Intel 64 and IA-32 Architectures. Software Developer’s Manual (2026) - page 12
VAESKEYGENASSIST
X3[31:0] := SRC [127: 96];
X2[31:0] := SRC [95: 64];
X1[31:0] := SRC [63: 32];
X0[31:0] := SRC [31: 0];
RCON[31:0] := ZeroExtend(imm8[7:0]);
DEST[31:0] := SubWord(X1);
DEST[63:32 ] := RotWord( SubWord(X1) ) XOR RCON;
DEST[95:64] := SubWord(X3);
DEST[127:96] := RotWord( SubWord(X3) ) XOR RCON;
DEST[MAXVL-1:128] := 0;
Intel C/C++ Compiler Intrinsic Equivalent
(V)AESKEYGENASSIST __m128i _mm_aeskeygenassist (__m128i, const int)
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-21, “Type 4 Class Exception Conditions,” additionally:
#UD
If VEX.vvvv ≠ 1111B.
AESKEYGENASSIST-AES Round Key Generation Assist
Vol. 2A
3-59
AND-Logical AND
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
24 ib
AND AL, imm8
I
Valid
Valid
AL AND imm8.
25 iw
AND AX, imm16
I
Valid
Valid
AX AND imm16.
25 id
AND EAX, imm32
I
Valid
Valid
EAX AND imm32.
REX.W + 25 id
AND RAX, imm32
I
Valid
N.E.
RAX AND imm32 sign-extended to 64-bits.
80 /4 ib
AND r/m81, imm81
MI
Valid
Valid
r/m8 AND imm8.
81 /4 iw
AND r/m16, imm16
MI
Valid
Valid
r/m16 AND imm16.
81 /4 id
AND r/m32, imm32
MI
Valid
Valid
r/m32 AND imm32.
REX.W + 81 /4 id
AND r/m64, imm32
MI
Valid
N.E.
r/m64 AND imm32 sign extended to 64-bits.
83 /4 ib
AND r/m16, imm8
MI
Valid
Valid
r/m16 AND imm8 (sign-extended).
83 /4 ib
AND r/m32, imm8
MI
Valid
Valid
r/m32 AND imm8 (sign-extended).
REX.W + 83 /4 ib
AND r/m64, imm8
MI
Valid
N.E.
r/m64 AND imm8 (sign-extended).
20 /r
AND r/m81, r81
MR
Valid
Valid
r/m8 AND r8.
21 /r
AND r/m16, r16
MR
Valid
Valid
r/m16 AND r16.
21 /r
AND r/m32, r32
MR
Valid
Valid
r/m32 AND r32.
REX.W + 21 /r
AND r/m64, r64
MR
Valid
N.E.
r/m64 AND r64.
22 /r
AND r81, r/m81
RM
Valid
Valid
r8 AND r/m8.
23 /r
AND r16, r/m16
RM
Valid
Valid
r16 AND r/m16.
23 /r
AND r32, r/m32
RM
Valid
Valid
r32 AND r/m32.
REX.W + 23 /r
AND r64, r/m64
RM
Valid
N.E.
r64 AND r/m64.
NOTES:
1. With a REX prefix in 64-bit mode, attempts to access AH, BH, CH, or DH will instead access SPL, DIL, BPL, or SIL, respectively.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM
ModRM:reg (r, w)
ModRM:r/m (r)
N/A
N/A
MR
ModRM:r/m (r, w)
ModRM:reg (r)
N/A
N/A
MI
ModRM:r/m (r, w)
imm8/16/32
N/A
N/A
I
AL/AX/EAX/RAX
imm8/16/32
N/A
N/A
Description
Performs a bitwise AND operation on the destination (first) and source (second) operands and stores the result in
the destination operand location. The source operand can be an immediate, a register, or a memory location; the
destination operand can be a register or a memory location. (However, two memory operands cannot be used in
one instruction.) Each bit of the result is set to 1 if both corresponding bits of the first and second operands are 1;
otherwise, it is set to 0.
This instruction can be used with a LOCK prefix to allow the it to be executed atomically.
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.
Operation
DEST := DEST AND SRC;
AND-Logical AND
Vol. 2A
3-60
Flags Affected
The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is
undefined.
Protected Mode Exceptions
#GP(0)
If the destination operand points to a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
AND-Logical AND
Vol. 2A
3-61
ANDN-Logical AND NOT
Opcode/
Op/
64/32-
CPUID
Description
Instruction
En
bit
Feature
Mode
Flag
VEX.LZ.0F38.W0 F2 /r
RVM
V/V
BMI1
Bitwise AND of inverted r32b with r/m32, store result in r32a.
ANDN r32a, r32b, r/m32
VEX.LZ. 0F38.W1 F2 /r
RVM
V/N.E.
BMI1
Bitwise AND of inverted r64b with r/m64, store result in r64a.
ANDN r64a, r64b, r/m64
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RVM
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
Performs a bitwise logical AND of inverted second operand (the first source operand) with the third operand (the
second source operand). The result is stored in the first operand (destination operand).
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.
Operation
DEST := (NOT SRC1) bitwiseAND SRC2;
SF := DEST[OperandSize -1];
ZF := (DEST = 0);
Flags Affected
SF and ZF are updated based on result. OF and CF flags are cleared. AF and PF flags are undefined.
Intel C/C++ Compiler Intrinsic Equivalent
Auto-generated from high-level language.
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-29, “Type 13 Class Exception Conditions.”
ANDN-Logical AND NOT
Vol. 2A
3-62
ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
Opcode/
Op /
64/32 bit
CPUID Feature
Description
Instruction
En
Mode
Flag
Support
66 0F 55 /r
A
V/V
SSE2
Return the bitwise logical AND NOT of packed double
ANDNPD xmm1, xmm2/m128
precision floating-point values in xmm1 and
xmm2/mem.
VEX.128.66.0F 55 /r
B
V/V
AVX
Return the bitwise logical AND NOT of packed double
VANDNPD xmm1, xmm2,
precision floating-point values in xmm2 and
xmm3/m128
xmm3/mem.
VEX.256.66.0F 55/r
B
V/V
AVX
Return the bitwise logical AND NOT of packed double
VANDNPD ymm1, ymm2,
precision floating-point values in ymm2 and
ymm3/m256
ymm3/mem.
EVEX.128.66.0F.W1 55 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND NOT of packed double
VANDNPD xmm1 {k1}{z}, xmm2,
AVX512DQ) OR
precision floating-point values in xmm2 and
xmm3/m128/m64bcst
AVX10.1
xmm3/m128/m64bcst subject to writemask k1.
EVEX.256.66.0F.W1 55 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND NOT of packed double
VANDNPD ymm1 {k1}{z}, ymm2,
AVX512DQ) OR
precision floating-point values in ymm2 and
ymm3/m256/m64bcst
AVX10.1
ymm3/m256/m64bcst subject to writemask k1.
EVEX.512.66.0F.W1 55 /r
C
V/V
AVX512DQ
Return the bitwise logical AND NOT of packed double
VANDNPD zmm1 {k1}{z}, zmm2,
OR AVX10.1
precision floating-point values in zmm2 and
zmm3/m512/m64bcst
zmm3/m512/m64bcst subject to writemask k1.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (r, w)
ModRM:r/m (r)
N/A
N/A
B
N/A
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
C
Full
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
Performs a bitwise logical AND NOT of the two, four or eight packed double precision floating-point values from the
first source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with write-
mask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of
the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding
register destination are unmodified.
ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
Vol. 2A
3-63
Operation
VANDNPD (EVEX Encoded Versions)
(KL, VL) = (2, 128), (4, 256), (8, 512)
FOR j := 0 TO KL-1
i := j * 64
IF k1[j] OR *no writemask*
IF (EVEX.b == 1) AND (SRC2 *is memory*)
THEN
DEST[i+63:i] := (NOT(SRC1[i+63:i])) BITWISE AND SRC2[63:0]
ELSE
DEST[i+63:i] := (NOT(SRC1[i+63:i])) BITWISE AND SRC2[i+63:i]
FI;
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+63:i] remains unchanged*
ELSE
; zeroing-masking
DEST[i+63:i] = 0
FI;
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0
VANDNPD (VEX.256 Encoded Version)
DEST[63:0] := (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0]
DEST[127:64] := (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64]
DEST[191:128] := (NOT(SRC1[191:128])) BITWISE AND SRC2[191:128]
DEST[255:192] := (NOT(SRC1[255:192])) BITWISE AND SRC2[255:192]
DEST[MAXVL-1:256] := 0
VANDNPD (VEX.128 Encoded Version)
DEST[63:0] := (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0]
DEST[127:64] := (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64]
DEST[MAXVL-1:128] := 0
ANDNPD (128-bit Legacy SSE Version)
DEST[63:0] := (NOT(DEST[63:0])) BITWISE AND SRC[63:0]
DEST[127:64] := (NOT(DEST[127:64])) BITWISE AND SRC[127:64]
DEST[MAXVL-1:128] (Unmodified)
Intel C/C++ Compiler Intrinsic Equivalent
VANDNPD __m512d _mm512_andnot_pd (__m512d a, __m512d b);
VANDNPD __m512d _mm512_mask_andnot_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);
VANDNPD __m512d _mm512_maskz_andnot_pd (__mmask8 k, __m512d a, __m512d b);
VANDNPD __m256d _mm256_mask_andnot_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);
VANDNPD __m256d _mm256_maskz_andnot_pd (__mmask8 k, __m256d a, __m256d b);
VANDNPD __m128d _mm_mask_andnot_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);
VANDNPD __m128d _mm_maskz_andnot_pd (__mmask8 k, __m128d a, __m128d b);
VANDNPD __m256d _mm256_andnot_pd (__m256d a, __m256d b);
ANDNPD __m128d _mm_andnot_pd (__m128d a, __m128d b);
SIMD Floating-Point Exceptions
None.
ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
Vol. 2A
3-64
Other Exceptions
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”
EVEX-encoded instruction, see Table 2-51, “Type E4 Class Exception Conditions.”
ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
Vol. 2A
3-65
ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values
Opcode/
Op /
64/32 bit
CPUID Feature
Description
Instruction
En
Mode
Flag
Support
NP 0F 55 /r
A
V/V
SSE
Return the bitwise logical AND NOT of packed single
ANDNPS xmm1, xmm2/m128
precision floating-point values in xmm1 and xmm2/mem.
VEX.128.0F 55 /r
B
V/V
AVX
Return the bitwise logical AND NOT of packed single
VANDNPS xmm1, xmm2,
precision floating-point values in xmm2 and xmm3/mem.
xmm3/m128
VEX.256.0F 55 /r
B
V/V
AVX
Return the bitwise logical AND NOT of packed single
VANDNPS ymm1, ymm2,
precision floating-point values in ymm2 and ymm3/mem.
ymm3/m256
EVEX.128.0F.W0 55 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND of packed single precision
VANDNPS xmm1 {k1}{z}, xmm2,
AVX512DQ) OR
floating-point values in xmm2 and xmm3/m128/m32bcst
xmm3/m128/m32bcst
AVX10.1
subject to writemask k1.
EVEX.256.0F.W0 55 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND of packed single precision
VANDNPS ymm1 {k1}{z}, ymm2,
AVX512DQ) OR
floating-point values in ymm2 and ymm3/m256/m32bcst
ymm3/m256/m32bcst
AVX10.1
subject to writemask k1.
EVEX.512.0F.W0 55 /r
C
V/V
AVX512DQ
Return the bitwise logical AND of packed single precision
VANDNPS zmm1 {k1}{z}, zmm2,
OR AVX10.1
floating-point values in zmm2 and zmm3/m512/m32bcst
zmm3/m512/m32bcst
subject to writemask k1.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (r, w)
ModRM:r/m (r)
N/A
N/A
B
N/A
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
C
Full
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
Performs a bitwise logical AND NOT of the four, eight or sixteen packed single precision floating-point values from
the first source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with write-
mask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of
the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding
ZMM register destination are unmodified.
ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values
Vol. 2A
3-66
Operation
VANDNPS (EVEX Encoded Versions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j := 0 TO KL-1
i := j * 32
IF k1[j] OR *no writemask*
IF (EVEX.b == 1) AND (SRC2 *is memory*)
THEN
DEST[i+31:i] := (NOT(SRC1[i+31:i])) BITWISE AND SRC2[31:0]
ELSE
DEST[i+31:i] := (NOT(SRC1[i+31:i])) BITWISE AND SRC2[i+31:i]
FI;
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+31:i] remains unchanged*
ELSE
; zeroing-masking
DEST[i+31:i] = 0
FI;
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0
VANDNPS (VEX.256 Encoded Version)
DEST[31:0] := (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0]
DEST[63:32] := (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32]
DEST[95:64] := (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64]
DEST[127:96] := (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96]
DEST[159:128] := (NOT(SRC1[159:128])) BITWISE AND SRC2[159:128]
DEST[191:160] := (NOT(SRC1[191:160])) BITWISE AND SRC2[191:160]
DEST[223:192] := (NOT(SRC1[223:192])) BITWISE AND SRC2[223:192]
DEST[255:224] := (NOT(SRC1[255:224])) BITWISE AND SRC2[255:224].
