Skip to content

cbrt in musl ​

Musl libc 是一个轻量级、快速、安全且符合标准的 C 标准库(libc),旨在替代 GNU C Library (glibc)。它特别适合用于嵌入式系统、资源受限的环境以及需要高度可移植性和静态链接的应用。

Musl 的数学库中提供了丰富的数学函数实现。为了更加精确,这些函数通常使用了多种技巧来处理浮点数带来的舍入误差和多项式带来的近似误差。本文以立方根函数(cube root, cbrt)为例,看 musl 使用了什么样的技巧,这些技巧又给程序验证带来了哪些困难。考虑到完整证明的复杂性,本文仅对 cbrt 的实现进行分析,并不涉及完整的形式证明。

cbrt 的实现 ​

c
/* origin: FreeBSD /usr/src/lib/msun/src/s_cbrt.c */
/*
 * ====================================================
 * Copyright (C) 1993 by Sun Microsystems, Inc. All rights reserved.
 *
 * Developed at SunPro, a Sun Microsystems, Inc. business.
 * Permission to use, copy, modify, and distribute this
 * software is freely granted, provided that this notice
 * is preserved.
 * ====================================================
 *
 * Optimized by Bruce D. Evans.
 */
/* cbrt(x)
 * Return cube root of x
 */

#include <math.h>
#include <stdint.h>

static const uint32_t
B1 = 715094163, /* B1 = (1023-1023/3-0.03306235651)*2**20 */
B2 = 696219795; /* B2 = (1023-1023/3-54/3-0.03306235651)*2**20 */

/* |1/cbrt(x) - p(x)| < 2**-23.5 (~[-7.93e-8, 7.929e-8]). */
static const double
P0 =  1.87595182427177009643,  /* 0x3ffe03e6, 0x0f61e692 */
P1 = -1.88497979543377169875,  /* 0xbffe28e0, 0x92f02420 */
P2 =  1.621429720105354466140, /* 0x3ff9f160, 0x4a49d6c2 */
P3 = -0.758397934778766047437, /* 0xbfe844cb, 0xbee751d9 */
P4 =  0.145996192886612446982; /* 0x3fc2b000, 0xd4e4edd7 */

double cbrt(double x)
{
	union {double f; uint64_t i;} u = {x};
	double_t r,s,t,w;
	uint32_t hx = u.i>>32 & 0x7fffffff;

	if (hx >= 0x7ff00000)  /* cbrt(NaN,INF) is itself */
		return x+x;

	/*
	 * Rough cbrt to 5 bits:
	 *    cbrt(2**e*(1+m) ~= 2**(e/3)*(1+(e%3+m)/3)
	 * where e is integral and >= 0, m is real and in [0, 1), and "/" and
	 * "%" are integer division and modulus with rounding towards minus
	 * infinity.  The RHS is always >= the LHS and has a maximum relative
	 * error of about 1 in 16.  Adding a bias of -0.03306235651 to the
	 * (e%3+m)/3 term reduces the error to about 1 in 32. With the IEEE
	 * floating point representation, for finite positive normal values,
	 * ordinary integer divison of the value in bits magically gives
	 * almost exactly the RHS of the above provided we first subtract the
	 * exponent bias (1023 for doubles) and later add it back.  We do the
	 * subtraction virtually to keep e >= 0 so that ordinary integer
	 * division rounds towards minus infinity; this is also efficient.
	 */
	if (hx < 0x00100000) { /* zero or subnormal? */
		u.f = x*0x1p54;
		hx = u.i>>32 & 0x7fffffff;
		if (hx == 0)
			return x;  /* cbrt(0) is itself */
		hx = hx/3 + B2;
	} else
		hx = hx/3 + B1;
	u.i &= 1ULL<<63;
	u.i |= (uint64_t)hx << 32;
	t = u.f;

