search for: carryless

...w.githubusercontent.com/riscv/riscv-bitmanip/master/bitmanip-0.92.pdf >> [3] https://www.bearssl.org/constanttime.html > > What benefit would this intrinsic would bring to the middle-end IR, > over it's current naive expanded form? Isn't a "naive" expansion of NxN carryless multiply extremely involved? I'd expect something like 2N shifts, N truncs, N selects, and N xors. That link mentions an alternative that is more efficient, but I wouldn't exactly call it naive... Cheers, Nicolai > > Note that teaching backends to produce it, or even adding it...

<div> </div><div><div><p>Carry-less multiplication[1] instructions exist (at least optionally) on many architectures: armv8, RISC-V, x86_64, POWER, SPARC, C64x, and possibly more.</p><p>This proposal is to add a <code>llvm.clmul</code> instruction. Or if that is contentious, <code>llvm.experimental.bitmanip.clmul</code> instruction.