What register width does SHA256SUM0 use?
Zknh RV32/RV64: transform X(rs1)[31:0]. RV64 sign-extends the 32-bit result into rd. The upper source word is ignored.
SHA256SUM0
RISC-V SHA256SUM0 Instruction Details
Instruction ManualSHA2 OP-IMM fixed-selector fieldsSHA-256 Σ0: ror32(x,2) ^ ror32(x,13) ^ ror32(x,22)
Instruction Syntax
sha256sum0 rd, rs1
Syntax is sha256sum0 rd, rs1, with only two integer-register operands selecting x0–x31 or ABI names.
32-bit OP-IMM encoding: bits 31..20=000100000000, funct3=001, opcode=0010011; there is no assembly immediate.
RV32/RV64 Zknh (also included in Zkn/Zk); transform only the low 32 source bits and sign-extend the 32-bit result on RV64.
An x0 source is zero and writes to x0 are discarded; rd=rs1 reads the original source first. This instruction must have data-independent execution latency.
ZknhCrypto & Security
Instruction Behavior
sha256sum0 is the Zknh SHA-256 Σ0 transform: Σ0(x) = ror32(x,2) ^ ror32(x,13) ^ ror32(x,22). It is defined for RV32/RV64 with x = X(rs1)[31:0]. RV64 ignores the upper source word and sign-extends the 32-bit result into rd. These transforms also work for SHA2-224. Rotations stay within the input word width; >> is a zero-filling logical right shift.
SHA256SUM0 Decode And Execute Animation
Bounded teaching inputs execute the official SHA-256 fixed-width bit operations; this does not model a complete algorithm or microarchitecture.
rd
rs1
sha256sum0
,
Initially rd shares the source value when rd=rs1; otherwise the demo starts rd at 0. An rs1=x0 source always reads 0. SHA256SUM0 is defined in RV32/RV64; RV64 uses X(rs1)[31:0] and sign-extends the 32-bit result to XLEN.
fixed selector
source
fixed
destination
OP-IMM
31..20
000100000000
19..15
rs1=x11
14..12
001
11..7
rd=x10
6..0
0010011
Execution Data Path
inb
0x89ABCDEF
ror32(inb, 2)
0xE26AF37B
ror32(inb, 13)
0x6F7C4D5E
ror32(inb, 22)
0xAF37BE26
result
0x22210003
Architectural Result
a0(x10) = 0x00000000
This animation shows only official ISA fields and architectural state; it does not model a complete hash algorithm, pipeline, cache, or timing implementation.
Quick Understanding & Search Notes
sha256sum0 reads one integer source, applies the fixed SHA-256 Σ0 formula, then writes rd. The input word and transform result are 32 bits; RV64 ignores the upper source word and sign-extends the result to 64 bits.
The 32-bit instruction fixes bits 31..20 to 000100000000 (0x100), funct3=001 and opcode=0010011; the syntax has no immediate.
An x0 source is zero; rd=x0 discards writeback, and rd=rs1 reads the source before writing it.
This instruction must have data-independent execution latency; animation steps do not represent CPU cycles.
Common Usage Scenarios
SHA-256 Σ0 transform
RV32/RV64 Zknh, x11=1: sha256sum0 x10, x11 applies the fixed formula on this page and yields x10=0x40080400. RV64 sign-extends this 32-bit result; its top bit is zero in this example.
Pre-Use Checklist
Syntax Check
- Syntax is sha256sum0 rd, rs1, with only two integer-register operands selecting x0–x31 or ABI names.
- 32-bit OP-IMM encoding: bits 31..20=000100000000, funct3=001, opcode=0010011; there is no assembly immediate.
Semantic Check
- RV32/RV64 Zknh (also included in Zkn/Zk); transform only the low 32 source bits and sign-extend the 32-bit result on RV64.
- An x0 source is zero and writes to x0 are discarded; rd=rs1 reads the original source first. This instruction must have data-independent execution latency.
Pitfalls / Common Confusions
σ0/σ1 and Σ0/Σ1 use different fixed formulas; 0/1 do not select the low/high input half.
Rotations use the fixed word width; a >> term is logical and does not replicate the sign bit.
RV64 sign-extends the result rather than zero-extending it; upper source bits are ignored.
FAQ
Is the fixed selector an immediate operand?
No. The syntax is sha256sum0 rd, rs1. Bits 31..20 select the transform; there is no assembly immediate.