| #PF(fault-code) | If a page fault occurs in accessing the memory operand. |
| #SS(0) |
If the memory operand effective address is outside the SS segment limit. If the SS register contains an unusable segment. |
|
#UD INVPCID—Invalidate Process-Context Identifier |
If if CPUID.(EAX=07H, ECX=0H):EBX.INVPCID (bit 10) = 0. If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP |
If an invalid type is specified in the register operand, i.e., INVPCID_TYPE > 3. If bits 63:12 of INVPCID_DESC are not all zero. If INVPCID_TYPE is either 0 or 1 and INVPCID_DESC[11:0] is not zero. If INVPCID_TYPE is 0 and the linear address in INVPCID_DESC[127:64] is not canonical. |
| #UD |
If CPUID.(EAX=07H, ECX=0H):EBX.INVPCID (bit 10) = 0. If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
| #GP(0) | The INVPCID instruction is not recognized in virtual-8086 mode. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #GP(0) |
If the current privilege level is not 0. If the memory operand is in the CS, DS, ES, FS, or GS segments and the memory address is in a non-canonical form. If an invalid type is specified in the register operand, i.e., INVPCID_TYPE > 3. If bits 63:12 of INVPCID_DESC are not all zero. If CR4.PCIDE=0, INVPCID_TYPE is either 0 or 1, and INVPCID_DESC[11:0] is not zero. If INVPCID_TYPE is 0 and the linear address in INVPCID_DESC[127:64] is not canonical. |
| #PF(fault-code) | If a page fault occurs in accessing the memory operand. |
| #SS(0) |
If the memory destination operand is in the SS segment and the memory address is in a non- canonical form. |
|
#UD 3-475 |
If the LOCK prefix is used. If CPUID.(EAX=07H, ECX=0H):EBX.INVPCID (bit 10) = 0. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| CF | IRET | NP | Valid | Valid | Interrupt return (16-bit operand size). |
| CF | IRETD | NP | Valid | Valid | Interrupt return (32-bit operand size). |
| REX.W + CF | IRETQ | NP | Valid | N.E. | Interrupt return (64-bit operand size). |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| NP | NA | NA | NA | NA |
Description
Operation
Flags Affected
| All the flags and fields in the EFLAGS register are potentially modified, depending on the mode of operation of the |
| processor. If performing a return from a nested task to a previous task, the EFLAGS register will be modified |
| according to the EFLAGS image stored in the previous task’s TSS. |
Protected Mode Exceptions
| #GP(0) |
If the return code or stack segment selector is NULL. If the return instruction pointer is not within the return code segment limit. |
| #GP(selector) |
If a segment selector index is outside its descriptor table limits. If the return code segment selector RPL is less than the CPL. If the DPL of a conforming-code segment is greater than the return code segment selector RPL. If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment selector. If the stack segment descriptor DPL is not equal to the RPL of the return code segment selector. If the stack segment is not a writable data segment. If the stack segment selector RPL is not equal to the RPL of the return code segment selector. If the segment descriptor for a code segment does not indicate it is a code segment. If the segment selector for a TSS has its local/global bit set for local. If a TSS segment descriptor specifies that the TSS is not busy. If a TSS segment descriptor specifies that the TSS is not available. |
| #SS(0) | If the top bytes of stack are not within stack limits. |
| #NP(selector) | If the return code or stack segment is not present. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If an unaligned memory reference occurs when the CPL is 3 and alignment checking is enabled. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP | If the return instruction pointer is not within the return code segment limit. |
| #SS | If the top bytes of stack are not within stack limits. |
Virtual-8086 Mode Exceptions
| #GP(0) |
If the return instruction pointer is not within the return code segment limit. IF IOPL not equal to 3. |
| #PF(fault-code) | If a page fault occurs. |
| #SS(0) | If the top bytes of stack are not within stack limits. |
| #AC(0) | If an unaligned memory reference occurs and alignment checking is enabled. |
| #UD | If the LOCK prefix is used. |
Compatibility Mode Exceptions
|
#GP(0) Other exceptions same as in Protected Mode. 3-481 |
If EFLAGS.NT[bit 14] = 1. |
64-Bit Mode Exceptions
| #GP(0) |
If EFLAGS.NT[bit 14] = 1. If the return code segment selector is NULL. If the stack segment selector is NULL going back to compatibility mode. If the stack segment selector is NULL going back to CPL3 64-bit mode. If a NULL stack segment selector RPL is not equal to CPL going back to non-CPL3 64-bit mode. If the return instruction pointer is not within the return code segment limit. If the return instruction pointer is non-canonical. |
| #GP(Selector) |
If a segment selector index is outside its descriptor table limits. If a segment descriptor memory address is non-canonical. If the segment descriptor for a code segment does not indicate it is a code segment. If the proposed new code segment descriptor has both the D-bit and L-bit set. If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment selector. If CPL is greater than the RPL of the code segment selector. If the DPL of a conforming-code segment is greater than the return code segment selector RPL. If the stack segment is not a writable data segment. If the stack segment descriptor DPL is not equal to the RPL of the return code segment selector. If the stack segment selector RPL is not equal to the RPL of the return code segment selector. |
| #SS(0) |
If an attempt to pop a value off the stack violates the SS limit. If an attempt to pop a value off the stack causes a non-canonical address to be referenced. |
| #NP(selector) | If the return code or stack segment is not present. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If an unaligned memory reference occurs when the CPL is 3 and alignment checking is enabled. |
|
#UD IRET/IRETD—Interrupt Return |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 77 cb | JA rel8 | D | Valid | Valid | Jump short if above (CF=0 and ZF=0). |
| 73 cb | JAE rel8 | D | Valid | Valid | Jump short if above or equal (CF=0). |
| 72 cb | JB rel8 | D | Valid | Valid | Jump short if below (CF=1). |
| 76 cb | JBE rel8 | D | Valid | Valid | Jump short if below or equal (CF=1 or ZF=1). |
| 72 cb | JC rel8 | D | Valid | Valid | Jump short if carry (CF=1). |
| E3 cb | JCXZ rel8 | D | N.E. | Valid | Jump short if CX register is 0. |
| E3 cb | JECXZ rel8 | D | Valid | Valid | Jump short if ECX register is 0. |
| E3 cb | JRCXZ rel8 | D | Valid | N.E. | Jump short if RCX register is 0. |
| 74 cb | JE rel8 | D | Valid | Valid | Jump short if equal (ZF=1). |
| 7F cb | JG rel8 | D | Valid | Valid | Jump short if greater (ZF=0 and SF=OF). |
| 7D cb | JGE rel8 | D | Valid | Valid | Jump short if greater or equal (SF=OF). |
| 7C cb | JL rel8 | D | Valid | Valid | Jump short if less (SF≠ OF). |
| 7E cb | JLE rel8 | D | Valid | Valid | Jump short if less or equal (ZF=1 or SF≠ OF). |
| 76 cb | JNA rel8 | D | Valid | Valid | Jump short if not above (CF=1 or ZF=1). |
| 72 cb | JNAE rel8 | D | Valid | Valid | Jump short if not above or equal (CF=1). |
| 73 cb | JNB rel8 | D | Valid | Valid | Jump short if not below (CF=0). |
| 77 cb | JNBE rel8 | D | Valid | Valid |
Jump short if not below or equal (CF=0 and ZF=0). |
| 73 cb | JNC rel8 | D | Valid | Valid | Jump short if not carry (CF=0). |
| 75 cb | JNE rel8 | D | Valid | Valid | Jump short if not equal (ZF=0). |
| 7E cb | JNG rel8 | D | Valid | Valid | Jump short if not greater (ZF=1 or SF≠ OF). |
| 7C cb | JNGE rel8 | D | Valid | Valid | Jump short if not greater or equal (SF≠ OF). |
| 7D cb | JNL rel8 | D | Valid | Valid | Jump short if not less (SF=OF). |
| 7F cb | JNLE rel8 | D | Valid | Valid |
Jump short if not less or equal (ZF=0 and SF=OF). |
| 71 cb | JNO rel8 | D | Valid | Valid | Jump short if not overflow (OF=0). |
| 7B cb | JNP rel8 | D | Valid | Valid | Jump short if not parity (PF=0). |
| 79 cb | JNS rel8 | D | Valid | Valid | Jump short if not sign (SF=0). |
| 75 cb | JNZ rel8 | D | Valid | Valid | Jump short if not zero (ZF=0). |
| 70 cb | JO rel8 | D | Valid | Valid | Jump short if overflow (OF=1). |
| 7A cb | JP rel8 | D | Valid | Valid | Jump short if parity (PF=1). |
| 7A cb | JPE rel8 | D | Valid | Valid | Jump short if parity even (PF=1). |
| 7B cb | JPO rel8 | D | Valid | Valid | Jump short if parity odd (PF=0). |
| 78 cb | JS rel8 | D | Valid | Valid | Jump short if sign (SF=1). |
| 74 cb | JZ rel8 | D | Valid | Valid | Jump short if zero (ZF = 1). |
| 0F 87 cw | JA rel16 | D | N.S. | Valid |
Jump near if above (CF=0 and ZF=0). Not supported in 64-bit mode. |
| 0F 87 cd | JA rel32 | D | Valid | Valid | Jump near if above (CF=0 and ZF=0). |
| 0F 83 cw | JAE rel16 | D | N.S. | Valid |
Jump near if above or equal (CF=0). Not supported in 64-bit mode. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 83 cd | JAE rel32 | D | Valid | Valid | Jump near if above or equal (CF=0). |
| 0F 82 cw | JB rel16 | D | N.S. | Valid |
Jump near if below (CF=1). Not supported in 64-bit mode. |
| 0F 82 cd | JB rel32 | D | Valid | Valid | Jump near if below (CF=1). |
| 0F 86 cw | JBE rel16 | D | N.S. | Valid |
Jump near if below or equal (CF=1 or ZF=1). Not supported in 64-bit mode. |
| 0F 86 cd | JBE rel32 | D | Valid | Valid | Jump near if below or equal (CF=1 or ZF=1). |
| 0F 82 cw | JC rel16 | D | N.S. | Valid |
Jump near if carry (CF=1). Not supported in 64-bit mode. |
| 0F 82 cd | JC rel32 | D | Valid | Valid | Jump near if carry (CF=1). |
| 0F 84 cw | JE rel16 | D | N.S. | Valid |
Jump near if equal (ZF=1). Not supported in 64-bit mode. |
| 0F 84 cd | JE rel32 | D | Valid | Valid | Jump near if equal (ZF=1). |
| 0F 84 cw | JZ rel16 | D | N.S. | Valid |
Jump near if 0 (ZF=1). Not supported in 64-bit mode. |
| 0F 84 cd | JZ rel32 | D | Valid | Valid | Jump near if 0 (ZF=1). |
| 0F 8F cw | JG rel16 | D | N.S. | Valid |
Jump near if greater (ZF=0 and SF=OF). Not supported in 64-bit mode. |
| 0F 8F cd | JG rel32 | D | Valid | Valid | Jump near if greater (ZF=0 and SF=OF). |
| 0F 8D cw | JGE rel16 | D | N.S. | Valid |
Jump near if greater or equal (SF=OF). Not supported in 64-bit mode. |
| 0F 8D cd | JGE rel32 | D | Valid | Valid | Jump near if greater or equal (SF=OF). |
| 0F 8C cw | JL rel16 | D | N.S. | Valid |
Jump near if less (SF≠ OF). Not supported in 64-bit mode. |
| 0F 8C cd | JL rel32 | D | Valid | Valid | Jump near if less (SF≠ OF). |
| 0F 8E cw | JLE rel16 | D | N.S. | Valid |
Jump near if less or equal (ZF=1 or SF≠ OF). Not supported in 64-bit mode. |
| 0F 8E cd | JLE rel32 | D | Valid | Valid | Jump near if less or equal (ZF=1 or SF≠ OF). |
