Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, A-L

AESENCWIDE128KL-Perform Ten Rounds of AES Encryption Flow With Key Locker on 8 Blocks

Using 128-Bit Key

Opcode/

Op/

64/32-bit

CPUID Feature

Description

Instruction

Mode

Flag

F3 0F 38 D8 !(11):000:bbb

V/V

AESKLE WIDE_KL

Encrypt XMM0-7 using 128-bit AES key indicated

AESENCWIDE128KL m384, <XMM0-7>

by handle at m384 and store each resultant block

back to its corresponding register.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operands 2-9

N/A

ModRM:r/m (r)

Implicit XMM0-7 (r, w)

Description

The AESENCWIDE128KL¹ instruction performs ten rounds of AES to encrypt each of the eight blocks in XMM0-7

using the 128-bit key indicated by the handle from the second operand. It replaces each input block in XMM0-7

with its corresponding encrypted block if the operation succeeds (e.g., does not run into a handle violation failure).

Operation

AESENCWIDE128KL

Handle := UnalignedLoad of 384 bit (SRC);

// Load is not guaranteed to be atomic.

Illegal Handle = (

HandleReservedBitSet (Handle) ||

(Handle[0] AND (CPL > 0)) ||

Handle [1] ||

HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES128

);

IF (Illegal Handle)

THEN RFLAGS.ZF := 1;

ELSE

(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate384 (Handle[383:0], IWKey);

IF Authentic == 0

THEN RFLAGS.ZF := 1;

ELSE

XMM0 := AES128Encrypt (XMM0, UnwrappedKey) ;

XMM1 := AES128Encrypt (XMM1, UnwrappedKey) ;

XMM2 := AES128Encrypt (XMM2, UnwrappedKey) ;

XMM3 := AES128Encrypt (XMM3, UnwrappedKey) ;

XMM4 := AES128Encrypt (XMM4, UnwrappedKey) ;

XMM5 := AES128Encrypt (XMM5, UnwrappedKey) ;

XMM6 := AES128Encrypt (XMM6, UnwrappedKey) ;

XMM7 := AES128Encrypt (XMM7, UnwrappedKey) ;

RFLAGS.ZF := 0;

FI;

RFLAGS.OF, SF, AF, PF, CF := 0;

1. Further details on Key Locker and usage of this instruction can be found here:

https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html.

AESENCWIDE128KL-Perform Ten Rounds of AES Encryption Flow With Key Locker on 8 Blocks Using 128-Bit Key

Vol. 2A

3-71

INSTRUCTION SET REFERENCE, A-L

Flags Affected

ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other

arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0.

Intel C/C++ Compiler Intrinsic Equivalent

AESENCWIDE128KLunsigned char _mm_aesencwide128kl_u8(__m128i odata[8], const __m128i idata[8], const void* h);

Exceptions (All Operating Modes)

#UD

If the LOCK prefix is used.

If CPUID.07H:ECX.KL [bit 23] = 0.

If CR4.KL = 0.

If CPUID.AESKLE = 0.

If CR0.EM = 1.

If CR4.OSFXSR = 0.

If CPUID.19H:EBX.WIDE_KL [bit 2] = 0.

#NM

If CR0.TS = 1.

#PF

If a page fault occurs.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If the memory address is in a non-canonical form.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

If a memory address referencing the SS segment is in a non-canonical form.

3-72

Vol. 2A

AESENCWIDE128KL-Perform Ten Rounds of AES Encryption Flow With Key Locker on 8 Blocks Using 128-Bit Key

INSTRUCTION SET REFERENCE, A-L

AESENCWIDE256KL-Perform 14 Rounds of AES Encryption Flow With Key Locker on 8 Blocks

Using 256-Bit Key

Opcode/

Op/

64/32-bit

CPUID Feature

Description

Instruction

Mode

Flag

F3 0F 38 D8 !(11):010:bbb

V/V

AESKLE WIDE_KL

Encrypt XMM0-7 using 256-bit AES key indicated

AESENCWIDE256KL m512, <XMM0-7>

by handle at m512 and store each resultant block

back to its corresponding register.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operands 2-9

N/A

ModRM:r/m (r)

Implicit XMM0-7 (r, w)

Description

The AESENCWIDE256KL¹ instruction performs 14 rounds of AES to encrypt each of the eight blocks in XMM0-7

using the 256-bit key indicated by the handle from the second operand. It replaces each input block in XMM0-7

with its corresponding encrypted block if the operation succeeds (e.g., does not run into a handle violation failure).

Operation

AESENCWIDE256KL

Handle := UnalignedLoad of 512 bit (SRC);

// Load is not guaranteed to be atomic.

Illegal Handle = (

HandleReservedBitSet (Handle) ||

(Handle[0] AND (CPL > 0)) ||

Handle [1] ||

HandleKeyType (Handle) != HANDLE_KEY_TYPE_AES256

);

IF (Illegal Handle)

THEN RFLAGS.ZF := 1;

ELSE

(UnwrappedKey, Authentic) := UnwrapKeyAndAuthenticate512 (Handle[511:0], IWKey);

IF (Authentic == 0)

THEN RFLAGS.ZF := 1;

ELSE

XMM0 := AES256Encrypt (XMM0, UnwrappedKey) ;

XMM1 := AES256Encrypt (XMM1, UnwrappedKey) ;

XMM2 := AES256Encrypt (XMM2, UnwrappedKey) ;

XMM3 := AES256Encrypt (XMM3, UnwrappedKey) ;

XMM4 := AES256Encrypt (XMM4, UnwrappedKey) ;

XMM5 := AES256Encrypt (XMM5, UnwrappedKey) ;

XMM6 := AES256Encrypt (XMM6, UnwrappedKey) ;

XMM7 := AES256Encrypt (XMM7, UnwrappedKey) ;

RFLAGS.ZF := 0;

FI;

RFLAGS.OF, SF, AF, PF, CF := 0;

1. Further details on Key Locker and usage of this instruction can be found here:

https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html.

AESENCWIDE256KL-Perform 14 Rounds of AES Encryption Flow With Key Locker on 8 Blocks Using 256-Bit Key

Vol. 2A

3-73

INSTRUCTION SET REFERENCE, A-L

Flags Affected

ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to a handle violation. The other

arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0.

Intel C/C++ Compiler Intrinsic Equivalent

AESENCWIDE256KLunsigned char _mm_aesencwide256kl_u8(__m128i odata[8], const __m128i idata[8], const void* h);

Exceptions (All Operating Modes)

#UD

If the LOCK prefix is used.

