Can VGMUL.VV always use a v0.t mask?
No. This element-group crypto instruction has no vm operand; ordinary RVV mask syntax should not be added to examples.
VGMUL.VV
RISC-V VGMUL.VV Instruction Details
Instruction ManualOP-VE OPMVV (funct6=101000, vm=1, vs1=10001, funct3=010)Vector GHASH multiply: multiply 128-bit element groups in vd by hash subkey groups in vs2.
Instruction Syntax
vgmul.vv vd, vs2
Syntax: vgmul.vv vd, vs2. Vector registers select v0–v31. vd is also an input; fixed vm=1 means no masking. No immediate operand.
32-bit OP-VE: funct6=101000, fixed vm=1[25], vs2[24:20], 10001[19:15] (fixed selector), funct3=010, vd[11:7], opcode=1110111.
Zvkg depends on Zve32x; SEW=32, EGW=128, EGS=4, with other SEWs reserved. Multiply inputs from vd and vs2, replacing vd. Reduce modulo x^128+x^7+x^2+x+1 and reverse bits within each input/output byte for GHASH ordering. Execution latency must be data-independent.
vl and vstart must be multiples of 4; violations are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even at vl=0. Enable vector state with a legal supported vtype. Same-width sources/destination may overlap, reading original values; equal registers supply equal inputs. LMUL>1 groups must be aligned.
Only active body elements are processed. Prestart is undisturbed; inactive/tail follow vma/vta. vstart≥vl (including vl=0) changes no destination elements; successful execution resets vstart. Unsupported nonzero vstart may be rejected by the implementation.
ZvkgVector CryptoGCM/GHASH
Instruction Behavior
vgmul.vv performs a GHASH field multiply over 128-bit element groups with SEW=32. It reads one operand from vd and the other from vs2, then writes the product back to vd.
VGMUL.VV Decode & Execute Animation
This bounded model shows ISA-visible state for one 128-bit element group; it does not model a pipeline, cryptographic protocol, or unspecified implementation detail.
Execution context: enable Zvkg and vector state with a legal supported vtype; LMUL=1, VLEN≥256 in the normal branch. Only group 0 is expanded (low 128 bits, element 0 in the low 32 bits). The insufficient-capacity branch represents LMUL*VLEN<128. Nonzero vstart assumes implementation support.
Bounded execution context
32-bit OP-VE encoding fields
31..26
funct6
101000
25
vm
1
24..20
vs2
01000
19..15
vs1 fixed
10001
14..12
funct3
010
11..7
vd
00100
6..0
OP-VE
1110111
Execution data path
funct6=101000, funct3=010, Zvkg
v4[0..3] <- pending
Quick Understanding & Search Notes
Reads the old vd value and multiplies it by vs2 in the GHASH field, replacing vd with the product.
Performs GHASH GF(2^128) field multiplication over 128-bit element groups with SEW=32.
This element-group crypto instruction has no vm mask operand and executes at element-group granularity.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must hold at least one element group.
Field multiplication reduces modulo x^128+x^7+x^2+x+1; input and output bits are reversed within each byte for GHASH ordering.
LMUL*VLEN<128 raises an illegal-instruction exception even when vl=0. With vl=0 or supported vstart≥vl, no destination elements change; successful execution resets vstart.
Vector Execution Context
Syntax: vgmul.vv vd, vs2. Vector registers select v0–v31. vd is also an input; fixed vm=1 means no masking. No immediate operand.
32-bit OP-VE: funct6=101000, fixed vm=1[25], vs2[24:20], 10001[19:15] (fixed selector), funct3=010, vd[11:7], opcode=1110111.
Zvkg depends on Zve32x; SEW=32, EGW=128, EGS=4, with other SEWs reserved. Multiply inputs from vd and vs2, replacing vd. Reduce modulo x^128+x^7+x^2+x+1 and reverse bits within each input/output byte for GHASH ordering. Execution latency must be data-independent.
vl and vstart must be multiples of 4; violations are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even at vl=0. Enable vector state with a legal supported vtype. Same-width sources/destination may overlap, reading original values; equal registers supply equal inputs. LMUL>1 groups must be aligned.
Only active body elements are processed. Prestart is undisturbed; inactive/tail follow vma/vta. vstart≥vl (including vl=0) changes no destination elements; successful execution resets vstart. Unsupported nonzero vstart may be rejected by the implementation.
Common Usage Scenarios
Crypto & Security
With the listed extension and vector state enabled, legal supported vtype, LMUL=1, VLEN=256, vstart=0 and no mask: SEW=32, vl=4, v4=0x0, v8=0x80: v4=0x0. Only the active group/element is shown; tu keeps tails undisturbed. Success resets vstart=0.
Vector Acceleration
With the listed extension and vector state enabled, legal supported vtype, LMUL=1, VLEN=256, vstart=0 and no mask: SEW=32, vl=4, v4=0x0, v8=0x80: v4=0x0. Only the active group/element is shown; tu keeps tails undisturbed. Success resets vstart=0.
Pre-Use Checklist
Syntax Check
- Syntax: vgmul.vv vd, vs2. Vector registers select v0–v31. vd is also an input; fixed vm=1 means no masking. No immediate operand.
- 32-bit OP-VE: funct6=101000, fixed vm=1[25], vs2[24:20], 10001[19:15] (fixed selector), funct3=010, vd[11:7], opcode=1110111.
Semantic Check
- Zvkg depends on Zve32x; SEW=32, EGW=128, EGS=4, with other SEWs reserved. Multiply inputs from vd and vs2, replacing vd. Reduce modulo x^128+x^7+x^2+x+1 and reverse bits within each input/output byte for GHASH ordering. Execution latency must be data-independent.
- vl and vstart must be multiples of 4; violations are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even at vl=0. Enable vector state with a legal supported vtype. Same-width sources/destination may overlap, reading original values; equal registers supply equal inputs. LMUL>1 groups must be aligned.
- Only active body elements are processed. Prestart is undisturbed; inactive/tail follow vma/vta. vstart≥vl (including vl=0) changes no destination elements; successful execution resets vstart. Unsupported nonzero vstart may be rejected by the implementation.
Pitfalls / Common Confusions
No vm operand; this element-group crypto instruction is not maskable.
Requires SEW=32 and EGW=128; vd and vs2 both supply 128-bit field-multiplication operands.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must be at least 128.
FAQ
What determines the element width for VGMUL.VV?
SEW must be 32, with EGW=128 and EGS=4; other SEW encodings are reserved.