The remaining shift-adds, the interleavers, and the crossbar permutations.
| Semantics | Encoding | In | |
|---|---|---|---|
| sh2add.uw / sh3add.uw (RV64) | rd = rs2 + (zext32(rs1) << 2/3) — unsigned-word indices into int/pointer arrays. | OP-32 0010000 / 100, 110 | Zba |
| sh3add rd, rs1, rs2 | rd = rs2 + (rs1 << 3) — doubleword/pointer array indexing. | OP 0010000 / 110 | Zba |
| slli.uw rd, rs1, shamt (RV64) | rd = zext32(rs1) << shamt — scales uint32 indices past ×8 without a separate zext.w. | OP-IMM-32 000010 + 6-bit shamt / 001 | Zba |
| unzip rd, rs (RV32 only) | Bit DE-interleave: even-position bits to the low half, odd to the high. | OP-IMM funct12 0000100_01111 / 101 | Zbkb |
| zip rd, rs (RV32 only) | Bit interleave: low half to even positions, high half to odd. | OP-IMM funct12 0000100_01111 / 001 | Zbkb |
| xnor rd, rs1, rs2 | rd = ~(rs1 ^ rs2) — completes the logical-with-negate trio. | OP 0100000 / 100 | Zbb, Zbkb |
| xperm8 rd, rs1, rs2 | Byte crossbar: each byte of rd = rs1’s byte selected by the corresponding byte of rs2 (out-of-range → 0). | OP 0010100 / 100 | Zbkx |
| xperm4 rd, rs1, rs2 | Nibble crossbar — a 16-entry, 4-bit in-register lookup table. The constant-time SBox. | OP 0010100 / 010 | Zbkx |
The xperm pair is the page’s headline: secret-index table lookups through memory leak the index via cache timing (the canonical AES attack); an in-register crossbar has no memory access to leak. Combined with Zkt’s data-independent-latency requirement, xperm turns S-box layers into constant-time register arithmetic.
Hardware Designer Notes
With this page the B-extension datapath is complete: adder legs (Zba), inverter reuse + scan trees + rotator (Zbb), one-hot decode (Zbs), and the optional crypto crossbar/clmul islands. The final page wraps up zext.h and the two stragglers.
Minimal Linux-boot hart MUST
- xperm4: sixteen 16:1 4-bit muxes; xperm8: eight 8:1 byte muxes with the out-of-bounds-to-zero leg — modest gates, wide routing
- zip/unzip (RV32): pure wire permutations sharing one funct12, funct3 selecting direction
MAY simplify / trap-and-emulate
- Take Zbkx only on crypto-targeted cores; nothing outside cipher kernels uses crossbars
- Fold slli.uw into the shifter’s existing zero-extend input mux
Check yourself — sh3add, slli.uw, xperm
1.What makes xperm4/xperm8 crypto's constant-time SBox mechanism?
2.Why does slli.uw exist when slli already shifts?
3.zip/unzip exist only on RV32. What do they do and why the asymmetry?