What register width does SHA512SIG0 use?
Zknh RV64 only: transform the full 64-bit X(rs1) and write the 64-bit result to rd.
SHA512SIG0
RISC-V SHA512SIG0 Instruction Details
Instruction ManualSHA2 OP-IMM fixed-selector fieldsSHA-512 σ0: ror64(x,1) ^ ror64(x,8) ^ (x >> 7)
Instruction Syntax
sha512sig0 rd, rs1
Syntax is sha512sig0 rd, rs1, with only two integer-register operands selecting x0–x31 or ABI names.
32-bit OP-IMM encoding: bits 31..20=000100000110, funct3=001, opcode=0010011; there is no assembly immediate.
RV64 Zknh only (also included in Zkn/Zk); fixed right rotations, logical right shift and XOR operate on the complete 64-bit source.
An x0 source is zero and writes to x0 are discarded; rd=rs1 reads the original source first. This instruction must have data-independent execution latency.
ZknhCrypto & Security
Instruction Behavior
sha512sig0 is the Zknh SHA-512 σ0 transform: σ0(x) = ror64(x,1) ^ ror64(x,8) ^ (x >> 7). It is RV64-only: x is the complete 64-bit X(rs1), and rd receives the 64-bit result. RV32 uses a sha512sig0l/sha512sig0h sequence for the full σ0 transform. Rotations stay within the input word width; >> is a zero-filling logical right shift.
SHA512SIG0 Decode And Execute Animation
Bounded teaching inputs execute the official SHA-512 fixed-width bit operations; this does not model a complete algorithm or microarchitecture.
rd
rs1
sha512sig0
,
Initially rd shares the source value when rd=rs1; otherwise the demo starts rd at 0. An rs1=x0 source always reads 0. SHA512SIG0 is defined only for RV64 and operates on the complete 64-bit X(rs1).
fixed selector
source
fixed
destination
OP-IMM
31..20
000100000110
19..15
rs1=x11
14..12
001
11..7
rd=x10
6..0
0010011
Execution Data Path
inb
0x0123456789ABCDEF
ror64(inb, 1)
0x8091A2B3C4D5E6F7
ror64(inb, 8)
0xEF0123456789ABCD
inb >> 7
0x0002468ACF13579B
result
0x6F92C77C6C4F1AA1
Architectural Result
a0(x10) = 0x0000000000000000
This animation shows only official ISA fields and architectural state; it does not model a complete hash algorithm, pipeline, cache, or timing implementation.
Quick Understanding & Search Notes
sha512sig0 reads one integer source, applies the fixed SHA-512 σ0 formula, then writes rd. It is RV64-only, with a 64-bit input and result.
The 32-bit instruction fixes bits 31..20 to 000100000110 (0x106), funct3=001 and opcode=0010011; the syntax has no immediate.
An x0 source is zero; rd=x0 discards writeback, and rd=rs1 reads the source before writing it.
This instruction must have data-independent execution latency; animation steps do not represent CPU cycles.
Common Usage Scenarios
SHA-512 σ0 transform
RV64 Zknh, x11=1: sha512sig0 x10, x11 applies the fixed formula on this page and yields x10=0x8100000000000000. The input and result are 64 bits.
Pre-Use Checklist
Syntax Check
- Syntax is sha512sig0 rd, rs1, with only two integer-register operands selecting x0–x31 or ABI names.
- 32-bit OP-IMM encoding: bits 31..20=000100000110, funct3=001, opcode=0010011; there is no assembly immediate.
Semantic Check
- RV64 Zknh only (also included in Zkn/Zk); fixed right rotations, logical right shift and XOR operate on the complete 64-bit source.
- An x0 source is zero and writes to x0 are discarded; rd=rs1 reads the original source first. This instruction must have data-independent execution latency.
Pitfalls / Common Confusions
σ0/σ1 and Σ0/Σ1 use different fixed formulas; 0/1 do not select the low/high input half.
Rotations use the fixed word width; a >> term is logical and does not replicate the sign bit.
RV64 only; do not apply the 32-bit SHA-256 formula to this 64-bit transform.
FAQ
Is the fixed selector an immediate operand?
No. The syntax is sha512sig0 rd, rs1. Bits 31..20 select the transform; there is no assembly immediate.