	/*
	 * New cbrt to 23 bits:
	 *    cbrt(x) = t*cbrt(x/t**3) ~= t*P(t**3/x)
	 * where P(r) is a polynomial of degree 4 that approximates 1/cbrt(r)
	 * to within 2**-23.5 when |r - 1| < 1/10.  The rough approximation
	 * has produced t such than |t/cbrt(x) - 1| ~< 1/32, and cubing this
	 * gives us bounds for r = t**3/x.
	 *
	 * Try to optimize for parallel evaluation as in __tanf.c.
	 */
	r = (t*t)*(t/x);
	t = t*((P0+r*(P1+r*P2))+((r*r)*r)*(P3+r*P4));

	/*
	 * Round t away from zero to 23 bits (sloppily except for ensuring that
	 * the result is larger in magnitude than cbrt(x) but not much more than
	 * 2 23-bit ulps larger).  With rounding towards zero, the error bound
	 * would be ~5/6 instead of ~4/6.  With a maximum error of 2 23-bit ulps
	 * in the rounded t, the infinite-precision error in the Newton
	 * approximation barely affects third digit in the final error
	 * 0.667; the error in the rounded t can be up to about 3 23-bit ulps
	 * before the final error is larger than 0.667 ulps.
	 */
	u.f = t;
	u.i = (u.i + 0x80000000) & 0xffffffffc0000000ULL;
	t = u.f;

	/* one step Newton iteration to 53 bits with error < 0.667 ulps */
	s = t*t;         /* t*t is exact */
	r = x/s;         /* error <= 0.5 ulps; |r| < |t| */
	w = t+t;         /* t+t is exact */
	r = (r-t)/(w+r); /* r-t is exact; w+r ~= 3*t */
	t = t+t*r;       /* error <= 0.5 + 0.5/3 + epsilon */
	return t;
}

NaN 和 Inf ​

c
uint32_t hx = u.i>>32 & 0x7fffffff;
if (hx >= 0x7ff00000)  /* cbrt(NaN,INF) is itself */
    return x+x;

hx 是浮点数 x 的高 32 位,掩码 0x7fffffff 用于去掉符号位。0x7ff00000 是指数全 1、尾数全 0,即 NaN 或 Infinity。

第一次逼近 ​

c
static const uint32_t
B1 = 715094163, /* B1 = (1023-1023/3-0.03306235651)*2**20 */
B2 = 696219795; /* B2 = (1023-1023/3-54/3-0.03306235651)*2**20 */

/*
    * Rough cbrt to 5 bits:
    *    cbrt(2**e*(1+m) ~= 2**(e/3)*(1+(e%3+m)/3)
    * where e is integral and >= 0, m is real and in [0, 1), and "/" and
    * "%" are integer division and modulus with rounding towards minus
    * infinity.  The RHS is always >= the LHS and has a maximum relative
    * error of about 1 in 16.  Adding a bias of -0.03306235651 to the
    * (e%3+m)/3 term reduces the error to about 1 in 32. With the IEEE
    * floating point representation, for finite positive normal values,
    * ordinary integer divison of the value in bits magically gives
    * almost exactly the RHS of the above provided we first subtract the
    * exponent bias (1023 for doubles) and later add it back.  We do the
    * subtraction virtually to keep e >= 0 so that ordinary integer
    * division rounds towards minus infinity; this is also efficient.
    */
if (hx < 0x00100000) { /* zero or subnormal? */
    u.f = x*0x1p54;
    hx = u.i>>32 & 0x7fffffff;
    if (hx == 0)
        return x;  /* cbrt(0) is itself */
    hx = hx/3 + B2;
} else
    hx = hx/3 + B1;
u.i &= 1ULL<<63;
u.i |= (uint64_t)hx << 32;
t = u.f;

0x00100000 0x00100000 是最小 normal 数的指数位。小于此值是零或次正规数。

先看正规数对应的分支:

c
else
    hx = hx/3 + B1;
u.i &= 1ULL<<63;
u.i |= (uint64_t)hx << 32;
t = u.f;

后面的 u.i &= 1ULL<<63; 是保留符号位,u.i |= (uint64_t)hx << 32; 是将处理后的 hx 放回高 32 位,低 32 位保持为 0,得到一个结果 t。这其实很好理解,比较难理解的是 hx/3 + B1 这一步。

