VSHA512RNDS2

VSHA512RNDS2 runs two of the 80 rounds of SHA-512’s compression function (FIPS 180-4), the 64-bit counterpart of SHA256RNDS2 and laid out the same way, with each 32-bit word widened to a quadword in a YMM register. The first operand holds C, D, G and H, from qword 3 down, the second A, B, E and F, and the result, the new A, B, E and F, replaces the first. The words W[t] of the message schedule, each already added to its round constant K[t], come from qwords 0 and 1 of the third operand, an XMM register.

What changed from SHA-256#

• The word sums are an operand. SHA256RNDS2 reads them from XMM0 implicitly; VSHA512RNDS2 takes any XMM register, so nothing needs to be moved into XMM0 first. With four sums in a YMM register, the low two serve one VSHA512RNDS2 as they are and the high two the next, once moved down.
• The functions are SHA-512’s. The rotations of the two Sigma functions are by 28, 34 and 39 bits and by 14, 18 and 41; Ch and Maj are the same bitwise choices as in SHA-256.
• Registers only. All three operands are registers, and the destination is always 256 bits wide (VEX.256), so it has no upper half to keep.

As for SHA-256, two rounds turn the old A, B, E and F into the new C, D, G and H, so the two state registers swap roles after each instruction, 40 of them per 128-byte block. The schedule’s other 64 words, four at a time, come from VSHA512MSG1 and VSHA512MSG2; SHA-384 and the SHA-512/t variants use the same rounds with other initial values and a shorter result.

Where it runs#

The SHA512 extension (CPUID leaf 7, subleaf 1, EAX bit 0, along with AVX) arrived, by Intel’s extensions reference, with Arrow Lake S, Clearwater Forest and Diamond Rapids; Intel’s manual now documents it too. Zen 5 has none of it: its recorded case raised #UD. GCC 14 and Clang 23 provide _mm256_sha512rnds2_epi64(cdgh, abef, wk) with -msha512, and compile it to the one instruction at -O2; GCC 14 also enables it with -march=arrowlake-s but not -march=arrowlake.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] & 1:
    fault(UD)                    # CPUID: no SHA512
src1 = ymm1.read()
a = ymm2.q[3]              # the state: A,
b = ymm2.q[2]              # B, E, F in
c = src1.q[3]              # ymm2, C, D, G,
d = src1.q[2]              # H in ymm1
e = ymm2.q[1]
f = ymm2.q[0]
g = src1.q[1]
h = src1.q[0]
for i in range(2):
    t1 = h + sum1(e, 64) + choose(e, f, g)
    t1 += xmm3.q[i]        # W[t] + K[t]
    t2 = sum0(a, 64) + majority(a, b, c)
    h = g
    g = f
    f = e
    e = low(d + t1, 64)
    d = c
    c = b
    b = a
    a = low(t1 + t2, 64)
ymm1.q[3] = a              # the new A, B,
ymm1.q[2] = b              # E, F: C, D, G,
ymm1.q[1] = e              # H are ymm2's
ymm1.q[0] = f
# ymm1 is zeroed from bit 256 up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

avx-type-6

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSHA512RNDS2, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SHA512 instructions

• VSHA512MSG1
• VSHA512MSG2