vsha512rnds2

SHA512 Rounds 2

VSHA512RNDS2 ymm1, ymm2, xmm3

SHA512 2 rounds calculation (AVX512).

Details

Executes two rounds of SHA-512 compression function, processing a 256-bit working variable vector (ymm1) using a 256-bit state operand (ymm2) and round constants from a 128-bit XMM register. This instruction performs the core iterative hash compression and does not modify EFLAGS.

Pseudocode Operation

A_B[0..1] ← ymm1[128*i..128*i+127] for i in 0 to 1
C_D_E_F_G_H[0..3] ← ymm2[64*i..64*i+63] for i in 0 to 3
RK[0..1] ← xmm3[64*i..64*i+63] for i in 0 to 1
for round in 0 to 1:
  temp ← sha512_compress_round(A_B, C_D_E_F_G_H, RK[round])
  A_B, C_D_E_F_G_H ← temp
ymm1[256 bits] ← A_B[0..1]

Example

VSHA512RNDS2 ymm1, ymm2, xmm3

Encoding

Binary Layout

Format EVEX

Opcode VEX.256.F2.0F38.W0 CB 11:rrr:bbb

Extension SHA512

Operands

dest
256-bit YMM AVX register
src1
256-bit YMM AVX register
src2
128-bit XMM SIMD register

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
VEX.256.F2.0F38.W0 CB 11:rrr:bbb	VSHA512RNDS2 ymm1, ymm2, xmm3	A	V/V	AVX SHA512	Perform 2 rounds of SHA512 operation using an initial SHA512 state (C,D,G,H) from ymm1, an initial SHA512 state (A,B,E,F) from ymm2, and a pre-computed sum of the next 2 round message qwords and the corresponding round constants from xmm3, storing the updated SHA512 state (A,B,E,F) result in ymm1.

Instruction Operand Encoding

Op/En	Tuple Type	Operand 1	Operand 2	Operand 3	Operand 4
A	N/A	ModRM:reg (r, w)	VEX.vvvv (r)	ModRM:r/m (r)	N/A

Description

The VSHA512RNDS2 instruction performs two rounds of SHA512 operation using initial SHA512 state (C,D,G,H) from the first operand, an initial SHA512 state (A,B,E,F) from the second operand, and a pre-computed sum of the next two round message qwords and the corresponding round constants from the third operand (only the two lower qwords of the third operand). The updated SHA512 state (A,B,E,F) is written to the first operand, and the second operand can be used as the updated state (C,D,G,H) in later rounds. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf for more information on the SHA512 standard.

Operation

define ROR64(qword, n):
count := n % 64
dest := (qword >> count) | (qword << (64-count))
return dest

define SHR64(qword, n):
return qword >> n

define cap_sigma0(qword):
return ROR64(qword,28) ^ ROR64(qword, 34) ^ ROR64(qword, 39)

define cap_sigma1(qword):
return ROR64(qword,14) ^ ROR64(qword, 18) ^ ROR64(qword, 41)

define MAJ(a,b,c):
return (a & b) ^ (a & c) ^ (b & c)

define CH(e,f,g):
return (e & f) ^ (g & ~e)





VSHA512RNDS2—Perform Two Rounds of SHA512 Operation                                                                                 Vol. 2C 5-748
VSHA512RNDS2 SRCDEST, SRC1, SRC2
A[0] := SRC1.qword[3]
B[0] := SRC1.qword[2]
C[0] := SRCDEST.qword[3]
D[0] := SRCDEST.qword[2]
E[0] := SRC1.qword[1]
F[0] := SRC1.qword[0]
G[0] := SRCDEST.qword[1]
H[0] := SRCDEST.qword[0]
WK[0]:= SRC2.qword[0]
WK[1]:= SRC2.qword[1]

FOR i in 0..1:
A[i+1] := CH(E[i], F[i], G[i]) +
cap_sigma1(E[i]) + WK[i] + H[i] +
MAJ(A[i], B[i], C[i]) +
cap_sigma0(A[i])
B[i+1] := A[i]
C[i+1] := B[i]
D[i+1] := C[i]
E[i+1] := CH(E[i], F[i], G[i]) +
cap_sigma1(E[i]) + WK[i] + H[i] + D[i]
F[i+1] := E[i]
G[i+1] := F[i]
H[i+1] := G[i]

SRCDEST.qword[3] = A[2]
SRCDEST.qword[2] = B[2]
SRCDEST.qword[1] = E[2]
SRCDEST.qword[0] = F[2]

Intel C/C++ Compiler Intrinsic Equivalent

VSHA512RNDS2 __m256i _mm256_sha512rnds2_epi64 (__m256i __A, __m256i __B, __m128i __C);

Flags Affected

None.

Exceptions

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-23, “Type 6 Class Exception Conditions.” VSHA512RNDS2—Perform Two Rounds of SHA512 Operation Vol. 2C 5-749