Does SHA512SIG0L use floating-point or vector registers?
No. These scalar crypto extension instructions use integer X registers.
SHA512SIG0L
RISC-V SHA512SIG0L Instruction Details
Instruction ManualR-typeRV32 SHA-512 σ0 low word: rs1 is the input low word; rs2 is the other word.
Instruction Syntax
sha512sig0l rd, rs1, rs2
Syntax is sha512sig0l rd, rs1, rs2; operands select integer x0–x31 or ABI names, with no assembly immediate.
32-bit OP: funct7=0101010, funct3=000, opcode=0110011; rs1 and rs2 are sources and rd is the destination.
RV32 Zknh only (also included in Zkn/Zk); rs1 supplies the input low word and rs2 the other word. The page's 32-bit formula computes the low result word.
An x0 source is zero and writes to x0 are discarded; overlapping operands read values before writeback. Equal sources share one value. Execution latency must be data-independent.
ZknhCrypto & Security
Instruction Behavior
sha512sig0l is an RV32 Zknh instruction computing the low 32-bit word of SHA-512 σ0. With a=X(rs1) and b=X(rs2), rd receives the low 32 bits of ((a >> 1) ^ (a >> 7) ^ (a >> 8) ^ (b << 31) ^ (b << 25) ^ (b << 24)). Right shifts zero-fill; left shifts retain 32 bits. rs1 is the input low word and rs2 is the other word. The example reverses sources for the other result word.
SHA512SIG0L Decode And Execute Animation
Applies the official RV32 formula for one SHA-512 Sigma result word.
rd
rs1
rs2
sha512sig0l
,
,
Execution Context
XLEN is fixed at 32. For the low form, rs1 is the input low word and rs2 is the input high word. Initially rd shares an overlapping source value, otherwise it starts at 0. An x0 source must be 0; identical sources must share one value.
fixed
source
source
fixed
destination
OP
31..25
0101010
24..20
rs2=x12
19..15
rs1=x11
14..12
000
11..7
rd=x10
6..0
0110011
Execution Data Path
X(rs1)[31:0]
0x89ABCDEF
X(rs2)[31:0]
0x01234567
rs1 >> 1
0x44D5E6F7
rs1 >> 7
0x0113579B
rs1 >> 8
0x0089ABCD
rs2 << 31
0x80000000
rs2 << 25
0xCE000000
rs2 << 24
0x67000000
result
0x6C4F1AA1
Architectural Result
a0(x10) = 0x00000000
This animation shows only official ISA fields and architectural state; it does not model a complete hash algorithm or microarchitecture.
Quick Understanding & Search Notes
RV32 SHA-512 σ0 low word: rs1 is the input low word; rs2 is the other word.
sha512sig0l uses integer X registers with XLEN=32.
Execution latency must not depend on the data being processed; no particular cycle count is specified.
A write to x0 is discarded; source values are read before this instruction writes back.
Common Usage Scenarios
SHA-512 hash transforms
RV32 Zknh, a0=1 (low), a1=0 (high): the example first writes t0=0x00000000, then reverses sources to write t1=0x81000000. Both original inputs remain intact across the sequence.
Integer-register bit operations
RV32 Zknh, a0=1 (low), a1=0 (high): the example first writes t0=0x00000000, then reverses sources to write t1=0x81000000. Both original inputs remain intact across the sequence.
Pre-Use Checklist
Syntax Check
- Syntax is sha512sig0l rd, rs1, rs2; operands select integer x0–x31 or ABI names, with no assembly immediate.
- 32-bit OP: funct7=0101010, funct3=000, opcode=0110011; rs1 and rs2 are sources and rd is the destination.
Semantic Check
- RV32 Zknh only (also included in Zkn/Zk); rs1 supplies the input low word and rs2 the other word. The page's 32-bit formula computes the low result word.
- An x0 source is zero and writes to x0 are discarded; overlapping operands read values before writeback. Equal sources share one value. Execution latency must be data-independent.
Pitfalls / Common Confusions
Defined only on RV32; sha512sig0l reads the input low word from rs1 and the other word from rs2.
In the example, a0 is the input low word and a1 is the high word; t0/t1 receive the low/high results without destroying an input still needed by the second instruction.
Each instruction computes one 32-bit word.
FAQ
Is SHA512SIG0L a complete algorithm implementation?
It computes one 32-bit result word of SHA-512 σ0; the example L/H sequence combines the full 64-bit transform.