对于 64 位浮点数,hx 对应的二进制布局为:

|符号位 s|11 位指数 E|尾数位的高 20 位 M20|

假设完整的尾数为 M=M20×232+M32,其中 M32 是尾数的低 32 位,那么忽略后 32 位尾数和符号位的 x 即:

x=(−1)s×2E−1023×(1+M252)=(−1)s×2E−1023×(1+M20×232+M32252)=(−1)s×2E−1023×(1+M20220+M32252)=2E−1023×(1+M20220)

设 e=E−1023,m=M20220,那么有:

x=2e×(1+m)

那么理想中 x 的立方根为:

cbrt(x)=2e3×(1+m)13

但是显然 e 并不一定恰好是 3 的倍数,假设 e=3q+r 且 q=⌊e3⌋,那么有:

e3=3q+r3=q+r3=⌊e3⌋+r3

因此:

cbrt(x)=2⌊e3⌋×((1+m)×2r)13

整数除法 hx / 3 做了什么:

hx3=E×220+M203=E3×220+M203=e+10233×220+M203=e3×220+M203+10233×220

常数 B1 被定义为:

B1=(1023−10233−0.03306235651)×220

因此 hx/3 + B1 的结果为:

hx/3+B1=e3×220+M203+10233×220+(1023−10233−0.03306235651)×220=e3×220+M203+(1023−0.03306235651)×220=(e3+1023)×220+M203−0.03306235651×220

延续上面对 e 的处理:

hx/3+B1=(⌊e3⌋+1023)×220+M203−0.03306235651×220+r3×220

重新解读这个值的位布局:

新的指数位为:E′=⌊e3⌋+1023,即 e′=E′−1023=⌊e3⌋

新的尾数位为:M20′=M203−0.03306235651×220+r3×220

那么 t 的值为:

t=2e′×(1+m′)=2⌊e3⌋×(1+m+r3−0.03306235651)

这个 t 与理想的 cbrt(x) 之间的相对误差为:

Fr(m)=1+m+r3−0.03306235651((1+m)×2r)13−1

令 δ=0.03306235651,N(m)=1+m+r3−δ:

Fr(m)+1=N(m)((1+m)×2r)13=N(m)×((1+m)×2r)−13

求导,得到:

Fr′(m)=2−r/39(1+m)−4/3(2m−r+3δ).

令导数为 0,得到极值点:

2m−r+3δ=0⟹m=r−3δ2

(感慨,没想到又得算这个)

对 r = 0, 1, 2 分别讨论:

r = 2 时,m=2−3δ2≈0.95040647,原误差函数的最大值出现在 m→0:

limm→0+F2(m)=53−δ22/3−1 ≈0.02910623.

同理,r = 1 时:

limm→0+F1(m)=43−δ21/3−1 ≈0.03202576.

r = 0 复杂一些,

形式上的极值点为:≈−0.04959353

它不在 [0,1) 内。

不过,r=0 时还需要考虑指数借位。当:

m3−δ<0

也就是:

m<3δ

时,构造出的浮点数会自然地从指数借 1。

所以实际误差函数是(不再重新推导):

F0(m)={1+m6−δ2(1+m)1/3−1,0≤m<3δ,1+m3−δ(1+m)1/3−1,3δ≤m<1.

最小值出现在分段连接点:

m=3δ.

此时:

F0(3δ)=1(1+3δ)1/3−1≈−0.03103193.

最大值出现在 m→1 时:

limm→1−F0(m)=43−δ21/3−1 ≈0.03202576.

综上所述,相对误差大约在 0.032 左右。

再回过头来看非规格化数的分支:

c
if (hx < 0x00100000) { /* zero or subnormal? */
    u.f = x*0x1p54;
    hx = u.i>>32 & 0x7fffffff;
    if (hx == 0)
        return x;  /* cbrt(0) is itself */
    hx = hx/3 + B2;
}

0x00100000 是最小规格化数的指数位。小于此值是零或次正规数。非规格化数的指数为 0,尾数位不包含前导的 1。因此:

x=2−1022×M20220=2−1022×m

为了和规格化数保持一致的处理,这里没有对非规格化数使用额外的算法,而是把非规格化数乘以 254,使其放大为规格化数,然后再进行第一次逼近。B2 的定义就很清楚了:

