1 /*

     2  * Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved.

     3  * ORACLE PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.

     4  *

     5  *

     6  *

     7  *

     8  *

     9  *

    10  *

    11  *

    12  *

    13  *

    14  *

    15  *

    16  *

    17  *

    18  *

    19  *

    20  *

    21  *

    22  *

    23  *

    24  */

    25 

    26 // package java.util;

    27 

    28 import java.math.BigInteger;

    29 import java.util.concurrent.atomic.AtomicLong;

    30 

    31 /**

    32  * A generator of uniform pseudorandom values applicable for use in

    33  * (among other contexts) isolated parallel computations that may

    34  * generate subtasks.  Class {@code L128X256MixRandom} implements

    35  * interfaces {@link java.util.Rng} and {@link java.util.SplittableRng},

    36  * and therefore supports methods for producing pseudorandomly chosen

    37  * numbers of type {@code int}, {@code long}, {@code float}, and {@code double}

    38  * as well as creating new split-off {@code L128X256MixRandom} objects,

    39  * with similar usages as for class {@link java.util.SplittableRandom}.

    40  *

    41  * <p>Series of generated values pass the TestU01 BigCrush and PractRand test suites

    42  * that measure independence and uniformity properties of random number generators.

    43  * (Most recently validated with

    44  * <a href="http://simul.iro.umontreal.ca/testu01/tu01.html">version 1.2.3 of TestU01</a>

    45  * and <a href="http://pracrand.sourceforge.net">version 0.90 of PractRand</a>.

    46  * Note that TestU01 BigCrush was used to test not only values produced by the {@code nextLong()}

    47  * method but also the result of bit-reversing each value produced by {@code nextLong()}.)

    48  * These tests validate only the methods for certain

    49  * types and ranges, but similar properties are expected to hold, at

    50  * least approximately, for others as well.

    51  *

    52  * <p>{@code L128X256MixRandom} is a specific member of the LXM family of algorithms

    53  * for pseudorandom number generators.  Every LXM generator consists of two

    54  * subgenerators; one is an LCG (Linear Congruential Generator) and the other is

    55  * an Xorshift generator.  Each output of an LXM generator is the sum of one

    56  * output from each subgenerator, possibly processed by a final mixing function

    57  * (and {@code L128X256MixRandom} does use a mixing function).

    58  *

    59  * <p>The LCG subgenerator for {@code L128X256MixRandom} has an update step of the

    60  * form {@code s = m * s + a}, where {@code s}, {@code m}, and {@code a} are all

    61  * 128-bit integers; {@code s} is the mutable state, the multiplier {@code m}

    62  * is fixed (the same for all instances of {@code L128X256MixRandom}}) and the addend

    63  * {@code a} is a parameter (a final field of the instance).  The parameter

    64  * {@code a} is required to be odd (this allows the LCG to have the maximal

    65  * period, namely 2<sup>128</sup>); therefore there are 2<sup>127</sup> distinct choices

    66  * of parameter.

    67  *

    68  * <p>The Xorshift subgenerator for {@code L128X256MixRandom} is the {@code xoshiro256} algorithm,

    69  * version 1.0 (parameters 17, 45), without any final scrambler such as "+" or "**".

    70  * Its state consists of four {@code long} fields {@code x0}, {@code x1}, {@code x2},

    71  * and {@code x3}, which can take on any values provided that they are not all zero.

    72  * The period of this subgenerator is 2<sup>256</sup>-1.

    73  * 

    74  * <p> The mixing function for {@code L128X256MixRandom} is the 64-bit MurmurHash3 finalizer.

    75  *

    76  * <p> Because the periods 2<sup>128</sup> and 2<sup>256</sup>-1 of the two subgenerators

    77  * are relatively prime, the <em>period</em> of any single {@code L128X256MixRandom} object 

    78  * (the length of the series of generated 64-bit values before it repeats) is the product

    79  * of the periods of the subgenerators, that is, 2<sup>128</sup>(2<sup>256</sup>-1),

    80  * which is just slightly smaller than 2<sup>384</sup>.  Moreover, if two distinct

    81  * {@code L128X256MixRandom} objects have different {@code a} parameters, then their

    82  * cycles of produced values will be different.

    83  *

    84  * <p>The 64-bit values produced by the {@code nextLong()} method are exactly equidistributed.

    85  * For any specific instance of {@code L128X256MixRandom}, over the course of its cycle each

    86  * of the 2<sup>64</sup> possible {@code long} values will be produced 2<sup>256</sup>-1 times.

    87  * The values produced by the {@code nextInt()}, {@code nextFloat()}, and {@code nextDouble()}

    88  * methods are likewise exactly equidistributed.