| 0F 86 cw | JNA rel16 | D | N.S. | Valid |
Jump near if not above (CF=1 or ZF=1). Not supported in 64-bit mode. |
| 0F 86 cd | JNA rel32 | D | Valid | Valid | Jump near if not above (CF=1 or ZF=1). |
| 0F 82 cw | JNAE rel16 | D | N.S. | Valid |
Jump near if not above or equal (CF=1). Not supported in 64-bit mode. |
| 0F 82 cd | JNAE rel32 | D | Valid | Valid | Jump near if not above or equal (CF=1). |
| 0F 83 cw | JNB rel16 | D | N.S. | Valid |
Jump near if not below (CF=0). Not supported in 64-bit mode. |
| 0F 83 cd | JNB rel32 | D | Valid | Valid | Jump near if not below (CF=0). |
| 0F 87 cw | JNBE rel16 | D | N.S. | Valid |
Jump near if not below or equal (CF=0 and ZF=0). Not supported in 64-bit mode. |
| 0F 87 cd | JNBE rel32 | D | Valid | Valid |
Jump near if not below or equal (CF=0 and ZF=0). |
| 0F 83 cw | JNC rel16 | D | N.S. | Valid |
Jump near if not carry (CF=0). Not supported in 64-bit mode. |
| 0F 83 cd | JNC rel32 | D | Valid | Valid | Jump near if not carry (CF=0). |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 85 cw | JNE rel16 | D | N.S. | Valid |
Jump near if not equal (ZF=0). Not supported in 64-bit mode. |
| 0F 85 cd | JNE rel32 | D | Valid | Valid | Jump near if not equal (ZF=0). |
| 0F 8E cw | JNG rel16 | D | N.S. | Valid |
Jump near if not greater (ZF=1 or SF≠ OF). Not supported in 64-bit mode. |
| 0F 8E cd | JNG rel32 | D | Valid | Valid | Jump near if not greater (ZF=1 or SF≠ OF). |
| 0F 8C cw | JNGE rel16 | D | N.S. | Valid |
Jump near if not greater or equal (SF≠ OF). Not supported in 64-bit mode. |
| 0F 8C cd | JNGE rel32 | D | Valid | Valid | Jump near if not greater or equal (SF≠ OF). |
| 0F 8D cw | JNL rel16 | D | N.S. | Valid |
Jump near if not less (SF=OF). Not supported in 64-bit mode. |
| 0F 8D cd | JNL rel32 | D | Valid | Valid | Jump near if not less (SF=OF). |
| 0F 8F cw | JNLE rel16 | D | N.S. | Valid |
Jump near if not less or equal (ZF=0 and SF=OF). Not supported in 64-bit mode. |
| 0F 8F cd | JNLE rel32 | D | Valid | Valid |
Jump near if not less or equal (ZF=0 and SF=OF). |
| 0F 81 cw | JNO rel16 | D | N.S. | Valid |
Jump near if not overflow (OF=0). Not supported in 64-bit mode. |
| 0F 81 cd | JNO rel32 | D | Valid | Valid | Jump near if not overflow (OF=0). |
| 0F 8B cw | JNP rel16 | D | N.S. | Valid |
Jump near if not parity (PF=0). Not supported in 64-bit mode. |
| 0F 8B cd | JNP rel32 | D | Valid | Valid | Jump near if not parity (PF=0). |
| 0F 89 cw | JNS rel16 | D | N.S. | Valid |
Jump near if not sign (SF=0). Not supported in 64-bit mode. |
| 0F 89 cd | JNS rel32 | D | Valid | Valid | Jump near if not sign (SF=0). |
| 0F 85 cw | JNZ rel16 | D | N.S. | Valid |
Jump near if not zero (ZF=0). Not supported in 64-bit mode. |
| 0F 85 cd | JNZ rel32 | D | Valid | Valid | Jump near if not zero (ZF=0). |
| 0F 80 cw | JO rel16 | D | N.S. | Valid |
Jump near if overflow (OF=1). Not supported in 64-bit mode. |
| 0F 80 cd | JO rel32 | D | Valid | Valid | Jump near if overflow (OF=1). |
| 0F 8A cw | JP rel16 | D | N.S. | Valid |
Jump near if parity (PF=1). Not supported in 64-bit mode. |
| 0F 8A cd | JP rel32 | D | Valid | Valid | Jump near if parity (PF=1). |
| 0F 8A cw | JPE rel16 | D | N.S. | Valid |
Jump near if parity even (PF=1). Not supported in 64-bit mode. |
| 0F 8A cd | JPE rel32 | D | Valid | Valid | Jump near if parity even (PF=1). |
| 0F 8B cw | JPO rel16 | D | N.S. | Valid |
Jump near if parity odd (PF=0). Not supported in 64-bit mode. |
| 0F 8B cd | JPO rel32 | D | Valid | Valid | Jump near if parity odd (PF=0). |
| 0F 88 cw | JS rel16 | D | N.S. | Valid |
Jump near if sign (SF=1). Not supported in 64- bit mode. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 88 cd | JS rel32 | D | Valid | Valid | Jump near if sign (SF=1). |
| 0F 84 cw | JZ rel16 | D | N.S. | Valid |
Jump near if 0 (ZF=1). Not supported in 64-bit mode. |
| 0F 84 cd | JZ rel32 | D | Valid | Valid | Jump near if 0 (ZF=1). |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| D | Offset | NA | NA | NA |
Description
| Checks the state of one or more of the status flags in the EFLAGS register (CF, OF, PF, SF, and ZF) and, if the flags |
| are in the specified state (condition), performs a jump to the target instruction specified by the destination |
| operand. A condition code (cc) is associated with each instruction to indicate the condition being tested for. If the |
| condition is not satisfied, the jump is not performed and execution continues with the instruction following the Jcc |
| instruction. |
| The target instruction is specified with a relative offset (a signed offset relative to the current value of the instruc- |
| tion pointer in the EIP register). A relative offset (rel8, rel16, or rel32) is generally specified as a label in assembly |
| code, but at the machine code level, it is encoded as a signed, 8-bit or 32-bit immediate value, which is added to |
| the instruction pointer. Instruction coding is most efficient for offsets of –128 to +127. If the operand-size attribute |
| is 16, the upper two bytes of the EIP register are cleared, resulting in a maximum instruction pointer size of 16 bits. |
| The conditions for each Jcc mnemonic are given in the “Description” column of the table on the preceding page. The |
| terms “less” and “greater” are used for comparisons of signed integers and the terms “above” and “below” are used |
| for unsigned integers. |
| Because a particular state of the status flags can sometimes be interpreted in two ways, two mnemonics are |
| defined for some opcodes. For example, the JA (jump if above) instruction and the JNBE (jump if not below or |
| equal) instruction are alternate mnemonics for the opcode 77H. |
| The Jcc instruction does not support far jumps (jumps to other code segments). When the target for the conditional |
| jump is in a different segment, use the opposite condition from the condition being tested for the Jcc instruction, |
| and then access the target with an unconditional far jump (JMP instruction) to the other segment. For example, the |
| following conditional far jump is illegal: |
| JZ FARLABEL; |
| To accomplish this far jump, use the following two instructions: |
| JNZ BEYOND; |
| JMP FARLABEL; |
| BEYOND: |
| The JRCXZ, JECXZ and JCXZ instructions differ from other Jcc instructions because they do not check status flags. |
| Instead, they check RCX, ECX or CX for 0. The register checked is determined by the address-size attribute. These |
| instructions are useful when used at the beginning of a loop that terminates with a conditional loop instruction |
| (such as LOOPNE). They can be used to prevent an instruction sequence from entering a loop when RCX, ECX or CX |
| is 0. This would cause the loop to execute 264, 232 or 64K times (not zero times). |
| All conditional jumps are converted to code fetches of one or two cache lines, regardless of jump address or cache- |
| ability. |
| In 64-bit mode, operand size is fixed at 64 bits. JMP Short is RIP = RIP + 8-bit offset sign extended to 64 bits. JMP |
| Near is RIP = RIP + 32-bit offset sign extended to 64-bits. |
| Jcc—Jump if Condition Is Met |
Operation
| IF condition |
| THEN |
| tempEIP ← EIP + SignExtend(DEST); |
| IF OperandSize = 16 |
| THEN tempEIP ← tempEIP AND 0000FFFFH; |
| FI; |
| IF tempEIP is not within code segment limit |
| THEN #GP(0); |
| ELSE EIP ← tempEIP |
| FI; |
| FI; |
Flags Affected
None
Protected Mode Exceptions
| #GP(0) | If the offset being jumped to is beyond the limits of the CS segment. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP |
If the offset being jumped to is beyond the limits of the CS segment or is outside of the effec- tive address space from 0 to FFFFH. This condition can occur if a 32-bit address size override prefix is used. |
| #UD | If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
Same exceptions as in real address mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #GP(0) | If the memory address is in a non-canonical form. |
|
#UD 3-487 |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| EB cb | JMP rel8 | D | Valid | Valid |
Jump short, RIP = RIP + 8-bit displacement sign extended to 64-bits |
| E9 cw | JMP rel16 | D | N.S. | Valid |
Jump near, relative, displacement relative to next instruction. Not supported in 64-bit mode. |
| E9 cd | JMP rel32 | D | Valid | Valid |
Jump near, relative, RIP = RIP + 32-bit displacement sign extended to 64-bits |
| FF /4 | JMP r/m16 | M | N.S. | Valid |
Jump near, absolute indirect, address = zero- extended r/m16. Not supported in 64-bit mode. |
| FF /4 | JMP r/m32 | M | N.S. | Valid |
Jump near, absolute indirect, address given in r/m32. Not supported in 64-bit mode. |
| FF /4 | JMP r/m64 | M | Valid | N.E. |
Jump near, absolute indirect, RIP = 64-Bit offset from register or memory |
| EA cd | JMP ptr16:16 | D | Inv. | Valid | Jump far, absolute, address given in operand |
| EA cp | JMP ptr16:32 | D | Inv. | Valid | Jump far, absolute, address given in operand |
| FF /5 | JMP m16:16 | D | Valid | Valid |
Jump far, absolute indirect, address given in m16:16 |
| FF /5 | JMP m16:32 | D | Valid | Valid |
Jump far, absolute indirect, address given in m16:32. |
| REX.W + FF /5 | JMP m16:64 | D | Valid | N.E. |
Jump far, absolute indirect, address given in m16:64. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| D | Offset | NA | NA | NA |
| M | ModRM:r/m (r) | NA | NA | NA |
Description
Operation
Flags Affected
All flags are affected if a task switch occurs; no flags are affected if a task switch does not occur.
Protected Mode Exceptions
Real-Address Mode Exceptions
| #GP |
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS | If a memory operand effective address is outside the SS segment limit. |
| #UD | If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
| #GP(0) |
If the target operand is beyond the code segment limits. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made. (Only occurs when fetching target from memory.) |
| #UD | If the LOCK prefix is used. |
Compatibility Mode Exceptions
Same as 64-bit mode exceptions.
64-Bit Mode Exceptions
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L1.0F.W0 4A /r KADDW k1, k2, k3 |
RVR | V/V | AVX512DQ | Add 16 bits masks in k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W0 4A /r KADDB k1, k2, k3 |
RVR | V/V | AVX512DQ | Add 8 bits masks in k2 and k3 and place result in k1. |
|
VEX.L1.0F.W1 4A /r KADDQ k1, k2, k3 |
RVR | V/V | AVX512BW | Add 64 bits masks in k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W1 4A /r KADDD k1, k2, k3 |
RVR | V/V | AVX512BW | Add 32 bits masks in k2 and k3 and place result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
Adds the vector mask k2 and the vector mask k3, and writes the result into vector mask k1.
