The last two reference instructions, closing §33.3, plus §33.4’s framing of the crypto-vector instruction category.
| Operation | In | |
|---|---|---|
| vsm4r.[vv,vs] | SM4 cipher round: SBox + the L linear layer + round-key XOR, per 128-bit element group. .vv per-group key, .vs broadcast key. | Zvksed |
| vwsll.[vv,vx,vi] | Widening shift-left: SEW source → 2·SEW destination, no bits lost. Bitmanip and wide-precision arithmetic helper. | Zvbb |
Hardware Designer Notes
That completes the vector-crypto instruction reference. The remaining pages (bitmanip/clmul detail and the Sail model) formalize the bit-manipulation semantics and pin every instruction’s exact behavior — the same differential-testing discipline the scalar crypto chapter closed with.
Minimal Linux-boot hart MUST
- vsm4r: the SM4 round (SBox + L + key XOR) per element group, .vv/.vs key source, data-independent latency
- vwsll: per-lane widening shifter, constant-time under Zvkt
- Verify the element-group constraints (vl, vstart EGS-multiples) hold across every crypto instruction
MAY simplify / trap-and-emulate
- Share SM4/AES round datapaths’ structure (byte-select, SBox, linear layer, key XOR) with direction/algorithm muxing
Check yourself — SM4 round & widening shift
1.vsm4r.[vv,vs] has both .vv and .vs forms. What does the .vs form enable?
2.vwsll (vector widening shift-left) — what makes it 'widening' and why is it in the crypto bitmanip set?
2 questions