (RT) = int_to_gfp((RC) - (RA) * (RB), GFPRIME)
823 the multiplication and subtraction happens on infinite-precision integers
825 ## `gfpmaddsubr` Prime Galois Field `GF(p)` Multiply-Add and Multiply-Sub-Reversed (for FFT)
828 gfpmaddsubr RT, RA, RB, RC
831 TODO: add link to explanation for where `RS` comes from.
834 product = (RA) * (RB)
836 (RT) = int_to_gfp(product + term, GFPRIME)
837 (RS) = int_to_gfp(term - product, GFPRIME)
840 the multiplication, addition, and subtraction happens on infinite-precision integers
842 ## Twin Butterfly (Tukey-Cooley) Mul-add-sub
844 used in combination with SV FFT REMAP to perform
845 a full NTT in-place. possible by having 3-in 2-out,
846 to avoid the need for a temp register. RS is written
849 gffmadd RT,RA,RC,RB (Rc=0)
850 gffmadd. RT,RA,RC,RB (Rc=1)
854 RT <- GFADD(GFMUL(RA, RC), RB))
855 RS <- GFADD(GFMUL(RA, RC), RB))
860 with the modulo and degree being in an SPR, multiply can be identical
861 equivalent to standard integer add
865 | 0.5|6.10|11.15|16.20|21.25| 26..30 |31|
866 | -- | -- | --- | --- | --- | ------ |--|
867 | NN | RT | RA | RB |11000| 01110 |Rc|
872 from functools import reduce
882 # constants used in the multGF2 function
883 mask1 = mask2 = polyred = None
886 """Define parameters of binary finite field GF(2^m)/g(x)
887 - irPoly: coefficients of irreducible polynomial g(x)
889 # degree: extension degree of binary field
890 degree = gf_degree(irPoly)
893 """Convert an integer into a polynomial"""
894 return [(sInt >> i) & 1
895 for i in reversed(range(sInt.bit_length()))]
897 global mask1, mask2, polyred
898 mask1 = mask2 = 1 << degree
900 polyred = reduce(lambda x, y: (x << 1) + y, i2P(irPoly)[1:])
903 """Multiply two polynomials in GF(2^m)/g(x)"""
906 # standard long-multiplication: check LSB and add
910 # standard modulo: check MSB and add polynomial
916 if __name__ == "__main__":
918 # Define binary field GF(2^3)/x^3 + x + 1
919 setGF2(0b1011) # degree 3
921 # Evaluate the product (x^2 + x + 1)(x^2 + 1)
922 print("{:02x}".format(multGF2(0b111, 0b101)))
924 # Define binary field GF(2^8)/x^8 + x^4 + x^3 + x + 1
925 # (used in the Advanced Encryption Standard-AES)
926 setGF2(0b100011011) # degree 8
928 # Evaluate the product (x^7)(x^7 + x + 1)
929 print("{:02x}".format(multGF2(0b10000000, 0b10000011)))
935 # https://bugs.libre-soc.org/show_bug.cgi?id=782#c33
936 # https://ftp.libre-soc.org/ARITH18_Kobayashi.pdf
939 s = getGF2() # get the full polynomial (including the MSB)
945 for i in range(1, 2*degree+1):
946 # could use count-trailing-1s here to skip ahead
947 if r & mask1: # test MSB of r
948 if s & mask1: # test MSB of s
951 s <<= 1 # shift left 1
953 r, s = s, r # swap r,s
954 u, v = v<<1, u # shift v and swap
957 u >>= 1 # right shift left
960 r <<= 1 # shift left 1
961 u <<= 1 # shift left 1
969 ## GF2 (carryless) div and mod
980 def FullDivision(self, f, v):
982 Takes two arguments, f, v
983 fDegree and vDegree are the degrees of the field elements
984 f and v represented as a polynomials.
985 This method returns the field elements a and b such that
987 f(x) = a(x) * v(x) + b(x).
989 That is, a is the divisor and b is the remainder, or in
990 other words a is like floor(f/v) and b is like f modulo v.