If CPUID.07H:ECX.KL [bit 23] = 0.

If CR4.KL = 0.

If CPUID.19H:EBX.AESKLE [bit 0] = 0.

If CR0.EM = 1.

If CR4.OSFXSR = 0.

If CPUID.19H:EBX.WIDE_KL [bit 2] = 0.

#NM

If CR0.TS = 1.

#PF

If a page fault occurs.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If the memory address is in a non-canonical form.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

If a memory address referencing the SS segment is in a non-canonical form.

3-74

Vol. 2A

AESENCWIDE256KL-Perform 14 Rounds of AES Encryption Flow With Key Locker on 8 Blocks Using 256-Bit Key

INSTRUCTION SET REFERENCE, A-L

AESIMC-Perform the AES InvMixColumn Transformation

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

66 0F 38 DB /r

V/V

AES

Perform the InvMixColumn transformation on

AESIMC xmm1, xmm2/m128

a 128-bit round key from xmm2/m128 and

store the result in xmm1.

VEX.128.66.0F38.WIG DB /r

V/V

Both AES

Perform the InvMixColumn transformation on

VAESIMC xmm1, xmm2/m128

and

a 128-bit round key from xmm2/m128 and

AVX flags

store the result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Perform the InvMixColumns transformation on the source operand and store the result in the destination operand.

The destination operand is an XMM register. The source operand can be an XMM register or a 128-bit memory loca-

tion.

Note: the AESIMC instruction should be applied to the expanded AES round keys (except for the first and last round

key) in order to prepare them for decryption using the “Equivalent Inverse Cipher” (defined in FIPS 197).

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain

unchanged.

VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

AESIMC

DEST[127:0] := InvMixColumns( SRC );

DEST[MAXVL-1:128] (Unmodified)

VAESIMC

DEST[127:0] := InvMixColumns( SRC );

DEST[MAXVL-1:128] := 0;

Intel C/C++ Compiler Intrinsic Equivalent

(V)AESIMC __m128i _mm_aesimc (__m128i)

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions,” additionally:

#UD

If VEX.vvvv ≠ 1111B.

AESIMC-Perform the AES InvMixColumn Transformation

Vol. 2A

3-75

INSTRUCTION SET REFERENCE, A-L

AESKEYGENASSIST-AES Round Key Generation Assist

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

66 0F 3A DF /r ib

RMI

V/V

AES

Assist in AES round key generation using an 8

AESKEYGENASSIST xmm1, xmm2/m128, imm8

bits Round Constant (RCON) specified in the

immediate byte, operating on 128 bits of data

specified in xmm2/m128 and stores the

result in xmm1.

VEX.128.66.0F3A.WIG DF /r ib

RMI

V/V

Both AES

Assist in AES round key generation using 8

VAESKEYGENASSIST xmm1, xmm2/m128, imm8

and

bits Round Constant (RCON) specified in the

AVX flags

immediate byte, operating on 128 bits of data

specified in xmm2/m128 and stores the

result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (w)

ModRM:r/m (r)

imm8

N/A

Description

Assist in expanding the AES cipher key, by computing steps towards generating a round key for encryption, using

128-bit data specified in the source operand and an 8-bit round constant specified as an immediate, store the result

in the destination operand.

The destination operand is an XMM register. The source operand can be an XMM register or a 128-bit memory loca-

tion.

128-bit Legacy SSE version: Bits (MAXVL-1:128) of the corresponding YMM destination register remain unchanged.

VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

AESKEYGENASSIST

X3[31:0] := SRC [127: 96];

X2[31:0] := SRC [95: 64];

X1[31:0] := SRC [63: 32];

X0[31:0] := SRC [31: 0];

RCON[31:0] := ZeroExtend(imm8[7:0]);

DEST[31:0] := SubWord(X1);

DEST[63:32 ] := RotWord( SubWord(X1) ) XOR RCON;

DEST[95:64] := SubWord(X3);

DEST[127:96] := RotWord( SubWord(X3) ) XOR RCON;

DEST[MAXVL-1:128] (Unmodified)

3-76

Vol. 2A

AESKEYGENASSIST-AES Round Key Generation Assist

INSTRUCTION SET REFERENCE, A-L

VAESKEYGENASSIST

X3[31:0] := SRC [127: 96];

X2[31:0] := SRC [95: 64];

X1[31:0] := SRC [63: 32];

X0[31:0] := SRC [31: 0];

RCON[31:0] := ZeroExtend(imm8[7:0]);

DEST[31:0] := SubWord(X1);

DEST[63:32 ] := RotWord( SubWord(X1) ) XOR RCON;

DEST[95:64] := SubWord(X3);

DEST[127:96] := RotWord( SubWord(X3) ) XOR RCON;

DEST[MAXVL-1:128] := 0;

Intel C/C++ Compiler Intrinsic Equivalent

(V)AESKEYGENASSIST __m128i _mm_aeskeygenassist (__m128i, const int)

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions,” additionally:

#UD

If VEX.vvvv ≠ 1111B.

AESKEYGENASSIST-AES Round Key Generation Assist

Vol. 2A

3-77

INSTRUCTION SET REFERENCE, A-L

AND-Logical AND

Opcode

Instruction

Op/

64-bit

Compat/

Description

Mode

Leg Mode

24 ib

AND AL, imm8

Valid

AL AND imm8.

25 iw

AND AX, imm16

Valid

AX AND imm16.

25 id

AND EAX, imm32

Valid

EAX AND imm32.

REX.W + 25 id

AND RAX, imm32

Valid

N.E.

RAX AND imm32 sign-extended to 64-bits.

80 /4 ib

AND r/m8, imm8

Valid

r/m8 AND imm8.

REX + 80 /4 ib

AND r/m8^*, imm8

Valid

N.E.

r/m8 AND imm8.

81 /4 iw

AND r/m16, imm16

Valid

r/m16 AND imm16.

81 /4 id

AND r/m32, imm32

Valid

r/m32 AND imm32.

REX.W + 81 /4 id

AND r/m64, imm32

Valid

N.E.

r/m64 AND imm32 sign extended to 64-bits.

83 /4 ib

AND r/m16, imm8

Valid

r/m16 AND imm8 (sign-extended).

83 /4 ib

AND r/m32, imm8

Valid

r/m32 AND imm8 (sign-extended).

REX.W + 83 /4 ib

AND r/m64, imm8

Valid

N.E.

r/m64 AND imm8 (sign-extended).

20 /r

AND r/m8, r8

Valid

r/m8 AND r8.

