[reaperhulk]

ARMv7's bitsliced SM4 S-box materializes 13 inversions while evaluating its Boolean circuit. Carry selected intermediates complemented and use OR gates through De Morgan's law, leaving nine explicit inversions. Reorder and allocate the equivalent circuit to reduce the generated S-box from 205 to 199 ARM instructions. The core is shared by ECB and every mode, including serial CBC/CFB encryption and OFB.

The existing exhaustive kernel proof checks the generated instructions against all 256 S-box inputs. All functional, constant-time, ABI and memory-frame proofs remain intact. A small SM4 allocator extension replaces selected AND gates with OR gates; its output is explicitly written out and checked against the compiler, and the instructions themselves are verified. No specification or TCB changes, lookup tables, or new ISA requirements.

Validation: full Lean build (22450 jobs), scoped emitter generation/audits and generated-code checks for all five SM4 registrations, public-import checks, static checks, all 19 SM4 integration tests, ARM/Thumb assembly compilation, Rustfmt and ARM Clippy. Native ARM/Thumb benchmark passed, paired against 766b22d169ef8dbeed285e031117efa29eeb2d1d on Neoverse N2. Every measured mode and size improved by 1.3–1.7%.

16 KiB timings in microseconds (lower is better):

Operation	ARM parent	ARM new	OpenSSL	Thumb parent	Thumb new	OpenSSL
ECB encryption	105.66	103.84	119.09	105.79	103.97	119.04
ECB decryption	105.68	103.86	118.60	105.82	104.05	118.63
CTR	108.12	106.28	133.67	108.38	106.75	133.69
CBC encryption	997.93	983.46	129.25	~1010	993.73	129.18
CFB encryption	997.98	983.48	128.97	~1010	994.02	129.00
OFB	997.29	982.61	127.36	~1010	993.41	127.34

The serial modes remain substantially slower than OpenSSL. The first comparison predates #3033/#3036/#3037. After those merged, this PR was rebased and regenerated for their inlined cipher cores; the new comparison below covers those changed implementations. This PR is now stacked on #3034, which batches CBC decryption; the generated code includes both CBC improvements.

Full CI passed, including native ARM/Thumb tests, Lean, emitter audits and static checks.

Post-rebase CFB/OFB benchmark, paired against main 7755b984f60deb7a4f27e6e72458b400bb580ef0. Only CFB/OFB ran: they gained newly generated inlined S-box code after their parent implementations merged. ECB/CTR code and its earlier measurements are unchanged.

16 KiB timings in microseconds:

Operation	ARM parent	ARM new	OpenSSL	Thumb parent	Thumb new	OpenSSL
CFB decryption	106.42	104.62	122.76	106.59	104.80	122.77
CFB encryption	824.45	809.81	129.08	824.86	809.98	128.98
OFB	823.71	809.24	127.45	824.44	809.60	127.35

The new inlined implementations improve by 1.7–1.8% at 16 KiB; the serial gap remains about 6.3 times OpenSSL. Full post-rebase Lean build (22428 jobs), scoped emitter audits/check, ARM/Thumb assembly compilation, Rustfmt and ARM Clippy pass. Updated full CI passed.

Final integration: regenerated both CBC directions after #3040 merged and #3034 was restacked on it. Full Lean build (22450 jobs), all five SM4 emitter/audit checks, ARM/Thumb compilation, all 19 SM4 tests, public-import checks, Rustfmt and ARM Clippy pass. CBC-only comparison against the exact #3034 parent 634f60aaebaf7d9d45a452f7980653692b5e3e08 passed on both ARM and Thumb. Updated full CI passed, including Lean, emitter audits/checks, ARM/Thumb tests, static checks and coverage. Earlier ECB/CTR/CFB/OFB code and measurements are unchanged.

Final combined CBC timings at 16 KiB, in microseconds:

Operation	ARM parent	ARM new	OpenSSL	Thumb parent	Thumb new	OpenSSL
CBC decryption	107.37	105.52	121.00	108.39	106.36	123.48
CBC encryption	824.14	809.26	129.22	824.16	809.73	129.23

All measured CBC sizes improved by 1.4–1.9%. CBC decryption also beats OpenSSL at 1 KiB (ARM 7.74 vs 8.47 µs; Thumb 7.79 vs 8.60 µs). At 64 bytes it remains slower (2.02 vs 1.42/1.44 µs); serial CBC encryption remains about 6.3 times slower at 16 KiB.