rajamesandClaude Opus 5.5
9a391eb0ad
UM* as first written in DECOMPOSITION.md section 4 was exact only while u1 <= 2^(n-2): plain +* loses the carry out of T and its shift keeps T's sign bit, so the loop is exact only while S and T stay in [-2^(n-2), 2^(n-2)). The rewrite multiplies by s = u1 2/, which always lies in that range, starting T at t0 = u2 2/ when u1 is odd, so the loop yields hi:lo = t0 + s*u2 exactly. Then u1*u2 = 2*(hi:lo) + c_lo + c_hi*2^n c_lo = u1 & u2 & 1 c_hi = (u1<0 ? u2 : 0) + (u1 odd and u2<0 ? 1 : 0) restores the halved-away bits and the unsigned reading of both top bits. test_foundation.c runs the new definition against v4_umul over every pair of the edge vectors plus 20000 pseudo-random pairs, at 32- and 64-bit cells, optimised and under ASan+UBSan. The two pinned failing cases are now ordinary exactness checks. Two hand mutations of the correction step each fail more than 10000 checks at both widths. DECOMPOSITION.md: section 4 UM* replaced, D-3 ruling text updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
33 lines
1.6 KiB
C
33 lines
1.6 KiB
C
/* umul.h -- unsigned multiply fixing UM* under D-3 constraints.
|
|
*
|
|
* DECOMPOSITION.md section 4 first said of UM* (since rewritten to be exact over
|
|
* the full range; see test_foundation.c): "NEEDS REVISION: written for the carry-keeping
|
|
* +* that D-3 rejected. With plain F18 +* the carry out of T is lost, so this
|
|
* is only correct when the partial sums never overflow T (operands below 2^31).
|
|
* A full-range UM* needs a correction step; to be rewritten and proven on the
|
|
* golden model."
|
|
*
|
|
* D-3 states: "Plain F18 semantics. The carry out of T is not kept."
|
|
* The +* defined in the F18 shifts T:A right; the add is T <- T+S when bit 0
|
|
* of A was set, but any carry out of that addition is discarded (not shifted
|
|
* into the high part). That means UM* as written only works for inputs whose
|
|
* partial products don't generate a carry beyond T's width during the loop.
|
|
*
|
|
* We need a correct full-range unsigned multiply (u1*u2 -> ulo, uhi) that is
|
|
* correct for all cell-width values of u1,u2, expressed in terms of the v4
|
|
* primitives or at least specified precisely for the golden model. Since
|
|
* we're building the golden model in C first, the canonical implementation is
|
|
* the width-correct C multiplication split into high/low halves at V4_CELL_BITS.
|
|
* This header provides both: a reference C implementation (for verification)
|
|
* and a documented form that matches D-3's +* constraint.
|
|
*/
|
|
#ifndef V4_UMUL_H
|
|
#define V4_UMUL_H
|
|
|
|
#include "v4/cell.h"
|
|
|
|
/* Unsigned multiply: (u1, u2) -> (ulo, uhi). Full range, width-correct. */
|
|
void v4_umul(v4_ucell u1, v4_ucell u2, v4_ucell *ulo, v4_ucell *uhi);
|
|
|
|
#endif /* V4_UMUL_H */
|