Operation
KADDW
| DEST[15:0] (cid:197) SRC1[15:0] + SRC2[15:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KADDB
| DEST[7:0] (cid:197) SRC1[7:0] + SRC2[7:0] |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KADDQ
| DEST[63:0] (cid:197) SRC1[63:0] + SRC2[63:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KADDD
| DEST[31:0] (cid:197) SRC1[31:0] + SRC2[31:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KADDW/KADDB/KADDQ/KADDD—ADD Two Masks |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.NDS.L1.0F.W0 41 /r KANDW k1, k2, k3 |
RVR | V/V | AVX512F | Bitwise AND 16 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W0 41 /r KANDB k1, k2, k3 |
RVR | V/V | AVX512DQ | Bitwise AND 8 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.0F.W1 41 /r KANDQ k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise AND 64 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W1 41 /r KANDD k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise AND 32 bits masks k2 and k3 and place result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise AND between the vector mask k2 and the vector mask k3, and writes the result into vector mask |
| k1. |
Operation
KANDW
| DEST[15:0] (cid:197) SRC1[15:0] BITWISE AND SRC2[15:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KANDB
| DEST[7:0] (cid:197) SRC1[7:0] BITWISE AND SRC2[7:0] |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KANDQ
| DEST[63:0] (cid:197) SRC1[63:0] BITWISE AND SRC2[63:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KANDD
| DEST[31:0] (cid:197) SRC1[31:0] BITWISE AND SRC2[31:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
KANDW __mmask16 _mm512_kand(__mmask16 a, __mmask16 b);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| 3-497 |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.NDS.L1.0F.W0 42 /r KANDNW k1, k2, k3 |
RVR | V/V | AVX512F |
Bitwise AND NOT 16 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W0 42 /r KANDNB k1, k2, k3 |
RVR | V/V | AVX512DQ | Bitwise AND NOT 8 bits masks k1 and k2 and place result in k1. |
|
VEX.L1.0F.W1 42 /r KANDNQ k1, k2, k3 |
RVR | V/V | AVX512BW |
Bitwise AND NOT 64 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W1 42 /r KANDND k1, k2, k3 |
RVR | V/V | AVX512BW |
Bitwise AND NOT 32 bits masks k2 and k3 and place result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise AND NOT between the vector mask k2 and the vector mask k3, and writes the result into vector |
| mask k1. |
Operation
KANDNW
| DEST[15:0] (cid:197) (BITWISE NOT SRC1[15:0]) BITWISE AND SRC2[15:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KANDNB
| DEST[7:0] (cid:197) (BITWISE NOT SRC1[7:0]) BITWISE AND SRC2[7:0] |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KANDNQ
| DEST[63:0] (cid:197) (BITWISE NOT SRC1[63:0]) BITWISE AND SRC2[63:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KANDND
| DEST[31:0] (cid:197) (BITWISE NOT SRC1[31:0]) BITWISE AND SRC2[31:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
KANDNW __mmask16 _mm512_kandn(__mmask16 a, __mmask16 b);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KANDNW/KANDNB/KANDNQ/KANDND—Bitwise Logical AND NOT Masks |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L0.0F.W0 90 /r KMOVW k1, k2/m16 |
RM | V/V | AVX512F | Move 16 bits mask from k2/m16 and store the result in k1. |
|
VEX.L0.66.0F.W0 90 /r KMOVB k1, k2/m8 |
RM | V/V | AVX512DQ | Move 8 bits mask from k2/m8 and store the result in k1. |
|
VEX.L0.0F.W1 90 /r KMOVQ k1, k2/m64 |
RM | V/V | AVX512BW | Move 64 bits mask from k2/m64 and store the result in k1. |
|
VEX.L0.66.0F.W1 90 /r KMOVD k1, k2/m32 |
RM | V/V | AVX512BW | Move 32 bits mask from k2/m32 and store the result in k1. |
|
VEX.L0.0F.W0 91 /r KMOVW m16, k1 |
MR | V/V | AVX512F | Move 16 bits mask from k1 and store the result in m16. |
|
VEX.L0.66.0F.W0 91 /r KMOVB m8, k1 |
MR | V/V | AVX512DQ | Move 8 bits mask from k1 and store the result in m8. |
|
VEX.L0.0F.W1 91 /r KMOVQ m64, k1 |
MR | V/V | AVX512BW | Move 64 bits mask from k1 and store the result in m64. |
|
VEX.L0.66.0F.W1 91 /r KMOVD m32, k1 |
MR | V/V | AVX512BW | Move 32 bits mask from k1 and store the result in m32. |
|
VEX.L0.0F.W0 92 /r KMOVW k1, r32 |
RR | V/V | AVX512F | Move 16 bits mask from r32 to k1. |
|
VEX.L0.66.0F.W0 92 /r KMOVB k1, r32 |
RR | V/V | AVX512DQ | Move 8 bits mask from r32 to k1. |
|
VEX.L0.F2.0F.W1 92 /r KMOVQ k1, r64 |
RR | V/I | AVX512BW | Move 64 bits mask from r64 to k1. |
|
VEX.L0.F2.0F.W0 92 /r KMOVD k1, r32 |
RR | V/V | AVX512BW | Move 32 bits mask from r32 to k1. |
|
VEX.L0.0F.W0 93 /r KMOVW r32, k1 |
RR | V/V | AVX512F | Move 16 bits mask from k1 to r32. |
|
VEX.L0.66.0F.W0 93 /r KMOVB r32, k1 |
RR | V/V | AVX512DQ | Move 8 bits mask from k1 to r32. |
|
VEX.L0.F2.0F.W1 93 /r KMOVQ r64, k1 |
RR | V/I | AVX512BW | Move 64 bits mask from k1 to r64. |
|
VEX.L0.F2.0F.W0 93 /r KMOVD r32, k1 |
RR | V/V | AVX512BW | Move 32 bits mask from k1 to r32. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 |
| RM | ModRM:reg (w) | ModRM:r/m (r) |
| MR | ModRM:r/m (w, ModRM:[7:6] must not be 11b) | ModRM:reg (r) |
| RR | ModRM:reg (w) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Copies values from the source operand (second operand) to the destination operand (first operand). The source |
| and destination operands can be mask registers, memory location or general purpose. The instruction cannot be |
| used to transfer data between general purpose registers and or memory locations. |
| When moving to a mask register, the result is zero extended to MAX_KL size (i.e., 64 bits currently). When moving |
| to a general-purpose register (GPR), the result is zero-extended to the size of the destination. In 32-bit mode, the |
| default GPR destination’s size is 32 bits. In 64-bit mode, the default GPR destination’s size is 64 bits. Note that |
| REX.W cannot be used to modify the size of the general-purpose destination. |
| 3-499 |
Operation
KMOVW
| IF *destination is a memory location* |
| DEST[15:0] (cid:197) SRC[15:0] |
| IF *destination is a mask register or a GPR * |
| DEST (cid:197) ZeroExtension(SRC[15:0]) |
KMOVB
| IF *destination is a memory location* |
| DEST[7:0] (cid:197) SRC[7:0] |
| IF *destination is a mask register or a GPR * |
| DEST (cid:197) ZeroExtension(SRC[7:0]) |
KMOVQ
| IF *destination is a memory location or a GPR* |
| DEST[63:0] (cid:197) SRC[63:0] |
| IF *destination is a mask register* |
| DEST (cid:197) ZeroExtension(SRC[63:0]) |
KMOVD
| IF *destination is a memory location* |
| DEST[31:0] (cid:197) SRC[31:0] |
| IF *destination is a mask register or a GPR * |
| DEST (cid:197) ZeroExtension(SRC[31:0]) |
Intel C/C++ Compiler Intrinsic Equivalent
KMOVW __mmask16 _mm512_kmov(__mmask16 a);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| Instructions with RR operand encoding See Exceptions Type K20. |
| Instructions with RM or MR operand encoding See Exceptions Type K21. |
| KMOVW/KMOVB/KMOVQ/KMOVD—Move from and to Mask Registers |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L0.0F.W0 44 /r KNOTW k1, k2 |
RR | V/V | AVX512F | Bitwise NOT of 16 bits mask k2. |
|
VEX.L0.66.0F.W0 44 /r KNOTB k1, k2 |
RR | V/V | AVX512DQ | Bitwise NOT of 8 bits mask k2. |
|
VEX.L0.0F.W1 44 /r KNOTQ k1, k2 |
RR | V/V | AVX512BW | Bitwise NOT of 64 bits mask k2. |
|
VEX.L0.66.0F.W1 44 /r KNOTD k1, k2 |
RR | V/V | AVX512BW | Bitwise NOT of 32 bits mask k2. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 |
| RR | ModRM:reg (w) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
Performs a bitwise NOT of vector mask k2 and writes the result into vector mask k1.
Operation
KNOTW
| DEST[15:0] (cid:197) BITWISE NOT SRC[15:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KNOTB
| DEST[7:0] (cid:197) BITWISE NOT SRC[7:0] |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KNOTQ
| DEST[63:0] (cid:197) BITWISE NOT SRC[63:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KNOTD
| DEST[31:0] (cid:197) BITWISE NOT SRC[31:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
KNOTW __mmask16 _mm512_knot(__mmask16 a);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| 3-501 |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.NDS.L1.0F.W0 45 /r KORW k1, k2, k3 |
RVR | V/V | AVX512F | Bitwise OR 16 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W0 45 /r KORB k1, k2, k3 |
RVR | V/V | AVX512DQ | Bitwise OR 8 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.0F.W1 45 /r KORQ k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise OR 64 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W1 45 /r KORD k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise OR 32 bits masks k2 and k3 and place result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise OR between the vector mask k2 and the vector mask k3, and writes the result into vector mask |
| k1 (three-operand form). |
Operation
KORW
| DEST[15:0] (cid:197) SRC1[15:0] BITWISE OR SRC2[15:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KORB
| DEST[7:0] (cid:197) SRC1[7:0] BITWISE OR SRC2[7:0] |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KORQ
| DEST[63:0] (cid:197) SRC1[63:0] BITWISE OR SRC2[63:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KORD
| DEST[31:0] (cid:197) SRC1[31:0] BITWISE OR SRC2[31:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
KORW __mmask16 _mm512_kor(__mmask16 a, __mmask16 b);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KORW/KORB/KORQ/KORD—Bitwise Logical OR Masks |
|
Opcode/ Instruction |
Op/ En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L0.0F.W0 98 /r KORTESTW k1, k2 |
RR | V/V | AVX512F | Bitwise OR 16 bits masks k1 and k2 and update ZF and CF accordingly. |
|
VEX.L0.66.0F.W0 98 /r KORTESTB k1, k2 |
RR | V/V | AVX512DQ | Bitwise OR 8 bits masks k1 and k2 and update ZF and CF accordingly. |
|
VEX.L0.0F.W1 98 /r KORTESTQ k1, k2 |
RR | V/V | AVX512BW | Bitwise OR 64 bits masks k1 and k2 and update ZF and CF accordingly. |
|
VEX.L0.66.0F.W1 98 /r KORTESTD k1, k2 |
RR | V/V | AVX512BW | Bitwise OR 32 bits masks k1 and k2 and update ZF and CF accordingly. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 |
| RR | ModRM:reg (w) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise OR between the vector mask register k2, and the vector mask register k1, and sets CF and ZF |
| based on the operation result. |
| ZF flag is set if both sources are 0x0. CF is set if, after the OR operation is done, the operation result is all 1’s. |
Operation
KORTESTW
| TMP[15:0] (cid:197) DEST[15:0] BITWISE OR SRC[15:0] |
| IF(TMP[15:0]=0) |
| THEN ZF (cid:197) 1 |
| ELSE ZF (cid:197) 0 |
| FI; |
| IF(TMP[15:0]=FFFFh) |
| THEN CF (cid:197) 1 |
| ELSE CF (cid:197) 0 |
| FI; |
KORTESTB
| TMP[7:0] (cid:197) DEST[7:0] BITWISE OR SRC[7:0] |
| IF(TMP[7:0]=0) |
| THEN ZF (cid:197) 1 |
| ELSE ZF (cid:197) 0 |
| FI; |
| IF(TMP[7:0]==FFh) |
| THEN CF (cid:197) 1 |
| ELSE CF (cid:197) 0 |
| FI; |
| 3-503 |
KORTESTQ
| TMP[63:0] (cid:197) DEST[63:0] BITWISE OR SRC[63:0] |
| IF(TMP[63:0]=0) |
| THEN ZF (cid:197) 1 |
| ELSE ZF (cid:197) 0 |
| FI; |
| IF(TMP[63:0]==FFFFFFFF_FFFFFFFFh) |
| THEN CF (cid:197) 1 |
| ELSE CF (cid:197) 0 |
| FI; |
KORTESTD
| TMP[31:0] (cid:197) DEST[31:0] BITWISE OR SRC[31:0] |
| IF(TMP[31:0]=0) |
| THEN ZF (cid:197) 1 |
| ELSE ZF (cid:197) 0 |
| FI; |
| IF(TMP[31:0]=FFFFFFFFh) |
| THEN CF (cid:197) 1 |
| ELSE CF (cid:197) 0 |
| FI; |
Intel C/C++ Compiler Intrinsic Equivalent
KORTESTW __mmask16 _mm512_kortest[cz](__mmask16 a, __mmask16 b);
Flags Affected
| The ZF flag is set if the result of OR-ing both sources is all 0s. |
| The CF flag is set if the result of OR-ing both sources is all 1s. |
| The OF, SF, AF, and PF flags are set to 0. |
Other Exceptions
| See Exceptions Type K20. |
| KORTESTW/KORTESTB/KORTESTQ/KORTESTD—OR Masks And Set Flags |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L0.66.0F3A.W1 32 /r KSHIFTLW k1, k2, imm8 |
RRI | V/V | AVX512F | Shift left 16 bits in k2 by immediate and write result in k1. |
|
VEX.L0.66.0F3A.W0 32 /r KSHIFTLB k1, k2, imm8 |
RRI | V/V | AVX512DQ | Shift left 8 bits in k2 by immediate and write result in k1. |
|
VEX.L0.66.0F3A.W1 33 /r KSHIFTLQ k1, k2, imm8 |
RRI | V/V | AVX512BW | Shift left 64 bits in k2 by immediate and write result in k1. |
|
VEX.L0.66.0F3A.W0 33 /r KSHIFTLD k1, k2, imm8 |
RRI | V/V | AVX512BW | Shift left 32 bits in k2 by immediate and write result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RRI | ModRM:reg (w) | ModRM:r/m (r, ModRM:[7:6] must be 11b) | Imm8 |
Description
| Shifts 8/16/32/64 bits in the second operand (source operand) left by the count specified in immediate byte and |
| place the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destina- |
| tion are zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for |
| word shift), 31 (for doubleword shift) or 63 (for quadword shift). |
Operation
KSHIFTLW
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=15 |
| THEN DEST[15:0] (cid:197) SRC1[15:0] << COUNT; |
| FI; |
KSHIFTLB
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=7 |
| DEST[7:0] (cid:197) SRC1[7:0] << COUNT; |
| FI; |
KSHIFTLQ
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=63 |
| DEST[63:0] (cid:197) SRC1[63:0] << COUNT; |
| FI; |
| 3-505 |
KSHIFTLD
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=31 |
| DEST[31:0] (cid:197) SRC1[31:0] << COUNT; |
| FI; |
Intel C/C++ Compiler Intrinsic Equivalent
Compiler auto generates KSHIFTLW when needed.