DEST[MAXVL-1:256] := 0
VANDNPS (VEX.128 Encoded Version)
DEST[31:0] := (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0]
DEST[63:32] := (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32]
DEST[95:64] := (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64]
DEST[127:96] := (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96]
DEST[MAXVL-1:128] := 0
ANDNPS (128-bit Legacy SSE Version)
DEST[31:0] := (NOT(DEST[31:0])) BITWISE AND SRC[31:0]
DEST[63:32] := (NOT(DEST[63:32])) BITWISE AND SRC[63:32]
DEST[95:64] := (NOT(DEST[95:64])) BITWISE AND SRC[95:64]
DEST[127:96] := (NOT(DEST[127:96])) BITWISE AND SRC[127:96]
DEST[MAXVL-1:128] (Unmodified)
ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values
Vol. 2A
3-67
Intel C/C++ Compiler Intrinsic Equivalent
VANDNPS __m512 _mm512_andnot_ps (__m512 a, __m512 b);
VANDNPS __m512 _mm512_mask_andnot_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);
VANDNPS __m512 _mm512_maskz_andnot_ps (__mmask16 k, __m512 a, __m512 b);
VANDNPS __m256 _mm256_mask_andnot_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);
VANDNPS __m256 _mm256_maskz_andnot_ps (__mmask8 k, __m256 a, __m256 b);
VANDNPS __m128 _mm_mask_andnot_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);
VANDNPS __m128 _mm_maskz_andnot_ps (__mmask8 k, __m128 a, __m128 b);
VANDNPS __m256 _mm256_andnot_ps (__m256 a, __m256 b);
ANDNPS __m128 _mm_andnot_ps (__m128 a, __m128 b);
SIMD Floating-Point Exceptions
None.
Other Exceptions
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”
EVEX-encoded instruction, see Table 2-51, “Type E4 Class Exception Conditions.”
ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values
Vol. 2A
3-68
ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values
Opcode/
Op /
64/32 bit
CPUID Feature
Description
Instruction
En
Mode
Flag
Support
66 0F 54 /r
A
V/V
SSE2
Return the bitwise logical AND of packed double
ANDPD xmm1, xmm2/m128
precision floating-point values in xmm1 and
xmm2/mem.
VEX.128.66.0F 54 /r
B
V/V
AVX
Return the bitwise logical AND of packed double
VANDPD xmm1, xmm2, xmm3/m128
precision floating-point values in xmm2 and
xmm3/mem.
VEX.256.66.0F 54 /r
B
V/V
AVX
Return the bitwise logical AND of packed double
VANDPD ymm1, ymm2, ymm3/m256
precision floating-point values in ymm2 and
ymm3/mem.
EVEX.128.66.0F.W1 54 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND of packed double
VANDPD xmm1 {k1}{z}, xmm2,
AVX512DQ) OR
precision floating-point values in xmm2 and
xmm3/m128/m64bcst
AVX10.1
xmm3/m128/m64bcst subject to writemask k1.
EVEX.256.66.0F.W1 54 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND of packed double
VANDPD ymm1 {k1}{z}, ymm2,
AVX512DQ) OR
precision floating-point values in ymm2 and
ymm3/m256/m64bcst
AVX10.1
ymm3/m256/m64bcst subject to writemask k1.
EVEX.512.66.0F.W1 54 /r
C
V/V
AVX512DQ
Return the bitwise logical AND of packed double
VANDPD zmm1 {k1}{z}, zmm2,
OR AVX10.1
precision floating-point values in zmm2 and
zmm3/m512/m64bcst
zmm3/m512/m64bcst subject to writemask k1.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (r, w)
ModRM:r/m (r)
N/A
N/A
B
N/A
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
C
Full
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
Performs a bitwise logical AND of the two, four or eight packed double precision floating-point values from the first
source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with write-
mask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of
the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding
register destination are unmodified.
ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values
Vol. 2A
3-69
Operation
VANDPD (EVEX Encoded Versions)
(KL, VL) = (2, 128), (4, 256), (8, 512)
FOR j := 0 TO KL-1
i := j * 64
IF k1[j] OR *no writemask*
THEN
IF (EVEX.b == 1) AND (SRC2 *is memory*)
THEN
DEST[i+63:i] := SRC1[i+63:i] BITWISE AND SRC2[63:0]
ELSE
DEST[i+63:i] := SRC1[i+63:i] BITWISE AND SRC2[i+63:i]
FI;
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+63:i] remains unchanged*
ELSE
; zeroing-masking
DEST[i+63:i] = 0
FI;
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0
VANDPD (VEX.256 Encoded Version)
DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0]
DEST[127:64] := SRC1[127:64] BITWISE AND SRC2[127:64]
DEST[191:128] := SRC1[191:128] BITWISE AND SRC2[191:128]
DEST[255:192] := SRC1[255:192] BITWISE AND SRC2[255:192]
DEST[MAXVL-1:256] := 0
VANDPD (VEX.128 Encoded Version)
DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0]
DEST[127:64] := SRC1[127:64] BITWISE AND SRC2[127:64]
DEST[MAXVL-1:128] := 0
ANDPD (128-bit Legacy SSE Version)
DEST[63:0] := DEST[63:0] BITWISE AND SRC[63:0]
DEST[127:64] := DEST[127:64] BITWISE AND SRC[127:64]
DEST[MAXVL-1:128] (Unmodified)
Intel C/C++ Compiler Intrinsic Equivalent
VANDPD __m512d _mm512_and_pd (__m512d a, __m512d b);
VANDPD __m512d _mm512_mask_and_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);
VANDPD __m512d _mm512_maskz_and_pd (__mmask8 k, __m512d a, __m512d b);
VANDPD __m256d _mm256_mask_and_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);
VANDPD __m256d _mm256_maskz_and_pd (__mmask8 k, __m256d a, __m256d b);
VANDPD __m128d _mm_mask_and_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);
VANDPD __m128d _mm_maskz_and_pd (__mmask8 k, __m128d a, __m128d b);
VANDPD __m256d _mm256_and_pd (__m256d a, __m256d b);
ANDPD __m128d _mm_and_pd (__m128d a, __m128d b);
SIMD Floating-Point Exceptions
None.
ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values
Vol. 2A
3-70
Other Exceptions
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”
EVEX-encoded instruction, see Table 2-51, “Type E4 Class Exception Conditions.”
ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values
Vol. 2A
3-71
ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values
Opcode/
Op /
64/32 bit
CPUID Feature
Description
Instruction
En
Mode
Flag
Support
NP 0F 54 /r
A
V/V
SSE
Return the bitwise logical AND of packed single precision
ANDPS xmm1, xmm2/m128
floating-point values in xmm1 and xmm2/mem.
VEX.128.0F 54 /r
B
V/V
AVX
Return the bitwise logical AND of packed single precision
VANDPS xmm1,xmm2,
floating-point values in xmm2 and xmm3/mem.
xmm3/m128
VEX.256.0F 54 /r
B
V/V
AVX
Return the bitwise logical AND of packed single precision
VANDPS ymm1, ymm2,
floating-point values in ymm2 and ymm3/mem.
ymm3/m256
EVEX.128.0F.W0 54 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND of packed single precision
VANDPS xmm1 {k1}{z}, xmm2,
AVX512DQ) OR
floating-point values in xmm2 and xmm3/m128/m32bcst
xmm3/m128/m32bcst
AVX10.1
subject to writemask k1.
EVEX.256.0F.W0 54 /r
C
V/V
(AVX512VL AND
Return the bitwise logical AND of packed single precision
VANDPS ymm1 {k1}{z}, ymm2,
AVX512DQ) OR
floating-point values in ymm2 and ymm3/m256/m32bcst
ymm3/m256/m32bcst
AVX10.1
subject to writemask k1.
EVEX.512.0F.W0 54 /r
C
V/V
AVX512DQ
Return the bitwise logical AND of packed single precision
VANDPS zmm1 {k1}{z}, zmm2,
OR AVX10.1
floating-point values in zmm2 and zmm3/m512/m32bcst
zmm3/m512/m32bcst
subject to writemask k1.
Instruction Operand Encoding
Op/En
Tuple Type
Operand 1
Operand 2
Operand 3
Operand 4
A
N/A
ModRM:reg (r, w)
ModRM:r/m (r)
N/A
N/A
B
N/A
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
N/A
C
Full
ModRM:reg (w)
EVEX.vvvv (r)
ModRM:r/m (r)
N/A
Description
Performs a bitwise logical AND of the four, eight or sixteen packed single precision floating-point values from the
first source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with write-
mask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of
the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding
ZMM register destination are unmodified.
ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values
Vol. 2A
3-72
Operation
VANDPS (EVEX Encoded Versions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j := 0 TO KL-1
i := j * 32
IF k1[j] OR *no writemask*
IF (EVEX.b == 1) AND (SRC2 *is memory*)
THEN
DEST[i+63:i] := SRC1[i+31:i] BITWISE AND SRC2[31:0]
ELSE
DEST[i+31:i] := SRC1[i+31:i] BITWISE AND SRC2[i+31:i]
FI;
ELSE
IF *merging-masking*
; merging-masking
THEN *DEST[i+31:i] remains unchanged*
ELSE
; zeroing-masking
DEST[i+31:i] := 0
FI;
FI;
ENDFOR
DEST[MAXVL-1:VL] := 0;
VANDPS (VEX.256 Encoded Version)
DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0]
DEST[63:32] := SRC1[63:32] BITWISE AND SRC2[63:32]
DEST[95:64] := SRC1[95:64] BITWISE AND SRC2[95:64]
DEST[127:96] := SRC1[127:96] BITWISE AND SRC2[127:96]
DEST[159:128] := SRC1[159:128] BITWISE AND SRC2[159:128]
DEST[191:160] := SRC1[191:160] BITWISE AND SRC2[191:160]
DEST[223:192] := SRC1[223:192] BITWISE AND SRC2[223:192]
DEST[255:224] := SRC1[255:224] BITWISE AND SRC2[255:224].
DEST[MAXVL-1:256] := 0;
VANDPS (VEX.128 Encoded Version)
DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0]
DEST[63:32] := SRC1[63:32] BITWISE AND SRC2[63:32]
DEST[95:64] := SRC1[95:64] BITWISE AND SRC2[95:64]
DEST[127:96] := SRC1[127:96] BITWISE AND SRC2[127:96]
DEST[MAXVL-1:128] := 0;
ANDPS (128-bit Legacy SSE Version)
DEST[31:0] := DEST[31:0] BITWISE AND SRC[31:0]
DEST[63:32] := DEST[63:32] BITWISE AND SRC[63:32]
DEST[95:64] := DEST[95:64] BITWISE AND SRC[95:64]
DEST[127:96] := DEST[127:96] BITWISE AND SRC[127:96]
DEST[MAXVL-1:128] (Unmodified)
ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values
Vol. 2A
3-73
Intel C/C++ Compiler Intrinsic Equivalent
VANDPS __m512 _mm512_and_ps (__m512 a, __m512 b);
VANDPS __m512 _mm512_mask_and_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);
VANDPS __m512 _mm512_maskz_and_ps (__mmask16 k, __m512 a, __m512 b);
VANDPS __m256 _mm256_mask_and_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);
VANDPS __m256 _mm256_maskz_and_ps (__mmask8 k, __m256 a, __m256 b);
VANDPS __m128 _mm_mask_and_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);
VANDPS __m128 _mm_maskz_and_ps (__mmask8 k, __m128 a, __m128 b);
VANDPS __m256 _mm256_and_ps (__m256 a, __m256 b);
ANDPS __m128 _mm_and_ps (__m128 a, __m128 b);
SIMD Floating-Point Exceptions
None.
Other Exceptions
VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”
EVEX-encoded instruction, see Table 2-51, “Type E4 Class Exception Conditions.”
ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values
Vol. 2A
3-74
ARPL-Adjust RPL Field of Segment Selector
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
63 /r
ARPL r/m16, r16
MR
N. E.
Valid
Adjust RPL of r/m16 to not less than RPL of
r16.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
MR
ModRM:r/m (w)
ModRM:reg (r)
N/A
N/A
Description
Compares the RPL fields of two segment selectors. The first operand (the destination operand) contains one
segment selector and the second operand (source operand) contains the other. (The RPL field is located in bits 0
and 1 of each operand.) If the RPL field of the destination operand is less than the RPL field of the source operand,
the ZF flag is set and the RPL field of the destination operand is increased to match that of the source operand.
Otherwise, the ZF flag is cleared and no change is made to the destination operand. (The destination operand can
be a word register or a memory location; the source operand must be a word register.)
The ARPL instruction is provided for use by operating-system procedures (however, it can also be used by applica-
tions). It is generally used to adjust the RPL of a segment selector that has been passed to the operating system
by an application program to match the privilege level of the application program. Here the segment selector
passed to the operating system is placed in the destination operand and segment selector for the application
program’s code segment is placed in the source operand. (The RPL field in the source operand represents the priv-
ilege level of the application program.) Execution of the ARPL instruction then ensures that the RPL of the segment
selector received by the operating system is no lower (does not have a higher privilege) than the privilege level of
the application program (the segment selector for the application program’s code segment can be read from the
stack following a procedure call).
This instruction executes as described in compatibility mode and legacy mode. It is not encodable in 64-bit mode.
See “Checking Caller Access Privileges” in Chapter 3, “Protected-Mode Memory Management,” of the Intel® 64 and
IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information about the use of this instruc-
tion.
