VSM3MSG1

VSM3MSG1 starts one step of SM3’s message expansion, four words at a time. SM3 extends a block’s 16 words to 68, each new one as

W[j] = P1(W[j-16] ^ W[j-9] ^ (W[j-3] <<< 15)) ^ (W[j-13] <<< 7) ^ W[j-6]

where <<< rotates left and P1(x) is x XOR x rotated left by 15 XOR x rotated left by 23. VSM3MSG1 computes the P1 part for four consecutive j. Its third operand, a register or 16 bytes of memory, holds W[j-16] to W[j-13], dword 0 the oldest; the first, W[j-9] to W[j-6]; the second, W[j-3] to W[j-1] in dwords 0 to 2. The four results replace the first operand.

The missing term#

The fourth word needs W[j] rotated, the first word of this very step, which does not exist yet. VSM3MSG1 leaves that term out, and VSM3MSG2 adds it at the end. That works because P1 is built from rotations and XOR alone: P1 of a sum by XOR is the XOR of the P1s, and P1 of W[j] rotated by 15 is the XOR of W[j] rotated by 6, 15 and 30, which is what VSM3MSG2 folds into its last word.

One step#

With the last sixteen words in four registers, oldest first, as m0 to m3, the operands are m0 and two pieces cut with byte shifts: W[j-9] to W[j-6] are _mm_alignr_epi8(m2, m1, 12), and W[j-3] to W[j-1] are m3 shifted right by four bytes. VSM3MSG2 needs two more such pieces. GCC 14 and Clang 23 at -O2 (-msm3) compile the whole step to three VPALIGNRs, a VPSRLDQ, the two SM3 instructions and one register move. Thirteen steps make the 52 words after the first 16, which the rounds of VSM3RNDS2 use as W[j] and as W[j] XOR W[j+4].

Zen 5 has no SM3 extension (CPUID leaf 7, subleaf 1, EAX bit 1), and both its recorded cases raised #UD.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] >> 1 & 1:
    fault(UD)                    # CPUID: no SM3
# xmm1: W[j-9] to W[j-6]; xmm2: W[j-3] to
# W[j-1]; src3: W[j-16] to W[j-13]; each
# dword i: P1 of W[j+i-16] ^ W[j+i-9] ^
# rol(W[j+i-3], 15), that of dword 3 yet
# without W[j]
for i in range(4):
    x = xmm1.d[i] ^ src3.d[i]
    if i < 3:
        x ^= rol(xmm2.d[i], 15, 32)
    xmm1.d[i] = sm3_p1(x)
# xmm1 is zeroed from bit 128 up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

avx-type-4

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSM3MSG1, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SM3 instructions

• VSM3MSG2
• VSM3RNDS2