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD—Shift Left Mask Registers |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L0.66.0F3A.W1 30 /r KSHIFTRW k1, k2, imm8 |
RRI | V/V | AVX512F | Shift right 16 bits in k2 by immediate and write result in k1. |
|
VEX.L0.66.0F3A.W0 30 /r KSHIFTRB k1, k2, imm8 |
RRI | V/V | AVX512DQ | Shift right 8 bits in k2 by immediate and write result in k1. |
|
VEX.L0.66.0F3A.W1 31 /r KSHIFTRQ k1, k2, imm8 |
RRI | V/V | AVX512BW | Shift right 64 bits in k2 by immediate and write result in k1. |
|
VEX.L0.66.0F3A.W0 31 /r KSHIFTRD k1, k2, imm8 |
RRI | V/V | AVX512BW | Shift right 32 bits in k2 by immediate and write result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RRI | ModRM:reg (w) | ModRM:r/m (r, ModRM:[7:6] must be 11b) | Imm8 |
Description
| Shifts 8/16/32/64 bits in the second operand (source operand) right by the count specified in immediate and place |
| the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destination are |
| zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for word shift), |
| 31 (for doubleword shift) or 63 (for quadword shift). |
Operation
KSHIFTRW
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=15 |
| THEN DEST[15:0] (cid:197) SRC1[15:0] >> COUNT; |
| FI; |
KSHIFTRB
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=7 |
| DEST[7:0] (cid:197) SRC1[7:0] >> COUNT; |
| FI; |
KSHIFTRQ
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=63 |
| DEST[63:0] (cid:197) SRC1[63:0] >> COUNT; |
| FI; |
| 3-507 |
KSHIFTRD
| COUNT (cid:197) imm8[7:0] |
| DEST[MAX_KL-1:0] (cid:197) 0 |
| IF COUNT <=31 |
| DEST[31:0] (cid:197) SRC1[31:0] >> COUNT; |
| FI; |
Intel C/C++ Compiler Intrinsic Equivalent
Compiler auto generates KSHIFTRW when needed.
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD—Shift Right Mask Registers |
|
Opcode/ Instruction |
Op En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.L0.0F.W0 99 /r KTESTW k1, k2 |
RR | V/V | AVX512DQ |
Set ZF and CF depending on sign bit AND and ANDN of 16 bits mask register sources. |
|
VEX.L0.66.0F.W0 99 /r KTESTB k1, k2 |
RR | V/V | AVX512DQ |
Set ZF and CF depending on sign bit AND and ANDN of 8 bits mask register sources. |
|
VEX.L0.0F.W1 99 /r KTESTQ k1, k2 |
RR | V/V | AVX512BW |
Set ZF and CF depending on sign bit AND and ANDN of 64 bits mask register sources. |
|
VEX.L0.66.0F.W1 99 /r KTESTD k1, k2 |
RR | V/V | AVX512BW |
Set ZF and CF depending on sign bit AND and ANDN of 32 bits mask register sources. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand2 |
| RR | ModRM:reg (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise comparison of the bits of the first source operand and corresponding bits in the second source |
| operand. If the AND operation produces all zeros, the ZF is set else the ZF is clear. If the bitwise AND operation of |
| the inverted first source operand with the second source operand produces all zeros the CF is set else the CF is |
| clear. Only the EFLAGS register is updated. |
| Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. |
Operation
KTESTW
| TEMP[15:0] (cid:197) SRC2[15:0] AND SRC1[15:0] |
| IF (TEMP[15:0] = = 0) |
| THEN ZF (cid:197)1; |
| ELSE ZF (cid:197) 0; |
| FI; |
| TEMP[15:0] (cid:197) SRC2[15:0] AND NOT SRC1[15:0] |
| IF (TEMP[15:0] = = 0) |
| THEN CF (cid:197)1; |
| ELSE CF (cid:197) 0; |
| FI; |
| AF (cid:197) OF (cid:197) PF (cid:197) SF (cid:197) 0; |
KTESTB
| TEMP[7:0] (cid:197) SRC2[7:0] AND SRC1[7:0] |
| IF (TEMP[7:0] = = 0) |
| THEN ZF (cid:197)1; |
| ELSE ZF (cid:197) 0; |
| FI; |
| TEMP[7:0] (cid:197) SRC2[7:0] AND NOT SRC1[7:0] |
| IF (TEMP[7:0] = = 0) |
| THEN CF (cid:197)1; |
| ELSE CF (cid:197) 0; |
| FI; |
| AF (cid:197) OF (cid:197) PF (cid:197) SF (cid:197) 0; |
| 3-509 |
KTESTQ
| TEMP[63:0] (cid:197) SRC2[63:0] AND SRC1[63:0] |
| IF (TEMP[63:0] = = 0) |
| THEN ZF (cid:197)1; |
| ELSE ZF (cid:197) 0; |
| FI; |
| TEMP[63:0] (cid:197) SRC2[63:0] AND NOT SRC1[63:0] |
| IF (TEMP[63:0] = = 0) |
| THEN CF (cid:197)1; |
| ELSE CF (cid:197) 0; |
| FI; |
| AF (cid:197) OF (cid:197) PF (cid:197) SF (cid:197) 0; |
KTESTD
| TEMP[31:0] (cid:197) SRC2[31:0] AND SRC1[31:0] |
| IF (TEMP[31:0] = = 0) |
| THEN ZF (cid:197)1; |
| ELSE ZF (cid:197) 0; |
| FI; |
| TEMP[31:0] (cid:197) SRC2[31:0] AND NOT SRC1[31:0] |
| IF (TEMP[31:0] = = 0) |
| THEN CF (cid:197)1; |
| ELSE CF (cid:197) 0; |
| FI; |
| AF (cid:197) OF (cid:197) PF (cid:197) SF (cid:197) 0; |
Intel C/C++ Compiler Intrinsic Equivalent
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KTESTW/KTESTB/KTESTQ/KTESTD—Packed Bit Test Masks and Set Flags |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.NDS.L1.66.0F.W0 4B /r KUNPCKBW k1, k2, k3 |
RVR | V/V | AVX512F |
Unpack and interleave 8 bits masks in k2 and k3 and write word result in k1. |
|
VEX.NDS.L1.0F.W0 4B /r KUNPCKWD k1, k2, k3 |
RVR | V/V | AVX512BW |
Unpack and interleave 16 bits in k2 and k3 and write double- word result in k1. |
|
VEX.NDS.L1.0F.W1 4B /r KUNPCKDQ k1, k2, k3 |
RVR | V/V | AVX512BW |
Unpack and interleave 32 bits masks in k2 and k3 and write quadword result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Unpacks the lower 8/16/32 bits of the second and third operands (source operands) into the low part of the first |
| operand (destination operand), starting from the low bytes. The result is zero-extended in the destination. |
Operation
KUNPCKBW
| DEST[7:0] (cid:197) SRC2[7:0] |
| DEST[15:8] (cid:197) SRC1[7:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KUNPCKWD
| DEST[15:0] (cid:197) SRC2[15:0] |
| DEST[31:16] (cid:197) SRC1[15:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
KUNPCKDQ
| DEST[31:0] (cid:197) SRC2[31:0] |
| DEST[63:32] (cid:197) SRC1[31:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
| KUNPCKBW __mmask16 _mm512_kunpackb(__mmask16 a, __mmask16 b); |
| KUNPCKDQ __mmask64 _mm512_kunpackd(__mmask64 a, __mmask64 b); |
| KUNPCKWD __mmask32 _mm512_kunpackw(__mmask32 a, __mmask32 b); |
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| 3-511 |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.NDS.L1.0F.W0 46 /r KXNORW k1, k2, k3 |
RVR | V/V | AVX512F | Bitwise XNOR 16 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W0 46 /r KXNORB k1, k2, k3 |
RVR | V/V | AVX512DQ | Bitwise XNOR 8 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.0F.W1 46 /r KXNORQ k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise XNOR 64 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W1 46 /r KXNORD k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise XNOR 32 bits masks k2 and k3 and place result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise XNOR between the vector mask k2 and the vector mask k3, and writes the result into vector |
| mask k1 (three-operand form). |
Operation
KXNORW
| DEST[15:0] (cid:197) NOT (SRC1[15:0] BITWISE XOR SRC2[15:0]) |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KXNORB
| DEST[7:0] (cid:197) NOT (SRC1[7:0] BITWISE XOR SRC2[7:0]) |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KXNORQ
| DEST[63:0] (cid:197) NOT (SRC1[63:0] BITWISE XOR SRC2[63:0]) |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KXNORD
| DEST[31:0] (cid:197) NOT (SRC1[31:0] BITWISE XOR SRC2[31:0]) |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
KXNORW __mmask16 _mm512_kxnor(__mmask16 a, __mmask16 b);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| KXNORW/KXNORB/KXNORQ/KXNORD—Bitwise Logical XNOR Masks |
|
Opcode/ Instruction |
Op/En |
64/32 bit Mode Support |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
|
VEX.NDS.L1.0F.W0 47 /r KXORW k1, k2, k3 |
RVR | V/V | AVX512F | Bitwise XOR 16 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W0 47 /r KXORB k1, k2, k3 |
RVR | V/V | AVX512DQ | Bitwise XOR 8 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.0F.W1 47 /r KXORQ k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise XOR 64 bits masks k2 and k3 and place result in k1. |
|
VEX.L1.66.0F.W1 47 /r KXORD k1, k2, k3 |
RVR | V/V | AVX512BW | Bitwise XOR 32 bits masks k2 and k3 and place result in k1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 |
| RVR | ModRM:reg (w) | VEX.1vvv (r) | ModRM:r/m (r, ModRM:[7:6] must be 11b) |
Description
| Performs a bitwise XOR between the vector mask k2 and the vector mask k3, and writes the result into vector mask |
| k1 (three-operand form). |
Operation
KXORW
| DEST[15:0] (cid:197) SRC1[15:0] BITWISE XOR SRC2[15:0] |
| DEST[MAX_KL-1:16] (cid:197) 0 |
KXORB
| DEST[7:0] (cid:197) SRC1[7:0] BITWISE XOR SRC2[7:0] |
| DEST[MAX_KL-1:8] (cid:197) 0 |
KXORQ
| DEST[63:0] (cid:197) SRC1[63:0] BITWISE XOR SRC2[63:0] |
| DEST[MAX_KL-1:64] (cid:197) 0 |
KXORD
| DEST[31:0] (cid:197) SRC1[31:0] BITWISE XOR SRC2[31:0] |
| DEST[MAX_KL-1:32] (cid:197) 0 |
Intel C/C++ Compiler Intrinsic Equivalent
KXORW __mmask16 _mm512_kxor(__mmask16 a, __mmask16 b);
Flags Affected
None
SIMD Floating-Point Exceptions
None
Other Exceptions
| See Exceptions Type K20. |
| 3-513 |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 9F | LAHF | NP | Invalid* | Valid | Load: AH ← EFLAGS(SF:ZF:0:AF:0:PF:1:CF). |
NOTES:
*Valid in specific steppings. See Description section.
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| NP | NA | NA | NA | NA |
Description
| This instruction executes as described above in compatibility mode and legacy mode. It is valid in 64-bit mode only |
| if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1. |
Operation
| IF 64-Bit Mode |
| THEN |
| IF CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1; |
| THEN AH ← RFLAGS(SF:ZF:0:AF:0:PF:1:CF); |
| ELSE #UD; |
| FI; |
| ELSE |
| AH ← EFLAGS(SF:ZF:0:AF:0:PF:1:CF); |
| FI; |
Flags Affected
None. The state of the flags in the EFLAGS register is not affected.
Protected Mode Exceptions
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
Same exceptions as in protected mode.
