GF2P8AFFINEQB

GF2P8AFFINEQB treats each byte as a vector of 8 bits, multiplies it by an 8-by-8 bit matrix and XORs the immediate into the result. Over GF(2), multiplying is AND and adding is XOR, so each result bit is the parity of the input byte ANDed with one row of the matrix. The matrix is a quadword of the second operand, shared by the 8 bytes of the first operand in the same position. Any function of a byte whose output bits are each an XOR of some input bits, plus a constant, is one such matrix: moving, copying, dropping and inverting bits all are.

Reading the matrix#

The rows run backwards: bit j of the result comes from byte 7 - j of the quadword, so the byte at the lowest address drives the top bit. The identity matrix is therefore 0102040810204080h, and 8040201008040201h reverses the bits of every byte. A case recorded on Zen 5 applied both to one register with an immediate of 80h, and got each byte back, then reversed, with its top bit flipped.

Shifts that x86 lacks#

x86 has no vector shift or rotate of bytes, and no bit reversal at all. With GFNI enabled (-mgfni, or a -march such as znver5 or icelake-server), Clang 23 at -O2 compiles a shift of a vector of bytes by a constant, left, logical or arithmetic right, a rotate by a constant, and a loop reversing the bits of each byte, to one GF2P8AFFINEQB each, with the matrix as a constant in memory. GCC 14 shifts words with PSLLW or PSRLW and masks off the bits that crossed into the neighbouring byte, and reverses bits with three rounds of shifts and masks.

Finite fields#

Intel’s optimization guide names Reed-Solomon codes and SM4 as uses, and computes SM4’s S-box with the 512-bit form followed by VGF2P8AFFINEINVQB, which inverts each byte in GF(2^8) before its own affine step (Section 19.3, Example 19-2). GF2P8MULB multiplies bytes in the same field.

This page is the legacy SSE form, which needs GFNI only; its memory operand must be aligned to 16 bytes, and bits 128 and up of the register are left alone. VGF2P8AFFINEQB has the VEX form and the EVEX form with masking and a broadcast matrix. AMD’s Zen 5 guide lists all of them as one macro-op with a latency of 3 cycles.

In the optimization guide

What the optimization guide says about GF2P8AFFINEQB, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Tremont

• Vectors and cryptography: Tremont adds the Galois-field instructions, for ciphers, error correction and bit-matrix multiplication, which run on port 20, and speeds up pclmulqdq; Intel gives no numbers.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

src1 = xmm1.read()
for i in range(16):
    a = src2.q[i // 8]           # the matrix of byte i
    x = src1.b[i]
    r = 0
    for j in range(8):           # bit j: row 7 - j
        row = a >> 8 * (7 - j) & 0xFF
        r |= popcount(row & x) % 2 << j
    xmm1.b[i] = r ^ imm8
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to GF2P8AFFINEQB, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More GFNI instructions

• GF2P8AFFINEINVQB
• GF2P8MULB
• VGF2P8AFFINEINVQB
• VGF2P8AFFINEQB
• VGF2P8MULB