Vector AES (Zvkned) and the start of the bitmanip set (Zvbb/Zvkb) — each AES instruction advancing one round across every 128-bit element group in the vector at once.
| Operation | In | |
|---|---|---|
| vaesem.[vv,vs] / vaesef.[vv,vs] | Forward AES middle / final round on each 128-bit element group. .vv uses a per-group key; .vs broadcasts ONE key group to all blocks. | Zvkned |
| vaesdm.[vv,vs] / vaesdf.[vv,vs] | Inverse AES middle / final round (decryption). | Zvkned |
| vaesz.vs | AddRoundKey only (XOR the round key, no SBox/MixColumns) — the pre-round whitening step. | Zvkned |
| vaeskf1.vi / vaeskf2.vi | AES key expansion with a round-number immediate (kf1 for AES-128, kf2 for AES-256’s second word). | Zvkned |
| vandn.[vv,vx] | Lane-wise AND with inverted operand. | Zvbb / Zvkb |
| vbrev.v / vbrev8.v | Per-element full bit-reverse / bit-reverse-within-bytes (GHASH reflection). | Zvbb (brev8 also Zvkb) |
| vclz.v / vctz.v / vcpop.v | Per-element count-leading-zeros / trailing-zeros / population-count — the Zbb operations, lane-wise. | Zvbb |
Hardware Designer Notes
Vector AES is the throughput centerpiece: at VLEN=512 you encrypt four AES blocks per round instruction, ~40 GB/s-class AES-GCM on a server core. The area is N copies of the u32 SBox datapath — the design question is how many lane groups you can afford to feed.
Minimal Linux-boot hart MUST
- Replicate the AES round datapath (SBox + ShiftRows + MixColumns + key XOR) per 128-bit lane group, all lanes data-independent in latency
- Implement .vs key broadcast (read one element group, apply to all) and .vv per-group keys
- Share the SBox array with your scalar Zknd/Zkne if both are present
MAY simplify / trap-and-emulate
- Time-multiplex fewer physical SBoxes across lane groups if area-constrained — accepting lower throughput, keeping latency constant
- Implement Zvkb (the crypto subset) without full Zvbb on a crypto-focused core
Check yourself — vector AES & bitmanip
1.vaesem.vs vs vaesem.vv — what's the difference and which does CTR-mode AES use?
2.What does vaesz.vs do, and why is it separate from the round instructions?
3.vbrev.v, vclz.v, vctz.v, vcpop.v — what are these in the vector bitmanip set?