B2=(1023−10233−543−0.03306235651)×220

第二次逼近 ​

c
/* |1/cbrt(x) - p(x)| < 2**-23.5 (~[-7.93e-8, 7.929e-8]). */
static const double
P0 =  1.87595182427177009643,  /* 0x3ffe03e6, 0x0f61e692 */
P1 = -1.88497979543377169875,  /* 0xbffe28e0, 0x92f02420 */
P2 =  1.621429720105354466140, /* 0x3ff9f160, 0x4a49d6c2 */
P3 = -0.758397934778766047437, /* 0xbfe844cb, 0xbee751d9 */
P4 =  0.145996192886612446982; /* 0x3fc2b000, 0xd4e4edd7 */
/*
	* New cbrt to 23 bits:
	*    cbrt(x) = t*cbrt(x/t**3) ~= t*P(t**3/x)
	* where P(r) is a polynomial of degree 4 that approximates 1/cbrt(r)
	* to within 2**-23.5 when |r - 1| < 1/10.  The rough approximation
	* has produced t such than |t/cbrt(x) - 1| ~< 1/32, and cubing this
	* gives us bounds for r = t**3/x.
	*
	* Try to optimize for parallel evaluation as in __tanf.c.
	*/
r = (t*t)*(t/x);
t = t*((P0+r*(P1+r*P2))+((r*r)*r)*(P3+r*P4));

/*
	* Round t away from zero to 23 bits (sloppily except for ensuring that
	* the result is larger in magnitude than cbrt(x) but not much more than
	* 2 23-bit ulps larger).  With rounding towards zero, the error bound
	* would be ~5/6 instead of ~4/6.  With a maximum error of 2 23-bit ulps
	* in the rounded t, the infinite-precision error in the Newton
	* approximation barely affects third digit in the final error
	* 0.667; the error in the rounded t can be up to about 3 23-bit ulps
	* before the final error is larger than 0.667 ulps.
	*/
u.f = t;
u.i = (u.i + 0x80000000) & 0xffffffffc0000000ULL;
t = u.f;

t 是上一步得到的结果,我们知道 t 和理想中的 cbrt(x) 的相对误差大约在 0.032 左右。假设 y=cbrt(x), y3=x,可以写成 t=y(1+ϵ),其中 ϵ≈0.032 是相对误差。

(t*t)*(t/x) 计算了 r=t3x,即:

r=t3x=(y(1+ϵ))3x=y3(1+ϵ)3x=(1+ϵ)3.

因此,r 表示的是:当前近似值 t 的立方,相对于正确输入 x 偏大或偏小多少。因为前面已经分析过 t 的误差范围大约在 0.032 左右,所以 r 的范围大约在 0.9 ~ 1.1 之间,即:

|r−1|<0.1

既然已经知道了误差 r=(1+ϵ)3,那么一个直观的思路是,把上一步的结果 t 乘以 1r3 就可以得到一个更精确的结果。但直接调用另一个立方根函数显然没有意义,所以代码使用一个四次多项式 P(r) 来近似 1r3,即代码中的:

P(r)=P0+r(P1+rP2)+r3(P3+rP4)

代码之所以没有直接写成普通的多项式计算形式:

P0 + r*(P1 + r*(P2 + r*(P3 + r*P4)))

而是:

P0 + r*(P1 + r*P2) + (r*r)*r*(P3 + r*P4)

这么做主要是为了指令级并行,尽可能更好的利用 CPU 性能。

参数 P0 到 P4 应该是通过 Remez 算法得到的,并非直接对应 Taylor 展开的系数。因为 Taylor 展开在区间 [0.9,1.1] 上的误差可能不够小,而 Remez 算法可以在指定区间上最小化最大误差,从而得到更好的近似。

多项式和理想的 1r3 的误差大约在 2−23.5。

c
/*
	* Round t away from zero to 23 bits (sloppily except for ensuring that
	* the result is larger in magnitude than cbrt(x) but not much more than
	* 2 23-bit ulps larger).  With rounding towards zero, the error bound
	* would be ~5/6 instead of ~4/6.  With a maximum error of 2 23-bit ulps
	* in the rounded t, the infinite-precision error in the Newton
	* approximation barely affects third digit in the final error
	* 0.667; the error in the rounded t can be up to about 3 23-bit ulps
	* before the final error is larger than 0.667 ulps.
	*/
u.f = t;
u.i = (u.i + 0x80000000) & 0xffffffffc0000000ULL;
t = u.f;