    89  *

    90  * <p>In fact, the 64-bit values produced by the {@code nextLong()} method are exactly

    91  * 2-equidistributed.  For any specific instance of {@code L128X256MixRandom}, consider

    92  * the (overlapping) length-2 subsequences of the cycle of 64-bit values produced by

    93  * {@code nextLong()} (assuming no other methods are called that would affect the state).

    94  * There are 2<sup>128</sup>(2<sup>256</sup>-1) such subsequences, and each subsequence,

    95  * which consists of 2 64-bit values, can have one of 2<sup>128</sup> values, and each

    96  * such value occurs  2<sup>256</sup>-1 times.  The values produced by the {@code nextInt()},

    97  * {@code nextFloat()}, and {@code nextDouble()} methods are likewise exactly 2-equidistributed.

    98  *

    99  * <p>Moreover, the 64-bit values produced by the {@code nextLong()} method are 4-equidistributed.

   100  * To be precise: for any specific instance of {@code L128X256MixRandom}, consider

   101  * the (overlapping) length-4 subsequences of the cycle of 64-bit values produced by

   102  * {@code nextLong()} (assuming no other methods are called that would affect the state).

   103  * There are <sup>128</sup>(2<sup>256</sup>-1) such subsequences, and each subsequence,

   104  * which consists of 4 64-bit values, can have one of 2<sup>256</sup> values. Of those

   105  * 2<sup>256</sup> subsequence values, nearly all of them (2<sup>256</sup>-2<sup>128</sup>)

   106  * occur 2<sup>128</sup> times over the course of the entire cycle, and the other

   107  * 2<sup>128</sup> subsequence values occur only 2<sup>128</sup>-1 times.  So the ratio

   108  * of the probability of getting one of the less common subsequence values and the

   109  * probability of getting one of the more common subsequence values is 1-2<sup>-128</sup>.

   110  * (Note that the set of 2<sup>128</sup> less-common subsequence values will differ from

   111  * one instance of {@code L128X256MixRandom} to another, as a function of the additive

   112  * parameter of the LCG.)  The values produced by the {@code nextInt()}, {@code nextFloat()},

   113  * and {@code nextDouble()} methods are likewise 4-equidistributed.

   114  *

   115  * <p>Method {@link #split} constructs and returns a new {@code L128X256MixRandom}

   116  * instance that shares no mutable state with the current instance. However, with

   117  * very high probability, the values collectively generated by the two objects

   118  * have the same statistical properties as if the same quantity of values were

   119  * generated by a single thread using a single {@code L128X256MixRandom} object.

   120  * This is because, with high probability, distinct {@code L128X256MixRandom} objects

   121  * have distinct {@code a} parameters and therefore use distinct members of the

   122  * algorithmic family; and even if their {@code a} parameters are the same, with

   123  * very high probability they will traverse different parts of their common state

   124  * cycle.

   125  *

   126  * <p>As with {@link java.util.SplittableRandom}, instances of

   127  * {@code L128X256MixRandom} are <em>not</em> thread-safe.

   128  * They are designed to be split, not shared, across threads. For

   129  * example, a {@link java.util.concurrent.ForkJoinTask} fork/join-style

   130  * computation using random numbers might include a construction

   131  * of the form {@code new Subtask(someL128X256MixRandom.split()).fork()}.

   132  *

   133  * <p>This class provides additional methods for generating random

   134  * streams, that employ the above techniques when used in

   135  * {@code stream.parallel()} mode.

   136  *

   137  * <p>Instances of {@code L128X256MixRandom} are not cryptographically

   138  * secure.  Consider instead using {@link java.security.SecureRandom}

   139  * in security-sensitive applications. Additionally,

   140  * default-constructed instances do not use a cryptographically random

   141  * seed unless the {@linkplain System#getProperty system property}

   142  * {@code java.util.secureRandomSeed} is set to {@code true}.

   143  *

   144  * @author  Guy Steele

   145  * @since   1.9

   146  */

   147 public final class L128X256MixRandom extends AbstractSplittableRng {

   148 

   149     /*

   150      * Implementation Overview.

   151      *

   152      * The 128-bit parameter `a` is represented as two long fields `ah` and `al`.

   153      * The 128-bit state variable `s` is represented as two long fields `sh` and `sl`.

   154      *

   155      * The split operation uses the current generator to choose eight

   156      * new 64-bit long values that are then used to initialize the

   157      * parameters `ah` and `al` and the state variables `sh`, `sl`,

   158      * `x0`, `x1`, `x2`, and `x3` for a newly constructed generator.

   159      *

   160      * With extremely high probability, no two generators so chosen

   161      * will have the same `a` parameter, and testing has indicated

   162      * that the values generated by two instances of {@code L128X256MixRandom}

   163      * will be (approximately) independent if have different values for `a`.

