VSM3RNDS2

VSM3RNDS2 runs two of the 64 rounds of SM3, the Chinese national hash function that the IETF draft on this page’s sources describes, with a 256-bit result like SHA-256’s. Its layout follows SHA256RNDS2: the eight 32-bit working variables are split over two XMM registers, C, D, G and H in the first operand from dword 3 down, A, B, E and F in the second, and the new A, B, E and F replace the first operand. The third operand, a register or 16 bytes of memory, carries the message words, and the immediate gives the number of the first round.

What SM3 asks for#

• Two kinds of word. Each SM3 round uses a word W[j] and also W[j] XOR W[j+4]. The instruction forms the XORs itself, so its third operand holds W[j] and W[j+1] in dwords 0 and 1 and W[j+4] and W[j+5] in dwords 2 and 3; one unpack of two registers of the schedule builds it, and the other half of the same pair serves the next VSM3RNDS2.
• Constants from the round number. SM3 has two round constants, one for rounds 0 to 15 and one after, rotated left by the round number. The instruction takes the number from the immediate, keeping only bits 5:1, so an even round from 0 to 62, and makes the constants itself; no table of constants is added in software.
• Rounds that change form. Rounds 0 to 15 combine the variables with XOR, later ones with majority and choice functions, again picked by the immediate.
• Rotations between rounds. In SM3, C and G receive B and F rotated left by 9 and 19 bits. The instruction expects C, D, G and H as the previous instruction left A, B, E and F, unrotated, and rotates them on entry, so the two registers swap roles each time, as with SHA256RNDS2: 32 instructions per 64-byte block.

Unlike SHA-256, SM3 combines each block’s result with the previous hash value by XOR rather than addition. The 68 words W[j] come from VSM3MSG1 and VSM3MSG2.

Where it runs#

The SM3 extension (CPUID leaf 7, subleaf 1, EAX bit 1, with AVX) arrived, by Intel’s extensions reference, with Arrow Lake S, Clearwater Forest and Diamond Rapids. Zen 5 lacks it, and both its recorded cases, register and memory forms, raised #UD. GCC 14 and Clang 23 provide _mm_sm3rnds2_epi32(cdgh, abef, words, round) with -msm3, compiled to the one instruction at -O2.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] >> 1 & 1:
    fault(UD)                    # CPUID: no SM3
j = imm8 & 0x3E            # rounds j, j + 1
a = xmm2.d[3]              # A, B, E, F
b = xmm2.d[2]
e = xmm2.d[1]
f = xmm2.d[0]
c = rol(xmm1.d[3], 9, 32)  # C, D, G, H
d = rol(xmm1.d[2], 9, 32)
g = rol(xmm1.d[1], 19, 32)
h = rol(xmm1.d[0], 19, 32)
for i in range(2):
    k = 0x79CC4519 if j < 16 else 0x7A879D8A
    k = rol(k, j + i, 32)  # T[j+i]
    s = rol(a, 12, 32)
    ss1 = rol(low(s + e + k, 32), 7, 32)
    ss2 = ss1 ^ s
    if j < 16:
        ff = a ^ b ^ c
        gg = e ^ f ^ g
    else:
        ff = majority(a, b, c)
        gg = choose(e, f, g)
    w = src3.d[i]          # W[j+i]; and
    t1 = ff + d + ss2 + (w ^ src3.d[i + 2])
    t2 = gg + h + ss1 + w  # W[j+i+4]
    d = c
    c = rol(b, 9, 32)
    b = a
    a = low(t1, 32)
    h = g
    g = rol(f, 19, 32)
    f = e
    e = sm3_p0(low(t2, 32))
xmm1.d[3] = a
xmm1.d[2] = b
xmm1.d[1] = e
xmm1.d[0] = f
# xmm1 is zeroed from bit 128 up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

All forms

avx-type-4

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSM3RNDS2, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SM3 instructions

• VSM3MSG1
• VSM3MSG2