SHA256RNDS2

SHA256RNDS2 runs two of the 64 rounds of SHA-256’s compression function (FIPS 180-4). The eight working variables, A to H, are split over two registers in an order of the instruction’s own, from dword 3 down: C, D, G and H in the first operand, A, B, E and F in the second. The third input is implicit: dwords 0 and 1 of XMM0 hold, for each of the two rounds, the message schedule word W[t] already added to the round constant K[t]. The result, the new A, B, E and F, replaces the first operand.

Alternating registers#

After two rounds the new C, D, G and H are simply the old A, B, E and F, which the second operand still holds. So a block takes 32 SHA256RNDS2s whose two state registers swap roles each time, with no moves between them. Each needs only two words of W + K in XMM0, so code adds four schedule words to four constants with one PADDD and brings the upper two down with PSHUFD for the second SHA256RNDS2.

Around the rounds#

• The schedule. FIPS 180-4 extends a block’s 16 words to 64. SHA256MSG1 and SHA256MSG2 compute four at a time, with the term W[t-7] added by software between them (PALIGNR and PADDD).
• The state. H0 to H7 in the standard’s order must be shuffled into the A, B, E, F and C, D, G, H layout before the first block and back after the last; between blocks only the final additions of the compression function remain, two PADDDs.
• XMM0 is fixed. The register allocator has to free it: for _mm_sha256rnds2_epu32(cdgh, abef, wk) (-msha) GCC 14 and Clang 23 at -O2 move wk into XMM0 first.

There is no VEX form; the legacy form keeps bits 128 and up of its destination. The SHA512 extension later added VSHA512RNDS2 in the same shape for SHA-512, as VEX-encoded instructions on YMM registers; Zen 5 has none of them. AMD’s Zen 5 guide lists SHA256RNDS2 as microcoded.

In the optimization guide

What the optimization guide says about SHA256RNDS2, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Silvermont to Goldmont Plus

• Vectors and cryptography: Goldmont is the first Atom core with the SHA extensions and RDSEED.

Tremont

• Vectors and cryptography: Intel improved the SHA extensions on Tremont: the round instructions run on port 20 and the message instructions on port 21, so the two can overlap.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

src1 = xmm1.read()
a = src2.d[3]              # the state: A,
b = src2.d[2]              # B, E, F in
c = src1.d[3]              # src2, C, D, G,
d = src1.d[2]              # H in xmm1
e = src2.d[1]
f = src2.d[0]
g = src1.d[1]
h = src1.d[0]
for i in range(2):
    t1 = h + sum1(e, 32) + choose(e, f, g)
    t1 += xmm0.d[i]        # W[t] + K[t]
    t2 = sum0(a, 32) + majority(a, b, c)
    h = g
    g = f
    f = e
    e = low(d + t1, 32)
    d = c
    c = b
    b = a
    a = low(t1 + t2, 32)
xmm1.d[3] = a              # the new A, B,
xmm1.d[2] = b              # E, F: C, D, G,
xmm1.d[1] = e              # H are src2's
xmm1.d[0] = f
# bits 128 and up of the register are unchanged

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

SSE_TYPE_4

Attributes

What else XED records about the forms. How to read.

Memory forms

aligned memory operand

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to SHA256RNDS2, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA instructions

• SHA1MSG1
• SHA1MSG2
• SHA1NEXTE
• SHA1RNDS4
• SHA256MSG1
• SHA256MSG2