RVOPcode
Home/Instructions/Vector AES Final-Round Encryption (Scalar Key)
VAESEF.VS

RISC-V VAESEF.VS Instruction Details

Instruction ManualOP-VE vector-scalar form

Vector AES final-round encryption using one scalar 128-bit round-key element group from vs2 for all state groups.

Instruction Syntax

vaesef.vs vd, vs2

vd supplies the old state and receives the new state; vs2 supplies round keys, both using vector registers v0–v31. There is no third source, immediate or v0.t mask operand; v0 is writable as data.

32-bit OP-VE: opcode=1110111, funct6=101001, vm=1, vs1=00011, funct3=010; vs1 is a fixed selector, not a source operand.

Requires enabled Zvkned and vector state, SEW=32, EGW=128, EGS=4. SubBytes → ShiftRows → round-key XOR (no MixColumns); all active state groups use vs2 element group 0; encodings where vd overlaps this scalar key group are reserved.

Process groups vstart/4 through vl/4−1. Encodings with vl or vstart not a multiple of 4, or other SEW values, are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even if vl=0. Execution latency must not depend on operand data.

ZvknedVector CryptoAES
Related Search Terms
vaesef.vs instructionRISC-V vaesef.vsvaesef.vs syntaxvaesef.vs encodingZvknedvector AES final-round encryption

Instruction Behavior

vaesef.vs performs AES final-round encryption. Each 128-bit element group in vd undergoes SubBytes, then ShiftRows, then XOR with the scalar 128-bit round-key element group from vs2; the new state is written back to vd. SEW must be 32.

VAESEF.VS Decode And Execute Animation

This bounded model shows only official ISA-visible fields, state, and conditions; it does not model a complete cryptographic protocol or microarchitecture.

vaesef.vs
fixed 101001 / vm=1 / vs1=00011vs2=v16vs1=00011funct3=010vd=v8opcode=1110111
Execution Data Path

state -> SubBytes, ShiftRows, then AddRoundKey -> vd

result pending

Quick Understanding & Search Notes

Vector AES final-round encryption using one scalar 128-bit round-key element group from vs2 for all state groups.

Performs AES final-round encryption: SubBytes, then ShiftRows, followed by XOR with the round key; it does not include MixColumns.
This element-group crypto instruction has no vm mask operand and executes at element-group granularity.
SEW=32, EGW=128, EGS=4; encodings with vl or vstart not a multiple of 4 are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even when vl=0.
The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture — Version 20260120, §§33.1.4–33.1.6, 33.3.3, 33.4, 33.6

Vector Execution Context

vd supplies the old state and receives the new state; vs2 supplies round keys, both using vector registers v0–v31. There is no third source, immediate or v0.t mask operand; v0 is writable as data.

32-bit OP-VE: opcode=1110111, funct6=101001, vm=1, vs1=00011, funct3=010; vs1 is a fixed selector, not a source operand.

Requires enabled Zvkned and vector state, SEW=32, EGW=128, EGS=4. SubBytes → ShiftRows → round-key XOR (no MixColumns); all active state groups use vs2 element group 0; encodings where vd overlaps this scalar key group are reserved.

Process groups vstart/4 through vl/4−1. Encodings with vl or vstart not a multiple of 4, or other SEW values, are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even if vl=0. Execution latency must not depend on operand data.

The RISC-V Instruction Set Manual, Volume I: Unprivileged Architecture — Version 20260120, Chapter 33

Common Usage Scenarios

Crypto & Security

With Zvkned and vector state enabled, VLEN=128, LMUL=1, SEW=32, vl=4, vstart=0, and zero state in v8 and zero key in v16, this round function writes v8=0x63636363636363636363636363636363, updating this active group only.

Vector Acceleration

With Zvkned and vector state enabled, VLEN=128, LMUL=1, SEW=32, vl=4, vstart=0, and zero state in v8 and zero key in v16, this round function writes v8=0x63636363636363636363636363636363, updating this active group only.

Pre-Use Checklist

Syntax Check
  • vd supplies the old state and receives the new state; vs2 supplies round keys, both using vector registers v0–v31. There is no third source, immediate or v0.t mask operand; v0 is writable as data.
  • 32-bit OP-VE: opcode=1110111, funct6=101001, vm=1, vs1=00011, funct3=010; vs1 is a fixed selector, not a source operand.
Semantic Check
  • Requires enabled Zvkned and vector state, SEW=32, EGW=128, EGS=4. SubBytes → ShiftRows → round-key XOR (no MixColumns); all active state groups use vs2 element group 0; encodings where vd overlaps this scalar key group are reserved.
  • Process groups vstart/4 through vl/4−1. Encodings with vl or vstart not a multiple of 4, or other SEW values, are reserved. LMUL*VLEN<128 raises an illegal-instruction exception even if vl=0. Execution latency must not depend on operand data.

Pitfalls / Common Confusions

No vm operand; this element-group crypto instruction is not maskable.
The .vs scalar operand is an element group in vector register vs2, not a GPR or FP register.
For .vs, vd must not overlap the vs2 scalar element group.
SEW=32, EGW=128, EGS=4; vl and vstart must be multiples of 4, and LMUL*VLEN must cover at least one 128-bit element group.

FAQ

Can VAESEF.VS always use a v0.t mask?

No. This element-group crypto instruction has no vm operand; ordinary RVV mask syntax should not be added to examples.

What determines the element width for VAESEF.VS?

This instruction fixes SEW=32 and executes on 128-bit element groups; encodings with other SEW values are reserved.