| Operation | In | |
|---|---|---|
| vsha2ms.vv | SHA-2 message schedule: expand the 16-word block into 64 (SHA-256) or 80 (SHA-512) schedule words via the σ0/σ1 sigmas, feeding the compression instructions. | Zvknha / Zvknhb |
| vsm3c.vi | SM3 compression round: the immediate selects the round index (and thus the round-dependent constant Tj and rotation). Processes the 256-bit SM3 state element group. | Zvksh |
The message-schedule/compression split is universal across the hash
extensions: vsha2ms (or vsm3me, next page) expands the message
into round words; vsha2ch/cl (or vsm3c) consume them to update the
working state. It mirrors the scalar structure — where
sha256sig0/sig1 were the message-schedule sigmas
and sum0/sum1 the round Sigmas — but each vector instruction fuses a
whole step across multiple hash lanes.
Hardware Designer Notes
The hash schedule/compression datapaths are fixed rotate-XOR networks plus modular additions — cheap per lane, replicated for batched hashing throughput. SM4 (next page) is the one ShangMi extension with real SBox area.
Minimal Linux-boot hart MUST
- vsha2ms: the σ0/σ1 rotate-XOR-shift schedule datapath over message element groups, sized for 128-bit (SHA-256) or 256-bit (SHA-512) groups
- vsm3c: the SM3 round with immediate-selected constant Tj and the P0 permutation, over 256-bit groups
- Data-independent latency across all lanes
MAY simplify / trap-and-emulate
- Share the schedule sigma logic with the compression Sigma logic (both are fixed rotate-XOR trees)
- Reuse scalar SM3 P0/P1 datapath widened to vector lanes
Check yourself — SHA message schedule & SM3 compress
1.vsha2ms.vv does what in the SHA-2 pipeline?
2.vsm3c.vi (SM3 compression) takes an immediate. What does it encode?