33.3.1-4Vector Crypto IV: AES Round Instructions in Detail

Part III Linux boot: optional Vol. I (Unprivileged) pp. 494–501 · ~2 min read

The four AES round instructions (mapped on page II), now with their element-group operation. All share the shape: loop over element groups, transform the 128-bit state in vd, XOR a round key from vs2.

AES round instructions (EGW=128, EGS=4, SEW=32; vl and vstart are EGS-multiples)
Per-element-group operation
vaesef.[vv,vs]Forward FINAL round: SubBytes → ShiftRows → XOR round key. No MixColumns (final round).
vaesem.[vv,vs]Forward MIDDLE round: SubBytes → ShiftRows → MixColumns → XOR round key.
vaesdf.[vv,vs]Inverse FINAL round: InvShiftRows → InvSubBytes → XOR round key.
vaesdm.[vv,vs]Inverse MIDDLE round: InvShiftRows → InvSubBytes → InvMixColumns → XOR round key.
Dotted-underlined cells have explanations — click one.

The canonical operation (vaesdf.vv shown):

eg_len = vl/EGS;  eg_start = vstart/EGS
foreach i in eg_start .. eg_len-1:
    keyelem = (suffix == "vv") ? i : 0     # .vs broadcasts group 0
    state = get_velem(vd,  EGW=128, i)     # round state
    rkey  = get_velem(vs2, EGW=128, keyelem)
    vd[i] = (InvSubBytes(InvShiftRows(state))) ^ rkey

vd is read-modify-write: it holds the running AES state, so a software round loop issues the same instruction on the same vd once per round, vs2 supplying that round’s key. The .vs form’s documented vd/vs2 overlap exception exists precisely so the broadcast key group can sit anywhere.

Hardware Designer Notes

The datapath is the u32 AES round replicated per 128-bit lane group, with the round-key XOR fed from either per-group (.vv) or broadcast (.vs) reads. Throughput scales with lane groups; the round-loop control lives in software, keeping the hardware a clean combinational block.

Minimal Linux-boot hart MUST

  • Implement the element-group loop with the .vv/.vs key-source mux and the in-place vd state update
  • Data-independent latency across ALL element groups — no per-lane early-out
  • Honor the .vs vd/vs2 overlap allowance (an exception to the normal vector overlap reservations)

MAY simplify / trap-and-emulate

  • Share InvSubBytes/SubBytes SBox arrays between encrypt and decrypt and across lane groups
  • Fuse the round-loop instructions if your decoder recognizes the AES sequence

Check yourself — vector AES round detail

1.In vaesdf.vv the operation loops 'foreach i from vstart/EGS to vl/EGS'. What does each iteration process?

2.Why does vd serve as BOTH input (round state) and output (new state) in the AES round instructions?

2 questions