The carry-less multipliers and the bit-count family.
| Semantics | Encoding | In | |
|---|---|---|---|
| bseti rd, rs1, shamt | rd = rs1 | (1 << shamt) — the immediate single-bit set (register form on the previous page). | OP-IMM 0010100 / 001 | Zbs |
| clmul rd, rs1, rs2 | Low XLEN bits of the carry-less (GF(2), XOR-instead-of-ADD) product. | OP 0000101 / 001 | Zbc, Zbkc |
| clmulh rd, rs1, rs2 | High half: bits 2·XLEN−1 : XLEN of the carry-less product (zero in the top bit). | OP 0000101 / 011 | Zbc, Zbkc |
| clmulr rd, rs1, rs2 | Bits 2·XLEN−2 : XLEN−1 — the “reversed” slice that makes bit-reflected CRCs one multiply shorter. | OP 0000101 / 010 | Zbc only |
| clz rd, rs | Count leading zeros; clz(0) = XLEN — defined, unlike certain other ISAs. | OP-IMM funct12 0110000_00000 / 001 | Zbb |
| clzw rd, rs (RV64) | Leading zeros in the low word; clzw(0) = 32. | OP-IMM-32, same funct12 | Zbb |
| cpop rd, rs | Population count — number of set bits. | OP-IMM funct12 0110000_00010 / 001 | Zbb |
| cpopw rd, rs (RV64) | Popcount of the low word. | OP-IMM-32, same funct12 | Zbb |
The unary count instructions borrow the SYSTEM trick: with one
source, the 12-bit immediate field becomes a sub-opcode
(0110000_000xx). Their software impact is outsized — clz is
integer log2, normalization, and the fast path of every
floating-point emulation; cpop is Hamming distance, bitboard
evaluation, and sparse-set cardinality; ctz (next page) is the
find-first-set of every scheduler bitmap.
Hardware Designer Notes
The count tree is a textbook log-depth reduction (~350 gates at 64 bits); the clmul array is the one real area decision on this page. Measure your target’s AES-GCM traffic before buying the tree.
Minimal Linux-boot hart MUST
- clz/ctz/cpop share one bit-scan/reduction tree; w-forms mask the upper half and adjust the zero-input constant (XLEN vs 32)
- clmul family: fixed-latency implementation if you claim Zkt — GHASH operands are secrets, and early-out multipliers leak them
MAY simplify / trap-and-emulate
- Implement clmul iteratively (1 bit/cycle) on area-constrained cores — correct, slow, and fine without crypto claims
- Build the XOR-tree multiplier (~half an integer multiplier — no carry-propagate) and pipeline it in 2 cycles for GHASH throughput
- Skip clmulr (implement Zbkc not Zbc) if CRC performance is not on your datasheet
Check yourself — clmul & counts
1.What is carry-less multiplication, and why do CRCs and AES-GCM want it?
2.How are clz/ctz/cpop encoded, given they have only ONE source operand?
3.Under Zkt (data-independent timing), what implementation constraint hits clmul?