REX + 20 /r

AND r/m8^*, r8^*

Valid

N.E.

r/m64 AND r8 (sign-extended).

21 /r

AND r/m16, r16

Valid

r/m16 AND r16.

21 /r

AND r/m32, r32

Valid

r/m32 AND r32.

REX.W + 21 /r

AND r/m64, r64

Valid

N.E.

r/m64 AND r32.

22 /r

AND r8, r/m8

Valid

r8 AND r/m8.

REX + 22 /r

AND r8^*, r/m8^*

Valid

N.E.

r/m64 AND r8 (sign-extended).

23 /r

AND r16, r/m16

Valid

r16 AND r/m16.

23 /r

AND r32, r/m32

Valid

r32 AND r/m32.

REX.W + 23 /r

AND r64, r/m64

Valid

N.E.

r64 AND r/m64.

NOTES:

*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

ModRM:r/m (r, w)

imm8/16/32

N/A

AL/AX/EAX/RAX

imm8/16/32

N/A

Description

Performs a bitwise AND operation on the destination (first) and source (second) operands and stores the result in

the destination operand location. The source operand can be an immediate, a register, or a memory location; the

destination operand can be a register or a memory location. (However, two memory operands cannot be used in

one instruction.) Each bit of the result is set to 1 if both corresponding bits of the first and second operands are 1;

otherwise, it is set to 0.

This instruction can be used with a LOCK prefix to allow the it to be executed atomically.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

3-78

Vol. 2A

AND-Logical AND

INSTRUCTION SET REFERENCE, A-L

Operation

DEST := DEST AND SRC;

Flags Affected

The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is

undefined.

Protected Mode Exceptions

#GP(0)

If the destination operand points to a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

AND-Logical AND

Vol. 2A

3-79

INSTRUCTION SET REFERENCE, A-L

ANDN-Logical AND NOT

Opcode/Instruction

Op/

64/32-

CPUID

Description

bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F2 /r

RVM

V/V

BMI1

Bitwise AND of inverted r32b with r/m32, store result in r32a.

ANDN r32a, r32b, r/m32

VEX.LZ. 0F38.W1 F2 /r

RVM

V/NE

BMI1

Bitwise AND of inverted r64b with r/m64, store result in r64a.

ANDN r64a, r64b, r/m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RVM

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical AND of inverted second operand (the first source operand) with the third operand (the

second source operand). The result is stored in the first operand (destination operand).

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt

to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

DEST := (NOT SRC1) bitwiseAND SRC2;

SF := DEST[OperandSize -1];

ZF := (DEST = 0);

Flags Affected

SF and ZF are updated based on result. OF and CF flags are cleared. AF and PF flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

Auto-generated from high-level language.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions.”

3-80

Vol. 2A

ANDN-Logical AND NOT

INSTRUCTION SET REFERENCE, A-L

ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 54 /r

V/V

SSE2

Return the bitwise logical AND of packed double precision

ANDPD xmm1, xmm2/m128

floating-point values in xmm1 and xmm2/mem.

VEX.128.66.0F 54 /r

V/V

AVX

Return the bitwise logical AND of packed double precision

VANDPD xmm1, xmm2, xmm3/m128

floating-point values in xmm2 and xmm3/mem.

VEX.256.66.0F 54 /r

V/V

AVX

Return the bitwise logical AND of packed double precision

VANDPD ymm1, ymm2, ymm3/m256

floating-point values in ymm2 and ymm3/mem.

EVEX.128.66.0F.W1 54 /r

V/V

AVX512VL

Return the bitwise logical AND of packed double precision

VANDPD xmm1 {k1}{z}, xmm2,

AVX512DQ

floating-point values in xmm2 and xmm3/m128/m64bcst

xmm3/m128/m64bcst

subject to writemask k1.

EVEX.256.66.0F.W1 54 /r

V/V

AVX512VL

Return the bitwise logical AND of packed double precision

VANDPD ymm1 {k1}{z}, ymm2,

AVX512DQ

floating-point values in ymm2 and ymm3/m256/m64bcst

ymm3/m256/m64bcst

subject to writemask k1.

EVEX.512.66.0F.W1 54 /r

V/V

AVX512DQ

Return the bitwise logical AND of packed double precision

VANDPD zmm1 {k1}{z}, zmm2,

floating-point values in zmm2 and zmm3/m512/m64bcst

zmm3/m512/m64bcst

subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical AND of the two, four or eight packed double precision floating-point values from the first

source operand and the second source operand, and stores the result in the destination operand.

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be

a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a

64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with

writemask k1.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register

or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the

corresponding ZMM register destination are zeroed.

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM

the corresponding ZMM register destination are zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values

Vol. 2A

3-81

INSTRUCTION SET REFERENCE, A-L

Operation

VANDPD (EVEX Encoded Versions)

(KL, VL) = (2, 128), (4, 256), (8, 512)

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask*

THEN

IF (EVEX.b == 1) AND (SRC2 *is memory*)

THEN

DEST[i+63:i] := SRC1[i+63:i] BITWISE AND SRC2[63:0]

ELSE

DEST[i+63:i] := SRC1[i+63:i] BITWISE AND SRC2[i+63:i]

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+63:i] remains unchanged*

ELSE

; zeroing-masking

DEST[i+63:i] = 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VANDPD (VEX.256 Encoded Version)

DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0]

DEST[127:64] := SRC1[127:64] BITWISE AND SRC2[127:64]

DEST[191:128] := SRC1[191:128] BITWISE AND SRC2[191:128]

DEST[255:192] := SRC1[255:192] BITWISE AND SRC2[255:192]

DEST[MAXVL-1:256] := 0

VANDPD (VEX.128 Encoded Version)

DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0]

DEST[127:64] := SRC1[127:64] BITWISE AND SRC2[127:64]

DEST[MAXVL-1:128] := 0

ANDPD (128-bit Legacy SSE Version)

DEST[63:0] := DEST[63:0] BITWISE AND SRC[63:0]

DEST[127:64] := DEST[127:64] BITWISE AND SRC[127:64]

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VANDPD __m512d _mm512_and_pd (__m512d a, __m512d b);

VANDPD __m512d _mm512_mask_and_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);

VANDPD __m512d _mm512_maskz_and_pd (__mmask8 k, __m512d a, __m512d b);

VANDPD __m256d _mm256_mask_and_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);

VANDPD __m256d _mm256_maskz_and_pd (__mmask8 k, __m256d a, __m256d b);

VANDPD __m128d _mm_mask_and_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);

VANDPD __m128d _mm_maskz_and_pd (__mmask8 k, __m128d a, __m128d b);

VANDPD __m256d _mm256_and_pd (__m256d a, __m256d b);

ANDPD __m128d _mm_and_pd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions

None.