Virtual-8086 Mode Exceptions
Same exceptions as in protected mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
|
#UD LAHF—Load Status Flags into AH Register |
If CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 0. If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 02 /r | LAR r16, r16/m16 | RM | Valid | Valid | r16 ← access rights referenced by r16/m16 |
| 0F 02 /r | LAR reg, r32/m161 | RM | Valid | Valid | reg ← access rights referenced by r32/m16 |
NOTES:
1. For all loads (regardless of source or destination sizing) only bits 16-0 are used. Other bits are ignored.
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| RM | ModRM:reg (w) | ModRM:r/m (r) | NA | NA |
Description
Table 3-52. Segment and Gate Types
| Type | Protected Mode | IA-32e Mode | ||
|---|---|---|---|---|
| Name | Valid | Name | Valid | |
|
0 1 2 3 4 5 6 7 8 9 A B C D E F |
Reserved Available 16-bit TSS LDT Busy 16-bit TSS 16-bit call gate 16-bit/32-bit task gate 16-bit interrupt gate 16-bit trap gate Reserved Available 32-bit TSS Reserved Busy 32-bit TSS 32-bit call gate Reserved 32-bit interrupt gate 32-bit trap gate |
No Yes Yes Yes Yes Yes No No No Yes No Yes Yes No No No |
Reserved Reserved LDT Reserved Reserved Reserved Reserved Reserved Reserved Available 64-bit TSS Reserved Busy 64-bit TSS 64-bit call gate Reserved 64-bit interrupt gate 64-bit trap gate |
No No No No No No No No No Yes No Yes Yes No No No |
Operation
| IF Offset(SRC) > descriptor table limit |
| THEN |
| ZF ← 0; |
| ELSE |
| SegmentDescriptor ← descriptor referenced by SRC; |
| IF SegmentDescriptor(Type) ≠ conforming code segment |
| and (CPL > DPL) or (RPL > DPL) |
| or SegmentDescriptor(Type) is not valid for instruction |
| THEN |
| ZF ← 0; |
| ELSE |
| DEST ← access rights from SegmentDescriptor as given in Description section; |
| ZF ← 1; |
| FI; |
| FI; |
Flags Affected
| The ZF flag is set to 1 if the access rights are loaded successfully; otherwise, it is cleared to 0. |
| LAR—Load Access Rights Byte |
Protected Mode Exceptions
| #GP(0) |
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and the memory operand effective address is unaligned while the current privilege level is 3. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #UD | The LAR instruction is not recognized in real-address mode. |
Virtual-8086 Mode Exceptions
| #UD | The LAR instruction cannot be executed in virtual-8086 mode. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) |
If the memory operand effective address referencing the SS segment is in a non-canonical form. |
| #GP(0) | If the memory operand effective address is in a non-canonical form. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and the memory operand effective address is unaligned while the current privilege level is 3. |
|
#UD 3-517 |
If the LOCK prefix is used. |
| Opcode/Instruction | Op/En | 64/32-bit Mode | CPUID Feature Flag | Description |
|---|---|---|---|---|
|
F2 0F F0 /r LDDQU xmm1, mem |
RM | V/V | SSE3 |
Load unaligned data from mem and return double quadword in xmm1. |
|
VEX.128.F2.0F.WIG F0 /r VLDDQU xmm1, m128 |
RM | V/V | AVX |
Load unaligned packed integer values from mem to xmm1. |
|
VEX.256.F2.0F.WIG F0 /r VLDDQU ymm1, m256 |
RM | V/V | AVX |
Load unaligned packed integer values from mem to ymm1. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| RM | ModRM:reg (w) | ModRM:r/m (r) | NA | NA |
Description
| The instruction is functionally similar to (V)MOVDQU ymm/xmm, m256/m128 for loading from memory. That is: |
| 32/16 bytes of data starting at an address specified by the source memory operand (second operand) are fetched |
| from memory and placed in a destination register (first operand). The source operand need not be aligned on a |
| 32/16-byte boundary. Up to 64/32 bytes may be loaded from memory; this is implementation dependent. |
| This instruction may improve performance relative to (V)MOVDQU if the source operand crosses a cache line |
| boundary. In situations that require the data loaded by (V)LDDQU be modified and stored to the same location, use |
| (V)MOVDQU or (V)MOVDQA instead of (V)LDDQU. To move a double quadword to or from memory locations that |
| are known to be aligned on 16-byte boundaries, use the (V)MOVDQA instruction. |
Implementation Notes
| • |
| If the source is aligned to a 32/16-byte boundary, based on the implementation, the 32/16 bytes may be |
| loaded more than once. For that reason, the usage of (V)LDDQU should be avoided when using uncached or |
| write-combining (WC) memory regions. For uncached or WC memory regions, keep using (V)MOVDQU. |
| • |
| This instruction is a replacement for (V)MOVDQU (load) in situations where cache line splits significantly affect |
| performance. It should not be used in situations where store-load forwarding is performance critical. If |
| performance of store-load forwarding is critical to the application, use (V)MOVDQA store-load pairs when data |
| is 256/128-bit aligned or (V)MOVDQU store-load pairs when data is 256/128-bit unaligned. |
| • |
| If the memory address is not aligned on 32/16-byte boundary, some implementations may load up to 64/32 |
| bytes and return 32/16 bytes in the destination. Some processor implementations may issue multiple loads to |
| access the appropriate 32/16 bytes. Developers of multi-threaded or multi-processor software should be aware |
| that on these processors the loads will be performed in a non-atomic way. |
| • |
| If alignment checking is enabled (CR0.AM = 1, RFLAGS.AC = 1, and CPL = 3), an alignment-check exception |
| (#AC) may or may not be generated (depending on processor implementation) when the memory address is |
| not aligned on an 8-byte boundary. |
| In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15). |
| Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD. |
Operation
LDDQU (128-bit Legacy SSE version)
| DEST[127:0] (cid:197) SRC[127:0] |
| DEST[VLMAX-1:128] (Unmodified) |
| LDDQU—Load Unaligned Integer 128 Bits |
VLDDQU (VEX.128 encoded version)
| DEST[127:0] (cid:197) SRC[127:0] |
| DEST[VLMAX-1:128] (cid:197) 0 |
VLDDQU (VEX.256 encoded version)
DEST[255:0] (cid:197) SRC[255:0]
Intel C/C++ Compiler Intrinsic Equivalent
|
LDDQU: VLDDQU: __m256i _mm256_lddqu_si256 (__m256i * p); |
__m128i _mm_lddqu_si128 (__m128i * p); |
Numeric Exceptions
None
Other Exceptions
| See Exceptions Type 4; |
| Note treatment of #AC varies. |
| 3-519 |
| Opcode/Instruction | Op/En | 64/32-bit Mode | CPUID Feature Flag | Description |
|---|---|---|---|---|
|
0F AE /2 LDMXCSR m32 |
M | V/V | SSE | Load MXCSR register from m32. |
|
VEX.LZ.0F.WIG AE /2 VLDMXCSR m32 |
M | V/V | AVX | Load MXCSR register from m32. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| M | ModRM:r/m (r) | NA | NA | NA |
Description
| Loads the source operand into the MXCSR control/status register. The source operand is a 32-bit memory location. |
| See “MXCSR Control and Status Register” in Chapter 10, of the Intel® 64 and IA-32 Architectures Software Devel- |
| oper’s Manual, Volume 1, for a description of the MXCSR register and its contents. |
| The LDMXCSR instruction is typically used in conjunction with the (V)STMXCSR instruction, which stores the |
| contents of the MXCSR register in memory. |
| The default MXCSR value at reset is 1F80H. |
| If a (V)LDMXCSR instruction clears a SIMD floating-point exception mask bit and sets the corresponding exception |
| flag bit, a SIMD floating-point exception will not be immediately generated. The exception will be generated only |
| upon the execution of the next instruction that meets both conditions below: |
| • |
| the instruction must operate on an XMM or YMM register operand, |
| • |
| the instruction causes that particular SIMD floating-point exception to be reported. |
| This instruction’s operation is the same in non-64-bit modes and 64-bit mode. |
| If VLDMXCSR is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause an |
| #UD exception. |
| Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD. |
Operation
MXCSR ← m32;
C/C++ Compiler Intrinsic Equivalent
_mm_setcsr(unsigned int i)
Numeric Exceptions
None
Other Exceptions
| See Exceptions Type 5; additionally |
| For an attempt to set reserved bits in MXCSR. |
| If VEX.vvvv (cid:143) 1111B. |
| LDMXCSR—Load MXCSR Register |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| C5 /r | LDS r16,m16:16 | RM | Invalid | Valid | Load DS:r16 with far pointer from memory. |
| C5 /r | LDS r32,m16:32 | RM | Invalid | Valid | Load DS:r32 with far pointer from memory. |
| 0F B2 /r | LSS r16,m16:16 | RM | Valid | Valid | Load SS:r16 with far pointer from memory. |
| 0F B2 /r | LSS r32,m16:32 | RM | Valid | Valid | Load SS:r32 with far pointer from memory. |
| REX + 0F B2 /r | LSS r64,m16:64 | RM | Valid | N.E. | Load SS:r64 with far pointer from memory. |
| C4 /r | LES r16,m16:16 | RM | Invalid | Valid | Load ES:r16 with far pointer from memory. |
| C4 /r | LES r32,m16:32 | RM | Invalid | Valid | Load ES:r32 with far pointer from memory. |
| 0F B4 /r | LFS r16,m16:16 | RM | Valid | Valid | Load FS:r16 with far pointer from memory. |
| 0F B4 /r | LFS r32,m16:32 | RM | Valid | Valid | Load FS:r32 with far pointer from memory. |
| REX + 0F B4 /r | LFS r64,m16:64 | RM | Valid | N.E. | Load FS:r64 with far pointer from memory. |
| 0F B5 /r | LGS r16,m16:16 | RM | Valid | Valid | Load GS:r16 with far pointer from memory. |
| 0F B5 /r | LGS r32,m16:32 | RM | Valid | Valid | Load GS:r32 with far pointer from memory. |
| REX + 0F B5 /r | LGS r64,m16:64 | RM | Valid | N.E. | Load GS:r64 with far pointer from memory. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| RM | ModRM:reg (w) | ModRM:r/m (r) | NA | NA |
Description
| Loads a far pointer (segment selector and offset) from the second operand (source operand) into a segment |
| register and the first operand (destination operand). The source operand specifies a 48-bit or a 32-bit pointer in |
| memory depending on the current setting of the operand-size attribute (32 bits or 16 bits, respectively). The |
| instruction opcode and the destination operand specify a segment register/general-purpose register pair. The 16- |
| bit segment selector from the source operand is loaded into the segment register specified with the opcode (DS, |
| SS, ES, FS, or GS). The 32-bit or 16-bit offset is loaded into the register specified with the destination operand. |
| If one of these instructions is executed in protected mode, additional information from the segment descriptor |
| pointed to by the segment selector in the source operand is loaded in the hidden part of the selected segment |
| register. |
| Also in protected mode, a NULL selector (values 0000 through 0003) can be loaded into DS, ES, FS, or GS registers |
| without causing a protection exception. (Any subsequent reference to a segment whose corresponding segment |
| register is loaded with a NULL selector, causes a general-protection exception (#GP) and no memory reference to |
| the segment occurs.) |
| In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.W promotes |
| operation to specify a source operand referencing an 80-bit pointer (16-bit selector, 64-bit offset) in memory. |
| Using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). See the summary chart at |
| the beginning of this section for encoding data and limits. |
Operation
Flags Affected
None
Protected Mode Exceptions
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
| #GP(0) |
If a NULL selector is loaded into the SS register. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. |
| #GP(selector) |
If the SS register is being loaded and any of the following is true: the segment selector index is not within the descriptor table limits, the segment selector RPL is not equal to CPL, the segment is a non-writable data segment, or DPL is not equal to CPL. If the DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and any of the following is true: the segment selector index is not within descriptor table limits, the segment is neither a data nor a readable code segment, or the segment is a data or noncon- forming-code segment and both RPL and CPL are greater than DPL. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #SS(selector) | If the SS register is being loaded and the segment is marked not present. |
| #NP(selector) |
If DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and the segment is marked not present. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
Real-Address Mode Exceptions
| #GP | If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS | If a memory operand effective address is outside the SS segment limit. |
|
#UD 3-523 |
If source operand is not a memory location. If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
| #GP(0) | If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) | If alignment checking is enabled and an unaligned memory reference is made. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #GP(0) |
If the memory address is in a non-canonical form. If a NULL selector is attempted to be loaded into the SS register in compatibility mode. If a NULL selector is attempted to be loaded into the SS register in CPL3 and 64-bit mode. If a NULL selector is attempted to be loaded into the SS register in non-CPL3 and 64-bit mode where its RPL is not equal to CPL. |
| #GP(Selector) |