   164      *

   165      * The default (no-argument) constructor, in essence, uses

   166      * "defaultGen" to generate eight new 64-bit values for the same

   167      * purpose.  Multiple generators created in this way will certainly

   168      * differ in their `a` parameters.  The defaultGen state must be accessed

   169      * in a thread-safe manner, so we use an AtomicLong to represent

   170      * this state.  To bootstrap the defaultGen, we start off using a

   171      * seed based on current time unless the

   172      * java.util.secureRandomSeed property is set. This serves as a

   173      * slimmed-down (and insecure) variant of SecureRandom that also

   174      * avoids stalls that may occur when using /dev/random.

   175      *

   176      * File organization: First static fields, then instance

   177      * fields, then constructors, then instance methods.

   178      */

   179 

   180     /* ---------------- static fields ---------------- */

   181 

   182     /**

   183      * The seed generator for default constructors.

   184      */

   185     private static final AtomicLong defaultGen = new AtomicLong(RngSupport.initialSeed());

   186 

   187     /*

   188      * The period of this generator, which is (2**256 - 1) * 2**128.

   189      */

   190     private static final BigInteger thePeriod =

   191 	BigInteger.ONE.shiftLeft(256).subtract(BigInteger.ONE).shiftLeft(128);

   192 

   193     /*

   194      * The multiplier used in the LCG portion of the algorithm is 2**64 + m;

   195      * where m is taken from

   196      * Pierre L'Ecuyer, Tables of linear congruential generators of

   197      * different sizes and good lattice structure, <em>Mathematics of

   198      * Computation</em> 68, 225 (January 1999), pages 249–260,

   199      * Table 4 (first multiplier for size 2<sup>64</sup>).

   200      *

   201      * This is almost certainly not the best possible 128-bit multiplier

   202      * for an LCG, but it is sufficient for our purposes here; because

   203      * is is larger than 2**64, the 64-bit values produced by nextLong()

   204      * are exactly 2-equidistributed, and the fact that it is of the

   205      * form (2**64 + m) simplifies the code, given that we have only

   206      * 64-bit arithmetic to work with.

   207      */

   208 

   209     private static final long m = 2862933555777941757L;

   210 

   211     /* ---------------- instance fields ---------------- */

   212 

   213     /**

   214      * The parameter that is used as an additive constant for the LCG.

   215      * Must be odd.

   216      */

   217     private final long ah, al;

   218 

   219     /**

   220      * The per-instance state: sh and sl for the LCG; x0, x1, x2, and x3 for the xorshift.

   221      * At least one of the four fields x0, x1, x2, and x3 must be nonzero.

   222      */

   223     private long sh, sl, x0, x1, x2, x3;

   224 

   225     /* ---------------- constructors ---------------- */

   226 

   227     /**

   228      * Basic constructor that initializes all fields from parameters.

   229      * It then adjusts the field values if necessary to ensure that

   230      * all constraints on the values of fields are met.

   231      */

   232     public L128X256MixRandom(long ah, long al, long sh, long sl, long x0, long x1, long x2, long x3) {

   233 	// Force a to be odd.

   234         this.ah = ah;

   235         this.al = al | 1;

   236         this.sh = sh;

   237         this.sl = sl;

   238         this.x0 = x0;

   239         this.x1 = x1;

   240         this.x2 = x2;

   241         this.x3 = x3;

   242 	// If x0, x1, x2, and x3 are all zero, we must choose nonzero values.

   243         if ((x0 | x1 | x2 | x3) == 0) {

   244 	    // At least three of the four values generated here will be nonzero.

   245 	    this.x0 = RngSupport.mixStafford13(sh += RngSupport.GOLDEN_RATIO_64);

   246 	    this.x1 = RngSupport.mixStafford13(sh += RngSupport.GOLDEN_RATIO_64);

   247 	    this.x2 = RngSupport.mixStafford13(sh += RngSupport.GOLDEN_RATIO_64);

   248 	    this.x3 = RngSupport.mixStafford13(sh + RngSupport.GOLDEN_RATIO_64);

   249 	}

   250     }

   251 

   252     /**

   253      * Creates a new instance of {@code L128X256MixRandom} using the

   254      * specified {@code long} value as the initial seed. Instances of

   255      * {@code L128X256MixRandom} created with the same seed in the same

   256      * program generate identical sequences of values.

   257      *

   258      * @param seed the initial seed

   259      */

   260     public L128X256MixRandom(long seed) {

   261 	// Using a value with irregularly spaced 1-bits to xor the seed

   262 	// argument tends to improve "pedestrian" seeds such as 0 or

   263 	// other small integers.  We may as well use SILVER_RATIO_64.

   264 	//

   265 	// The seed is hashed by mixMurmur64 to produce the `a` parameter.

   266 	// The seed is hashed by mixStafford13 to produce the initial `x0`,

   267 	// which will then be used to produce the first generated value.

