The packers, the byte/bit reversers, and the rotates — Zbkb’s core inventory.
| Semantics | Encoding | In | |
|---|---|---|---|
| pack rd, rs1, rs2 | rd = low half of rs2 ∥ low half of rs1 (rs1 lands in the low bits). | OP 0000100 / 100 | Zbkb |
| packh rd, rs1, rs2 | rd = zext(rs2[7:0] ∥ rs1[7:0]) — byte pairing for bit-sliced ciphers. | OP 0000100 / 111 | Zbkb |
| packw rd, rs1, rs2 (RV64) | Pack the low 16s into a 32-bit value, sign-extended. | OP-32 0000100 / 100 | Zbkb |
| rev8 rd, rs | Byte-reverse the whole register — htons/bswap, the endianness bridge. | OP-IMM funct12 0110100_11000 (RV32) / 0110101_11000 (RV64), funct3 101 | Zbb, Zbkb |
| brev8 rd, rs | Reverse the bits WITHIN each byte (bytes stay put) — crypto’s bit-reflection primitive; rev8 ∘ brev8 = full bit reversal. | OP-IMM funct12 0110100_00111 / 101 | Zbkb |
| rol rd, rs1, rs2 | Rotate left by rs2 mod XLEN — bits wrap instead of vanishing. | OP 0110000 / 001 | Zbb, Zbkb |
| rolw rd, rs1, rs2 (RV64) | 32-bit rotate on the low word, sign-extended. | OP-32 0110000 / 001 | Zbb, Zbkb |
| ror rd, rs1, rs2 | Rotate right by rs2 mod XLEN. Replaces the neg/sll/srl/or four-step. | OP 0110000 / 101 | Zbb, Zbkb |
Why crypto stakes a claim on this page: SHA-2’s Σ/σ functions are rotate-XOR chains, ChaCha’s quarter-round is add-rotate-xor, GCM needs bit reflection (brev8), and bit-sliced AES lives on pack/packh lane assembly. Zbkb regroups exactly these under a crypto-scoped name so a security core can take them without the rest of Zbb.
Hardware Designer Notes
Everything here is routing, not logic: the rotator reuses the shifter, the reversers are wire crossings, the packers are muxes. The cost center is decode area and the verification matrix across XLEN modes — budget test vectors for the w-form wrap behavior.
Minimal Linux-boot hart MUST
- Extend the existing barrel shifter with wrap-around muxes — one structure serves rol/ror/rori and the w-forms (32-bit mode masks and duplicates the wrap)
- rev8/brev8 are pure wiring permutations (zero gates, just routing congestion) — but distinct XLEN-specific funct12 decode points
MAY simplify / trap-and-emulate
- Fuse ror+xor pairs (SHA hot path) into one macro-op
- Treat pack as a shift-or through the existing datapath rather than dedicated concat wiring
Check yourself — pack, rev8, rotates
1.Why does rev8's funct12 differ between RV32 (0110100_11000) and RV64 (0110101_11000)?
2.What four-instruction idiom do rol/ror replace?
3.pack rd, rs1, rs2 does what, and why does crypto care?