If the FS, or GS register is being loaded with a non-NULL segment selector and any of the following is true: the segment selector index is not within descriptor table limits, the memory address of the descriptor is non-canonical, the segment is neither a data nor a readable code segment, or the segment is a data or nonconforming-code segment and both RPL and CPL are greater than DPL. If the SS register is being loaded and any of the following is true: the segment selector index is not within the descriptor table limits, the memory address of the descriptor is non-canonical, the segment selector RPL is not equal to CPL, the segment is a nonwritable data segment, or DPL is not equal to CPL. |
| #SS(0) | If a memory operand effective address is non-canonical |
| #SS(Selector) | If the SS register is being loaded and the segment is marked not present. |
| #NP(selector) |
If FS, or GS register is being loaded with a non-NULL segment selector and the segment is marked not present. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
|
#UD LDS/LES/LFS/LGS/LSS—Load Far Pointer |
If source operand is not a memory location. If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 8D /r | LEA r16,m | RM | Valid | Valid | Store effective address for m in register r16. |
| 8D /r | LEA r32,m | RM | Valid | Valid | Store effective address for m in register r32. |
| REX.W + 8D /r | LEA r64,m | RM | Valid | N.E. | Store effective address for m in register r64. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| RM | ModRM:reg (w) | ModRM:r/m (r) | NA | NA |
Description
| Computes the effective address of the second operand (the source operand) and stores it in the first operand |
| (destination operand). The source operand is a memory address (offset part) specified with one of the processors |
| addressing modes; the destination operand is a general-purpose register. The address-size and operand-size attri- |
| butes affect the action performed by this instruction, as shown in the following table. The operand-size attribute of |
| the instruction is determined by the chosen register; the address-size attribute is determined by the attribute of |
| the code segment. |
Table 3-53. Non-64-bit Mode LEA Operation with Address and Operand Size Attributes
| Operand Size | Address Size | Action Performed |
|---|---|---|
| 16 | 16 | 16-bit effective address is calculated and stored in requested 16-bit register destination. |
| 16 | 32 |
32-bit effective address is calculated. The lower 16 bits of the address are stored in the requested 16-bit register destination. |
| 32 | 16 |
16-bit effective address is calculated. The 16-bit address is zero-extended and stored in the requested 32-bit register destination. |
| 32 | 32 | 32-bit effective address is calculated and stored in the requested 32-bit register destination. |
| Different assemblers may use different algorithms based on the size attribute and symbolic reference of the source |
| operand. |
| In 64-bit mode, the instruction’s destination operand is governed by operand size attribute, the default operand |
| size is 32 bits. Address calculation is governed by address size attribute, the default address size is 64-bits. In 64- |
| bit mode, address size of 16 bits is not encodable. See Table 3-54. |
Table 3-54. 64-bit Mode LEA Operation with Address and Operand Size Attributes
| Operand Size | Address Size | Action Performed |
|---|---|---|
| 16 | 32 |
32-bit effective address is calculated (using 67H prefix). The lower 16 bits of the address are stored in the requested 16-bit register destination (using 66H prefix). |
| 16 | 64 |
64-bit effective address is calculated (default address size). The lower 16 bits of the address are stored in the requested 16-bit register destination (using 66H prefix). |
| 32 | 32 |
32-bit effective address is calculated (using 67H prefix) and stored in the requested 32-bit register destination. |
| 32 | 64 |
64-bit effective address is calculated (default address size) and the lower 32 bits of the address are stored in the requested 32-bit register destination. |
| 64 | 32 |
32-bit effective address is calculated (using 67H prefix), zero-extended to 64-bits, and stored in the requested 64-bit register destination (using REX.W). |
| 64 | 64 |
64-bit effective address is calculated (default address size) and all 64-bits of the address are stored in the requested 64-bit register destination (using REX.W). |
| LEA—Load Effective Address | Vol. 2A | 3-525 |
Operation
| IF OperandSize = 16 and AddressSize = 16 |
| THEN |
| DEST ← EffectiveAddress(SRC); (* 16-bit address *) |
| ELSE IF OperandSize = 16 and AddressSize = 32 |
| THEN |
| temp ← EffectiveAddress(SRC); (* 32-bit address *) |
| DEST ← temp[0:15]; (* 16-bit address *) |
| FI; |
| ELSE IF OperandSize = 32 and AddressSize = 16 |
| THEN |
| temp ← EffectiveAddress(SRC); (* 16-bit address *) |
| DEST ← ZeroExtend(temp); (* 32-bit address *) |
| FI; |
| ELSE IF OperandSize = 32 and AddressSize = 32 |
| THEN |
| DEST ← EffectiveAddress(SRC); (* 32-bit address *) |
| FI; |
| ELSE IF OperandSize = 16 and AddressSize = 64 |
| THEN |
| temp ← EffectiveAddress(SRC); (* 64-bit address *) |
| DEST ← temp[0:15]; (* 16-bit address *) |
| FI; |
| ELSE IF OperandSize = 32 and AddressSize = 64 |
| THEN |
| temp ← EffectiveAddress(SRC); (* 64-bit address *) |
| DEST ← temp[0:31]; (* 16-bit address *) |
| FI; |
| ELSE IF OperandSize = 64 and AddressSize = 64 |
| THEN |
| DEST ← EffectiveAddress(SRC); (* 64-bit address *) |
| FI; |
| FI; |
Flags Affected
None
Protected Mode Exceptions
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
Real-Address Mode Exceptions
Same exceptions as in protected mode.
Virtual-8086 Mode Exceptions
Same exceptions as in protected mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| Same exceptions as in protected mode. |
| LEA—Load Effective Address |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| C9 | LEAVE | NP | Valid | Valid | Set SP to BP, then pop BP. |
| C9 | LEAVE | NP | N.E. | Valid | Set ESP to EBP, then pop EBP. |
| C9 | LEAVE | NP | Valid | N.E. | Set RSP to RBP, then pop RBP. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| NP | NA | NA | NA | NA |
Description
| Releases the stack frame set up by an earlier ENTER instruction. The LEAVE instruction copies the frame pointer (in |
| the EBP register) into the stack pointer register (ESP), which releases the stack space allocated to the stack frame. |
| The old frame pointer (the frame pointer for the calling procedure that was saved by the ENTER instruction) is then |
| popped from the stack into the EBP register, restoring the calling procedure’s stack frame. |
| A RET instruction is commonly executed following a LEAVE instruction to return program control to the calling |
| procedure. |
| See “Procedure Calls for Block-Structured Languages” in Chapter 7 of the Intel® 64 and IA-32 Architectures Soft- |
| ware Developer’s Manual, Volume 1, for detailed information on the use of the ENTER and LEAVE instructions. |
| In 64-bit mode, the instruction’s default operation size is 64 bits; 32-bit operation cannot be encoded. See the |
| summary chart at the beginning of this section for encoding data and limits. |
Operation
| IF StackAddressSize = 32 |
| THEN |
| ESP ← EBP; |
| ELSE IF StackAddressSize = 64 |
| THEN RSP ← RBP; FI; |
| ELSE IF StackAddressSize = 16 |
| THEN SP ← BP; FI; |
| FI; |
| IF OperandSize = 32 |
| THEN EBP ← Pop(); |
| ELSE IF OperandSize = 64 |
| THEN RBP ← Pop(); FI; |
| ELSE IF OperandSize = 16 |
| THEN BP ← Pop(); FI; |
| FI; |
Flags Affected
| None |
| 3-527 |
Protected Mode Exceptions
| #SS(0) |
If the EBP register points to a location that is not within the limits of the current stack segment. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP | If the EBP register points to a location outside of the effective address space from 0 to FFFFH. |
| #UD | If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
| #GP(0) | If the EBP register points to a location outside of the effective address space from 0 to FFFFH. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) | If alignment checking is enabled and an unaligned memory reference is made. |
| #UD | If the LOCK prefix is used. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) | If the stack address is in a non-canonical form. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
|
#UD LEAVE—High Level Procedure Exit |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F AE E8 | LFENCE | NP | Valid | Valid | Serializes load operations. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| NP | NA | NA | NA | NA |
Description
| Performs a serializing operation on all load-from-memory instructions that were issued prior the LFENCE instruc- |
| tion. Specifically, LFENCE does not execute until all prior instructions have completed locally, and no later instruc- |
| tion begins execution until LFENCE completes. In particular, an instruction that loads from memory and that |
| precedes an LFENCE receives data from memory prior to completion of the LFENCE. (An LFENCE that follows an |
| instruction that stores to memory might complete before the data being stored have become globally visible.) |
| Instructions following an LFENCE may be fetched from memory before the LFENCE, but they will not execute until |
| the LFENCE completes. |
| Weakly ordered memory types can be used to achieve higher processor performance through such techniques as |
| out-of-order issue and speculative reads. The degree to which a consumer of data recognizes or knows that the |
| data is weakly ordered varies among applications and may be unknown to the producer of this data. The LFENCE |
| instruction provides a performance-efficient way of ensuring load ordering between routines that produce weakly- |
| ordered results and routines that consume that data. |
| Processors are free to fetch and cache data speculatively from regions of system memory that use the WB, WC, |
| and WT memory types. This speculative fetching can occur at any time and is not tied to instruction execution. |
| Thus, it is not ordered with respect to executions of the LFENCE instruction; data can be brought into the caches |
| speculatively just before, during, or after the execution of an LFENCE instruction. |
| This instruction’s operation is the same in non-64-bit modes and 64-bit mode. |
| Specification of the instruction's opcode above indicates a ModR/M byte of E8. For this instruction, the processor |
| ignores the r/m field of the ModR/M byte. Thus, LFENCE is encoded by any opcode of the form 0F AE Ex, where x is |
| in the range 8-F. |
Operation
Wait_On_Following_Instructions_Until(preceding_instructions_complete);
Intel C/C++ Compiler Intrinsic Equivalent
void _mm_lfence(void)
Exceptions (All Modes of Operation)
|
#UD 3-529 |
If CPUID.01H:EDX.SSE2[bit 26] = 0. If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 01 /2 | LGDT m16&32 | M | N.E. | Valid | Load m into GDTR. |
| 0F 01 /3 | LIDT m16&32 | M | N.E. | Valid | Load m into IDTR. |
| 0F 01 /2 | LGDT m16&64 | M | Valid | N.E. | Load m into GDTR. |
| 0F 01 /3 | LIDT m16&64 | M | Valid | N.E. | Load m into IDTR. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| M | ModRM:r/m (r) | NA | NA | NA |
Description
| Loads the values in the source operand into the global descriptor table register (GDTR) or the interrupt descriptor |
| table register (IDTR). The source operand specifies a 6-byte memory location that contains the base address (a |
| linear address) and the limit (size of table in bytes) of the global descriptor table (GDT) or the interrupt descriptor |
| table (IDT). If operand-size attribute is 32 bits, a 16-bit limit (lower 2 bytes of the 6-byte data operand) and a 32- |
| bit base address (upper 4 bytes of the data operand) are loaded into the register. If the operand-size attribute |
| is 16 bits, a 16-bit limit (lower 2 bytes) and a 24-bit base address (third, fourth, and fifth byte) are loaded. Here, |
| the high-order byte of the operand is not used and the high-order byte of the base address in the GDTR or IDTR is |
| filled with zeros. |
| The LGDT and LIDT instructions are used only in operating-system software; they are not used in application |
| programs. They are the only instructions that directly load a linear address (that is, not a segment-relative |
| address) and a limit in protected mode. They are commonly executed in real-address mode to allow processor |
| initialization prior to switching to protected mode. |
| In 64-bit mode, the instruction’s operand size is fixed at 8+2 bytes (an 8-byte base and a 2-byte limit). See the |
| summary chart at the beginning of this section for encoding data and limits. |
| See “SGDT—Store Global Descriptor Table Register” in Chapter 4, Intel® 64 and IA-32 Architectures Software |
| Developer’s Manual, Volume 2B, for information on storing the contents of the GDTR and IDTR. |
| LGDT/LIDT—Load Global/Interrupt Descriptor Table Register |
Operation
| IF Instruction is LIDT |
| THEN |
| IF OperandSize = 16 |
| THEN |
| IDTR(Limit) ← SRC[0:15]; |
| IDTR(Base) ← SRC[16:47] AND 00FFFFFFH; |
| ELSE IF 32-bit Operand Size |
| THEN |
| IDTR(Limit) ← SRC[0:15]; |
| IDTR(Base) ← SRC[16:47]; |
| FI; |
| ELSE IF 64-bit Operand Size (* In 64-Bit Mode *) |
| THEN |
| IDTR(Limit) ← SRC[0:15]; |
| IDTR(Base) ← SRC[16:79]; |
| FI; |
| FI; |
| ELSE (* Instruction is LGDT *) |
| IF OperandSize = 16 |
| THEN |
| GDTR(Limit) ← SRC[0:15]; |
| GDTR(Base) ← SRC[16:47] AND 00FFFFFFH; |
| ELSE IF 32-bit Operand Size |
| THEN |
| GDTR(Limit) ← SRC[0:15]; |
| GDTR(Base) ← SRC[16:47]; |
| FI; |
| ELSE IF 64-bit Operand Size (* In 64-Bit Mode *) |
| THEN |
| GDTR(Limit) ← SRC[0:15]; |
| GDTR(Base) ← SRC[16:79]; |
| FI; |
| FI; |
| FI; |
Flags Affected
None
Protected Mode Exceptions
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