   268 	// The other x values are filled in as if by a SplitMix PRNG with

   269 	// GOLDEN_RATIO_64 as the gamma value and Stafford13 as the mixer.

   270         this(RngSupport.mixMurmur64(seed ^= RngSupport.SILVER_RATIO_64),

   271 	     RngSupport.mixMurmur64(seed += RngSupport.GOLDEN_RATIO_64),

   272 	     0,

   273 	     1,

   274 	     RngSupport.mixStafford13(seed),

   275 	     RngSupport.mixStafford13(seed += RngSupport.GOLDEN_RATIO_64),

   276 	     RngSupport.mixStafford13(seed += RngSupport.GOLDEN_RATIO_64),

   277 	     RngSupport.mixStafford13(seed + RngSupport.GOLDEN_RATIO_64));

   278     }

   279 

   280     /**

   281      * Creates a new instance of {@code L128X256MixRandom} that is likely to

   282      * generate sequences of values that are statistically independent

   283      * of those of any other instances in the current program execution,

   284      * but may, and typically does, vary across program invocations.

   285      */

   286     public L128X256MixRandom() {

   287 	// Using GOLDEN_RATIO_64 here gives us a good Weyl sequence of values.

   288         this(defaultGen.getAndAdd(RngSupport.GOLDEN_RATIO_64));

   289     }

   290 

   291     /**

   292      * Creates a new instance of {@code L128X256MixRandom} using the specified array of

   293      * initial seed bytes. Instances of {@code L128X256MixRandom} created with the same

   294      * seed array in the same program execution generate identical sequences of values.

   295      *

   296      * @param seed the initial seed

   297      */

   298     public L128X256MixRandom(byte[] seed) {

   299 	// Convert the seed to 6 long values, of which the last 4 are not all zero.

   300 	long[] data = RngSupport.convertSeedBytesToLongs(seed, 6, 4);

   301 	long ah = data[0], al = data[1], sh = data[2], sl = data[3], x0 = data[4], x1 = data[5], x2 = data[6], x3 = data[7];

   302 	// Force a to be odd.

   303         this.ah = ah;

   304         this.al = al | 1;

   305         this.sh = sh;

   306         this.sl = sl;

   307         this.x0 = x0;

   308         this.x1 = x1;

   309         this.x2 = x2;

   310         this.x3 = x3;

   311     }

   312 

   313     /* ---------------- public methods ---------------- */

   314     

   315     /**

   316      * Constructs and returns a new instance of {@code L128X256MixRandom}

   317      * that shares no mutable state with this instance.

   318      * However, with very high probability, the set of values collectively

   319      * generated by the two objects has the same statistical properties as if

   320      * same the quantity of values were generated by a single thread using

   321      * a single {@code L128X256MixRandom} object.  Either or both of the two

   322      * objects may be further split using the {@code split} method,

   323      * and the same expected statistical properties apply to the

   324      * entire set of generators constructed by such recursive splitting.

   325      *

   326      * @param source a {@code SplittableRng} instance to be used instead

   327      *               of this one as a source of pseudorandom bits used to

   328      *               initialize the state of the new ones.

   329      * @return a new instance of {@code L128X256MixRandom}

   330      */

   331     public L128X256MixRandom split(SplittableRng source) {

   332 	// Literally pick a new instance "at random".

   333         return new L128X256MixRandom(source.nextLong(), source.nextLong(), 

   334 				     source.nextLong(), source.nextLong(),

   335 				     source.nextLong(), source.nextLong(),

   336 				     source.nextLong(), source.nextLong());

   337     }

   338 

   339     /**

   340      * Returns a pseudorandom {@code long} value.

   341      *

   342      * @return a pseudorandom {@code long} value

   343      */

   344 

   345     public long nextLong() {

   346 	final long z = sh + x0;

   347 	// The LCG: in effect, s = ((1LL << 64) + m) * s + a, if only we had 128-bit arithmetic.

   348 	final long u = m * sl;

   349 	sh = (m * sh) + Math.multiplyHigh(m, sl) + sl + ah;

   350 	sl = u + al;

   351 	if (Long.compareUnsigned(sl, u) < 0) ++sh;  // Handle the carry propagation from low half to high half.

   352 	long q0 = x0, q1 = x1, q2 = x2, q3 = x3;	

   353 	{ long t = q1 << 17; q2 ^= q0; q3 ^= q1; q1 ^= q2; q0 ^= q3; q2 ^= t; q3 = Long.rotateLeft(q3, 45); }  // xoshiro256 1.0

   354 	x0 = q0; x1 = q1; x2 = q2; x3 = q3;

   355 	return RngSupport.mixLea64(z);  // mixing function

   356     }

   357 

   358     public BigInteger period() { return thePeriod; }

   359 }