掩码 0xffffffffc0000000ULL 的低 30 位全部为 0,0x80000000 是第 31 位为 1,其他位为 0,恰好对应 23-bit 最小步长的两位,所以这一步是更加精化后的 t 向绝对值增大的方向做舍入。这是为后面的第三次逼近做准备。

第三次逼近 ​

c
/* one step Newton iteration to 53 bits with error < 0.667 ulps */
s = t*t;         /* t*t is exact */
r = x/s;         /* error <= 0.5 ulps; |r| < |t| */
w = t+t;         /* t+t is exact */
r = (r-t)/(w+r); /* r-t is exact; w+r ~= 3*t */
t = t+t*r;       /* error <= 0.5 + 0.5/3 + epsilon */
return t;

这里通过一步 Newton 迭代把最终结果精确到 53 位,误差小于 0.667 ulps。

Newton 迭代指:要求方程 f(z)=0 的根,给定一个初始近似值 zn,在该点用切线近似函数 f(z)≈f(zn)+f′(zn)(z−zn),求切线与 x 轴的交点作为下一个近似值 zn+1,迭代公式为:

zn+1=zn−f(zn)f′(zn)

在这里,对于给定的 x 要求其立方根 y=cbrt(x),等价于求方程:

f(y)=y3−x=0.

取:

f(z)=z3−x,

则:

f′(z)=3z2.

代入牛顿公式:

zn+1=zn−zn3−x3zn2 =zn−13(zn−xzn2) =13(2zn+xzn2).

所以立方根的标准 Newton 迭代是:

zn+1=2zn+x/zn23

但是 musl 的实现中实际上用的不是这个 Newton 迭代。回到源码实现:

c
s = t*t;
r = x/s;
w = t+t;
r = (r-t)/(w+r);
t = t+t*r;
s=t×t=t2r=xs=xt2w=t+t=2tr=r−tw+r=xt2−t2t+xt2tnew=t+t×r=t+txt2−t2t+xt2=t(1+xt2−t2t+xt2)=t(2t+xt2+xt2−t2t+xt2)=t(t+2xt22t+xt2)=t(t3+2x2t3+x)=tt3+2x2t3+x

这个公式实际上来自于 Halley 迭代,Halley 方法的一般公式为:

zn+1=zn−2f(zn)f′(zn)2(f′(zn))2−f(zn)f″(zn)

对于:

f(z)=z3−x,

有:

f′(z)=3z2f″(z)=6z

带入上式:

zn+1=zn−2(zn3−x)(3zn2)2(3zn2)2−(zn3−x)(6zn)

化简分子:

2(zn3−x)(3zn2)=6zn2(zn3−x).

化简分母:

2(3zn2)2−(zn3−x)(6zn)=18zn4−6zn(zn3−x)=18zn4−6zn4+6znx=12zn4+6znx=6zn(2zn3+x).

因此:

zn+1=zn−6zn2(zn3−x)6zn(2zn3+x)=zn−znzn3−x2zn3+x=zn2zn3+x−zn3+x2zn3+x=znzn3+2x2zn3+x.

这正好对应 musl 的实现。使用一次 Halley 迭代比使用一次 Newton 迭代更快收敛,误差更小(Halley 迭代的误差近似于 ϵnew≈ϵold3,相比之下 Newton 迭代的误差近似于 ϵnew≈ϵold2,因此 Halley 迭代才能把 23-bit 的精度提升到 53-bit)。

此外,s = t*t 和 w = t+t 之所以是精确的,是因为之前已经把 t 的后 30 位清零了,因此 t 的尾数位只有前 23 位有效,乘法和加法不会产生舍入误差。

CORE-MATH 中的 cbrt ​

CORE-MATH 给出了一个经过验证的 cbrt 实现。通过手工证明,cbrt 保证返回值是精确立方根经过一次正确舍入后的结果。