[#insns-sha256sig0, reftext="SHA2-256 Sigma0 instruction"]
=== sha256sig0

Synopsis::
Implements the Sigma0 transformation function as used in
the SHA2-256 hash function cite:[nist:fips:180:4] (Section 4.1.2).

Mnemonic::
sha256sig0 rd, rs1

Encoding::
[wavedrom, , svg]
....
{reg:[
{bits: 7, name: 0x13},
{bits: 5, name: 'rd'},
{bits: 3, name: 0x1},
{bits: 5, name: 'rs1'},
{bits: 5, name: 0x2},
{bits: 5, name: 0x8},
{bits: 2, name: 0x0},
]}
....

Description:: 
This instruction is supported for both RV32 and RV64 base architectures.
For RV32, the entire `XLEN` source register is operated on.
For RV64, the low `32` bits of the source register are operated on, and the
result sign extended to `XLEN` bits.
Though named for SHA2-256, the instruction works for both the
SHA2-224 and SHA2-256 parameterisations as described in
cite:[nist:fips:180:4].
This instruction must _always_ be implemented such that its execution
latency does not depend on the data being operated on.

Operation::
[source,sail]
--
function clause execute (SHA256SIG0(rs1,rd)) = {
  let inb    : bits(32) = X(rs1)[31..0];
  let result : bits(32) = ror32(inb,  7) ^ ror32(inb, 18) ^ (inb >>  3);
  X(rd)      = EXTS(result);
  RETIRE_SUCCESS
}
--

Included in::
[%header,cols="4,2,2"]
|===
|Extension
|Minimum version
|Lifecycle state

| <<zknh>>
| v1.0.0
| Frozen
| <<zkn>>
| v1.0.0
| Frozen
| <<zk>>
| v1.0.0
| Frozen
|===