3-82

Vol. 2A

ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

NP 0F 54 /r

V/V

SSE

Return the bitwise logical AND of packed single precision

ANDPS xmm1, xmm2/m128

floating-point values in xmm1 and xmm2/mem.

VEX.128.0F 54 /r

V/V

AVX

Return the bitwise logical AND of packed single precision

VANDPS xmm1,xmm2,

floating-point values in xmm2 and xmm3/mem.

xmm3/m128

VEX.256.0F 54 /r

V/V

AVX

Return the bitwise logical AND of packed single precision

VANDPS ymm1, ymm2,

floating-point values in ymm2 and ymm3/mem.

ymm3/m256

EVEX.128.0F.W0 54 /r

V/V

AVX512VL

Return the bitwise logical AND of packed single precision

VANDPS xmm1 {k1}{z}, xmm2,

AVX512DQ

floating-point values in xmm2 and xmm3/m128/m32bcst

xmm3/m128/m32bcst

subject to writemask k1.

EVEX.256.0F.W0 54 /r

V/V

AVX512VL

Return the bitwise logical AND of packed single precision

VANDPS ymm1 {k1}{z}, ymm2,

AVX512DQ

floating-point values in ymm2 and ymm3/m256/m32bcst

ymm3/m256/m32bcst

subject to writemask k1.

EVEX.512.0F.W0 54 /r

V/V

AVX512DQ

Return the bitwise logical AND of packed single precision

VANDPS zmm1 {k1}{z}, zmm2,

floating-point values in zmm2 and zmm3/m512/m32bcst

zmm3/m512/m32bcst

subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical AND of the four, eight or sixteen packed single precision floating-point values from the

first source operand and the second source operand, and stores the result in the destination operand.

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be

a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a

32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with

writemask k1.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register

or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the

corresponding ZMM register destination are zeroed.

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM

the corresponding ZMM register destination are zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

ZMM register destination are unmodified.

3-84

Vol. 2A

ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

Operation

VANDPS (EVEX Encoded Versions)

(KL, VL) = (4, 128), (8, 256), (16, 512)

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask*

IF (EVEX.b == 1) AND (SRC2 *is memory*)

THEN

DEST[i+63:i] := SRC1[i+31:i] BITWISE AND SRC2[31:0]

ELSE

DEST[i+31:i] := SRC1[i+31:i] BITWISE AND SRC2[i+31:i]

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+31:i] remains unchanged*

ELSE

; zeroing-masking

DEST[i+31:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0;

VANDPS (VEX.256 Encoded Version)

DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0]

DEST[63:32] := SRC1[63:32] BITWISE AND SRC2[63:32]

DEST[95:64] := SRC1[95:64] BITWISE AND SRC2[95:64]

DEST[127:96] := SRC1[127:96] BITWISE AND SRC2[127:96]

DEST[159:128] := SRC1[159:128] BITWISE AND SRC2[159:128]

DEST[191:160] := SRC1[191:160] BITWISE AND SRC2[191:160]

DEST[223:192] := SRC1[223:192] BITWISE AND SRC2[223:192]

DEST[255:224] := SRC1[255:224] BITWISE AND SRC2[255:224].

DEST[MAXVL-1:256] := 0;

VANDPS (VEX.128 Encoded Version)

DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0]

DEST[63:32] := SRC1[63:32] BITWISE AND SRC2[63:32]

DEST[95:64] := SRC1[95:64] BITWISE AND SRC2[95:64]

DEST[127:96] := SRC1[127:96] BITWISE AND SRC2[127:96]

DEST[MAXVL-1:128] := 0;

ANDPS (128-bit Legacy SSE Version)

DEST[31:0] := DEST[31:0] BITWISE AND SRC[31:0]

DEST[63:32] := DEST[63:32] BITWISE AND SRC[63:32]

DEST[95:64] := DEST[95:64] BITWISE AND SRC[95:64]

DEST[127:96] := DEST[127:96] BITWISE AND SRC[127:96]

DEST[MAXVL-1:128] (Unmodified)

ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values

Vol. 2A

3-85

INSTRUCTION SET REFERENCE, A-L

Intel C/C++ Compiler Intrinsic Equivalent

VANDPS __m512 _mm512_and_ps (__m512 a, __m512 b);

VANDPS __m512 _mm512_mask_and_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);

VANDPS __m512 _mm512_maskz_and_ps (__mmask16 k, __m512 a, __m512 b);

VANDPS __m256 _mm256_mask_and_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);

VANDPS __m256 _mm256_maskz_and_ps (__mmask8 k, __m256 a, __m256 b);

VANDPS __m128 _mm_mask_and_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);

VANDPS __m128 _mm_maskz_and_ps (__mmask8 k, __m128 a, __m128 b);

VANDPS __m256 _mm256_and_ps (__m256 a, __m256 b);

ANDPS __m128 _mm_and_ps (__m128 a, __m128 b);

SIMD Floating-Point Exceptions

None.

Other Exceptions

VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”

EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions.”

3-86

Vol. 2A

ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 55 /r

V/V

SSE2

Return the bitwise logical AND NOT of packed double

ANDNPD xmm1, xmm2/m128

precision floating-point values in xmm1 and xmm2/mem.

VEX.128.66.0F 55 /r

V/V

AVX

Return the bitwise logical AND NOT of packed double

VANDNPD xmm1, xmm2,

precision floating-point values in xmm2 and xmm3/mem.

xmm3/m128

VEX.256.66.0F 55/r

V/V

AVX

Return the bitwise logical AND NOT of packed double

VANDNPD ymm1, ymm2,

precision floating-point values in ymm2 and ymm3/mem.

ymm3/m256

EVEX.128.66.0F.W1 55 /r

V/V

AVX512VL

Return the bitwise logical AND NOT of packed double

VANDNPD xmm1 {k1}{z}, xmm2,

AVX512DQ

precision floating-point values in xmm2 and

xmm3/m128/m64bcst

xmm3/m128/m64bcst subject to writemask k1.

EVEX.256.66.0F.W1 55 /r

V/V

AVX512VL

Return the bitwise logical AND NOT of packed double

VANDNPD ymm1 {k1}{z}, ymm2,

AVX512DQ

precision floating-point values in ymm2 and

ymm3/m256/m64bcst

ymm3/m256/m64bcst subject to writemask k1.

