riscv-crypto

That's 5 copies for SVE (had an error in first message - SVE allows up to 2048-bit vectors, not 1024), and 10 copies for RVV if you wanted to target all widths (though you'd probably be fine for a decade or a couple by targeting just 128 & 256-bit, and maybe 512-bit). Plus one more for a scalar fallback. And yes, it's not particularly large of a cost, other than it being an extremely pointless waste of space given that it is possible to have just one variant that covers them all. Though, it would become significantly more problematic if you wanted to target different extension groups too (which you would quite likely want to some extent) as those'd multiply with all the length targets - SVE vs SVE2 vs more future extensions, and on RVV there's just a lot (Zvfh & Zvfhmin for FP16, Zvbb for extra bitmanip stuff, many more here[1]; and poten

The bit manipulation [0] extension has been ratified for a while now and is part of the RVA22 application extension profile [1]. You can already buy SOCs that support it, e.g. vision five 2 and star64. Interestingly the risc-v vector extension [2] has it's own popcount instructions for vector registers/register masks. This is needed, because the scalable architecture doesn't guarantee that a vector mask can fit into a 64 bit register, so vector masks are stored in a single LMUL=1 register. This works really well, because with LMUL=8 and SEW=8 you get 100% utilization of the single LMUL=1 vector register. Another interesting thing is that the vector crypto extension will likely introduce a element wise popcount instruction [3]. [0] https://github.com/riscv/riscv-bitmanip [1] https://github.com/riscv/riscv-profiles [2] https://github.com/ri

Direct links to some of the latest specs: - Scalar crypto: https://github.com/riscv/riscv-crypto/releases - Vectors: https://github.com/riscv/riscv-v-spec/releases - Bitmanip: https://github.com/riscv/riscv-bitmanip/releases