VSM3MSG2

VSM3MSG2 finishes one step of SM3’s message expansion, whose recurrence is

W[j] = P1(W[j-16] ^ W[j-9] ^ (W[j-3] <<< 15)) ^ (W[j-13] <<< 7) ^ W[j-6]

with <<< a left rotation. Its first operand holds the P1 parts that VSM3MSG1 computed for four consecutive j; the second, W[j-13] to W[j-10]; the third, a register or 16 bytes of memory, W[j-6] to W[j-3]. VSM3MSG2 XORs in each word’s W[j-13] rotated left by 7 and its W[j-6], and the four finished words replace the first operand.

The last word#

VSM3MSG1 could not include, in the fourth word, the rotation of W[j], the first word of the same step. Once that word is finished, VSM3MSG2 adds the missing part to the fourth: W[j] rotated left by 6, by 15 and by 30, the P1 of W[j] rotated by 15, which may be added late because P1 uses only rotations and XOR. So the four words come out complete, and the next step can use them at once.

Around it#

Both operands for VSM3MSG2 come from byte shifts of the last sixteen words: in registers m0 to m3, oldest first, W[j-13] to W[j-10] are _mm_alignr_epi8(m1, m0, 12) and W[j-6] to W[j-3] are _mm_alignr_epi8(m3, m2, 8). VSM3MSG1’s page lists what GCC 14 and Clang 23 make of a whole step. Unlike SHA-256’s SHA256MSG2, SM3’s schedule has no additions, only XOR and rotations, and it produces 68 words where the rounds of VSM3RNDS2 number 64: the last four serve only in the XORs W[j] ^ W[j+4] of rounds 60 to 63.

GCC 14 and Clang 23 provide _mm_sm3msg2_epi32(p1s, w13, w6) with -msm3. Zen 5 has no SM3 extension, and both its recorded cases raised #UD.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] >> 1 & 1:
    fault(UD)                    # CPUID: no SM3
# xmm1: VSM3MSG1's result; xmm2: W[j-13]
# to W[j-10]; src3: W[j-6] to W[j-3]; the
# result: W[j] to W[j+3]
for i in range(4):
    x = xmm1.d[i] ^ src3.d[i]
    x ^= rol(xmm2.d[i], 7, 32)
    if i == 0:
        w = x              # W[j]
    elif i == 3:           # W[j]'s part
        x ^= sm3_p1(rol(w, 15, 32))
    xmm1.d[i] = x
# xmm1 is zeroed from bit 128 up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

avx-type-4

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSM3MSG2, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SM3 instructions

• VSM3MSG1
• VSM3RNDS2