EVEX.512.66.0F.W1 55 /r

V/V

AVX512DQ

Return the bitwise logical AND NOT of packed double

VANDNPD zmm1 {k1}{z}, zmm2,

precision floating-point values in zmm2 and

zmm3/m512/m64bcst

zmm3/m512/m64bcst subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical AND NOT of the two, four or eight packed double precision floating-point values from the

first source operand and the second source operand, and stores the result in the destination operand.

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be

a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a

64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with

writemask k1.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register

or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the

corresponding ZMM register destination are zeroed.

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM

the corresponding ZMM register destination are zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values

Vol. 2A

3-87

INSTRUCTION SET REFERENCE, A-L

Operation

VANDNPD (EVEX Encoded Versions)

(KL, VL) = (2, 128), (4, 256), (8, 512)

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask*

IF (EVEX.b == 1) AND (SRC2 *is memory*)

THEN

DEST[i+63:i] := (NOT(SRC1[i+63:i])) BITWISE AND SRC2[63:0]

ELSE

DEST[i+63:i] := (NOT(SRC1[i+63:i])) BITWISE AND SRC2[i+63:i]

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+63:i] remains unchanged*

ELSE

; zeroing-masking

DEST[i+63:i] = 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VANDNPD (VEX.256 Encoded Version)

DEST[63:0] := (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0]

DEST[127:64] := (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64]

DEST[191:128] := (NOT(SRC1[191:128])) BITWISE AND SRC2[191:128]

DEST[255:192] := (NOT(SRC1[255:192])) BITWISE AND SRC2[255:192]

DEST[MAXVL-1:256] := 0

VANDNPD (VEX.128 Encoded Version)

DEST[63:0] := (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0]

DEST[127:64] := (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64]

DEST[MAXVL-1:128] := 0

ANDNPD (128-bit Legacy SSE Version)

DEST[63:0] := (NOT(DEST[63:0])) BITWISE AND SRC[63:0]

DEST[127:64] := (NOT(DEST[127:64])) BITWISE AND SRC[127:64]

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VANDNPD __m512d _mm512_andnot_pd (__m512d a, __m512d b);

VANDNPD __m512d _mm512_mask_andnot_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);

VANDNPD __m512d _mm512_maskz_andnot_pd (__mmask8 k, __m512d a, __m512d b);

VANDNPD __m256d _mm256_mask_andnot_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);

VANDNPD __m256d _mm256_maskz_andnot_pd (__mmask8 k, __m256d a, __m256d b);

VANDNPD __m128d _mm_mask_andnot_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);

VANDNPD __m128d _mm_maskz_andnot_pd (__mmask8 k, __m128d a, __m128d b);

VANDNPD __m256d _mm256_andnot_pd (__m256d a, __m256d b);

ANDNPD __m128d _mm_andnot_pd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions

None.

3-88

Vol. 2A

ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 55 /r

V/V

SSE

Return the bitwise logical AND NOT of packed single precision

ANDNPS xmm1, xmm2/m128

floating-point values in xmm1 and xmm2/mem.

VEX.128.0F 55 /r

V/V

AVX

Return the bitwise logical AND NOT of packed single precision

VANDNPS xmm1, xmm2,

floating-point values in xmm2 and xmm3/mem.

xmm3/m128

VEX.256.0F 55 /r

V/V

AVX

Return the bitwise logical AND NOT of packed single precision

VANDNPS ymm1, ymm2,

floating-point values in ymm2 and ymm3/mem.

ymm3/m256

EVEX.128.0F.W0 55 /r

V/V

AVX512VL

Return the bitwise logical AND of packed single precision

VANDNPS xmm1 {k1}{z}, xmm2,

AVX512DQ

floating-point values in xmm2 and xmm3/m128/m32bcst

xmm3/m128/m32bcst

subject to writemask k1.

EVEX.256.0F.W0 55 /r

V/V

AVX512VL

Return the bitwise logical AND of packed single precision

VANDNPS ymm1 {k1}{z}, ymm2,

AVX512DQ

floating-point values in ymm2 and ymm3/m256/m32bcst

ymm3/m256/m32bcst

subject to writemask k1.

EVEX.512.0F.W0 55 /r

V/V

AVX512DQ

Return the bitwise logical AND of packed single precision

VANDNPS zmm1 {k1}{z}, zmm2,

floating-point values in zmm2 and zmm3/m512/m32bcst

zmm3/m512/m32bcst

subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical AND NOT of the four, eight or sixteen packed single precision floating-point values from

the first source operand and the second source operand, and stores the result in the destination operand.

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be

a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a

32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with

writemask k1.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register

or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAXVL-1:256) of the

corresponding ZMM register destination are zeroed.

VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM

the corresponding ZMM register destination are zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

ZMM register destination are unmodified.

3-90

Vol. 2A

ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

Operation

VANDNPS (EVEX Encoded Versions)

(KL, VL) = (4, 128), (8, 256), (16, 512)

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask*

IF (EVEX.b == 1) AND (SRC2 *is memory*)

THEN

DEST[i+31:i] := (NOT(SRC1[i+31:i])) BITWISE AND SRC2[31:0]

ELSE

DEST[i+31:i] := (NOT(SRC1[i+31:i])) BITWISE AND SRC2[i+31:i]

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+31:i] remains unchanged*

ELSE

; zeroing-masking

DEST[i+31:i] = 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VANDNPS (VEX.256 Encoded Version)

DEST[31:0] := (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0]

DEST[63:32] := (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32]

DEST[95:64] := (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64]

DEST[127:96] := (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96]

DEST[159:128] := (NOT(SRC1[159:128])) BITWISE AND SRC2[159:128]

DEST[191:160] := (NOT(SRC1[191:160])) BITWISE AND SRC2[191:160]

DEST[223:192] := (NOT(SRC1[223:192])) BITWISE AND SRC2[223:192]

DEST[255:224] := (NOT(SRC1[255:224])) BITWISE AND SRC2[255:224].

