VSM4RNDS4

VSM4RNDS4 runs four of the 32 rounds of SM4, the Chinese national block cipher with 128-bit blocks and keys that the IETF draft on this page’s sources describes. A block is four 32-bit words; each round replaces the oldest word X[i] with

X[i+4] = X[i] ^ T(X[i+1] ^ X[i+2] ^ X[i+3] ^ rk[i])

where T passes each byte through SM4’s S-box and then XORs the word with itself rotated left by 2, 10, 18 and 24 bits. VSM4RNDS4 takes the four words in its second operand, dword 0 the oldest, the four round keys rk[i] to rk[i+3] in its third, a register or memory, and writes X[i+4] to X[i+7] to the first. So eight instructions, each fed the next four round keys, encrypt a block, and the result of one is the input of the next.

Lanes and keys#

• One block per 128-bit lane. The YMM form runs two blocks at once and the EVEX form on ZMM four, each lane with the round keys in the same lane of the third operand: several blocks of one message under one key, as in counter mode, or blocks under different keys.
• Decryption is the same instruction with the round keys in the opposite order, rk[31] first: SM4 decrypts with the same rounds. There is no separate decryption form, unlike AES’s AESDEC.
• The round keys come from software, computed once per key with VSM4KEY4.

After the last round SM4 outputs the four words in reverse order, X[35] to X[32], and the instruction leaves them X[32] to X[35] from dword 0 up, so a dword shuffle such as VPSHUFD with 1BH finishes the block. Each operation is on whole 32-bit words in the register’s little-endian order, while SM4 numbers bytes from the most significant, so code that loads blocks from memory byte-swaps each word first.

Where it runs#

The VEX forms need AVX and the SM4 extension (CPUID leaf 7, subleaf 1, EAX bit 2), which Intel’s extensions reference gives to Arrow Lake S, Clearwater Forest and Diamond Rapids. The EVEX forms, which add ZMM and registers 16 to 31 but no masking, need AVX10 as well: Diamond Rapids and Nova Lake. Zen 5 has neither: all ten of its recorded cases, VEX and EVEX, raised #UD. GCC 14 and Clang 23 compile _mm_sm4rnds4_epi32() and _mm256_sm4rnds4_epi32() with -msm4; only Clang 23 has _mm512_sm4rnds4_epi32(), with -msm4 -mavx10.2.

Forms

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if not cpuid_leaf(7, 1)[0] >> 2 & 1:
    fault(UD)                    # CPUID: no SM4
for i in range(VL // 128):  # each lane:
    a = ymm2.d[4 * i]      # the block's
    b = ymm2.d[4 * i + 1]  # four words,
    c = ymm2.d[4 * i + 2]  # the first in
    d = ymm2.d[4 * i + 3]  # dword 0
    for j in range(4):     # src3: four rk
        x = b ^ c ^ d ^ src3.d[4 * i + j]
        x = a ^ sm4_l(sm4_sub_word(x))
        ymm1.d[4 * i + j] = x  # the next
        a = b
        b = c
        c = d
        d = x
# ymm1 is zeroed from bit VL up

if not cpuid_leaf(7, 1)[0] >> 2 & 1:
    fault(UD)                    # CPUID: no SM4
if not cpuid_leaf(7, 1)[3] >> 19 & 1:
    fault(UD)                    # CPUID: no AVX10
for i in range(VL // 128):  # each lane:
    a = zmm2.d[4 * i]      # the block's
    b = zmm2.d[4 * i + 1]  # four words,
    c = zmm2.d[4 * i + 2]  # the first in
    d = zmm2.d[4 * i + 3]  # dword 0
    for j in range(4):     # src3: four rk
        x = b ^ c ^ d ^ src3.d[4 * i + j]
        x = a ^ sm4_l(sm4_sub_word(x))
        zmm1.d[4 * i + j] = x  # the next
        a = b
        b = c
        c = d
        d = x
# zmm1 is zeroed from bit VL up

Operands

Flags

None: XED records no flag that the forms test or change.

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

VEX forms

avx-type-6

EVEX forms

AVX512-E6

Intrinsics

The C intrinsics of Clang 23.1.2 that compile to VSM4RNDS4, each with the form it compiles to and the Clang options it needs. The forms come from compiling every intrinsic and decoding the result with Intel XED; all intrinsics A–Z explains the method.

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More SM4 instructions

• VSM4KEY4