RVOPcode
Home/Instructions/VAESDF-VS
VAESDF.VS

RISC-V VAESDF.VS Instruction Details

Instruction ManualOP-VE vector-scalar form

Vector AES final-round decryption using one scalar 128-bit round-key element group from vs2 for all state groups.

Instruction Syntax

vaesdf.vs vd, vs2

vd supplies the old state and receives the new state; vs2 supplies 128-bit round-key groups. Operands are vector registers, with no v0.t or integer scalar source.

32-bit OP-VE: opcode=1110111, funct6=101001, vm=1, vs1=00001, funct3=010; the vs1 field is not a source operand.

Requires Zvkned, SEW=32, EGW=128, EGS=4. Apply InvShiftRows, InvSubBytes, then XOR vs2 element group 0; encodings where vd overlaps this scalar key group are reserved; the final round has no InvMixColumns.

vl and vstart must be multiples of 4, otherwise the encoding is reserved. LMUL*VLEN<128 raises an illegal-instruction exception even if vl=0; other SEW encodings are reserved.

ZvknedVector CryptoAES
Related Search Terms
vaesdf.vs instructionRISC-V vaesdf.vsvaesdf.vs syntaxvaesdf.vs encodingZvknedvector AES final-round decryption

Instruction Behavior

vaesdf.vs performs AES final-round decryption. Each 128-bit element group in vd is transformed by InvShiftRows followed by InvSubBytes, then XORed with the scalar 128-bit round-key element group from vs2; the new state is written back to vd. SEW must be 32.

VAESDF.VS Decode And Execute Animation

This bounded model shows only official ISA-visible fields, state, and conditions; it does not model a complete cryptographic protocol or microarchitecture.

vaesdf.vs
fixed 101001 / vm=1 / vs1=00001vs2=v16vs1=00001funct3=010vd=v8opcode=1110111
Execution Data Path

state -> InvShiftRows, InvSubBytes, then AddRoundKey -> vd

result pending

Quick Understanding & Search Notes

VAESDF.VS applies InvShiftRows and InvSubBytes to 128-bit state groups in vd, then XORs the scalar round-key group from vs2; SEW=32.

Performs AES final-round decryption: InvShiftRows and InvSubBytes followed by XOR with the round key; SEW must be 32 and the element group is 128 bits.
This element-group crypto instruction has no vm mask operand and executes at element-group granularity.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must hold at least one element group.
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture (20260120), 33.3.1; 33.1.4–33.1.5; 33.4The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture (20260120), Chapter 31: V

Vector Execution Context

vd supplies the old state and receives the new state; vs2 supplies 128-bit round-key groups. Operands are vector registers, with no v0.t or integer scalar source.

32-bit OP-VE: opcode=1110111, funct6=101001, vm=1, vs1=00001, funct3=010; the vs1 field is not a source operand.

Requires Zvkned, SEW=32, EGW=128, EGS=4. Apply InvShiftRows, InvSubBytes, then XOR vs2 element group 0; encodings where vd overlaps this scalar key group are reserved; the final round has no InvMixColumns.

vl and vstart must be multiples of 4, otherwise the encoding is reserved. LMUL*VLEN<128 raises an illegal-instruction exception even if vl=0; other SEW encodings are reserved.

The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture — Version 20260120, Chapter 33

Common Usage Scenarios

Crypto & Security

Zvkned, VLEN=128, LMUL=1, SEW=32, vl=4, vstart=0, with zero state in v8 and zero key in v16: success writes v8=0x52525252525252525252525252525252.

Vector Acceleration

Zvkned, VLEN=128, LMUL=1, SEW=32, vl=4, vstart=0, with zero state in v8 and zero key in v16: success writes v8=0x52525252525252525252525252525252.

Pre-Use Checklist

Syntax Check
  • vd supplies the old state and receives the new state; vs2 supplies 128-bit round-key groups. Operands are vector registers, with no v0.t or integer scalar source.
  • 32-bit OP-VE: opcode=1110111, funct6=101001, vm=1, vs1=00001, funct3=010; the vs1 field is not a source operand.
Semantic Check
  • Requires Zvkned, SEW=32, EGW=128, EGS=4. Apply InvShiftRows, InvSubBytes, then XOR vs2 element group 0; encodings where vd overlaps this scalar key group are reserved; the final round has no InvMixColumns.
  • vl and vstart must be multiples of 4, otherwise the encoding is reserved. LMUL*VLEN<128 raises an illegal-instruction exception even if vl=0; other SEW encodings are reserved.

Pitfalls / Common Confusions

No vm operand; this element-group crypto instruction is not maskable.
The .vs scalar operand is an element group in vector register vs2, not a GPR or FP register.
For .vs, vd must not overlap the vs2 scalar element group.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must cover at least one 128-bit element group.

FAQ

Can VAESDF.VS always use a v0.t mask?

No. This element-group crypto instruction has no vm operand; ordinary RVV mask syntax should not be added to examples.

What determines the element width for VAESDF.VS?

This instruction fixes SEW=32 and executes on 128-bit element groups; encodings with other SEW values are reserved.