DEST[MAXVL-1:256] := 0

VANDNPS (VEX.128 Encoded Version)

DEST[31:0] := (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0]

DEST[63:32] := (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32]

DEST[95:64] := (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64]

DEST[127:96] := (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96]

DEST[MAXVL-1:128] := 0

ANDNPS (128-bit Legacy SSE Version)

DEST[31:0] := (NOT(DEST[31:0])) BITWISE AND SRC[31:0]

DEST[63:32] := (NOT(DEST[63:32])) BITWISE AND SRC[63:32]

DEST[95:64] := (NOT(DEST[95:64])) BITWISE AND SRC[95:64]

DEST[127:96] := (NOT(DEST[127:96])) BITWISE AND SRC[127:96]

DEST[MAXVL-1:128] (Unmodified)

ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values

Vol. 2A

3-91

INSTRUCTION SET REFERENCE, A-L

Intel C/C++ Compiler Intrinsic Equivalent

VANDNPS __m512 _mm512_andnot_ps (__m512 a, __m512 b);

VANDNPS __m512 _mm512_mask_andnot_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);

VANDNPS __m512 _mm512_maskz_andnot_ps (__mmask16 k, __m512 a, __m512 b);

VANDNPS __m256 _mm256_mask_andnot_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);

VANDNPS __m256 _mm256_maskz_andnot_ps (__mmask8 k, __m256 a, __m256 b);

VANDNPS __m128 _mm_mask_andnot_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);

VANDNPS __m128 _mm_maskz_andnot_ps (__mmask8 k, __m128 a, __m128 b);

VANDNPS __m256 _mm256_andnot_ps (__m256 a, __m256 b);

ANDNPS __m128 _mm_andnot_ps (__m128 a, __m128 b);

SIMD Floating-Point Exceptions

None.

Other Exceptions

VEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”

EVEX-encoded instruction, see Table 2-49, “Type E4 Class Exception Conditions.”

3-92

Vol. 2A

ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

ARPL-Adjust RPL Field of Segment Selector

Opcode

Instruction

Op/

64-bit

Compat/

Description

Mode

Leg Mode

63 /r

ARPL r/m16, r16

N. E.

Valid

Adjust RPL of r/m16 to not less than RPL of

r16.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

Compares the RPL fields of two segment selectors. The first operand (the destination operand) contains one

segment selector and the second operand (source operand) contains the other. (The RPL field is located in bits 0

and 1 of each operand.) If the RPL field of the destination operand is less than the RPL field of the source operand,

the ZF flag is set and the RPL field of the destination operand is increased to match that of the source operand.

Otherwise, the ZF flag is cleared and no change is made to the destination operand. (The destination operand can

be a word register or a memory location; the source operand must be a word register.)

The ARPL instruction is provided for use by operating-system procedures (however, it can also be used by applica-

tions). It is generally used to adjust the RPL of a segment selector that has been passed to the operating system

by an application program to match the privilege level of the application program. Here the segment selector

passed to the operating system is placed in the destination operand and segment selector for the application

program’s code segment is placed in the source operand. (The RPL field in the source operand represents the priv-

ilege level of the application program.) Execution of the ARPL instruction then ensures that the RPL of the segment

selector received by the operating system is no lower (does not have a higher privilege) than the privilege level of

the application program (the segment selector for the application program’s code segment can be read from the

stack following a procedure call).

This instruction executes as described in compatibility mode and legacy mode. It is not encodable in 64-bit mode.

See “Checking Caller Access Privileges” in Chapter 3, “Protected-Mode Memory Management,” of the Intel^®64 and

IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information about the use of this instruc-

tion.

Operation

IF 64-BIT MODE

THEN

See MOVSXD;

ELSE

IF DEST[RPL] < SRC[RPL]

THEN

ZF := 1;

DEST[RPL] := SRC[RPL];

ELSE

ZF := 0;

FI;

Flags Affected

The ZF flag is set to 1 if the RPL field of the destination operand is less than that of the source operand; otherwise,

it is set to 0.

ARPL-Adjust RPL Field of Segment Selector

Vol. 2A

3-93

INSTRUCTION SET REFERENCE, A-L

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

The ARPL instruction is not recognized in real-address mode.

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#UD

The ARPL instruction is not recognized in virtual-8086 mode.

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Not applicable.

3-94

Vol. 2A

ARPL-Adjust RPL Field of Segment Selector

INSTRUCTION SET REFERENCE, A-L

BEXTR-Bit Field Extract

Opcode/Instruction

Op/

64/32-

CPUID

Description

bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F7 /r

RMV

V/V

BMI1

Contiguous bitwise extract from r/m32 using r32b as control; store

BEXTR r32a, r/m32, r32b

result in r32a.

VEX.LZ.0F38.W1 F7 /r

RMV

V/N.E.

BMI1

Contiguous bitwise extract from r/m64 using r64b as control; store

BEXTR r64a, r/m64, r64b

result in r64a.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMV

ModRM:reg (w)

ModRM:r/m (r)

VEX.vvvv (r)

N/A

Description

Extracts contiguous bits from the first source operand (the second operand) using an index value and length value

specified in the second source operand (the third operand). Bit 7:0 of the second source operand specifies the

starting bit position of bit extraction. A START value exceeding the operand size will not extract any bits from the

second source operand. Bit 15:8 of the second source operand specifies the maximum number of bits (LENGTH)

beginning at the START position to extract. Only bit positions up to (OperandSize -1) of the first source operand are

extracted. The extracted bits are written to the destination register, starting from the least significant bit. All higher

order bits in the destination operand (starting at bit position LENGTH) are zeroed. The destination register is

cleared if no bits are extracted.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

START := SRC2[7:0];

LEN := SRC2[15:8];

TEMP := ZERO_EXTEND_TO_512 (SRC1 );

DEST := ZERO_EXTEND(TEMP[START+LEN -1: START]);

ZF := (DEST = 0);

Flags Affected

ZF is updated based on the result. AF, SF, and PF are undefined. All other flags are cleared.

Intel C/C++ Compiler Intrinsic Equivalent

BEXTR unsigned __int32 _bextr_u32(unsigned __int32 src, unsigned __int32 start. unsigned __int32 len);

BEXTR unsigned __int64 _bextr_u64(unsigned __int64 src, unsigned __int32 start. unsigned __int32 len);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions,” additionally:

#UD

If VEX.W = 1.

BEXTR-Bit Field Extract

Vol. 2A

3-95

INSTRUCTION SET REFERENCE, A-L

BLENDPD-Blend Packed Double Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

66 0F 3A 0D /r ib

RMI

V/V

SSE4_1

Select packed double precision floating-point

values from xmm1 and xmm2/m128 from

BLENDPD xmm1, xmm2/m128, imm8

mask specified in imm8 and store the values

into xmm1.

VEX.128.66.0F3A.WIG 0D /r ib

RVMI

V/V

AVX

Select packed double precision floating-point

Values from xmm2 and xmm3/m128 from

VBLENDPD xmm1, xmm2, xmm3/m128, imm8

mask in imm8 and store the values in xmm1.

