This span completes the RV32 SHA-512 half-operations (sum0r/sum1r) and the RV64 native transforms (sha512sig0/sig1/sum0/sum1 — the single-instruction 64-bit forms from the previous page), then arrives at the ShangMi hash.
| Computation | Role in SM3 | |
|---|---|---|
| sm3p0 rd, rs1 | x ^ rol(x,9) ^ rol(x,17) | P0 permutation — diffuses the compression-function output word. |
| sm3p1 rd, rs1 | x ^ rol(x,15) ^ rol(x,23) | P1 permutation — diffuses the message-expansion word. |
Two instructions, the same fixed-rotate-XOR hardware as the SHA transforms — only the rotation constants differ. SM3 (GB/T 32905-2016) is the Chinese national hash standard; the P0/P1 functions are its Σ-equivalents.
Hardware Designer Notes
For a chip targeting both markets, the hash accelerator is one rotate-XOR block parameterized by six constant sets (four SHA-256, four SHA-512, two SM3) — trivial area, and the constant-time property falls out of the fixed wiring. SM4 (next page) is the one ShangMi instruction with real SBox area.
Minimal Linux-boot hart MUST
- sm3p0/sm3p1 as fixed-rotate-XOR wirings — identical structure to the SHA transforms, different constants, data-independent latency
MAY simplify / trap-and-emulate
- Share the SHA/SM3 XOR-tree datapath with a constant-select mux for a dual-jurisdiction core
- Omit Zksh entirely outside Chinese-market products (and omit Zknh outside internet-standard products), keeping only the bitmanip substrate
Check yourself — SHA-512 RV64 & SM3
1.sm3p0 computes x ^ rol(x,9) ^ rol(x,17) and sm3p1 computes x ^ rol(x,15) ^ rol(x,23). What are these?
2.Why is SM3 (Zksh) a separate extension from SHA-2 (Zknh) when both are hash functions with near-identical instruction shapes?