Operation
IF 64-BIT MODE
THEN
See MOVSXD;
ELSE
IF DEST[RPL] < SRC[RPL]
THEN
ZF := 1;
DEST[RPL] := SRC[RPL];
ELSE
ZF := 0;
FI;
FI;
Flags Affected
The ZF flag is set to 1 if the RPL field of the destination operand is less than that of the source operand; otherwise,
it is set to 0.
ARPL-Adjust RPL Field of Segment Selector
Vol. 2A
3-75
Protected Mode Exceptions
#GP(0)
If the destination is located in a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#UD
The ARPL instruction is not recognized in real-address mode.
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#UD
The ARPL instruction is not recognized in virtual-8086 mode.
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
Not applicable.
ARPL-Adjust RPL Field of Segment Selector
Vol. 2A
3-76
BEXTR-Bit Field Extract
Opcode/Instruction
Op/
64/32-
CPUID
Description
En
bit
Feature
Mode
Flag
VEX.LZ.0F38.W0 F7 /r
RMV
V/V
BMI1
Contiguous bitwise extract from r/m32 using r32b as control; store
BEXTR r32a, r/m32, r32b
result in r32a.
VEX.LZ.0F38.W1 F7 /r
RMV
V/N.E.
BMI1
Contiguous bitwise extract from r/m64 using r64b as control; store
BEXTR r64a, r/m64, r64b
result in r64a.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RMV
ModRM:reg (w)
ModRM:r/m (r)
VEX.vvvv (r)
N/A
Description
Extracts contiguous bits from the first source operand (the second operand) using an index value and length value
specified in the second source operand (the third operand). Bit 7:0 of the second source operand specifies the
starting bit position of bit extraction. A START value exceeding the operand size will not extract any bits from the
second source operand. Bit 15:8 of the second source operand specifies the maximum number of bits (LENGTH)
beginning at the START position to extract. Only bit positions up to (OperandSize -1) of the first source operand are
extracted. The extracted bits are written to the destination register, starting from the least significant bit. All higher
order bits in the destination operand (starting at bit position LENGTH) are zeroed. The destination register is
cleared if no bits are extracted.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.
Operation
START := SRC2[7:0];
LEN := SRC2[15:8];
TEMP := ZERO_EXTEND_TO_512 (SRC1 );
DEST := ZERO_EXTEND(TEMP[START+LEN -1: START]);
ZF := (DEST = 0);
Flags Affected
ZF is updated based on the result. AF, SF, and PF are undefined. All other flags are cleared.
Intel C/C++ Compiler Intrinsic Equivalent
BEXTR unsigned __int32 _bextr_u32(unsigned __int32 src, unsigned __int32 start. unsigned __int32 len);
BEXTR unsigned __int64 _bextr_u64(unsigned __int64 src, unsigned __int32 start. unsigned __int32 len);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-29, “Type 13 Class Exception Conditions,” additionally:
#UD
If VEX.W = 1.
BEXTR-Bit Field Extract
Vol. 2A
3-77
BLENDPD-Blend Packed Double Precision Floating-Point Values
Opcode/
Op/
64/32-bit
CPUID
Description
Instruction
En
Mode
Feature
Flag
66 0F 3A 0D /r ib
RMI
V/V
SSE4_1
Select packed double precision floating-point
values from xmm1 and xmm2/m128 from
BLENDPD xmm1, xmm2/m128, imm8
mask specified in imm8 and store the values
into xmm1.
VEX.128.66.0F3A.WIG 0D /r ib
RVMI
V/V
AVX
Select packed double precision floating-point
Values from xmm2 and xmm3/m128 from
VBLENDPD xmm1, xmm2, xmm3/m128, imm8
mask in imm8 and store the values in xmm1.
VEX.256.66.0F3A.WIG 0D /r ib
RVMI
V/V
AVX
Select packed double precision floating-point
Values from ymm2 and ymm3/m256 from
VBLENDPD ymm1, ymm2, ymm3/m256, imm8
mask in imm8 and store the values in ymm1.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RMI
ModRM:reg (r, w)
ModRM:r/m (r)
imm8
N/A
RVMI
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8[3:0]
Description
Double precision floating-point values from the second source operand (third operand) are conditionally merged
with values from the first source operand (second operand) and written to the destination operand (first operand).
The immediate bits [3:0] determine whether the corresponding double precision floating-point value in the desti-
nation is copied from the second source or first source. If a bit in the mask, corresponding to a word, is ”1”, then
the double precision floating-point value in the second source operand is copied, else the value in the first source
operand is copied.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding
YMM register destination are unmodified.
VEX.128 encoded version: the first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of
the corresponding YMM register destination are zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register.
Operation
BLENDPD (128-bit Legacy SSE Version)
IF (IMM8[0] = 0)THEN DEST[63:0] := DEST[63:0]
ELSE DEST [63:0] := SRC[63:0] FI
IF (IMM8[1] = 0) THEN DEST[127:64] := DEST[127:64]
ELSE DEST [127:64] := SRC[127:64] FI
DEST[MAXVL-1:128] (Unmodified)
VBLENDPD (VEX.128 Encoded Version)
IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0]
ELSE DEST [63:0] := SRC2[63:0] FI
IF (IMM8[1] = 0) THEN DEST[127:64] := SRC1[127:64]
ELSE DEST [127:64] := SRC2[127:64] FI
DEST[MAXVL-1:128] := 0
BLENDPD-Blend Packed Double Precision Floating-Point Values
Vol. 2A
3-78
VBLENDPD (VEX.256 Encoded Version)
IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0]
ELSE DEST [63:0] := SRC2[63:0] FI
IF (IMM8[1] = 0) THEN DEST[127:64] := SRC1[127:64]
ELSE DEST [127:64] := SRC2[127:64] FI
IF (IMM8[2] = 0) THEN DEST[191:128] := SRC1[191:128]
ELSE DEST [191:128] := SRC2[191:128] FI
IF (IMM8[3] = 0) THEN DEST[255:192] := SRC1[255:192]
ELSE DEST [255:192] := SRC2[255:192] FI
Intel C/C++ Compiler Intrinsic Equivalent
BLENDPD __m128d _mm_blend_pd (__m128d v1, __m128d v2, const int mask);
VBLENDPD __m256d _mm256_blend_pd (__m256d a, __m256d b, const int mask);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-21, “Type 4 Class Exception Conditions.”
BLENDPD-Blend Packed Double Precision Floating-Point Values
Vol. 2A
3-79
BLENDPS-Blend Packed Single Precision Floating-Point Values
Opcode/
Op/
64/32-bit
CPUID
Description
Instruction
En
Mode
Feature
Flag
66 0F 3A 0C /r ib
RMI
V/V
SSE4_1
Select packed single precision floating-point
values from xmm1 and xmm2/m128 from
BLENDPS xmm1, xmm2/m128, imm8
mask specified in imm8 and store the values
into xmm1.
VEX.128.66.0F3A.WIG 0C /r ib
RVMI
V/V
AVX
Select packed single precision floating-point
values from xmm2 and xmm3/m128 from
VBLENDPS xmm1, xmm2, xmm3/m128, imm8
mask in imm8 and store the values in xmm1.
VEX.256.66.0F3A.WIG 0C /r ib
RVMI
V/V
AVX
Select packed single precision floating-point
values from ymm2 and ymm3/m256 from
VBLENDPS ymm1, ymm2, ymm3/m256, imm8
mask in imm8 and store the values in ymm1.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RMI
ModRM:reg (r, w)
ModRM:r/m (r)
imm8
N/A
RVMI
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8
Description
Packed single precision floating-point values from the second source operand (third operand) are conditionally
merged with values from the first source operand (second operand) and written to the destination operand (first
operand). The immediate bits [7:0] determine whether the corresponding single precision floating-point value in
the destination is copied from the second source or first source. If a bit in the mask, corresponding to a word, is
“1”, then the single precision floating-point value in the second source operand is copied, else the value in the first
source operand is copied.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding
YMM register destination are unmodified.
VEX.128 encoded version: The first source operand an XMM register. The second source operand is an XMM register
or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of the
corresponding YMM register destination are zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register.
Operation
BLENDPS (128-bit Legacy SSE Version)
IF (IMM8[0] = 0) THEN DEST[31:0] :=DEST[31:0]
ELSE DEST [31:0] := SRC[31:0] FI
IF (IMM8[1] = 0) THEN DEST[63:32] := DEST[63:32]
ELSE DEST [63:32] := SRC[63:32] FI
IF (IMM8[2] = 0) THEN DEST[95:64] := DEST[95:64]
ELSE DEST [95:64] := SRC[95:64] FI
IF (IMM8[3] = 0) THEN DEST[127:96] := DEST[127:96]
ELSE DEST [127:96] := SRC[127:96] FI
DEST[MAXVL-1:128] (Unmodified)
BLENDPS-Blend Packed Single Precision Floating-Point Values
Vol. 2A
3-80
VBLENDPS (VEX.128 Encoded Version)
IF (IMM8[0] = 0) THEN DEST[31:0] :=SRC1[31:0]
ELSE DEST [31:0] := SRC2[31:0] FI
IF (IMM8[1] = 0) THEN DEST[63:32] := SRC1[63:32]
ELSE DEST [63:32] := SRC2[63:32] FI
IF (IMM8[2] = 0) THEN DEST[95:64] := SRC1[95:64]
ELSE DEST [95:64] := SRC2[95:64] FI
IF (IMM8[3] = 0) THEN DEST[127:96] := SRC1[127:96]
ELSE DEST [127:96] := SRC2[127:96] FI
DEST[MAXVL-1:128] := 0
VBLENDPS (VEX.256 Encoded Version)
IF (IMM8[0] = 0) THEN DEST[31:0] :=SRC1[31:0]
ELSE DEST [31:0] := SRC2[31:0] FI
IF (IMM8[1] = 0) THEN DEST[63:32] := SRC1[63:32]
ELSE DEST [63:32] := SRC2[63:32] FI
IF (IMM8[2] = 0) THEN DEST[95:64] := SRC1[95:64]
ELSE DEST [95:64] := SRC2[95:64] FI
IF (IMM8[3] = 0) THEN DEST[127:96] := SRC1[127:96]
ELSE DEST [127:96] := SRC2[127:96] FI
IF (IMM8[4] = 0) THEN DEST[159:128] := SRC1[159:128]
ELSE DEST [159:128] := SRC2[159:128] FI
IF (IMM8[5] = 0) THEN DEST[191:160] := SRC1[191:160]
ELSE DEST [191:160] := SRC2[191:160] FI
IF (IMM8[6] = 0) THEN DEST[223:192] := SRC1[223:192]
ELSE DEST [223:192] := SRC2[223:192] FI
IF (IMM8[7] = 0) THEN DEST[255:224] := SRC1[255:224]
ELSE DEST [255:224] := SRC2[255:224] FI.
Intel C/C++ Compiler Intrinsic Equivalent
BLENDPS __m128 _mm_blend_ps (__m128 v1, __m128 v2, const int mask);
VBLENDPS __m256 _mm256_blend_ps (__m256 a, __m256 b, const int mask);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-21, “Type 4 Class Exception Conditions.”
BLENDPS-Blend Packed Single Precision Floating-Point Values
Vol. 2A
3-81
BLENDVPD-Variable Blend Packed Double Precision Floating-Point Values
Opcode/
Op/
64/32-bit
CPUID
Description
Instruction
En
Mode
Feature
Flag
66 0F 38 15 /r
RM0
V/V
SSE4_1
Select packed double precision floating-point
values from xmm1 and xmm2 from mask specified
BLENDVPD xmm1, xmm2/m128 , <XMM0>
in XMM0 and store the values in xmm1.
VEX.128.66.0F3A.W0 4B /r /is4
RVMR
V/V
AVX
Conditionally copy double precision floating-point
values from xmm2 or xmm3/m128 to xmm1, based
VBLENDVPD xmm1, xmm2, xmm3/m128, xmm4
on mask bits in the mask operand, xmm4.
VEX.256.66.0F3A.W0 4B /r /is4
RVMR
V/V
AVX
Conditionally copy double precision floating-point
values from ymm2 or ymm3/m256 to ymm1, based
VBLENDVPD ymm1, ymm2, ymm3/m256, ymm4
on mask bits in the mask operand, ymm4.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM0
ModRM:reg (r, w)
ModRM:r/m (r)
implicit XMM0
N/A
RVMR
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8[7:4]
Description
Conditionally copy each quadword data element of double precision floating-point value from the second source
operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits
are the most significant bit in each quadword element of the mask register.
Each quadword element of the destination operand is copied from:
• the corresponding quadword element in the second source operand, if a mask bit is “1”; or
• the corresponding quadword element in the first source operand, if a mask bit is “0”
The register assignment of the implicit mask operand for BLENDVPD is defined to be the architectural register
XMM0.
128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128)
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined
to be the architectural register XMM0. An attempt to execute BLENDVPD with a VEX prefix will cause #UD.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed.
VEX.W must be 0, otherwise, the instruction will #UD.
VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source
operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. VEX.W must be 0, otherwise, the instruction will #UD.
VBLENDVPD permits the mask to be any XMM or YMM register. In contrast, BLENDVPD treats XMM0 implicitly as the
mask and do not support non-destructive destination operation.
