VGF2P8MULB

VGF2P8MULB multiplies each byte of its first source by the byte in the same position of the second, in the finite field GF(2^8). A byte stands for a polynomial with coefficients 0 or 1, bit i for x^i; the bytes are multiplied as polynomials without carries, as PCLMULQDQ does for quadwords, and the product is reduced modulo x^8 + x^4 + x^3 + x + 1, 11Bh. So 2 times a byte shifts it left and, when bit 7 falls out, XORs in 1Bh. Every nonzero byte has an inverse: 53h times CAh is 01h.

Only the AES field#

The polynomial is fixed: it is the one AES uses, and the multiplications of AES’s MixColumns step and its inverse, by 2, 3, 9, 11, 13 and 14, are one instruction each. Codes that define GF(2^8) with another polynomial cannot use it directly; they need a change of basis, which VGF2P8AFFINEQB can do byte by byte. Multiplying by a constant does not need VGF2P8MULB either: it is linear over GF(2), so it is one VGF2P8AFFINEQB with the constant’s matrix, in any field. Intel’s optimization manual names Reed-Solomon codes and ciphers such as SM4 as the uses of the three GFNI instructions (Section 19.3).

In cases recorded on Zen 5, FFh times FFh gave 13h, 80h times 80h gave 9Ah, x^14 reduced, and 1 times any byte gave the byte back.

Three encodings#

GF2P8MULB is the SSE form, which needs GFNI only. VGF2P8MULB has VEX forms for xmm and ymm, GFNI with AVX, found also on processors without AVX-512 such as Alder Lake, and EVEX forms with masking up to zmm. There is no broadcast: the elements are bytes.

GCC 14 and Clang 23 at -O2 emit it only for the intrinsics, such as _mm512_gf2p8mul_epi8. A loop of the bitwise multiplication, shifting and XORing eight times, stays scalar in GCC for -march=znver5, and Clang vectorizes it with byte compares and adds instead; neither recognizes the doubling (a << 1) ^ ((a >> 7) * 0x1b).

AMD’s Zen 5 guide lists every form as one macro-op with a latency of 3 cycles, as for the affine instructions.

Forms

Latency and throughput

Data flow

Where the elements of the sources go, element 0 on the right; results that depend on a control value are drawn for an example. How to read.

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

for i in range(VL // 8):
    if k1[i]:  # 1 without a write mask
        a = zmm2.b[i]
        b = src3.b[i]
        zmm1.b[i] = gf2p8mul(a, b)
    elif zeroing:
        zmm1.b[i] = 0
    # else: zmm1.b[i] keeps its value
# zmm1 is zeroed from bit VL up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

VEX forms

avx-type-4

EVEX forms

AVX512-E4

Attributes

What else XED records about the forms. How to read.

EVEX forms

write masking

EVEX memory forms

memory fault suppression

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VGF2P8MULB, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More GFNI instructions

• GF2P8AFFINEINVQB
• GF2P8AFFINEQB
• GF2P8MULB
• VGF2P8AFFINEINVQB
• VGF2P8AFFINEQB

More AVX10.1 instructions

• VFPCLASSSH
• VFPCLASSSS
• VGATHERDPD
• VGATHERDPS
• VGATHERQPD
• VGATHERQPS
• VGETEXPPD
• VGETEXPPH
• VGETEXPPS
• VGETEXPSD
• VGETEXPSH
• VGETEXPSS
• VGETMANTPD
• VGETMANTPH
• VGETMANTPS
• VGETMANTSD
• VGETMANTSH
• VGETMANTSS
• VGF2P8AFFINEINVQB
• VGF2P8AFFINEQB
• VINSERTF32X4
• VINSERTF32X8
• VINSERTF64X2
• VINSERTF64X4
• VINSERTI32X4
• VINSERTI32X8
• VINSERTI64X2
• VINSERTI64X4
• VINSERTPS
• VMAXPD
• VMAXPH
• VMAXPS
• VMAXSD
• VMAXSH
• VMAXSS
• VMINPD
• VMINPH
• VMINPS
• VMINSD
• VMINSH

All 686 AVX10.1 instructions