| #GP(0) |
If the current privilege level is not 0. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
|
#PF(fault-code) 3-531 |
If a page fault occurs. |
Real-Address Mode Exceptions
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
| #GP | If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS | If a memory operand effective address is outside the SS segment limit. |
Virtual-8086 Mode Exceptions
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
| #GP(0) | The LGDT and LIDT instructions are not recognized in virtual-8086 mode. |
| #GP | If the current privilege level is not 0. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) | If a memory address referencing the SS segment is in a non-canonical form. |
| #GP(0) |
If the current privilege level is not 0. If the memory address is in a non-canonical form. |
| #UD |
If source operand is not a memory location. If the LOCK prefix is used. |
|
#PF(fault-code) LGDT/LIDT—Load Global/Interrupt Descriptor Table Register |
If a page fault occurs. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 00 /2 | LLDT r/m16 | M | Valid | Valid | Load segment selector r/m16 into LDTR. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| M | ModRM:r/m (r) | NA | NA | NA |
Description
| Loads the source operand into the segment selector field of the local descriptor table register (LDTR). The source |
| operand (a general-purpose register or a memory location) contains a segment selector that points to a local |
| descriptor table (LDT). After the segment selector is loaded in the LDTR, the processor uses the segment selector |
| to locate the segment descriptor for the LDT in the global descriptor table (GDT). It then loads the segment limit |
| and base address for the LDT from the segment descriptor into the LDTR. The segment registers DS, ES, SS, FS, |
| GS, and CS are not affected by this instruction, nor is the LDTR field in the task state segment (TSS) for the current |
| task. |
| If bits 2-15 of the source operand are 0, LDTR is marked invalid and the LLDT instruction completes silently. |
| However, all subsequent references to descriptors in the LDT (except by the LAR, VERR, VERW or LSL instructions) |
| cause a general protection exception (#GP). |
| The operand-size attribute has no effect on this instruction. |
| The LLDT instruction is provided for use in operating-system software; it should not be used in application |
| programs. This instruction can only be executed in protected mode or 64-bit mode. |
| In 64-bit mode, the operand size is fixed at 16 bits. |
Operation
| IF SRC(Offset) > descriptor table limit |
| THEN #GP(segment selector); FI; |
| IF segment selector is valid |
| Read segment descriptor; |
| IF SegmentDescriptor(Type) ≠ LDT |
| THEN #GP(segment selector); FI; |
| IF segment descriptor is not present |
| THEN #NP(segment selector); FI; |
| LDTR(SegmentSelector) ← SRC; |
| LDTR(SegmentDescriptor) ← GDTSegmentDescriptor; |
| ELSE LDTR ← INVALID |
| FI; |
Flags Affected
| None |
| 3-533 |
Protected Mode Exceptions
| #GP(0) |
If the current privilege level is not 0. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains a NULL segment selector. |
| #GP(selector) |
If the selector operand does not point into the Global Descriptor Table or if the entry in the GDT is not a Local Descriptor Table. Segment selector is beyond GDT limit. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #NP(selector) | If the LDT descriptor is not present. |
| #PF(fault-code) | If a page fault occurs. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #UD | The LLDT instruction is not recognized in real-address mode. |
Virtual-8086 Mode Exceptions
| #UD | The LLDT instruction is not recognized in virtual-8086 mode. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) | If a memory address referencing the SS segment is in a non-canonical form. |
| #GP(0) |
If the current privilege level is not 0. If the memory address is in a non-canonical form. |
| #GP(selector) |
If the selector operand does not point into the Global Descriptor Table or if the entry in the GDT is not a Local Descriptor Table. Segment selector is beyond GDT limit. |
| #NP(selector) | If the LDT descriptor is not present. |
| #PF(fault-code) | If a page fault occurs. |
|
#UD LLDT—Load Local Descriptor Table Register |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 01 /6 | LMSW r/m16 | M | Valid | Valid | Loads r/m16 in machine status word of CR0. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| M | ModRM:r/m (r) | NA | NA | NA |
Description
| Loads the source operand into the machine status word, bits 0 through 15 of register CR0. The source operand can |
| be a 16-bit general-purpose register or a memory location. Only the low-order 4 bits of the source operand (which |
| contains the PE, MP, EM, and TS flags) are loaded into CR0. The PG, CD, NW, AM, WP, NE, and ET flags of CR0 are |
| not affected. The operand-size attribute has no effect on this instruction. |
| If the PE flag of the source operand (bit 0) is set to 1, the instruction causes the processor to switch to protected |
| mode. While in protected mode, the LMSW instruction cannot be used to clear the PE flag and force a switch back |
| to real-address mode. |
| The LMSW instruction is provided for use in operating-system software; it should not be used in application |
| programs. In protected or virtual-8086 mode, it can only be executed at CPL 0. |
| This instruction is provided for compatibility with the Intel 286 processor; programs and procedures intended to |
| run on IA-32 and Intel 64 processors beginning with Intel386 processors should use the MOV (control registers) |
| instruction to load the whole CR0 register. The MOV CR0 instruction can be used to set and clear the PE flag in CR0, |
| allowing a procedure or program to switch between protected and real-address modes. |
| This instruction is a serializing instruction. |
| This instruction’s operation is the same in non-64-bit modes and 64-bit mode. Note that the operand size is fixed |
| at 16 bits. |
| See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 25 of the Intel® 64 and IA-32 Archi- |
| tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in |
| VMX non-root operation. |
Operation
CR0[0:3] ← SRC[0:3];
Flags Affected
None
Protected Mode Exceptions
| #GP(0) |
If the current privilege level is not 0. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP | If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
|
#UD 3-535 |
If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
| #GP(0) | The LMSW instruction is not recognized in real-address mode. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) | If a memory address referencing the SS segment is in a non-canonical form. |
| #GP(0) |
If the current privilege level is not 0. If the memory address is in a non-canonical form. |
| #PF(fault-code) | If a page fault occurs. |
|
#UD LMSW—Load Machine Status Word |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| F0 | LOCK | NP | Valid | Valid |
Asserts LOCK# signal for duration of the accompanying instruction. |
NOTES:
| * | See IA-32 Architecture Compatibility section below. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| NP | NA | NA | NA | NA |
Description
| Causes the processor’s LOCK# signal to be asserted during execution of the accompanying instruction (turns the |
| instruction into an atomic instruction). In a multiprocessor environment, the LOCK# signal ensures that the |
| processor has exclusive use of any shared memory while the signal is asserted. |
| In most IA-32 and all Intel 64 processors, locking may occur without the LOCK# signal being asserted. See the “IA- |
| 32 Architecture Compatibility” section below for more details. |
| The LOCK prefix can be prepended only to the following instructions and only to those forms of the instructions |
| where the destination operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCH8B, |
| CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD, and XCHG. If the LOCK prefix is used with one of |
| these instructions and the source operand is a memory operand, an undefined opcode exception (#UD) may be |
| generated. An undefined opcode exception will also be generated if the LOCK prefix is used with any instruction not |
| in the above list. The XCHG instruction always asserts the LOCK# signal regardless of the presence or absence of |
| the LOCK prefix. |
| The LOCK prefix is typically used with the BTS instruction to perform a read-modify-write operation on a memory |
| location in shared memory environment. |
| The integrity of the LOCK prefix is not affected by the alignment of the memory field. Memory locking is observed |
| for arbitrarily misaligned fields. |
| This instruction’s operation is the same in non-64-bit modes and 64-bit mode. |
IA-32 Architecture Compatibility
| Beginning with the P6 family processors, when the LOCK prefix is prefixed to an instruction and the memory area |
| being accessed is cached internally in the processor, the LOCK# signal is generally not asserted. Instead, only the |
| processor’s cache is locked. Here, the processor’s cache coherency mechanism ensures that the operation is |
| carried out atomically with regards to memory. See “Effects of a Locked Operation on Internal Processor Caches” |
| in Chapter 8 of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, the for more informa- |
| tion on locking of caches. |
Operation
AssertLOCK#(DurationOfAccompaningInstruction);
Flags Affected
None
Protected Mode Exceptions
|
#UD 3-537 |
If the LOCK prefix is used with an instruction not listed: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCH8B, CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD, XCHG. Other exceptions can be generated by the instruction when the LOCK prefix is applied. |
Real-Address Mode Exceptions
Same exceptions as in protected mode.
Virtual-8086 Mode Exceptions
Same exceptions as in protected mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| Same exceptions as in protected mode. |
| LOCK—Assert LOCK# Signal Prefix |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| AC | LODS m8 | NP | Valid | Valid |
For legacy mode, Load byte at address DS:(E)SI into AL. For 64-bit mode load byte at address (R)SI into AL. |
| AD | LODS m16 | NP | Valid | Valid |
For legacy mode, Load word at address DS:(E)SI into AX. For 64-bit mode load word at address (R)SI into AX. |
| AD | LODS m32 | NP | Valid | Valid |
For legacy mode, Load dword at address DS:(E)SI into EAX. For 64-bit mode load dword at address (R)SI into EAX. |
| REX.W + AD | LODS m64 | NP | Valid | N.E. | Load qword at address (R)SI into RAX. |
| AC | LODSB | NP | Valid | Valid |
For legacy mode, Load byte at address DS:(E)SI into AL. For 64-bit mode load byte at address (R)SI into AL. |
| AD | LODSW | NP | Valid | Valid |
For legacy mode, Load word at address DS:(E)SI into AX. For 64-bit mode load word at address (R)SI into AX. |
| AD | LODSD | NP | Valid | Valid |
For legacy mode, Load dword at address DS:(E)SI into EAX. For 64-bit mode load dword at address (R)SI into EAX. |
| REX.W + AD | LODSQ | NP | Valid | N.E. | Load qword at address (R)SI into RAX. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| NP | NA | NA | NA | NA |
Description
Operation
| IF AL ← SRC; (* Byte load *) |
| THEN AL ← SRC; (* Byte load *) |
| IF DF = 0 |
| THEN (E)SI ← (E)SI + 1; |
| ELSE (E)SI ← (E)SI – 1; |
| FI; |
| ELSE IF AX ← SRC; (* Word load *) |
| THEN IF DF = 0 |
| THEN (E)SI ← (E)SI + 2; |
| ELSE (E)SI ← (E)SI – 2; |
| IF; |
| FI; |
| ELSE IF EAX ← SRC; (* Doubleword load *) |
| THEN IF DF = 0 |
| THEN (E)SI ← (E)SI + 4; |
| ELSE (E)SI ← (E)SI – 4; |
| FI; |
| FI; |
| ELSE IF RAX ← SRC; (* Quadword load *) |
| THEN IF DF = 0 |
| THEN (R)SI ← (R)SI + 8; |
| ELSE (R)SI ← (R)SI – 8; |
| FI; |
| FI; |
| FI; |
Flags Affected
None
Protected Mode Exceptions
| #GP(0) |
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains a NULL segment selector. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP | If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS | If a memory operand effective address is outside the SS segment limit. |
|
#UD LODS/LODSB/LODSW/LODSD/LODSQ—Load String |
If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
| #GP(0) | If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) | If alignment checking is enabled and an unaligned memory reference is made. |
| #UD | If the LOCK prefix is used. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) | If a memory address referencing the SS segment is in a non-canonical form. |
| #GP(0) | If the memory address is in a non-canonical form. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
|
#UD 3-541 |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| E2 cb | LOOP rel8 | D | Valid | Valid | Decrement count; jump short if count ≠ 0. |
| E1 cb | LOOPE rel8 | D | Valid | Valid |
Decrement count; jump short if count ≠ 0 and ZF = 1. |
| E0 cb | LOOPNE rel8 | D | Valid | Valid |
Decrement count; jump short if count ≠ 0 and ZF = 0. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| D | Offset | NA | NA | NA |
Description
| Performs a loop operation using the RCX, ECX or CX register as a counter (depending on whether address size is 64 |
| bits, 32 bits, or 16 bits). Note that the LOOP instruction ignores REX.W; but 64-bit address size can be over-ridden |
| using a 67H prefix. |
| Each time the LOOP instruction is executed, the count register is decremented, then checked for 0. If the count is |