BLENDVPD-Variable Blend Packed Double Precision Floating-Point Values
Vol. 2A
3-82
Operation
BLENDVPD (128-bit Legacy SSE Version)
MASK := XMM0
IF (MASK[63] = 0) THEN DEST[63:0] := DEST[63:0]
ELSE DEST [63:0] := SRC[63:0] FI
IF (MASK[127] = 0) THEN DEST[127:64] := DEST[127:64]
ELSE DEST [127:64] := SRC[127:64] FI
DEST[MAXVL-1:128] (Unmodified)
VBLENDVPD (VEX.128 Encoded Version)
MASK := SRC3
IF (MASK[63] = 0) THEN DEST[63:0] := SRC1[63:0]
ELSE DEST [63:0] := SRC2[63:0] FI
IF (MASK[127] = 0) THEN DEST[127:64] := SRC1[127:64]
ELSE DEST [127:64] := SRC2[127:64] FI
DEST[MAXVL-1:128] := 0
VBLENDVPD (VEX.256 Encoded Version)
MASK := SRC3
IF (MASK[63] = 0) THEN DEST[63:0] := SRC1[63:0]
ELSE DEST [63:0] := SRC2[63:0] FI
IF (MASK[127] = 0) THEN DEST[127:64] := SRC1[127:64]
ELSE DEST [127:64] := SRC2[127:64] FI
IF (MASK[191] = 0) THEN DEST[191:128] := SRC1[191:128]
ELSE DEST [191:128] := SRC2[191:128] FI
IF (MASK[255] = 0) THEN DEST[255:192] := SRC1[255:192]
ELSE DEST [255:192] := SRC2[255:192] FI
Intel C/C++ Compiler Intrinsic Equivalent
BLENDVPD __m128d _mm_blendv_pd(__m128d v1, __m128d v2, __m128d v3);
VBLENDVPD __m128 _mm_blendv_pd (__m128d a, __m128d b, __m128d mask);
VBLENDVPD __m256 _mm256_blendv_pd (__m256d a, __m256d b, __m256d mask);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-21, “Type 4 Class Exception Conditions,” additionally:
#UD
If VEX.W = 1.
BLENDVPD-Variable Blend Packed Double Precision Floating-Point Values
Vol. 2A
3-83
BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values
Opcode/
Op/
64/32-bit
CPUID
Description
Instruction
En
Mode
Feature
Flag
66 0F 38 14 /r
RM0
V/V
SSE4_1
Select packed single precision floating-point values
from xmm1 and xmm2/m128 from mask specified
BLENDVPS xmm1, xmm2/m128, <XMM0>
in XMM0 and store the values into xmm1.
VEX.128.66.0F3A.W0 4A /r /is4
RVMR
V/V
AVX
Conditionally copy single precision floating-point
values from xmm2 or xmm3/m128 to xmm1, based
VBLENDVPS xmm1, xmm2, xmm3/m128, xmm4
on mask bits in the specified mask operand, xmm4.
VEX.256.66.0F3A.W0 4A /r /is4
RVMR
V/V
AVX
Conditionally copy single precision floating-point
values from ymm2 or ymm3/m256 to ymm1, based
VBLENDVPS ymm1, ymm2, ymm3/m256, ymm4
on mask bits in the specified mask register, ymm4.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM0
ModRM:reg (r, w)
ModRM:r/m (r)
implicit XMM0
N/A
RVMR
ModRM:reg (w)
VEX.vvvv (r)
ModRM:r/m (r)
imm8[7:4]
Description
Conditionally copy each dword data element of single precision floating-point value from the second source
operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits
are the most significant bit in each dword element of the mask register.
Each quadword element of the destination operand is copied from:
• the corresponding dword element in the second source operand, if a mask bit is “1”; or
• the corresponding dword element in the first source operand, if a mask bit is “0”.
The register assignment of the implicit mask operand for BLENDVPS is defined to be the architectural register
XMM0.
128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128)
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined
to be the architectural register XMM0. An attempt to execute BLENDVPS with a VEX prefix will cause #UD.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed.
VEX.W must be 0, otherwise, the instruction will #UD.
VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source
operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. VEX.W must be 0, otherwise, the instruction will #UD.
VBLENDVPS permits the mask to be any XMM or YMM register. In contrast, BLENDVPS treats XMM0 implicitly as the
mask and do not support non-destructive destination operation.
BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values
Vol. 2A
3-84
Operation
BLENDVPS (128-bit Legacy SSE Version)
MASK := XMM0
IF (MASK[31] = 0) THEN DEST[31:0] := DEST[31:0]
ELSE DEST [31:0] := SRC[31:0] FI
IF (MASK[63] = 0) THEN DEST[63:32] := DEST[63:32]
ELSE DEST [63:32] := SRC[63:32] FI
IF (MASK[95] = 0) THEN DEST[95:64] := DEST[95:64]
ELSE DEST [95:64] := SRC[95:64] FI
IF (MASK[127] = 0) THEN DEST[127:96] := DEST[127:96]
ELSE DEST [127:96] := SRC[127:96] FI
DEST[MAXVL-1:128] (Unmodified)
VBLENDVPS (VEX.128 Encoded Version)
MASK := SRC3
IF (MASK[31] = 0) THEN DEST[31:0] := SRC1[31:0]
ELSE DEST [31:0] := SRC2[31:0] FI
IF (MASK[63] = 0) THEN DEST[63:32] := SRC1[63:32]
ELSE DEST [63:32] := SRC2[63:32] FI
IF (MASK[95] = 0) THEN DEST[95:64] := SRC1[95:64]
ELSE DEST [95:64] := SRC2[95:64] FI
IF (MASK[127] = 0) THEN DEST[127:96] := SRC1[127:96]
ELSE DEST [127:96] := SRC2[127:96] FI
DEST[MAXVL-1:128] := 0
VBLENDVPS (VEX.256 Encoded Version)
MASK := SRC3
IF (MASK[31] = 0) THEN DEST[31:0] := SRC1[31:0]
ELSE DEST [31:0] := SRC2[31:0] FI
IF (MASK[63] = 0) THEN DEST[63:32] := SRC1[63:32]
ELSE DEST [63:32] := SRC2[63:32] FI
IF (MASK[95] = 0) THEN DEST[95:64] := SRC1[95:64]
ELSE DEST [95:64] := SRC2[95:64] FI
IF (MASK[127] = 0) THEN DEST[127:96] := SRC1[127:96]
ELSE DEST [127:96] := SRC2[127:96] FI
IF (MASK[159] = 0) THEN DEST[159:128] := SRC1[159:128]
ELSE DEST [159:128] := SRC2[159:128] FI
IF (MASK[191] = 0) THEN DEST[191:160] := SRC1[191:160]
ELSE DEST [191:160] := SRC2[191:160] FI
IF (MASK[223] = 0) THEN DEST[223:192] := SRC1[223:192]
ELSE DEST [223:192] := SRC2[223:192] FI
IF (MASK[255] = 0) THEN DEST[255:224] := SRC1[255:224]
ELSE DEST [255:224] := SRC2[255:224] FI
Intel C/C++ Compiler Intrinsic Equivalent
BLENDVPS __m128 _mm_blendv_ps(__m128 v1, __m128 v2, __m128 v3);
VBLENDVPS __m128 _mm_blendv_ps (__m128 a, __m128 b, __m128 mask);
VBLENDVPS __m256 _mm256_blendv_ps (__m256 a, __m256 b, __m256 mask);
SIMD Floating-Point Exceptions
None.
BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values
Vol. 2A
3-85
Other Exceptions
See Table 2-21, “Type 4 Class Exception Conditions,” additionally:
#UD
If VEX.W = 1.
BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values
Vol. 2A
3-86
BLSI-Extract Lowest Set Isolated Bit
Opcode/Instruction
Op/
64/32-
CPUID
Description
En
bit
Feature
Mode
Flag
VEX.LZ.0F38.W0 F3 /3
VM
V/V
BMI1
Extract lowest set bit from r/m32 and set that bit in r32.
BLSI r32, r/m32
VEX.LZ.0F38.W1 F3 /3
VM
V/N.E.
BMI1
Extract lowest set bit from r/m64, and set that bit in r64.
BLSI r64, r/m64
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
VM
VEX.vvvv (w)
ModRM:r/m (r)
N/A
N/A
Description
Extracts the lowest set bit from the source operand and set the corresponding bit in the destination register. All
other bits in the destination operand are zeroed. If no bits are set in the source operand, BLSI sets all the bits in
the destination to 0 and sets ZF and CF.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.
Operation
temp := (-SRC) bitwiseAND (SRC);
SF := temp[OperandSize -1];
ZF := (temp = 0);
IF SRC = 0
CF := 0;
ELSE
CF := 1;
FI
DEST := temp;
Flags Affected
ZF and SF are updated based on the result. CF is set if the source is not zero. OF flags are cleared. AF and PF
flags are undefined.
Intel C/C++ Compiler Intrinsic Equivalent
BLSI unsigned __int32 _blsi_u32(unsigned __int32 src);
BLSI unsigned __int64 _blsi_u64(unsigned __int64 src);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-29, “Type 13 Class Exception Conditions.”
BLSI-Extract Lowest Set Isolated Bit
Vol. 2A
3-87
BLSMSK-Get Mask Up to Lowest Set Bit
Opcode/Instruction
Op/
64/32-
CPUID
Description
En
bit
Feature
Mode
Flag
VEX.LZ.0F38.W0 F3 /2
VM
V/V
BMI1
Set all lower bits in r32 to “1” starting from bit 0 to lowest set bit in
BLSMSK r32, r/m32
r/m32.
VEX.LZ.0F38.W1 F3 /2
VM
V/N.E.
BMI1
Set all lower bits in r64 to “1” starting from bit 0 to lowest set bit in
BLSMSK r64, r/m64
r/m64.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
VM
VEX.vvvv (w)
ModRM:r/m (r)
N/A
N/A
Description
Sets all the lower bits of the destination operand to “1” up to and including lowest set bit (=1) in the source
operand. If source operand is zero, BLSMSK sets all bits of the destination operand to 1 and also sets CF to 1.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.
Operation
temp := (SRC-1) XOR (SRC) ;
SF := temp[OperandSize -1];
ZF := 0;
IF SRC = 0
CF := 1;
ELSE
CF := 0;
FI
DEST := temp;
Flags Affected
SF is updated based on the result. CF is set if the source if zero. ZF and OF flags are cleared. AF and PF flag are
undefined.
Intel C/C++ Compiler Intrinsic Equivalent
BLSMSK unsigned __int32 _blsmsk_u32(unsigned __int32 src);
BLSMSK unsigned __int64 _blsmsk_u64(unsigned __int64 src);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-29, “Type 13 Class Exception Conditions.”
BLSMSK-Get Mask Up to Lowest Set Bit
Vol. 2A
3-88
BLSR-Reset Lowest Set Bit
Opcode/Instruction
Op/
64/32-
CPUID
Description
En
bit
Feature
Mode
Flag
VEX.LZ.0F38.W0 F3 /1
VM
V/V
BMI1
Reset lowest set bit of r/m32, keep all other bits of r/m32 and write
BLSR r32, r/m32
result to r32.
VEX.LZ.0F38.W1 F3 /1
VM
V/N.E.
BMI1
Reset lowest set bit of r/m64, keep all other bits of r/m64 and write
BLSR r64, r/m64
result to r64.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
VM
VEX.vvvv (w)
ModRM:r/m (r)
N/A
N/A
Description
Copies all bits from the source operand to the destination operand and resets (=0) the bit position in the destina-
tion operand that corresponds to the lowest set bit of the source operand. If the source operand is zero BLSR sets
CF.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.
Operation
temp := (SRC-1) bitwiseAND ( SRC );
SF := temp[OperandSize -1];
ZF := (temp = 0);
IF SRC = 0
CF := 1;
ELSE
CF := 0;
FI
DEST := temp;
Flags Affected
ZF and SF flags are updated based on the result. CF is set if the source is zero. OF flag is cleared. AF and PF flags
are undefined.
Intel C/C++ Compiler Intrinsic Equivalent
BLSR unsigned __int32 _blsr_u32(unsigned __int32 src);
BLSR unsigned __int64 _blsr_u64(unsigned __int64 src);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-29, “Type 13 Class Exception Conditions.”
BLSR-Reset Lowest Set Bit
Vol. 2A
3-89
BNDCL-Check Lower Bound
Opcode/
Op/En
64/32 bit
CPUID
Description
Instruction
Mode
Feature
Support
Flag
F3 0F 1A /r
RM
N.E./V
MPX
Generate a #BR if the address in r/m32 is lower than the lower
BNDCL bnd, r/m32
bound in bnd.LB.
F3 0F 1A /r
RM
V/N.E.
MPX
Generate a #BR if the address in r/m64 is lower than the lower
BNDCL bnd, r/m64
bound in bnd.LB.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
Description
Compare the address in the second operand with the lower bound in bnd. The second operand can be either a
register or memory operand. If the address is lower than the lower bound in bnd.LB, it will set BNDSTATUS to 01H
and signal a #BR exception.
This instruction does not cause any memory access, and does not read or write any flags.