993 fDegree, vDegree = gf_degree(f), gf_degree(v)
995 for i in reversed(range(vDegree, fDegree+1):
996 if ((rem >> i) & 1): # check bit
997 res ^= (1 << (i - vDegree))
998 rem ^= ( v << (i - vDegree)))
1002 | 0.5|6.10|11.15|16.20| 21 | 22.23 | 24....30 |31| name |
1003 | -- | -- | --- | --- | -- | ----- | -------- |--| ---- |
1004 | NN | RT | RA | RB | 1 | 00 | 0001 110 |Rc| cldiv |
1005 | NN | RT | RA | RB | 1 | 01 | 0001 110 |Rc| clmod |
1007 ## GF2 carryless mul
1009 based on RV bitmanip
1010 see <https://en.wikipedia.org/wiki/CLMUL_instruction_set> and
1011 <https://www.felixcloutier.com/x86/pclmulqdq> and
1012 <https://en.m.wikipedia.org/wiki/Carry-less_product>
1014 these are GF2 operations with the modulo set to 2^degree.
1015 they are worth adding as their own non-overwrite operations
1016 (in the same pipeline).
1019 uint_xlen_t clmul(uint_xlen_t RA, uint_xlen_t RB)
1022 for (int i = 0; i < XLEN; i++)
1027 uint_xlen_t clmulh(uint_xlen_t RA, uint_xlen_t RB)
1030 for (int i = 1; i < XLEN; i++)
1032 x ^= RA >> (XLEN-i);
1035 uint_xlen_t clmulr(uint_xlen_t RA, uint_xlen_t RB)
1038 for (int i = 0; i < XLEN; i++)
1040 x ^= RA >> (XLEN-i-1);
1044 ## carryless Twin Butterfly (Tukey-Cooley) Mul-add-sub
1046 used in combination with SV FFT REMAP to perform
1047 a full NTT in-place. possible by having 3-in 2-out,
1048 to avoid the need for a temp register. RS is written
1051 clfmadd RT,RA,RC,RB (Rc=0)
1052 clfmadd. RT,RA,RC,RB (Rc=1)
1056 RT <- CLMUL(RA, RC) ^ RB
1057 RS <- CLMUL(RA, RC) ^ RB
1063 uint64_t bmatflip(uint64_t RA)
1071 uint64_t bmatxor(uint64_t RA, uint64_t RB)
1074 uint64_t RBt = bmatflip(RB);
1075 uint8_t u[8]; // rows of RA
1076 uint8_t v[8]; // cols of RB
1077 for (int i = 0; i < 8; i++) {
1079 v[i] = RBt >> (i*8);
1082 for (int i = 0; i < 64; i++) {
1083 if (pcnt(u[i / 8] & v[i % 8]) & 1)
1088 uint64_t bmator(uint64_t RA, uint64_t RB)
1091 uint64_t RBt = bmatflip(RB);
1092 uint8_t u[8]; // rows of RA
1093 uint8_t v[8]; // cols of RB
1094 for (int i = 0; i < 8; i++) {
1096 v[i] = RBt >> (i*8);
1099 for (int i = 0; i < 64; i++) {
1100 if ((u[i / 8] & v[i % 8]) != 0)
1108 # Already in POWER ISA
1110 ## count leading/trailing zeros with mask
1116 do i = 0 to 63 if((RB)i=1) then do
1117 if((RS)i=1) then break end end count ← count + 1
1123 vpdepd VRT,VRA,VRB, identical to RV bitmamip bdep, found already in v3.1 p106
1126 if VSR[VRB+32].dword[i].bit[63-m]=1 then do
1127 result = VSR[VRA+32].dword[i].bit[63-k]
1128 VSR[VRT+32].dword[i].bit[63-m] = result
1134 uint_xlen_t bdep(uint_xlen_t RA, uint_xlen_t RB)
1137 for (int i = 0, j = 0; i < XLEN; i++)
1138 if ((RB >> i) & 1) {
1140 r |= uint_xlen_t(1) << i;
1150 other way round: identical to RV bext, found in v3.1 p196
1153 uint_xlen_t bext(uint_xlen_t RA, uint_xlen_t RB)
1156 for (int i = 0, j = 0; i < XLEN; i++)
1157 if ((RB >> i) & 1) {
1159 r |= uint_xlen_t(1) << j;
1168 found in v3.1 p106 so not to be added here
1178 if((RB)63-i==1) then do
1179 result63-ptr1 = (RS)63-i
1185 # bit to byte permute
1187 similar to matrix permute in RV bitmanip, which has XOR and OR variants,
1188 these perform a transpose.
1192 b = VSR[VRB+32].dword[i].byte[k].bit[j]
1193 VSR[VRT+32].dword[i].byte[j].bit[k] = b