VSHA512MSG1

VSHA512MSG1 starts one step of SHA-512’s message schedule, four quadwords at a time, as SHA256MSG1 does for SHA-256 with dwords. FIPS 180-4 extends a block’s 16 message words to 80, each new one as

W[t] = sigma1(W[t-2]) + W[t-7] + sigma0(W[t-15]) + W[t-16]

where, for SHA-512, sigma0(x) is the XOR of x rotated right by 1, x rotated right by 8 and x shifted right by 7. VSHA512MSG1 adds the last two terms for four consecutive t. Its first operand, a YMM register, holds W[t-16] to W[t-13], qword 0 the oldest; qword 0 of its second operand, an XMM register, supplies W[t-12], the word beyond them that sigma0 needs. The four sums replace the first operand. Both operands are registers.

One step of the schedule#

With the last sixteen words in four YMM registers, oldest first, as m0 to m3, one step takes three parts:

• _mm256_sha512msg1_epi64(m0, _mm256_castsi256_si128(m1)) gives W[t-16] + sigma0(W[t-15]) for the four new words;
• W[t-7] to W[t-4] are qwords 1 to 3 of m2 and qword 0 of m3, gathered with a VPBLENDD and a VPERMQ and added with VPADDQ;
• VSHA512MSG2, last, adds the sigma1 terms.

GCC 14 and Clang 23 at -O2 (-mavx2 -msha512) compile this to those five instructions, GCC 14 with a VMOVDQA more. Where SHA-256 uses PALIGNR, the words here cross the 128-bit halves of the register, which VPALIGNR does not. Sixteen such steps make the 64 words that the 40 VSHA512RNDS2s of a block consume after the first 16, once each is added to its round constant.

Zen 5 has no SHA512 extension (CPUID leaf 7, subleaf 1, EAX bit 0), and its recorded case raised #UD; Intel’s extensions reference names Arrow Lake S, Clearwater Forest and Diamond Rapids as the first processors with it.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] & 1:
    fault(UD)                    # CPUID: no SHA512
# ymm1: W[t-16] to W[t-13]; xmm2.q[0]:
# W[t-12]; each qword of the result is
# W[i-16] + sigma0(W[i-15]) for i from t
src1 = ymm1.read()
for i in range(4):
    if i < 3:
        w = src1.q[i + 1]  # W[i-15]
    else:
        w = xmm2.q[0]
    ymm1.q[i] = src1.q[i] + sigma0(w, 64)
# ymm1 is zeroed from bit 256 up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

avx-type-6

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSHA512MSG1, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA512 instructions

• VSHA512MSG2
• VSHA512RNDS2