Can VCLMULH.VV always use a v0.t mask?
It can use v0.t; omitting it gives vm=1. With vm=0, v0 is the EEW=1 mask, so a normal data source or destination cannot also reuse v0; that encoding is reserved.
VCLMULH.VV
RISC-V VCLMULH.VV Instruction Details
Instruction ManualV-typeVector carry-less multiply high: GF(2) polynomial multiply returning high SEW bits
Instruction Syntax
vclmulh.vv vd, vs2, vs1, vm
vd, vs2 and vs1 select v0–v31 with EEW=SEW and EMUL=LMUL. Optional v0.t means vm=0; omission means vm=1. No immediate operand.
32-bit OP-V: funct6=001101, vm[25], vs2[24:20], vs1[19:15], funct3=010, vd[11:7], opcode=1010111.
Zvbc depends on Zve64x; only SEW=64 is defined, and other SEWs are reserved. Return the high 64 bits (127:64) of the GF(2) carry-less product, combining partial products with XOR and no integer carries.
Enable vector state and use a legal supported vtype. Same-width sources/destination may overlap, reading original source values; LMUL>1 groups must be aligned. A masked destination cannot overlap v0; v0 cannot supply both SEW data and an EEW=1 mask.
Process mask-enabled elements where vstart≤i<vl. Prestart elements are undisturbed; inactive/tail elements follow vma/vta and may retain values or become all ones. vstart≥vl (including vl=0) changes no destination. Success resets vstart; implementations may reject unsupported nonzero vstart.
ZvbcVector CryptoBit Manipulation
Instruction Behavior
vclmulh.vv is the Zvbc vector carry-less multiply-high instruction. It polynomial-multiplies vs2[i] and vs1[i] over GF(2) and returns bits 127:64 of the 128-bit product; vclmul.vv returns bits 63:0 of that product. It is defined only when SEW=64; other SEW encodings are reserved.
VCLMULH.VV Decode & Execute Animation
This bounded model shows only lane 0 ISA-visible state; it does not model a pipeline, a cryptographic protocol, or unspecified inactive/tail values.
Execution context: enable the listed extension and vector state, use a legal supported vtype, LMUL=1 and VLEN≥64×SEW. Only lane 0 is expanded; vl=32/64 does not replicate it to other elements. SEW=64 requires Zve64x. Nonzero vstart assumes implementation support; otherwise an illegal-instruction exception is permitted.
Bounded execution context
32-bit OP-V encoding fields
31..26
funct6
001101
25
vm
1
24..20
vs2
01000
19..15
vs1
01100
14..12
funct3
010
11..7
vd
00100
6..0
OP-V
1010111
Execution data path
funct6=001101, funct3=010, Zvbc
v4[0] <- pending
Quick Understanding & Search Notes
vclmulh.vv is the Zvbc vector carry-less multiply-high instruction. It polynomial-multiplies vs2[i] and vs1[i] over GF(2) and returns bits 127:64 of the 128-bit product; vclmul.vv returns bits 63:0 of that product. It is defined only when SEW=64; other SEW encodings are reserved.
Returns the high SEW bits of the 2*SEW carry-less product; SEW=64.
Zvbc depends on Zve64x. Only SEW=64 is defined; other SEW encodings are reserved.
Process only mask-enabled elements where vstart≤i<vl. When vstart≥vl (including vl=0), no destination elements update; successful completion resets vstart.
Vector Execution Context
vd, vs2 and vs1 select v0–v31 with EEW=SEW and EMUL=LMUL. Optional v0.t means vm=0; omission means vm=1. No immediate operand.
32-bit OP-V: funct6=001101, vm[25], vs2[24:20], vs1[19:15], funct3=010, vd[11:7], opcode=1010111.
Zvbc depends on Zve64x; only SEW=64 is defined, and other SEWs are reserved. Return the high 64 bits (127:64) of the GF(2) carry-less product, combining partial products with XOR and no integer carries.
Enable vector state and use a legal supported vtype. Same-width sources/destination may overlap, reading original source values; LMUL>1 groups must be aligned. A masked destination cannot overlap v0; v0 cannot supply both SEW data and an EEW=1 mask.
Process mask-enabled elements where vstart≤i<vl. Prestart elements are undisturbed; inactive/tail elements follow vma/vta and may retain values or become all ones. vstart≥vl (including vl=0) changes no destination. Success resets vstart; implementations may reject unsupported nonzero vstart.
Common Usage Scenarios
Per-element bit operation example
With the listed extension and vector state enabled, legal vtype, LMUL=1, VLEN≥128, vl=1, vstart=0 and no mask: SEW=64, v8[0]=0x8000000000000000, v12[0]=0x2: (x^63 × x)[127:64] = 0x1, written to v4[0].
Pre-Use Checklist
Syntax Check
- vd, vs2 and vs1 select v0–v31 with EEW=SEW and EMUL=LMUL. Optional v0.t means vm=0; omission means vm=1. No immediate operand.
- 32-bit OP-V: funct6=001101, vm[25], vs2[24:20], vs1[19:15], funct3=010, vd[11:7], opcode=1010111.
Semantic Check
- Zvbc depends on Zve64x; only SEW=64 is defined, and other SEWs are reserved. Return the high 64 bits (127:64) of the GF(2) carry-less product, combining partial products with XOR and no integer carries.
- Enable vector state and use a legal supported vtype. Same-width sources/destination may overlap, reading original source values; LMUL>1 groups must be aligned. A masked destination cannot overlap v0; v0 cannot supply both SEW data and an EEW=1 mask.
- Process mask-enabled elements where vstart≤i<vl. Prestart elements are undisturbed; inactive/tail elements follow vma/vta and may retain values or become all ones. vstart≥vl (including vl=0) changes no destination. Success resets vstart; implementations may reject unsupported nonzero vstart.
Pitfalls / Common Confusions
Returns high SEW bits; pair with vclmul.vv for full 128-bit product.
SEW=64. Used in GCM/GHASH authenticated encryption.
FAQ
What determines the element width for VCLMULH.VV?
Zvbc depends on Zve64x. Only SEW=64 is defined; other SEW encodings are reserved.