VEX.256.66.0F3A.WIG 0D /r ib

RVMI

V/V

AVX

Select packed double precision floating-point

Values from ymm2 and ymm3/m256 from

VBLENDPD ymm1, ymm2, ymm3/m256, imm8

mask in imm8 and store the values in ymm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

N/A

RVMI

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8[3:0]

Description

Double-precision floating-point values from the second source operand (third operand) are conditionally merged

with values from the first source operand (second operand) and written to the destination operand (first operand).

The immediate bits [3:0] determine whether the corresponding double precision floating-point value in the desti-

nation is copied from the second source or first source. If a bit in the mask, corresponding to a word, is ”1”, then

the double precision floating-point value in the second source operand is copied, else the value in the first source

operand is copied.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

YMM register destination are unmodified.

VEX.128 encoded version: the first source operand is an XMM register. The second source operand is an XMM

the corresponding YMM register destination are zeroed.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

Operation

BLENDPD (128-bit Legacy SSE Version)

IF (IMM8[0] = 0)THEN DEST[63:0] := DEST[63:0]

ELSE DEST [63:0] := SRC[63:0] FI

IF (IMM8[1] = 0) THEN DEST[127:64] := DEST[127:64]

ELSE DEST [127:64] := SRC[127:64] FI

DEST[MAXVL-1:128] (Unmodified)

VBLENDPD (VEX.128 Encoded Version)

IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0]

ELSE DEST [63:0] := SRC2[63:0] FI

IF (IMM8[1] = 0) THEN DEST[127:64] := SRC1[127:64]

ELSE DEST [127:64] := SRC2[127:64] FI

DEST[MAXVL-1:128] := 0

3-96

Vol. 2A

BLENDPD-Blend Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

VBLENDPD (VEX.256 Encoded Version)

IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0]

ELSE DEST [63:0] := SRC2[63:0] FI

IF (IMM8[1] = 0) THEN DEST[127:64] := SRC1[127:64]

ELSE DEST [127:64] := SRC2[127:64] FI

IF (IMM8[2] = 0) THEN DEST[191:128] := SRC1[191:128]

ELSE DEST [191:128] := SRC2[191:128] FI

IF (IMM8[3] = 0) THEN DEST[255:192] := SRC1[255:192]

ELSE DEST [255:192] := SRC2[255:192] FI

Intel C/C++ Compiler Intrinsic Equivalent

BLENDPD __m128d _mm_blend_pd (__m128d v1, __m128d v2, const int mask);

VBLENDPD __m256d _mm256_blend_pd (__m256d a, __m256d b, const int mask);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

BLENDPD-Blend Packed Double Precision Floating-Point Values

Vol. 2A

3-97

INSTRUCTION SET REFERENCE, A-L

BLENDPS-Blend Packed Single Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

66 0F 3A 0C /r ib

RMI

V/V

SSE4_1

Select packed single precision floating-point

values from xmm1 and xmm2/m128 from

BLENDPS xmm1, xmm2/m128, imm8

mask specified in imm8 and store the values

into xmm1.

VEX.128.66.0F3A.WIG 0C /r ib

RVMI

V/V

AVX

Select packed single precision floating-point

values from xmm2 and xmm3/m128 from

VBLENDPS xmm1, xmm2, xmm3/m128, imm8

mask in imm8 and store the values in xmm1.

VEX.256.66.0F3A.WIG 0C /r ib

RVMI

V/V

AVX

Select packed single precision floating-point

values from ymm2 and ymm3/m256 from

VBLENDPS ymm1, ymm2, ymm3/m256, imm8

mask in imm8 and store the values in ymm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

N/A

RVMI

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8

Description

Packed single precision floating-point values from the second source operand (third operand) are conditionally

merged with values from the first source operand (second operand) and written to the destination operand (first

operand). The immediate bits [7:0] determine whether the corresponding single precision floating-point value in

the destination is copied from the second source or first source. If a bit in the mask, corresponding to a word, is “1”,

then the single precision floating-point value in the second source operand is copied, else the value in the first

source operand is copied.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

YMM register destination are unmodified.

VEX.128 encoded version: The first source operand an XMM register. The second source operand is an XMM register

or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of the

corresponding YMM register destination are zeroed.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

Operation

BLENDPS (128-bit Legacy SSE Version)

IF (IMM8[0] = 0) THEN DEST[31:0] :=DEST[31:0]

ELSE DEST [31:0] := SRC[31:0] FI

IF (IMM8[1] = 0) THEN DEST[63:32] := DEST[63:32]

ELSE DEST [63:32] := SRC[63:32] FI

IF (IMM8[2] = 0) THEN DEST[95:64] := DEST[95:64]

ELSE DEST [95:64] := SRC[95:64] FI

IF (IMM8[3] = 0) THEN DEST[127:96] := DEST[127:96]

ELSE DEST [127:96] := SRC[127:96] FI

DEST[MAXVL-1:128] (Unmodified)

3-98

Vol. 2A

BLENDPS-Blend Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

VBLENDPS (VEX.128 Encoded Version)

IF (IMM8[0] = 0) THEN DEST[31:0] :=SRC1[31:0]

ELSE DEST [31:0] := SRC2[31:0] FI

IF (IMM8[1] = 0) THEN DEST[63:32] := SRC1[63:32]

ELSE DEST [63:32] := SRC2[63:32] FI

IF (IMM8[2] = 0) THEN DEST[95:64] := SRC1[95:64]

ELSE DEST [95:64] := SRC2[95:64] FI

IF (IMM8[3] = 0) THEN DEST[127:96] := SRC1[127:96]

ELSE DEST [127:96] := SRC2[127:96] FI

DEST[MAXVL-1:128] := 0

VBLENDPS (VEX.256 Encoded Version)

IF (IMM8[0] = 0) THEN DEST[31:0] :=SRC1[31:0]

ELSE DEST [31:0] := SRC2[31:0] FI

IF (IMM8[1] = 0) THEN DEST[63:32] := SRC1[63:32]

ELSE DEST [63:32] := SRC2[63:32] FI

IF (IMM8[2] = 0) THEN DEST[95:64] := SRC1[95:64]

ELSE DEST [95:64] := SRC2[95:64] FI

IF (IMM8[3] = 0) THEN DEST[127:96] := SRC1[127:96]

ELSE DEST [127:96] := SRC2[127:96] FI

IF (IMM8[4] = 0) THEN DEST[159:128] := SRC1[159:128]

ELSE DEST [159:128] := SRC2[159:128] FI

IF (IMM8[5] = 0) THEN DEST[191:160] := SRC1[191:160]

ELSE DEST [191:160] := SRC2[191:160] FI

IF (IMM8[6] = 0) THEN DEST[223:192] := SRC1[223:192]

ELSE DEST [223:192] := SRC2[223:192] FI

IF (IMM8[7] = 0) THEN DEST[255:224] := SRC1[255:224]

ELSE DEST [255:224] := SRC2[255:224] FI.