| 0, the loop is terminated and program execution continues with the instruction following the LOOP instruction. If |
| the count is not zero, a near jump is performed to the destination (target) operand, which is presumably the |
| instruction at the beginning of the loop. |
| The target instruction is specified with a relative offset (a signed offset relative to the current value of the instruc- |
| tion pointer in the IP/EIP/RIP register). This offset is generally specified as a label in assembly code, but at the |
| machine code level, it is encoded as a signed, 8-bit immediate value, which is added to the instruction pointer. |
| Offsets of –128 to +127 are allowed with this instruction. |
| Some forms of the loop instruction (LOOPcc) also accept the ZF flag as a condition for terminating the loop before |
| the count reaches zero. With these forms of the instruction, a condition code (cc) is associated with each instruction |
| to indicate the condition being tested for. Here, the LOOPcc instruction itself does not affect the state of the ZF flag; |
| the ZF flag is changed by other instructions in the loop. |
Operation
Flags Affected
None
Protected Mode Exceptions
| #GP(0) | If the offset being jumped to is beyond the limits of the CS segment. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #GP |
If the offset being jumped to is beyond the limits of the CS segment or is outside of the effec- tive address space from 0 to FFFFH. This condition can occur if a 32-bit address size override prefix is used. |
| #UD | If the LOCK prefix is used. |
Virtual-8086 Mode Exceptions
Same exceptions as in real address mode.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #GP(0) | If the offset being jumped to is in a non-canonical form. |
|
#UD 3-543 |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 03 /r | LSL r16, r16/m16 | RM | Valid | Valid | Load: r16 ← segment limit, selector r16/m16. |
| 0F 03 /r | LSL r32, r32/m16* | RM | Valid | Valid | Load: r32 ← segment limit, selector r32/m16. |
| REX.W + 0F 03 /r | LSL r64, r32/m16* | RM | Valid | Valid | Load: r64 ← segment limit, selector r32/m16 |
NOTES:
| * | For all loads (regardless of destination sizing), only bits 16-0 are used. Other bits are ignored. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| RM | ModRM:reg (w) | ModRM:r/m (r) | NA | NA |
Description
| Loads the unscrambled segment limit from the segment descriptor specified with the second operand (source |
| operand) into the first operand (destination operand) and sets the ZF flag in the EFLAGS register. The source |
| operand (which can be a register or a memory location) contains the segment selector for the segment descriptor |
| being accessed. The destination operand is a general-purpose register. |
| The processor performs access checks as part of the loading process. Once loaded in the destination register, soft- |
| ware can compare the segment limit with the offset of a pointer. |
| The segment limit is a 20-bit value contained in bytes 0 and 1 and in the first 4 bits of byte 6 of the segment |
| descriptor. If the descriptor has a byte granular segment limit (the granularity flag is set to 0), the destination |
| operand is loaded with a byte granular value (byte limit). If the descriptor has a page granular segment limit (the |
| granularity flag is set to 1), the LSL instruction will translate the page granular limit (page limit) into a byte limit |
| before loading it into the destination operand. The translation is performed by shifting the 20-bit “raw” limit left 12 |
| bits and filling the low-order 12 bits with 1s. |
| When the operand size is 32 bits, the 32-bit byte limit is stored in the destination operand. When the operand size |
| is 16 bits, a valid 32-bit limit is computed; however, the upper 16 bits are truncated and only the low-order 16 bits |
| are loaded into the destination operand. |
| This instruction performs the following checks before it loads the segment limit into the destination register: |
| • |
| Checks that the segment selector is not NULL. |
| • |
| Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being |
| accessed |
| • |
| Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for |
| (can be accessed with) the LSL instruction. The valid special segment and gate descriptor types are given in the |
| following table. |
| • |
| If the segment is not a conforming code segment, the instruction checks that the specified segment descriptor |
| is visible at the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of |
| the segment selector). |
| If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no |
| value is loaded in the destination operand. |
| LSL—Load Segment Limit |
Table 3-55. Segment and Gate Descriptor Types
| Type | Protected Mode | IA-32e Mode | ||
|---|---|---|---|---|
| Name | Valid | Name | Valid | |
|
0 1 2 3 4 5 6 7 8 9 A B C D E F |
Reserved Available 16-bit TSS LDT Busy 16-bit TSS 16-bit call gate 16-bit/32-bit task gate 16-bit interrupt gate 16-bit trap gate Reserved Available 32-bit TSS Reserved Busy 32-bit TSS 32-bit call gate Reserved 32-bit interrupt gate 32-bit trap gate |
No Yes Yes Yes No No No No No Yes No Yes No No No No |
Upper 8 byte of a 16-Byte descriptor Reserved LDT Reserved Reserved Reserved Reserved Reserved Reserved 64-bit TSS Reserved Busy 64-bit TSS 64-bit call gate Reserved 64-bit interrupt gate 64-bit trap gate |
Yes No Yes No No No No No No Yes No Yes No No No No |
Operation
| IF SRC(Offset) > descriptor table limit |
| THEN ZF ← 0; FI; |
| Read segment descriptor; |
| IF SegmentDescriptor(Type) ≠ conforming code segment |
| and (CPL > DPL) OR (RPL > DPL) |
| or Segment type is not valid for instruction |
| THEN |
| ZF ← 0; |
| ELSE |
| temp ← SegmentLimit([SRC]); |
| IF (G ← 1) |
| THEN temp ← ShiftLeft(12, temp) OR 00000FFFH; |
| ELSE IF OperandSize = 32 |
| THEN DEST ← temp; FI; |
| ELSE IF OperandSize = 64 (* REX.W used *) |
| THEN DEST (* Zero-extended *) ← temp; FI; |
| ELSE (* OperandSize = 16 *) |
| DEST ← temp AND FFFFH; |
| FI; |
| FI; |
Flags Affected
| The ZF flag is set to 1 if the segment limit is loaded successfully; otherwise, it is set to 0. |
| 3-545 |
Protected Mode Exceptions
| #GP(0) |
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and the memory operand effective address is unaligned while the current privilege level is 3. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #UD | The LSL instruction cannot be executed in real-address mode. |
Virtual-8086 Mode Exceptions
| #UD | The LSL instruction cannot be executed in virtual-8086 mode. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) |
If the memory operand effective address referencing the SS segment is in a non-canonical form. |
| #GP(0) | If the memory operand effective address is in a non-canonical form. |
| #PF(fault-code) | If a page fault occurs. |
| #AC(0) |
If alignment checking is enabled and the memory operand effective address is unaligned while the current privilege level is 3. |
|
#UD LSL—Load Segment Limit |
If the LOCK prefix is used. |
| Opcode | Instruction | Op/En | 64-Bit Mode | Compat/Leg Mode | Description |
|---|---|---|---|---|---|
| 0F 00 /3 | LTR r/m16 | M | Valid | Valid | Load r/m16 into task register. |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| M | ModRM:r/m (r) | NA | NA | NA |
Description
| Loads the source operand into the segment selector field of the task register. The source operand (a general- |
| purpose register or a memory location) contains a segment selector that points to a task state segment (TSS). |
| After the segment selector is loaded in the task register, the processor uses the segment selector to locate the |
| segment descriptor for the TSS in the global descriptor table (GDT). It then loads the segment limit and base |
| address for the TSS from the segment descriptor into the task register. The task pointed to by the task register is |
| marked busy, but a switch to the task does not occur. |
| The LTR instruction is provided for use in operating-system software; it should not be used in application programs. |
| It can only be executed in protected mode when the CPL is 0. It is commonly used in initialization code to establish |
| the first task to be executed. |
| The operand-size attribute has no effect on this instruction. |
| In 64-bit mode, the operand size is still fixed at 16 bits. The instruction references a 16-byte descriptor to load the |
| 64-bit base. |
Operation
| IF SRC is a NULL selector |
| THEN #GP(0); |
| IF SRC(Offset) > descriptor table limit OR IF SRC(type) ≠ global |
| THEN #GP(segment selector); FI; |
| Read segment descriptor; |
| IF segment descriptor is not for an available TSS |
| THEN #GP(segment selector); FI; |
| IF segment descriptor is not present |
| THEN #NP(segment selector); FI; |
| TSSsegmentDescriptor(busy) ← 1; |
| (* Locked read-modify-write operation on the entire descriptor when setting busy flag *) |
| TaskRegister(SegmentSelector) ← SRC; |
| TaskRegister(SegmentDescriptor) ← TSSSegmentDescriptor; |
Flags Affected
| None |
| 3-547 |
Protected Mode Exceptions
| #GP(0) |
If the current privilege level is not 0. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the source operand contains a NULL segment selector. If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment selector. |
| #GP(selector) |
If the source selector points to a segment that is not a TSS or to one for a task that is already busy. If the selector points to LDT or is beyond the GDT limit. |
| #NP(selector) | If the TSS is marked not present. |
| #SS(0) | If a memory operand effective address is outside the SS segment limit. |
| #PF(fault-code) | If a page fault occurs. |
| #UD | If the LOCK prefix is used. |
Real-Address Mode Exceptions
| #UD | The LTR instruction is not recognized in real-address mode. |
Virtual-8086 Mode Exceptions
| #UD | The LTR instruction is not recognized in virtual-8086 mode. |
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
| #SS(0) | If a memory address referencing the SS segment is in a non-canonical form. |
| #GP(0) |
If the current privilege level is not 0. If the memory address is in a non-canonical form. If the source operand contains a NULL segment selector. |
| #GP(selector) |
If the source selector points to a segment that is not a TSS or to one for a task that is already busy. If the selector points to LDT or is beyond the GDT limit. If the descriptor type of the upper 8-byte of the 16-byte descriptor is non-zero. |
| #NP(selector) | If the TSS is marked not present. |
| #PF(fault-code) | If a page fault occurs. |
|
#UD LTR—Load Task Register |
If the LOCK prefix is used. |
| Opcode/Instruction |
Op/ En |
64/32 -bit Mode |
CPUID Feature Flag |
Description |
|---|---|---|---|---|
| F3 0F BD /r | RM | V/V | LZCNT | Count the number of leading zero bits in r/m16, return result in r16. |
| LZCNT r16, r/m16 | ||||
| F3 0F BD /r | RM | V/V | LZCNT | Count the number of leading zero bits in r/m32, return result in r32. |
| LZCNT r32, r/m32 | ||||
| F3 REX.W 0F BD /r | RM | V/N.E. | LZCNT | Count the number of leading zero bits in r/m64, return result in r64. |
| LZCNT r64, r/m64 |
Instruction Operand Encoding
| Op/En | Operand 1 | Operand 2 | Operand 3 | Operand 4 |
| RM | ModRM:reg (w) | ModRM:r/m (r) | NA | NA |
Description
| Counts the number of leading most significant zero bits in a source operand (second operand) returning the result |
| into a destination (first operand). |
| LZCNT differs from BSR. For example, LZCNT will produce the operand size when the input operand is zero. It |
| should be noted that on processors that do not support LZCNT, the instruction byte encoding is executed as BSR. |
| In 64-bit mode 64-bit operand size requires REX.W=1. |
Operation
| temp ← OperandSize - 1 |
| DEST ← 0 |
| WHILE (temp >= 0) AND (Bit(SRC, temp) = 0) |
| DO |
| temp ← temp - 1 |
| DEST ← DEST+ 1 |
| OD |
| IF DEST = OperandSize |
| CF ← 1 |
| ELSE |
| CF ← 0 |
| FI |
| IF DEST = 0 |
| ZF ← 1 |
| ELSE |
| ZF ← 0 |
| FI |
Flags Affected
| ZF flag is set to 1 in case of zero output (most significant bit of the source is set), and to 0 otherwise, CF flag is set |
| to 1 if input was zero and cleared otherwise. OF, SF, PF and AF flags are undefined. |
| 3-549 |
Intel C/C++ Compiler Intrinsic Equivalent
| LZCNT: | unsigned __int32 _lzcnt_u32(unsigned __int32 src); |
| LZCNT: | unsigned __int64 _lzcnt_u64(unsigned __int64 src); |
Protected Mode Exceptions
| #GP(0) |
For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments. If the DS, ES, FS, or GS register is used to access memory and it contains a null segment selector. |
| #SS(0) | For an illegal address in the SS segment. |
| #PF (fault-code) | For a page fault. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
Real-Address Mode Exceptions
| #GP(0) | If any part of the operand lies outside of the effective address space from 0 to 0FFFFH. |
| #SS(0) | For an illegal address in the SS segment. |
Virtual 8086 Mode Exceptions
| #GP(0) | If any part of the operand lies outside of the effective address space from 0 to 0FFFFH. |
| #SS(0) | For an illegal address in the SS segment. |
| #PF (fault-code) | For a page fault. |
| #AC(0) |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |
Compatibility Mode Exceptions
Same exceptions as in Protected Mode.
64-Bit Mode Exceptions
| #GP(0) | If the memory address is in a non-canonical form. |
| #SS(0) | If a memory address referencing the SS segment is in a non-canonical form. |
| #PF (fault-code) | For a page fault. |
|
#AC(0) LZCNT— Count the Number of Leading Zero Bits |
If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. |