Operation
BNDCL BND, reg
IF reg < BND.LB Then
BNDSTATUS := 01H;
#BR;
FI;
BNDCL BND, mem
TEMP := LEA(mem);
IF TEMP < BND.LB Then
BNDSTATUS := 01H;
#BR;
FI;
Intel C/C++ Compiler Intrinsic Equivalent
BNDCL void _bnd_chk_ptr_lbounds(const void *q)
Flags Affected
None
Protected Mode Exceptions
#BR
If lower bound check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 67H prefix is not used and CS.D=0.
If 67H prefix is used and CS.D=1.
BNDCL-Check Lower Bound
Vol. 2A
3-90
Real-Address Mode Exceptions
#BR
If lower bound check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
Virtual-8086 Mode Exceptions
#BR
If lower bound check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#UD
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
Same exceptions as in protected mode.
BNDCL-Check Lower Bound
Vol. 2A
3-91
BNDCU/BNDCN-Check Upper Bound
Opcode/
Op/En
64/32 bit
CPUID
Description
Instruction
Mode
Feature
Support
Flag
F2 0F 1A /r
RM
N.E./V
MPX
Generate a #BR if the address in r/m32 is higher than the upper
BNDCU bnd, r/m32
bound in bnd.UB (bnb.UB in 1's complement form).
F2 0F 1A /r
RM
V/N.E.
MPX
Generate a #BR if the address in r/m64 is higher than the upper
BNDCU bnd, r/m64
bound in bnd.UB (bnb.UB in 1's complement form).
F2 0F 1B /r
RM
N.E./V
MPX
Generate a #BR if the address in r/m32 is higher than the upper
BNDCN bnd, r/m32
bound in bnd.UB (bnb.UB not in 1's complement form).
F2 0F 1B /r
RM
V/N.E.
MPX
Generate a #BR if the address in r/m64 is higher than the upper
BNDCN bnd, r/m64
bound in bnd.UB (bnb.UB not in 1's complement form).
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
Description
Compare the address in the second operand with the upper bound in bnd. The second operand can be either a
register or a memory operand. If the address is higher than the upper bound in bnd.UB, it will set BNDSTATUS to
01H and signal a #BR exception.
BNDCU perform 1’s complement operation on the upper bound of bnd first before proceeding with address compar-
ison. BNDCN perform address comparison directly using the upper bound in bnd that is already reverted out of 1’s
complement form.
This instruction does not cause any memory access, and does not read or write any flags.
Effective address computation of m32/64 has identical behavior to LEA
Operation
BNDCU BND, reg
IF reg > NOT(BND.UB) Then
BNDSTATUS := 01H;
#BR;
FI;
BNDCU BND, mem
TEMP := LEA(mem);
IF TEMP > NOT(BND.UB) Then
BNDSTATUS := 01H;
#BR;
FI;
BNDCN BND, reg
IF reg > BND.UB Then
BNDSTATUS := 01H;
#BR;
FI;
BNDCU/BNDCN-Check Upper Bound
Vol. 2A
3-92
BNDCN BND, mem
TEMP := LEA(mem);
IF TEMP > BND.UB Then
BNDSTATUS := 01H;
#BR;
FI;
Intel C/C++ Compiler Intrinsic Equivalent
BNDCU .void _bnd_chk_ptr_ubounds(const void *q)
Flags Affected
None
Protected Mode Exceptions
#BR
If upper bound check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 67H prefix is not used and CS.D=0.
If 67H prefix is used and CS.D=1.
Real-Address Mode Exceptions
#BR
If upper bound check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
Virtual-8086 Mode Exceptions
#BR
If upper bound check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#UD
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
Same exceptions as in protected mode.
BNDCU/BNDCN-Check Upper Bound
Vol. 2A
3-93
BNDLDX-Load Extended Bounds Using Address Translation
Opcode/
Op/En
64/32 bit
CPUID
Description
Instruction
Mode
Feature
Support
Flag
NP 0F 1A /r
RM
V/V
MPX
Load the bounds stored in a bound table entry (BTE) into bnd with
BNDLDX bnd, mib
address translation using the base of mib and conditional on the
index of mib matching the pointer value in the BTE.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
SIB.base (r): Address of pointer
RM
ModRM:reg (w)
N/A
SIB.index(r)
Description
BNDLDX uses the linear address constructed from the base register and displacement of the SIB-addressing form
of the memory operand (mib) to perform address translation to access a bound table entry and conditionally load
the bounds in the BTE to the destination. The destination register is updated with the bounds in the BTE, if the
content of the index register of mib matches the pointer value stored in the BTE.
If the pointer value comparison fails, the destination is updated with INIT bounds (lb = 0x0, ub = 0x0) (note: as
articulated earlier, the upper bound is represented using 1's complement, therefore, the 0x0 value of upper bound
allows for access to full memory).
This instruction does not cause memory access to the linear address of mib nor the effective address referenced by
the base, and does not read or write any flags.
Segment overrides apply to the linear address computation with the base of mib, and are used during address
translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be
linear address. There are no segmentation checks performed on the base of mib.
The base of mib will not be checked for canonical address violation as it does not access memory.
Any encoding of this instruction that does not specify base or index register will treat those registers as zero
(constant). The reg-reg form of this instruction will remain a NOP.
The scale field of the SIB byte has no effect on these instructions and is ignored.
The bound register may be partially updated on memory faults. The order in which memory operands are loaded is
implementation specific.
Operation
base := mib.SIB.base ? mib.SIB.base + Disp: 0;
ptr_value := mib.SIB.index ? mib.SIB.index : 0;
Outside 64-bit Mode
A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 );
A_BT[31:0] := LoadFrom(A_BDE );
IF A_BT[0] equal 0 Then
BNDSTATUS := A_BDE | 02H;
#BR;
FI;
A_BTE[31:0] := (Zero_extend32(base[11:2] « 4) + (A_BT[31:2] « 2 );
Temp_lb[31:0] := LoadFrom(A_BTE);
Temp_ub[31:0] := LoadFrom(A_BTE + 4);
Temp_ptr[31:0] := LoadFrom(A_BTE + 8);
IF Temp_ptr equal ptr_value Then
BND.LB := Temp_lb;
BND.UB := Temp_ub;
BNDLDX-Load Extended Bounds Using Address Translation
Vol. 2A
3-94
ELSE
BND.LB := 0;
BND.UB := 0;
FI;
In 64-bit Mode
A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );1
A_BT[63:0] := LoadFrom(A_BDE);
IF A_BT[0] equal 0 Then
BNDSTATUS := A_BDE | 02H;
#BR;
FI;
A_BTE[63:0] := (Zero_extend64(base[19:3] « 5) + (A_BT[63:3] « 3 );
Temp_lb[63:0] := LoadFrom(A_BTE);
Temp_ub[63:0] := LoadFrom(A_BTE + 8);
Temp_ptr[63:0] := LoadFrom(A_BTE + 16);
IF Temp_ptr equal ptr_value Then
BND.LB := Temp_lb;
BND.UB := Temp_ub;
ELSE
BND.LB := 0;
BND.UB := 0;
FI;
Intel C/C++ Compiler Intrinsic Equivalent
BNDLDX: Generated by compiler as needed.
Flags Affected
None.
Protected Mode Exceptions
#BR
If the bound directory entry is invalid.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 67H prefix is not used and CS.D=0.
If 67H prefix is used and CS.D=1.
#GP(0)
If a destination effective address of the Bound Table entry is outside the DS segment limit.
If DS register contains a NULL segment selector.
#PF(fault code)
If a page fault occurs.
Real-Address Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
#GP(0)
If a destination effective address of the Bound Table entry is outside the DS segment limit.
1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-
ated in CPUID.07H.00H:ECX.MPX_MAWAU[21:17]. See Appendix E.3.1 of Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 1.
BNDLDX-Load Extended Bounds Using Address Translation
Vol. 2A
3-95
Virtual-8086 Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
#GP(0)
If a destination effective address of the Bound Table entry is outside the DS segment limit.
#PF(fault code)
If a page fault occurs.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#BR
If the bound directory entry is invalid.
#UD
If ModRM is RIP relative.
If the LOCK prefix is used.
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#GP(0)
If the memory address (A_BDE or A_BTE) is in a non-canonical form.
#PF(fault code)
If a page fault occurs.
BNDLDX-Load Extended Bounds Using Address Translation
Vol. 2A
3-96
BNDMK-Make Bounds
Opcode/
Op/En
64/32 bit
CPUID
Description
Instruction
Mode
Feature
Support
Flag
F3 0F 1B /r
RM
N.E./V
MPX
Make lower and upper bounds from m32 and store them in bnd.
BNDMK bnd, m32
F3 0F 1B /r
RM
V/N.E.
MPX
Make lower and upper bounds from m64 and store them in bnd.
BNDMK bnd, m64
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
Description
Makes bounds from the second operand and stores the lower and upper bounds in the bound register bnd. The
second operand must be a memory operand. The content of the base register from the memory operand is stored
in the lower bound bnd.LB. The 1's complement of the effective address of m32/m64 is stored in the upper bound
b.UB. Computation of m32/m64 has identical behavior to LEA.
This instruction does not cause any memory access, and does not read or write any flags.
If the instruction did not specify base register, the lower bound will be zero. The reg-reg form of this instruction
retains legacy behavior (NOP).
The instruction causes an invalid-opcode exception (#UD) if executed in 64-bit mode with RIP-relative addressing.
Operation
BND.LB := SRCMEM.base;
IF 64-bit mode Then
BND.UB := NOT(LEA.64_bits(SRCMEM));
ELSE
BND.UB := Zero_Extend.64_bits(NOT(LEA.32_bits(SRCMEM)));
FI;
Intel C/C++ Compiler Intrinsic Equivalent
BNDMKvoid * _bnd_set_ptr_bounds(const void * q, size_t size);
Flags Affected
None.
Protected Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 67H prefix is not used and CS.D=0.
If 67H prefix is used and CS.D=1.
Real-Address Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
BNDMK-Make Bounds
Vol. 2A
3-97
Virtual-8086 Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
If RIP-relative addressing is used.
#SS(0)
If the memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
Same exceptions as in protected mode.
BNDMK-Make Bounds
Vol. 2A
3-98
BNDMOV-Move Bounds
Opcode/
Op/En
64/32 bit
CPUID
Description
Instruction
Mode
Feature
Support
Flag
66 0F 1A /r
RM
N.E./V
MPX
Move lower and upper bound from bnd2/m64 to bound register
BNDMOV bnd1, bnd2/m64
bnd1.
66 0F 1A /r
RM
V/N.E.
MPX
Move lower and upper bound from bnd2/m128 to bound register
BNDMOV bnd1, bnd2/m128
bnd1.
66 0F 1B /r
MR
N.E./V
MPX
Move lower and upper bound from bnd2 to bnd1/m64.
BNDMOV bnd1/m64, bnd2
66 0F 1B /r
MR
V/N.E.
MPX
Move lower and upper bound from bnd2 to bound register
BNDMOV bnd1/m128, bnd2
bnd1/m128.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
MR
ModRM:r/m (w)
ModRM:reg (r)
N/A
Description
BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the
destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction.
The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5.
BNDMOV to memory in 64-bit mode
Upper Bound (UB)
Lower Bound (LB)
16
8
0
Byte offset
BNDMOV to memory in 32-bit mode
Upper Bound (UB)
Lower Bound (LB)
16
8
4
0
Byte offset
Figure 3-5. Memory Layout of BNDMOV to/from Memory
This instruction does not change flags.
Operation
BNDMOV register to register
DEST.LB := SRC.LB;
DEST.UB := SRC.UB;
BNDMOV-Move Bounds
Vol. 2A
3-99
BNDMOV from memory
IF 64-bit mode THEN
DEST.LB := LOAD_QWORD(SRC);
DEST.UB := LOAD_QWORD(SRC+8);
ELSE
DEST.LB := LOAD_DWORD_ZERO_EXT(SRC);
DEST.UB := LOAD_DWORD_ZERO_EXT(SRC+4);
FI;
BNDMOV to memory
IF 64-bit mode THEN
DEST[63:0] := SRC.LB;
DEST[127:64] := SRC.UB;
ELSE
DEST[31:0] := SRC.LB;
DEST[63:32] := SRC.UB;
FI;
Intel C/C++ Compiler Intrinsic Equivalent
BNDMOV void * _bnd_copy_ptr_bounds(const void *q, const void *r)
Flags Affected
None.
Protected Mode Exceptions
#UD
If the LOCK prefix is used but the destination is not a memory operand.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 67H prefix is not used and CS.D=0.
If 67H prefix is used and CS.D=1.
#SS(0)
If the memory operand effective address is outside the SS segment limit.
#GP(0)
If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the destination operand points to a non-writable segment
If the DS, ES, FS, or GS segment register contains a NULL segment selector.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.
#PF(fault code)
If a page fault occurs.
Real-Address Mode Exceptions
#UD
If the LOCK prefix is used but the destination is not a memory operand.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
#GP(0)
If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If the memory operand effective address is outside the SS segment limit.
BNDMOV-Move Bounds
Vol. 2A
3-100
Virtual-8086 Mode Exceptions
#UD
If the LOCK prefix is used but the destination is not a memory operand.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
#GP(0)
If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If the memory operand effective address is outside the SS segment limit.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.
#PF(fault code)
If a page fault occurs.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#UD
If the LOCK prefix is used but the destination is not a memory operand.
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#SS(0)
If the memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.
