Can VGHSH.VV always use a v0.t mask?
No. This element-group crypto instruction has no vm operand; ordinary RVV mask syntax should not be added to examples.
VGHSH.VV
RISC-V VGHSH.VV Instruction Details
Instruction ManualOP-VE OPMVV (funct6=101100, vm=1, funct3=010)Vector GHASH add-multiply: update partial hash in vd using ciphertext vs1 and hash subkey vs2.
Instruction Syntax
vghsh.vv vd, vs2, vs1
Syntax: vghsh.vv vd, vs2, vs1. Vector registers select v0–v31. vd is also an input; fixed vm=1 means no masking. No immediate operand.
32-bit OP-VE: funct6=101100, fixed vm=1[25], vs2[24:20], vs1[19:15], funct3=010, vd[11:7], opcode=1110111.
Zvkg depends on Zve32x; SEW=32, EGW=128, EGS=4, with other SEWs reserved. XOR old Y from vd with X from vs1, then multiply by H from vs2. Reduce modulo x^128+x^7+x^2+x+1 and reverse bits within each input/output byte for GHASH ordering. Execution latency must be data-independent.
vl and vstart must be multiples of 4; violations are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even at vl=0. Enable vector state with a legal supported vtype. Same-width sources/destination may overlap, reading original values; equal registers supply equal inputs. LMUL>1 groups must be aligned.
Only active body elements are processed. Prestart is undisturbed; inactive/tail follow vma/vta. vstart≥vl (including vl=0) changes no destination elements; successful execution resets vstart. Unsupported nonzero vstart may be rejected by the implementation.
ZvkgVector CryptoGCM/GHASH
Instruction Behavior
vghsh.vv performs a GHASH add-multiply over 128-bit element groups with SEW=32. It reads partial hash Y_i from vd, ciphertext X_i from vs1, hash subkey H from vs2, and writes updated partial hash Y_{i+1} to vd.
VGHSH.VV Decode & Execute Animation
This bounded model shows ISA-visible state for one 128-bit element group; it does not model a pipeline, cryptographic protocol, or unspecified implementation detail.
Execution context: enable Zvkg and vector state with a legal supported vtype; LMUL=1, VLEN≥256 in the normal branch. Only group 0 is expanded (low 128 bits, element 0 in the low 32 bits). The insufficient-capacity branch represents LMUL*VLEN<128. Nonzero vstart assumes implementation support.
Bounded execution context
32-bit OP-VE encoding fields
31..26
funct6
101100
25
vm
1
24..20
vs2
01000
19..15
vs1
01100
14..12
funct3
010
11..7
vd
00100
6..0
OP-VE
1110111
Execution data path
funct6=101100, funct3=010, Zvkg
v4[0..3] <- pending
Quick Understanding & Search Notes
Reads the old vd value and XORs it with vs1 before multiplying by vs2 in the GHASH field.
Performs the GHASH ((Y_i XOR X_i) · H) update over 128-bit element groups with SEW=32.
This element-group crypto instruction has no vm mask operand and executes at element-group granularity.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must hold at least one element group.
Field multiplication reduces modulo x^128+x^7+x^2+x+1; input and output bits are reversed within each byte for GHASH ordering.
LMUL*VLEN<128 raises an illegal-instruction exception even when vl=0. With vl=0 or supported vstart≥vl, no destination elements change; successful execution resets vstart.
Vector Execution Context
Syntax: vghsh.vv vd, vs2, vs1. Vector registers select v0–v31. vd is also an input; fixed vm=1 means no masking. No immediate operand.
32-bit OP-VE: funct6=101100, fixed vm=1[25], vs2[24:20], vs1[19:15], funct3=010, vd[11:7], opcode=1110111.
Zvkg depends on Zve32x; SEW=32, EGW=128, EGS=4, with other SEWs reserved. XOR old Y from vd with X from vs1, then multiply by H from vs2. Reduce modulo x^128+x^7+x^2+x+1 and reverse bits within each input/output byte for GHASH ordering. Execution latency must be data-independent.
vl and vstart must be multiples of 4; violations are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even at vl=0. Enable vector state with a legal supported vtype. Same-width sources/destination may overlap, reading original values; equal registers supply equal inputs. LMUL>1 groups must be aligned.
Only active body elements are processed. Prestart is undisturbed; inactive/tail follow vma/vta. vstart≥vl (including vl=0) changes no destination elements; successful execution resets vstart. Unsupported nonzero vstart may be rejected by the implementation.
Common Usage Scenarios
Crypto & Security
With the listed extension and vector state enabled, legal supported vtype, LMUL=1, VLEN=256, vstart=0 and no mask: SEW=32, vl=4, v4=0x0, v8=0x80, v12=0x80: v4=0x80. Only the active group/element is shown; tu keeps tails undisturbed. Success resets vstart=0.
Vector Acceleration
With the listed extension and vector state enabled, legal supported vtype, LMUL=1, VLEN=256, vstart=0 and no mask: SEW=32, vl=4, v4=0x0, v8=0x80, v12=0x80: v4=0x80. Only the active group/element is shown; tu keeps tails undisturbed. Success resets vstart=0.
Pre-Use Checklist
Syntax Check
- Syntax: vghsh.vv vd, vs2, vs1. Vector registers select v0–v31. vd is also an input; fixed vm=1 means no masking. No immediate operand.
- 32-bit OP-VE: funct6=101100, fixed vm=1[25], vs2[24:20], vs1[19:15], funct3=010, vd[11:7], opcode=1110111.
Semantic Check
- Zvkg depends on Zve32x; SEW=32, EGW=128, EGS=4, with other SEWs reserved. XOR old Y from vd with X from vs1, then multiply by H from vs2. Reduce modulo x^128+x^7+x^2+x+1 and reverse bits within each input/output byte for GHASH ordering. Execution latency must be data-independent.
- vl and vstart must be multiples of 4; violations are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even at vl=0. Enable vector state with a legal supported vtype. Same-width sources/destination may overlap, reading original values; equal registers supply equal inputs. LMUL>1 groups must be aligned.
- Only active body elements are processed. Prestart is undisturbed; inactive/tail follow vma/vta. vstart≥vl (including vl=0) changes no destination elements; successful execution resets vstart. Unsupported nonzero vstart may be rejected by the implementation.
Pitfalls / Common Confusions
No vm operand; this element-group crypto instruction is not maskable.
Requires SEW=32, EGW=128. Operates on 128-bit group granularity.
GHASH uses a special polynomial in GF(2^128), not ordinary integer arithmetic.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must be at least 128.
FAQ
What determines the element width for VGHSH.VV?
SEW must be 32, with EGW=128 and EGS=4; other SEW encodings are reserved.