Does AES64DS use floating-point or vector registers?
No. These scalar crypto extension instructions use integer X registers.
AES64DS
RISC-V AES64DS Instruction Details
Instruction ManualR-typeAES final-round decrypt (RV64): two 64-bit source registers represent the full state and produce half of the next-round output
Instruction Syntax
aes64ds rd, rs1, rs2
Syntax is rd, rs1, rs2; there is no immediate operand. Registers select x0–x31 or ABI names, with no rs3.
32-bit OP encoding: funct7=0011101, funct3=000, opcode=0110011.
RV64 only, requiring Zknd (also included in Zkn/Zk). rs1/rs2 supply the full 128-bit state; inverse ShiftRows, per-byte inverse S-box, without InvMixColumns, produce one 64-bit output half, without implicit round-key XOR.
x0 sources are zero and rd=x0 discards writeback; overlap reads pre-execution source values, and equal sources have equal values. This instruction must have data-independent execution latency.
ZkndCrypto & Security
Instruction Behavior
aes64ds is an RV64 AES decrypt final-round instruction in Zknd. It uses rs1 and rs2 as two 64-bit source registers representing the full 128-bit AES state, applies Inverse ShiftRows and inverse SubBytes, and writes half of the next-round output to rd. The full 128-bit output is normally produced by executing the official paired instruction with reversed source-register order; round-key XOR is not implicitly performed by this AES64 round instruction.
AES64DS Decode And Execute Animation
Bounded teaching inputs follow the local official ISA formulas; this does not model a complete AES round, round-key XOR, or microarchitecture.
aes64ds
Execution Context
XLEN is fixed at 64; rs1 and rs2 jointly represent the complete 128-bit state. A destination that is not a source starts at 0; sources are read before writeback.
fixed funct7
source state
source state
fixed
destination
OP
31..25
0011101
24..20
rs2=x12
19..15
rs1=x11
14..12
000
11..7
rd=x10
6..0
0110011
Execution Data Path
rs1[63:0]
0x0011223344556677
rs2[63:0]
0x8899AABBCCDDEEFF
aes_rv64_shiftrows_inv
0xCC99663300DDAA77
inverse SubBytes
0x27F9D36652C96202
Current Step
Decode AES64 fixed OP fields
funct7=0011101, funct3=000, and OP=0110011; this encoding is RV64-only.
encoding: 0x3AC58533
syntax: aes64ds a0(x10), a1(x11), a2(x12)
syntax: aes64ds a0(x10), a1(x11), a2(x12)
Architectural Result
a0(x10) = 0x0000000000000000
This animation shows only official ISA fields and architectural state, not a particular CPU pipeline, cache, or timing implementation.
Quick Understanding & Search Notes
AES64DS reads two 64-bit state halves from rs1/rs2, applies inverse ShiftRows and a per-byte inverse S-box, and writes one 64-bit result. Preserve the original sources and reverse their order for the other half; round-key XOR is separate.
RV64 instruction: rs1/rs2 together represent the full AES state, and the instruction produces half of the next-round output; compute the other half with reversed source-register order.
Operands use integer X registers; this instruction must have execution latency independent of its input data values.
This instruction is defined only for RV64 and requires Zknd; the final-round form omits InvMixColumns.
Common Usage Scenarios
Crypto & Security
RV64 Zknd, a1=0x0011223344556677 and a2=0x8899AABBCCDDEEFF: inverse ShiftRows gives 0xCC99663300DDAA77; per-byte inverse S-box gives a0=0x27F9D36652C96202. Preserve the original sources and reverse their order for the other half.
Data Protection
RV64 Zknd, a1=0x0011223344556677 and a2=0x8899AABBCCDDEEFF: inverse ShiftRows gives 0xCC99663300DDAA77; per-byte inverse S-box gives a0=0x27F9D36652C96202. Preserve the original sources and reverse their order for the other half.
Pre-Use Checklist
Syntax Check
- Syntax is rd, rs1, rs2; there is no immediate operand. Registers select x0–x31 or ABI names, with no rs3.
- 32-bit OP encoding: funct7=0011101, funct3=000, opcode=0110011.
Semantic Check
- RV64 only, requiring Zknd (also included in Zkn/Zk). rs1/rs2 supply the full 128-bit state; inverse ShiftRows, per-byte inverse S-box, without InvMixColumns, produce one 64-bit output half, without implicit round-key XOR.
- x0 sources are zero and rd=x0 discards writeback; overlap reads pre-execution source values, and equal sources have equal values. This instruction must have data-independent execution latency.
Pitfalls / Common Confusions
RV64 only; this AES64 form is not available on RV32.
rs1 and rs2 are the two 64-bit halves of the current AES state; do not describe rs2 as a fixed round-key operand.
Final-round forms do not include MixColumns/InvMixColumns.
One execution produces only half of the 128-bit state output; compute the other half using the official reversed source-register order.
FAQ
Is AES64DS a complete algorithm implementation?
No. It performs one architecturally defined AES half-state step; software still combines instructions and round keys in algorithm order.