#PF(fault code)
If a page fault occurs.
BNDMOV-Move Bounds
Vol. 2A
3-101
BNDSTX-Store Extended Bounds Using Address Translation
Opcode/
Op/En
64/32 bit
CPUID
Description
Instruction
Mode
Feature
Support
Flag
NP 0F 1B /r
MR
V/V
MPX
Store the bounds in bnd and the pointer value in the index register
BNDSTX mib, bnd
of mib to a bound table entry (BTE) with address translation using
the base of mib.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
SIB.base (r): Address of pointer
MR
ModRM:reg (r)
N/A
SIB.index(r)
Description
BNDSTX uses the linear address constructed from the displacement and base register of the SIB-addressing form
of the memory operand (mib) to perform address translation to store to a bound table entry. The bounds in the
source operand bnd are written to the lower and upper bounds in the BTE. The content of the index register of mib
is written to the pointer value field in the BTE.
This instruction does not cause memory access to the linear address of mib nor the effective address referenced by
the base, and does not read or write any flags.
Segment overrides apply to the linear address computation with the base of mib, and are used during address
translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be
linear address. There are no segmentation checks performed on the base of mib.
The base of mib will not be checked for canonical address violation as it does not access memory.
Any encoding of this instruction that does not specify base or index register will treat those registers as zero
(constant). The reg-reg form of this instruction will remain a NOP.
The scale field of the SIB byte has no effect on these instructions and is ignored.
The bound register may be partially updated on memory faults. The order in which memory operands are loaded is
implementation specific.
Operation
base := mib.SIB.base ? mib.SIB.base + Disp: 0;
ptr_value := mib.SIB.index ? mib.SIB.index : 0;
Outside 64-bit Mode
A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 );
A_BT[31:0] := LoadFrom(A_BDE);
IF A_BT[0] equal 0 Then
BNDSTATUS := A_BDE | 02H;
#BR;
FI;
A_DEST[31:0] := (Zero_extend32(base[11:2] « 4) + (A_BT[31:2] « 2 ); // address of Bound table entry
A_DEST[8][31:0] := ptr_value;
A_DEST[0][31:0] := BND.LB;
A_DEST[4][31:0] := BND.UB;
BNDSTX-Store Extended Bounds Using Address Translation
Vol. 2A
3-102
In 64-bit Mode
A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );1
A_BT[63:0] := LoadFrom(A_BDE);
IF A_BT[0] equal 0 Then
BNDSTATUS := A_BDE | 02H;
#BR;
FI;
A_DEST[63:0] := (Zero_extend64(base[19:3] « 5) + (A_BT[63:3] « 3 ); // address of Bound table entry
A_DEST[16][63:0] := ptr_value;
A_DEST[0][63:0] := BND.LB;
A_DEST[8][63:0] := BND.UB;
Intel C/C++ Compiler Intrinsic Equivalent
BNDSTX: _bnd_store_ptr_bounds(const void **ptr_addr, const void *ptr_val);
Flags Affected
None.
Protected Mode Exceptions
#BR
If the bound directory entry is invalid.
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 67H prefix is not used and CS.D=0.
If 67H prefix is used and CS.D=1.
#GP(0)
If a destination effective address of the Bound Table entry is outside the DS segment limit.
If DS register contains a NULL segment selector.
If the destination operand points to a non-writable segment
#PF(fault code)
If a page fault occurs.
Real-Address Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
#GP(0)
If a destination effective address of the Bound Table entry is outside the DS segment limit.
Virtual-8086 Mode Exceptions
#UD
If the LOCK prefix is used.
If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
If 16-bit addressing is used.
#GP(0)
If a destination effective address of the Bound Table entry is outside the DS segment limit.
#PF(fault code)
If a page fault occurs.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-
ated in CPUID.07H.00H:ECX.MPX_MAWAU[21:17]. See Appendix E.3.1 of Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 1.
BNDSTX-Store Extended Bounds Using Address Translation
Vol. 2A
3-103
64-Bit Mode Exceptions
#BR
If the bound directory entry is invalid.
#UD
If ModRM is RIP relative.
If the LOCK prefix is used.
If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#GP(0)
If the memory address (A_BDE or A_BTE) is in a non-canonical form.
If the destination operand points to a non-writable segment
#PF(fault code)
If a page fault occurs.
BNDSTX-Store Extended Bounds Using Address Translation
Vol. 2A
3-104
BOUND-Check Array Index Against Bounds
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
62 /r
BOUND r16, m16&16
RM
Invalid
Valid
Check if r16 (array index) is within bounds
specified by m16&16.
62 /r
BOUND r32, m32&32
RM
Invalid
Valid
Check if r32 (array index) is within bounds
specified by m32&32.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM
ModRM:reg (r)
ModRM:r/m (r)
N/A
N/A
Description
BOUND determines if the first operand (array index) is within the bounds of an array specified the second operand
(bounds operand). The array index is a signed integer located in a register. The bounds operand is a memory loca-
tion that contains a pair of signed doubleword-integers (when the operand-size attribute is 32) or a pair of signed
word-integers (when the operand-size attribute is 16). The first doubleword (or word) is the lower bound of the
array and the second doubleword (or word) is the upper bound of the array. The array index must be greater than
or equal to the lower bound and less than or equal to the upper bound plus the operand size in bytes. If the index
is not within bounds, a BOUND range exceeded exception (#BR) is signaled. When this exception is generated, the
saved return instruction pointer points to the BOUND instruction.
The bounds limit data structure (two words or doublewords containing the lower and upper limits of the array) is
usually placed just before the array itself, making the limits addressable via a constant offset from the beginning of
the array. Because the address of the array already will be present in a register, this practice avoids extra bus
cycles to obtain the effective address of the array bounds.
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.
Operation
IF 64bit Mode
THEN
#UD;
ELSE
IF (ArrayIndex < LowerBound OR ArrayIndex > UpperBound) THEN
(* Below lower bound or above upper bound *)
IF <equation for PL enabled> THEN BNDSTATUS := 0
#BR;
FI;
FI;
Flags Affected
None.
BOUND-Check Array Index Against Bounds
Vol. 2A
3-105
Protected Mode Exceptions
#BR
If the bounds test fails.
#UD
If second operand is not a memory location.
If the LOCK prefix is used.
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
Real-Address Mode Exceptions
#BR
If the bounds test fails.
#UD
If second operand is not a memory location.
If the LOCK prefix is used.
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
Virtual-8086 Mode Exceptions
#BR
If the bounds test fails.
#UD
If second operand is not a memory location.
If the LOCK prefix is used.
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#UD
If in 64-bit mode.
BOUND-Check Array Index Against Bounds
Vol. 2A
3-106
BSF-Bit Scan Forward
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F BC /r
BSF r16, r/m16
RM
Valid
Valid
Bit scan forward on r/m16.
0F BC /r
BSF r32, r/m32
RM
Valid
Valid
Bit scan forward on r/m32.
REX.W + 0F BC /r
BSF r64, r/m64
RM
Valid
N.E.
Bit scan forward on r/m64.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
Description
Searches the source operand (second operand) for the least significant set bit (1 bit). If a least significant 1 bit is
found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a
memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source
operand. If the content of the source operand is zero, the destination operand is unmodified.1
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.
Operation
IF SRC <> 0
THEN
temp := 0;
WHILE Bit(SRC, temp) = 0
DO
temp := temp + 1;
OD;
DEST := temp;
FI;
Flags Affected
The ZF flag is set to 1 if the source operand is 0; otherwise, the ZF flag is cleared. The PF flag is set to 1 if the
number of bits set in the source operand is even; otherwise, it is cleared. The CF, OF, SF, and AF flags are all
cleared.2
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
1. With a zero source operand on some older processors, use of a 32-bit operand size may clear the upper 32 bits of a 64-bit destina-
tion while leaving the lower 32 bits unmodified.
2. On some older processors, the CF, OF, SF, AF, and PF flags are unmodified.
BSF-Bit Scan Forward
Vol. 2A
3-107
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
BSF-Bit Scan Forward
Vol. 2A
3-108
BSR-Bit Scan Reverse
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F BD /r
BSR r16, r/m16
RM
Valid
Valid
Bit scan reverse on r/m16.
0F BD /r
BSR r32, r/m32
RM
Valid
Valid
Bit scan reverse on r/m32.
REX.W + 0F BD /r
BSR r64, r/m64
RM
Valid
N.E.
Bit scan reverse on r/m64.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RM
ModRM:reg (w)
ModRM:r/m (r)
N/A
N/A
Description
Searches the source operand (second operand) for the most significant set bit (1 bit). If a most significant 1 bit is
found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a
memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source
operand. If the content source operand is zero, the destination operand is unmodified.1
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.
Operation
IF SRC <> 0
temp := OperandSize - 1;
WHILE Bit(SRC, temp) = 0
DO
temp := temp - 1;
OD;
DEST := temp;
FI;
Flags Affected
The ZF flag is set to 1 if the source operand is 0; otherwise, the ZF flag is cleared. The PF flag is set to 1 if the
number of bits set in the source operand is even; otherwise, it is cleared. The CF, OF, SF, and AF flags are all
cleared.2
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
1. With a zero source operand on some older processors, use of a 32-bit operand size may clear the upper 32 bits of a 64-bit destina-
tion while leaving the lower 32 bits unmodified.
2. On some older processors, the CF, OF, SF, AF, and PF flags are unmodified.
BSR-Bit Scan Reverse
Vol. 2A
3-109
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
BSR-Bit Scan Reverse
Vol. 2A
3-110
BSWAP-Byte Swap
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F C8+rd
BSWAP r32
O
Valid*
Valid
Reverses the byte order of a 32-bit register.
REX.W + 0F C8+rd
BSWAP r64
O
Valid
N.E.
Reverses the byte order of a 64-bit register.
NOTES:
* See IA-32 Architecture Compatibility section below.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
O
opcode + rd (r, w)
N/A
N/A
N/A
Description
Reverses the byte order of a 32-bit or 64-bit (destination) register. This instruction is provided for converting little-
endian values to big-endian format and vice versa. To swap bytes in a word value (16-bit register), use the XCHG
instruction. When the BSWAP instruction references a 16-bit register, the result is undefined.
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.B permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.
IA-32 Architecture Legacy Compatibility
The BSWAP instruction is not supported on IA-32 processors earlier than the Intel486™ processor family. For
compatibility with this instruction, software should include functionally equivalent code for execution on Intel
processors earlier than the Intel486 processor family.
Operation
TEMP := DEST
IF 64-bit mode AND OperandSize = 64
THEN
DEST[7:0] := TEMP[63:56];
DEST[15:8] := TEMP[55:48];
DEST[23:16] := TEMP[47:40];
DEST[31:24] := TEMP[39:32];
DEST[39:32] := TEMP[31:24];
DEST[47:40] := TEMP[23:16];
DEST[55:48] := TEMP[15:8];
DEST[63:56] := TEMP[7:0];
ELSE
DEST[7:0] := TEMP[31:24];
DEST[15:8] := TEMP[23:16];
DEST[23:16] := TEMP[15:8];
DEST[31:24] := TEMP[7:0];
FI;
Flags Affected
None.
Exceptions (All Operating Modes)
#UD
If the LOCK prefix is used.
BSWAP-Byte Swap
Vol. 2A
3-111
BT-Bit Test
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F A3 /r
BT r/m16, r16
MR
Valid
Valid
Store selected bit in CF flag.
0F A3 /r
BT r/m32, r32
MR
Valid
Valid
Store selected bit in CF flag.
REX.W + 0F A3 /r
BT r/m64, r64
MR
Valid
N.E.
Store selected bit in CF flag.
0F BA /4 ib
BT r/m16, imm8
MI
Valid
Valid
Store selected bit in CF flag.
0F BA /4 ib
BT r/m32, imm8
MI
Valid
Valid
Store selected bit in CF flag.
REX.W + 0F BA /4 ib
BT r/m64, imm8
MI
Valid
N.E.
Store selected bit in CF flag.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
MR
ModRM:r/m (r)
ModRM:reg (r)
N/A
N/A
MI
ModRM:r/m (r)
imm8
N/A
N/A
Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset (specified by the second operand) and stores the value of the bit in the CF flag. The bit base operand
can be a register or a memory location; the bit offset operand can be a register or an immediate value:
• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
mode).
• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. In this case, the low-order 3 or 5 bits (3 for 16-bit oper-
ands, 5 for 32-bit operands) of the immediate bit offset are stored in the immediate bit offset field, and the high-
order bits are shifted and combined with the byte displacement in the addressing mode by the assembler. The
processor will ignore the high order bits if they are not zero.
When accessing a bit in memory, the processor may access 4 bytes starting from the memory address for a 32-bit
operand size, using by the following relationship:
Effective Address + (4 ∗ (BitOffset DIV 32))
Or, it may access 2 bytes starting from the memory address for a 16-bit operand, using this relationship:
Effective Address + (2 ∗ (BitOffset DIV 16))
It may do so even when only a single byte needs to be accessed to reach the given bit. When using this bit
addressing mechanism, software should avoid referencing areas of memory close to address space holes. In partic-
ular, it should avoid references to memory-mapped I/O registers. Instead, software should use the MOV instruc-
tions to load from or store to these addresses, and use the register form of these instructions to manipulate the
data.
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit oper-
ands. See the summary chart at the beginning of this section for encoding data and limits.
