VSHA512MSG2

VSHA512MSG2 finishes one step of SHA-512’s message schedule: it adds the sigma1 term of FIPS 180-4’s recurrence,

W[t] = sigma1(W[t-2]) + W[t-7] + sigma0(W[t-15]) + W[t-16]

to four partial sums, as SHA256MSG2 does for SHA-256. For SHA-512, sigma1(x) is the XOR of x rotated right by 19, x rotated right by 61 and x shifted right by 6. The first operand, a YMM register, holds W[t-16] + sigma0(W[t-15]) + W[t-7] for t to t+3, that is, the result of VSHA512MSG1 with the W[t-7] terms added by software. The second holds the last four words, W[t-4] to W[t-1]; only its qwords 2 and 3 are read. The four finished words replace the first operand.

Why it comes last#

W[t+2] needs sigma1(W[t]), and W[t+3] needs sigma1(W[t+1]): two of the four new words depend on the other two. VSHA512MSG2 works them out in order inside the instruction, which is why it is the last part of a step. The schedule for SHA-512 has 64 such words per block, in sixteen steps, against 48 in twelve for SHA-256; VSHA512MSG1’s page shows a whole step and what GCC 14 and Clang 23 make of it.

Both operands are registers, and the result is the whole YMM register. GCC 14 and Clang 23 provide _mm256_sha512msg2_epi64(sums, last4) with -msha512. Zen 5 has no SHA512 extension, and its recorded case raised #UD.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] & 1:
    fault(UD)                    # CPUID: no SHA512
# ymm1: W[i-16] + sigma0(W[i-15]) + W[i-7]
# for i from t to t + 3; ymm2: W[t-4] to
# W[t-1]; the result: W[t] to W[t+3]
src1 = ymm1.read()
u = ymm2.q[2]              # W[t-2]
v = ymm2.q[3]              # W[t-1]
for i in range(4):
    w = low(src1.q[i] + sigma1(u, 64), 64)
    ymm1.q[i] = w          # W[t+i]
    u = v
    v = w
# ymm1 is zeroed from bit 256 up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

avx-type-6

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSHA512MSG2, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA512 instructions

• VSHA512MSG1
• VSHA512RNDS2