GF2P8AFFINEINVQB

GF2P8AFFINEINVQB replaces each byte by its inverse in the field GF(2^8) and then applies the same affine step as GF2P8AFFINEQB: a multiplication by an 8-by-8 bit matrix from the quadword in the same position of the second operand, and an XOR with the immediate. That page explains how the matrix is laid out. The field is the one AES uses, with the reduction polynomial x^8 + x^4 + x^3 + x + 1, and zero, which has no inverse, counts as its own: Intel’s manual gives the whole inverse table, from 0 to 0 and 1 to 1 up to FFh to 1Ch.

AES’s S-box in one instruction#

AES’s SubBytes is exactly this operation: an inverse in that field, then a fixed affine map, then an XOR with 63h. With the matrix F1E3C78F1F3E7CF8h in every quadword and an immediate of 63h, the instruction computes the S-box for 16 bytes. One of the cases recorded on Zen 5 used that matrix with an immediate of 80h: the bytes B1h, 6Fh and 71h gave 2Bh, 4Bh and 40h, which are their S-box values C8h, A8h and A3h with E3h, the XOR of 63h and 80h, applied on top. For the plain inverse, the identity matrix 0102040810204080h and an immediate of 0 leave it untouched.

Ciphers whose S-box is built from a field inverse, but which have no instructions of their own, can use it too, with an affine step before it where needed: Intel’s optimization manual computes SM4’s S-box with a VGF2P8AFFINEQB followed by a VGF2P8AFFINEINVQB, each with its own matrix and constant (Section 19.3, Example 19-2).

This form and its VEX and EVEX twins#

This page is the legacy SSE form, which needs GFNI only and works on 16 bytes; bits 128 and up of the register are kept, and a memory operand must be aligned to 16 bytes. VGF2P8AFFINEINVQB has the VEX forms (GFNI and AVX) and the EVEX forms with masking and a broadcast matrix. The intrinsic _mm_gf2p8affineinv_epi64_epi8(x, A, b) needs -mgfni, and b must be a constant. AMD’s Zen 5 guide lists it, like GF2P8AFFINEQB, as one macro-op with a latency of 3 cycles.

In the optimization guide

What the optimization guide says about GF2P8AFFINEINVQB, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Tremont

• Vectors and cryptography: Tremont adds the Galois-field instructions, for ciphers, error correction and bit-matrix multiplication, which run on port 20, and speeds up pclmulqdq; Intel gives no numbers.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

src1 = xmm1.read()
for i in range(16):
    a = src2.q[i // 8]           # the matrix of byte i
    x = gf2p8inv(src1.b[i])      # the inverse; 0 for 0
    r = 0
    for j in range(8):           # bit j: row 7 - j
        row = a >> 8 * (7 - j) & 0xFF
        r |= popcount(row & x) % 2 << j
    xmm1.b[i] = r ^ imm8
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to GF2P8AFFINEINVQB, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More GFNI instructions

• GF2P8AFFINEQB
• GF2P8MULB
• VGF2P8AFFINEINVQB
• VGF2P8AFFINEQB
• VGF2P8MULB