Operation
CF := Bit(BitBase, BitOffset);
BT-Bit Test
Vol. 2A
3-112
Flags Affected
The CF flag contains the value of the selected bit. The ZF flag is unaffected. The OF, SF, AF, and PF flags are
undefined.
Protected Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used.
BT-Bit Test
Vol. 2A
3-113
BTC-Bit Test and Complement
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F BB /r
BTC r/m16, r16
MR
Valid
Valid
Store selected bit in CF flag and complement.
0F BB /r
BTC r/m32, r32
MR
Valid
Valid
Store selected bit in CF flag and complement.
REX.W + 0F BB /r
BTC r/m64, r64
MR
Valid
N.E.
Store selected bit in CF flag and complement.
0F BA /7 ib
BTC r/m16, imm8
MI
Valid
Valid
Store selected bit in CF flag and complement.
0F BA /7 ib
BTC r/m32, imm8
MI
Valid
Valid
Store selected bit in CF flag and complement.
REX.W + 0F BA /7 ib
BTC r/m64, imm8
MI
Valid
N.E.
Store selected bit in CF flag and complement.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
MR
ModRM:r/m (r, w)
ModRM:reg (r)
N/A
N/A
MI
ModRM:r/m (r, w)
imm8
N/A
N/A
Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset operand (second operand), stores the value of the bit in the CF flag, and complements the selected
bit in the bit string. The bit base operand can be a register or a memory location; the bit offset operand can be a
register or an immediate value:
• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
mode). This allows any bit position to be selected.
• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. See “BT-Bit Test” in this chapter for more information on
this addressing mechanism.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.B permits
access to additional registers (R8-R15) for the bit base. Using a REX prefix in the form of REX.R permits access to
R8-R15 for the bit offset (when it uses a register). Using a REX prefix in the form of REX.W promotes operation to
64 bits. See the summary chart at the beginning of this section for encoding data and limits.
Operation
CF := Bit(BitBase, BitOffset);
Bit(BitBase, BitOffset) := NOT Bit(BitBase, BitOffset);
Flags Affected
The CF flag contains the value of the selected bit before it is complemented. The ZF flag is unaffected. The OF, SF,
AF, and PF flags are undefined.
BTC-Bit Test and Complement
Vol. 2A
3-114
Protected Mode Exceptions
#GP(0)
If the destination operand points to a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
BTC-Bit Test and Complement
Vol. 2A
3-115
BTR-Bit Test and Reset
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F B3 /r
BTR r/m16, r16
MR
Valid
Valid
Store selected bit in CF flag and clear.
0F B3 /r
BTR r/m32, r32
MR
Valid
Valid
Store selected bit in CF flag and clear.
REX.W + 0F B3 /r
BTR r/m64, r64
MR
Valid
N.E.
Store selected bit in CF flag and clear.
0F BA /6 ib
BTR r/m16, imm8
MI
Valid
Valid
Store selected bit in CF flag and clear.
0F BA /6 ib
BTR r/m32, imm8
MI
Valid
Valid
Store selected bit in CF flag and clear.
REX.W + 0F BA /6 ib
BTR r/m64, imm8
MI
Valid
N.E.
Store selected bit in CF flag and clear.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
MR
ModRM:r/m (r, w)
ModRM:reg (r)
N/A
N/A
MI
ModRM:r/m (r, w)
imm8
N/A
N/A
Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset operand (second operand), stores the value of the bit in the CF flag, and clears the selected bit in the
bit string to 0. The bit base operand can be a register or a memory location; the bit offset operand can be a register
or an immediate value:
• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
mode). This allows any bit position to be selected.
• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. See “BT-Bit Test” in this chapter for more information on
this addressing mechanism.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.
Operation
CF := Bit(BitBase, BitOffset);
Bit(BitBase, BitOffset) := 0;
Flags Affected
The CF flag contains the value of the selected bit before it is cleared. The ZF flag is unaffected. The OF, SF, AF, and
PF flags are undefined.
BTR-Bit Test and Reset
Vol. 2A
3-116
Protected Mode Exceptions
#GP(0)
If the destination operand points to a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Virtual-8086 Mode Exceptions
#GP(0)
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
BTR-Bit Test and Reset
Vol. 2A
3-117
BTS-Bit Test and Set
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
0F AB /r
BTS r/m16, r16
MR
Valid
Valid
Store selected bit in CF flag and set.
0F AB /r
BTS r/m32, r32
MR
Valid
Valid
Store selected bit in CF flag and set.
REX.W + 0F AB /r
BTS r/m64, r64
MR
Valid
N.E.
Store selected bit in CF flag and set.
0F BA /5 ib
BTS r/m16, imm8
MI
Valid
Valid
Store selected bit in CF flag and set.
0F BA /5 ib
BTS r/m32, imm8
MI
Valid
Valid
Store selected bit in CF flag and set.
REX.W + 0F BA /5 ib
BTS r/m64, imm8
MI
Valid
N.E.
Store selected bit in CF flag and set.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
MR
ModRM:r/m (r, w)
ModRM:reg (r)
N/A
N/A
MI
ModRM:r/m (r, w)
imm8
N/A
N/A
Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset operand (second operand), stores the value of the bit in the CF flag, and sets the selected bit in the
bit string to 1. The bit base operand can be a register or a memory location; the bit offset operand can be a register
or an immediate value:
• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
mode). This allows any bit position to be selected.
• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. See “BT-Bit Test” in this chapter for more information on
this addressing mechanism.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.
Operation
CF := Bit(BitBase, BitOffset);
Bit(BitBase, BitOffset) := 1;
Flags Affected
The CF flag contains the value of the selected bit before it is set. The ZF flag is unaffected. The OF, SF, AF, and PF
flags are undefined.
BTS-Bit Test and Set
Vol. 2A
3-118
Protected Mode Exceptions
#GP(0)
If the destination operand points to a non-writable segment.
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Real-Address Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Virtual-8086 Mode Exceptions
#GP
If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS
If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
Compatibility Mode Exceptions
Same exceptions as in protected mode.
64-Bit Mode Exceptions
#SS(0)
If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)
If the memory address is in a non-canonical form.
#PF(fault-code)
If a page fault occurs.
#AC(0)
If alignment checking is enabled and an unaligned memory reference is made while the
current privilege level is 3.
#UD
If the LOCK prefix is used but the destination is not a memory operand.
BTS-Bit Test and Set
Vol. 2A
3-119
BZHI-Zero High Bits Starting with Specified Bit Position
Opcode/Instruction
Op/
64/32-
CPUID
Description
En
bit
Feature
Mode
Flag
VEX.LZ.0F38.W0 F5 /r
RMV
V/V
BMI2
Zero bits in r/m32 starting with the position in r32b, write result to
BZHI r32a, r/m32, r32b
r32a.
VEX.LZ.0F38.W1 F5 /r
RMV
V/N.E.
BMI2
Zero bits in r/m64 starting with the position in r64b, write result to
BZHI r64a, r/m64, r64b
r64a.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
RMV
ModRM:reg (w)
ModRM:r/m (r)
VEX.vvvv (r)
N/A
Description
BZHI copies the bits of the first source operand (the second operand) into the destination operand (the first
operand) and clears the higher bits in the destination according to the INDEX value specified by the second source
operand (the third operand). The INDEX is specified by bits 7:0 of the second source operand. The INDEX value is
saturated at the value of OperandSize -1. CF is set, if the number contained in the 8 low bits of the third operand
is greater than OperandSize -1.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.
Operation
N := SRC2[7:0]
DEST := SRC1
IF (N < OperandSize)
DEST[OperandSize-1:N] := 0
FI
IF (N > OperandSize - 1)
CF := 1
ELSE
CF := 0
FI
Flags Affected
ZF and SF flags are updated based on the result. CF flag is set as specified in the Operation section. OF flag is
cleared. AF and PF flags are undefined.
Intel C/C++ Compiler Intrinsic Equivalent
BZHI unsigned __int32 _bzhi_u32(unsigned __int32 src, unsigned __int32 index);
BZHI unsigned __int64 _bzhi_u64(unsigned __int64 src, unsigned __int32 index);
SIMD Floating-Point Exceptions
None.
Other Exceptions
See Table 2-29, “Type 13 Class Exception Conditions.”
BZHI-Zero High Bits Starting with Specified Bit Position
Vol. 2A
3-120
CALL-Call Procedure
Opcode
Instruction
Op/
64-bit
Compat/
Description
En
Mode
Leg Mode
E8 cw
CALL rel16
D
N.S.
Valid
Call near, relative, displacement relative to next
instruction.
E8 cd
CALL rel32
D
Valid
Valid
Call near, relative, displacement relative to next
instruction. 32-bit displacement sign extended to
64-bits in 64-bit mode.
FF /2
CALL r/m16
M
N.E.
Valid
Call near, absolute indirect, address given in r/m16.
FF /2
CALL r/m32
M
N.E.
Valid
Call near, absolute indirect, address given in r/m32.
FF /2
CALL r/m64
M
Valid
N.E.
Call near, absolute indirect, address given in r/m64.
9A cd
CALL ptr16:16
D
Invalid
Valid
Call far, absolute, address given in operand.
9A cp
CALL ptr16:32
D
Invalid
Valid
Call far, absolute, address given in operand.
FF /3
CALL m16:16
M
Valid
Valid
Call far, absolute indirect address given in m16:16.
In 32-bit mode: if selector points to a gate, then RIP
= 32-bit zero extended displacement taken from
gate; else RIP = zero extended 16-bit offset from
far pointer referenced in the instruction.
FF /3
CALL m16:32
M
Valid
Valid
In 64-bit mode: If selector points to a gate, then RIP
= 64-bit displacement taken from gate; else RIP =
zero extended 32-bit offset from far pointer
referenced in the instruction.
REX.W FF /3
CALL m16:64
M
Valid
N.E.
In 64-bit mode: If selector points to a gate, then RIP
= 64-bit displacement taken from gate; else RIP =
64-bit offset from far pointer referenced in the
instruction.
Instruction Operand Encoding
Op/En
Operand 1
Operand 2
Operand 3
Operand 4
D
Offset
N/A
N/A
N/A
M
ModRM:r/m (r)
N/A
N/A
N/A
Description
Saves procedure linking information on the stack and branches to the called procedure specified using the target
operand. The target operand specifies the address of the first instruction in the called procedure. The operand can
be an immediate value, a general-purpose register, or a memory location.
This instruction can be used to execute four types of calls:
• Near Call - A call to a procedure in the current code segment (the segment currently pointed to by the CS
register), sometimes referred to as an intra-segment call.
• Far Call - A call to a procedure located in a different segment than the current code segment, sometimes
referred to as an inter-segment call.
• Inter-privilege-level far call - A far call to a procedure in a segment at a different privilege level than that
of the currently executing program or procedure.
• Task switch - A call to a procedure located in a different task.
The latter two call types (inter-privilege-level call and task switch) can only be executed in protected mode. See
“Calling Procedures Using Call and RET” in Chapter 6 of the Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 1, for additional information on near, far, and inter-privilege-level calls. See Chapter 10, “Task
Management,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for information
on performing task switches with the CALL instruction.
CALL-Call Procedure
Vol. 2A
3-121
Near Call. When executing a near call, the processor pushes the value of the EIP register (which contains the offset
of the instruction following the CALL instruction) on the stack (for use later as a return-instruction pointer). The
processor then branches to the address in the current code segment specified by the target operand. The target
operand specifies either an absolute offset in the code segment (an offset from the base of the code segment) or a
relative offset (a signed displacement relative to the current value of the instruction pointer in the EIP register; this
value points to the instruction following the CALL instruction). The CS register is not changed on near calls.
For a near call absolute, an absolute offset is specified indirectly in a general-purpose register or a memory location
(r/m16, r/m32, or r/m64). The operand-size attribute determines the size of the target operand (16, 32 or 64
bits). When in 64-bit mode, the operand size for near call (and all near branches) is forced to 64-bits. Absolute
offsets are loaded directly into the EIP(RIP) register. If the operand size attribute is 16, the upper two bytes of the
EIP register are cleared, resulting in a maximum instruction pointer size of 16 bits. When accessing an absolute
offset indirectly using the stack pointer [ESP] as the base register, the base value used is the value of the ESP
before the instruction executes.
A relative offset (rel16 or rel32) is generally specified as a label in assembly code. But at the machine code level, it
is encoded as a signed, 16- or 32-bit immediate value. This value is added to the value in the EIP(RIP) register. In
64-bit mode the relative offset is always a 32-bit immediate value which is sign extended to 64-bits before it is
added to the value in the RIP register for the target calculation. As with absolute offsets, the operand-size attribute
determines the size of the target operand (16, 32, or 64 bits). In 64-bit mode the target operand will always be 64-
bits because the operand size is forced to 64-bits for near branches.
Far Calls in Real-Address or Virtual-8086 Mode. When executing a far call in real- address or virtual-8086 mode, the
processor pushes the current value of both the CS and EIP registers on the stack for use as a return-instruction
pointer. The processor then performs a “far branch” to the code segment and offset specified with the target
operand for the called procedure. The target operand specifies an absolute far address either directly with a pointer
(ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). With the pointer method, the
segment and offset of the called procedure is encoded in the instruction using a 4-byte (16-bit operand size) or 6-
byte (32-bit operand size) far address immediate. With the indirect method, the target operand specifies a memory
location that contains a 4-byte (16-bit operand size) or 6-byte (32-bit operand size) far address. The operand-size
attribute determines the size of the offset (16 or 32 bits) in the far address. The far address is loaded directly into
the CS and EIP registers. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared.
