PCLMULQDQ

PCLMULQDQ multiplies two 64-bit values without carries: the partial products are combined with XOR instead of addition, so each bit of the 128-bit result is the parity of the bit products that land on it. In other words, it multiplies two polynomials whose coefficients are bits, which is the arithmetic of GF(2^n) and of CRCs. 3 times 3 is 5 this way (11 times 11 is 101), and the top bit of the 128-bit product is always zero. Bit 0 of the immediate picks the low or high quadword of the first operand, bit 4 that of the second; the other bits are ignored. Zen 5 gave 64 one bits for 1 times all ones, and 80H for 10H times 8.

What it is used for#

The instruction does only the multiplication. Its users, chiefly GHASH in AES-GCM (with AESENC) and CRCs of any polynomial, follow it with a reduction modulo their polynomial, itself built from more carry-less multiplications and shifts. That is how a program computes a CRC whose polynomial CRC32 does not use, such as 04C11DB7H. A full 128 by 128-bit product takes four PCLMULQDQs, one per pair of halves, or three with Karatsuba’s method.

From C#

_mm_clmulepi64_si128(a, b, imm) needs -mpclmul or an -march that has it (westmere, haswell, znver1 and later; x86-64-v3 and v4 do not), and GCC 14 and Clang 23 at -O2 compile it to one PCLMULQDQ. Neither turns a carry-less multiplication written as a loop of shifts and XORs into the instruction. GNU as 2.44 and Clang’s assembler accept PCLMULLQLQDQ, PCLMULHQLQDQ, PCLMULLQHQDQ and PCLMULHQHQDQ for the immediates 00H, 01H, 10H and 11H, and objdump prints these names.

The other forms#

The legacy form needs a 16-byte-aligned memory operand and keeps bits 128 and up of the destination. VPCLMULQDQ with VEX writes a third register; its 128-bit form needs only PCLMULQDQ and AVX, while the 256-bit and EVEX forms, which make one product in every 128-bit lane with the same immediate, need the separate VPCLMULQDQ bit (CPUID leaf 7, ECX bit 10). Intel’s optimization manual expects up to four times the speed of the legacy form from them, for GHASH among others (Section 19.2).

Speed#

AMD’s Zen 5 guide lists PCLMULQDQ with a latency of four cycles and one every two cycles, and gives VPCLMULQDQ on 512 bits the same figures, for four products at once.

In the optimization guide

What the optimization guide says about PCLMULQDQ, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Haswell and Broadwell

• What Broadwell changed: PCLMULQDQ becomes a single micro-op with lower latency and higher throughput: LLVM’s models give it three micro-ops and 11 cycles on Haswell, one and 5 on Broadwell.

Silvermont to Goldmont Plus

• Front end: Silvermont decodes SSSE3 and SSE4 instructions that use xmm8 to xmm15 slowly, as they exceed 3 bytes of prefixes and escapes. sources differ
• Vectors and cryptography: AES rounds and carry-less multiplication are slow on Silvermont and faster with each Goldmont. sources differ

Tremont

• Vectors and cryptography: Tremont adds the Galois-field instructions, for ciphers, error correction and bit-matrix multiplication, which run on port 20, and speeds up pclmulqdq; Intel gives no numbers.

Zen and Zen+

• Vectors and floating point: Carry-less multiplication with PCLMULQDQ and the half-precision conversions VCVTPH2PS and VCVTPS2PH are microcoded, in AMD’s spreadsheet and in LLVM’s model.

Forms

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

x = xmm1.q[imm8 & 1]
y = src2.q[imm8 >> 4 & 1]
xmm1.write(clmul(x, y))
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to PCLMULQDQ, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.