Far Calls in Protected Mode. When the processor is operating in protected mode, the CALL instruction can be used to
perform the following types of far calls:
• Far call to the same privilege level
• Far call to a different privilege level (inter-privilege level call)
• Task switch (far call to another task)
In protected mode, the processor always uses the segment selector part of the far address to access the corre-
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate, task gate, or TSS) and access
rights determine the type of call operation to be performed.
If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,
a general-protection exception is generated.) A far call to the same privilege level in protected mode is very similar
to one carried out in real-address or virtual-8086 mode. The target operand specifies an absolute far address either
directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). The
operand- size attribute determines the size of the offset (16 or 32 bits) in the far address. The new code segment
selector and its descriptor are loaded into CS register; the offset from the instruction is loaded into the EIP register.
A call gate (described in the next paragraph) can also be used to perform a far call to a code segment at the same
privilege level. Using this mechanism provides an extra level of indirection and is the preferred method of making
calls between 16-bit and 32-bit code segments.
When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed
through a call gate. The segment selector specified by the target operand identifies the call gate. The target
operand can specify the call gate segment selector either directly with a pointer (ptr16:16 or ptr16:32) or indirectly
with a memory location (m16:16 or m16:32). The processor obtains the segment selector for the new code
segment and the new instruction pointer (offset) from the call gate descriptor. (The offset from the target operand
is ignored when a call gate is used.)
CALL-Call Procedure
Vol. 2A
3-122
On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The
segment selector for the new stack segment is specified in the TSS for the currently running task. The branch to
the new code segment occurs after the stack switch. (Note that when using a call gate to perform a far call to a
segment at the same privilege level, no stack switch occurs.) On the new stack, the processor pushes the segment
selector and stack pointer for the calling procedure’s stack, an optional set of parameters from the calling proce-
dures stack, and the segment selector and instruction pointer for the calling procedure’s code segment. (A value in
the call gate descriptor determines how many parameters to copy to the new stack.) Finally, the processor
branches to the address of the procedure being called within the new code segment.
Executing a task switch with the CALL instruction is similar to executing a call through a call gate. The target
operand specifies the segment selector of the task gate for the new task activated by the switch (the offset in the
target operand is ignored). The task gate in turn points to the TSS for the new task, which contains the segment
selectors for the task’s code and stack segments. Note that the TSS also contains the EIP value for the next instruc-
tion that was to be executed before the calling task was suspended. This instruction pointer value is loaded into the
EIP register to re-start the calling task.
The CALL instruction can also specify the segment selector of the TSS directly, which eliminates the indirection of
the task gate. See Chapter 10, “Task Management,” in the Intel® 64 and IA-32 Architectures Software Developer’s
Manual, Volume 3A, for information on the mechanics of a task switch.
When execution of a CALL instruction effects a task switch, the nested task flag (NT) is set in the EFLAGS register
and the new TSS’s previous task link field is loaded with the old task’s TSS selector. Code is expected to suspend
this nested task by executing an IRET instruction which, because the NT flag is set, automatically uses the previous
task link to return to the calling task. (See “Task Linking” in Chapter 10 of the Intel® 64 and IA-32 Architectures
Software Developer’s Manual, Volume 3A, for information on nested tasks.) Switching tasks with the CALL instruc-
tion differs in this regard from JMP instruction. JMP does not set the NT flag and therefore does not expect an IRET
instruction to suspend the task.
Mixing 16-Bit and 32-Bit Calls. When making far calls between 16-bit and 32-bit code segments, use a call gate. If
the far call is from a 32-bit code segment to a 16-bit code segment, the call should be made from the first 64
KBytes of the 32-bit code segment. This is because the operand-size attribute of the instruction is set to 16, so only
a 16-bit return address offset can be saved. Also, the call should be made using a 16-bit call gate so that 16-bit
values can be pushed on the stack. See Chapter 24, “Mixing 16-Bit and 32-Bit Code,” in the Intel® 64 and IA-32
Architectures Software Developer’s Manual, Volume 3B, for more information.
Far Calls in Compatibility Mode. When the processor is operating in compatibility mode, the CALL instruction can be
used to perform the following types of far calls:
• Far call to the same privilege level, remaining in compatibility mode
• Far call to the same privilege level, transitioning to 64-bit mode
• Far call to a different privilege level (inter-privilege level call), transitioning to 64-bit mode
Note that a CALL instruction cannot be used to cause a task switch in compatibility mode since task switches are
not supported in IA-32e mode.
In compatibility mode, the processor always uses the segment selector part of the far address to access the corre-
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate) and access rights determine
the type of call operation to be performed.
If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,
a general-protection exception is generated.) A far call to the same privilege level in compatibility mode is very
similar to one carried out in protected mode. The target operand specifies an absolute far address either directly
with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). The operand-size
attribute determines the size of the offset (16 or 32 bits) in the far address. The new code segment selector and its
descriptor are loaded into CS register and the offset from the instruction is loaded into the EIP register. The differ-
ence is that 64-bit mode may be entered. This specified by the L bit in the new code segment descriptor.
Note that a 64-bit call gate (described in the next paragraph) can also be used to perform a far call to a code
segment at the same privilege level. However, using this mechanism requires that the target code segment
descriptor have the L bit set, causing an entry to 64-bit mode.
When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed
through a 64-bit call gate. The segment selector specified by the target operand identifies the call gate. The target
CALL-Call Procedure
Vol. 2A
3-123
operand can specify the call gate segment selector either directly with a pointer (ptr16:16 or ptr16:32) or indirectly
with a memory location (m16:16 or m16:32). The processor obtains the segment selector for the new code
segment and the new instruction pointer (offset) from the 16-byte call gate descriptor. (The offset from the target
operand is ignored when a call gate is used.)
On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The
segment selector for the new stack segment is set to NULL. The new stack pointer is specified in the TSS for the
currently running task. The branch to the new code segment occurs after the stack switch. (Note that when using
a call gate to perform a far call to a segment at the same privilege level, an implicit stack switch occurs as a result
of entering 64-bit mode. The SS selector is unchanged, but stack segment accesses use a segment base of 0x0,
the limit is ignored, and the default stack size is 64-bits. The full value of RSP is used for the offset, of which the
upper 32-bits are undefined.) On the new stack, the processor pushes the segment selector and stack pointer for
the calling procedure’s stack and the segment selector and instruction pointer for the calling procedure’s code
segment. (Parameter copy is not supported in IA-32e mode.) Finally, the processor branches to the address of the
procedure being called within the new code segment.
Near/(Far) Calls in 64-bit Mode. When the processor is operating in 64-bit mode, the CALL instruction can be used to
perform the following types of far calls:
• Far call to the same privilege level, transitioning to compatibility mode
• Far call to the same privilege level, remaining in 64-bit mode
• Far call to a different privilege level (inter-privilege level call), remaining in 64-bit mode
Note that in this mode the CALL instruction can not be used to cause a task switch in 64-bit mode since task
switches are not supported in IA-32e mode.
In 64-bit mode, the processor always uses the segment selector part of the far address to access the corresponding
descriptor in the GDT or LDT. The descriptor type (code segment, call gate) and access rights determine the type
of call operation to be performed.
If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,
a general-protection exception is generated.) A far call to the same privilege level in 64-bit mode is very similar to
one carried out in compatibility mode. The target operand specifies an absolute far address indirectly with a
memory location (m16:16, m16:32 or m16:64). The form of CALL with a direct specification of absolute far
address is not defined in 64-bit mode. The operand-size attribute determines the size of the offset (16, 32, or 64
bits) in the far address. The new code segment selector and its descriptor are loaded into the CS register; the offset
from the instruction is loaded into the EIP register. The new code segment may specify entry either into compati-
bility or 64-bit mode, based on the L bit value.
A 64-bit call gate (described in the next paragraph) can also be used to perform a far call to a code segment at the
same privilege level. However, using this mechanism requires that the target code segment descriptor have the L
bit set.
When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed
through a 64-bit call gate. The segment selector specified by the target operand identifies the call gate. The target
operand can only specify the call gate segment selector indirectly with a memory location (m16:16, m16:32 or
m16:64). The processor obtains the segment selector for the new code segment and the new instruction pointer
(offset) from the 16-byte call gate descriptor. (The offset from the target operand is ignored when a call gate is
used.)
On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The
segment selector for the new stack segment is set to NULL. The new stack pointer is specified in the TSS for the
currently running task. The branch to the new code segment occurs after the stack switch.
Note that when using a call gate to perform a far call to a segment at the same privilege level, an implicit stack
switch occurs as a result of entering 64-bit mode. The SS selector is unchanged, but stack segment accesses use
a segment base of 0x0, the limit is ignored, and the default stack size is 64-bits. (The full value of RSP is used for
the offset.) On the new stack, the processor pushes the segment selector and stack pointer for the calling proce-
dure’s stack and the segment selector and instruction pointer for the calling procedure’s code segment. (Parameter
copy is not supported in IA-32e mode.) Finally, the processor branches to the address of the procedure being called
within the new code segment.
CALL-Call Procedure
Vol. 2A
3-124
Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions‚” and Chapter 18, “Control-flow Enforcement
Technology (CET)‚” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for CET
details.
When FRED transitions are enabled, an execution of far CALL that references a call gate causes a general-protec-
tion exception, as does an execution of far CALL that would enter compatibility mode when CPL is 0.
Instruction ordering. Instructions following a far call may be fetched from memory before earlier instructions
complete execution, but they will not execute (even speculatively) until all instructions prior to the far call have
completed execution (the later instructions may execute before data stored by the earlier instructions have
become globally visible).
Instructions sequentially following a near indirect CALL instruction (i.e., those not at the target) may be executed
speculatively. If software needs to prevent this (e.g., in order to prevent a speculative execution side channel),
then an LFENCE instruction opcode can be placed after the near indirect CALL in order to block speculative execu-
tion.
Operation
IF near call
THEN IF near relative call
THEN
IF OperandSize = 64
THEN
tempDEST := SignExtend(DEST); (* DEST is rel32 *)
tempRIP := RIP + tempDEST;
IF stack not large enough for a 8-byte return address
THEN #SS(0); FI;
Push(RIP);
IF ShadowStackEnabled(CPL) AND DEST != 0
ShadowStackPush8B(RIP);
FI;
RIP := tempRIP;
FI;
IF OperandSize = 32
THEN
tempEIP := EIP + DEST; (* DEST is rel32 *)
IF tempEIP is not within code segment limit THEN #GP(0); FI;
IF stack not large enough for a 4-byte return address
THEN #SS(0); FI;
Push(EIP);
IF ShadowStackEnabled(CPL) AND DEST != 0
ShadowStackPush4B(EIP);
FI;
EIP := tempEIP;
FI;
IF OperandSize = 16
THEN
tempEIP := (EIP + DEST) AND 0000FFFFH; (* DEST is rel16 *)
IF tempEIP is not within code segment limit THEN #GP(0); FI;
IF stack not large enough for a 2-byte return address
THEN #SS(0); FI;
Push(IP);
IF ShadowStackEnabled(CPL) AND DEST != 0
(* IP is zero extended and pushed as a 32 bit value on shadow stack *)
ShadowStackPush4B(IP);
FI;
CALL-Call Procedure
Vol. 2A
3-125
EIP := tempEIP;
FI;
ELSE (* Near absolute call *)
IF OperandSize = 64
THEN
tempRIP := DEST; (* DEST is r/m64 *)
IF stack not large enough for a 8-byte return address
THEN #SS(0); FI;
Push(RIP);
IF ShadowStackEnabled(CPL)
ShadowStackPush8B(RIP);
FI;
RIP := tempRIP;
FI;
IF OperandSize = 32
THEN
tempEIP := DEST; (* DEST is r/m32 *)
IF tempEIP is not within code segment limit THEN #GP(0); FI;
IF stack not large enough for a 4-byte return address
THEN #SS(0); FI;
Push(EIP);
IF ShadowStackEnabled(CPL)
ShadowStackPush4B(EIP);
FI;
EIP := tempEIP;
FI;
IF OperandSize = 16
THEN
tempEIP := DEST AND 0000FFFFH; (* DEST is r/m16 *)
IF tempEIP is not within code segment limit THEN #GP(0); FI;
IF stack not large enough for a 2-byte return address
THEN #SS(0); FI;
Push(IP);
IF ShadowStackEnabled(CPL)
(* IP is zero extended and pushed as a 32 bit value on shadow stack *)
ShadowStackPush4B(IP);
FI;
EIP := tempEIP;
FI;
FI;rel/abs
IF (Call near indirect, absolute indirect)
IF EndbranchEnabledAndNotSuppressed(CPL)
IF CPL = 3
THEN
IF ( no 3EH prefix OR IA32_U_CET.NO_TRACK_EN == 0 )
THEN
IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH
FI;
ELSE
IF ( no 3EH prefix OR IA32_S_CET.NO_TRACK_EN == 0 )
THEN
IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH
FI;
FI;
CALL-Call Procedure
Vol. 2A
3-126