Intel C/C++ Compiler Intrinsic Equivalent

BLENDPS __m128 _mm_blend_ps (__m128 v1, __m128 v2, const int mask);

VBLENDPS __m256 _mm256_blend_ps (__m256 a, __m256 b, const int mask);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

BLENDPS-Blend Packed Single Precision Floating-Point Values

Vol. 2A

3-99

INSTRUCTION SET REFERENCE, A-L

BLENDVPD-Variable Blend Packed Double Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

66 0F 38 15 /r

RM0

V/V

SSE4_1

Select packed double precision floating-point

values from xmm1 and xmm2 from mask specified

BLENDVPD xmm1, xmm2/m128 , <XMM0>

in XMM0 and store the values in xmm1.

VEX.128.66.0F3A.W0 4B /r /is4

RVMR

V/V

AVX

Conditionally copy double precision floating-point

values from xmm2 or xmm3/m128 to xmm1, based

VBLENDVPD xmm1, xmm2, xmm3/m128, xmm4

on mask bits in the mask operand, xmm4.

VEX.256.66.0F3A.W0 4B /r /is4

RVMR

V/V

AVX

Conditionally copy double precision floating-point

values from ymm2 or ymm3/m256 to ymm1, based

VBLENDVPD ymm1, ymm2, ymm3/m256, ymm4

on mask bits in the mask operand, ymm4.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM0

ModRM:reg (r, w)

ModRM:r/m (r)

implicit XMM0

N/A

RVMR

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8[7:4]

Description

Conditionally copy each quadword data element of double precision floating-point value from the second source

operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits

are the most significant bit in each quadword element of the mask register.

Each quadword element of the destination operand is copied from:

• the corresponding quadword element in the second source operand, if a mask bit is “1”; or

• the corresponding quadword element in the first source operand, if a mask bit is “0”

The register assignment of the implicit mask operand for BLENDVPD is defined to be the architectural register

XMM0.

128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128)

of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined

to be the architectural register XMM0. An attempt to execute BLENDVPD with a VEX prefix will cause #UD.

VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second

source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. VEX.W

must be 0, otherwise, the instruction will #UD.

VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source

operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. VEX.W must be 0, otherwise, the instruction will #UD.

VBLENDVPD permits the mask to be any XMM or YMM register. In contrast, BLENDVPD treats XMM0 implicitly as the

mask and do not support non-destructive destination operation.

3-100

Vol. 2A

BLENDVPD-Variable Blend Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

Operation

BLENDVPD (128-bit Legacy SSE Version)

MASK := XMM0

IF (MASK[63] = 0) THEN DEST[63:0] := DEST[63:0]

ELSE DEST [63:0] := SRC[63:0] FI

IF (MASK[127] = 0) THEN DEST[127:64] := DEST[127:64]

ELSE DEST [127:64] := SRC[127:64] FI

DEST[MAXVL-1:128] (Unmodified)

VBLENDVPD (VEX.128 Encoded Version)

MASK := SRC3

IF (MASK[63] = 0) THEN DEST[63:0] := SRC1[63:0]

ELSE DEST [63:0] := SRC2[63:0] FI

IF (MASK[127] = 0) THEN DEST[127:64] := SRC1[127:64]

ELSE DEST [127:64] := SRC2[127:64] FI

DEST[MAXVL-1:128] := 0

VBLENDVPD (VEX.256 Encoded Version)

MASK := SRC3

IF (MASK[63] = 0) THEN DEST[63:0] := SRC1[63:0]

ELSE DEST [63:0] := SRC2[63:0] FI

IF (MASK[127] = 0) THEN DEST[127:64] := SRC1[127:64]

ELSE DEST [127:64] := SRC2[127:64] FI

IF (MASK[191] = 0) THEN DEST[191:128] := SRC1[191:128]

ELSE DEST [191:128] := SRC2[191:128] FI

IF (MASK[255] = 0) THEN DEST[255:192] := SRC1[255:192]

ELSE DEST [255:192] := SRC2[255:192] FI

Intel C/C++ Compiler Intrinsic Equivalent

BLENDVPD __m128d _mm_blendv_pd(__m128d v1, __m128d v2, __m128d v3);

VBLENDVPD __m128 _mm_blendv_pd (__m128d a, __m128d b, __m128d mask);

VBLENDVPD __m256 _mm256_blendv_pd (__m256d a, __m256d b, __m256d mask);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions,” additionally:

#UD

If VEX.W = 1.

BLENDVPD-Variable Blend Packed Double Precision Floating-Point Values

Vol. 2A

3-101

INSTRUCTION SET REFERENCE, A-L

BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

66 0F 38 14 /r

RM0

V/V

SSE4_1

Select packed single precision floating-point values

from xmm1 and xmm2/m128 from mask specified

BLENDVPS xmm1, xmm2/m128, <XMM0>

in XMM0 and store the values into xmm1.

VEX.128.66.0F3A.W0 4A /r /is4

RVMR

V/V

AVX

Conditionally copy single precision floating-point

values from xmm2 or xmm3/m128 to xmm1, based

VBLENDVPS xmm1, xmm2, xmm3/m128, xmm4

on mask bits in the specified mask operand, xmm4.

VEX.256.66.0F3A.W0 4A /r /is4

RVMR

V/V

AVX

Conditionally copy single precision floating-point

values from ymm2 or ymm3/m256 to ymm1, based

VBLENDVPS ymm1, ymm2, ymm3/m256, ymm4

on mask bits in the specified mask register, ymm4.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM0

ModRM:reg (r, w)

ModRM:r/m (r)

implicit XMM0

N/A

RVMR

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8[7:4]

Description

Conditionally copy each dword data element of single precision floating-point value from the second source

operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits

are the most significant bit in each dword element of the mask register.

Each quadword element of the destination operand is copied from:

• the corresponding dword element in the second source operand, if a mask bit is “1”; or

• the corresponding dword element in the first source operand, if a mask bit is “0”.

The register assignment of the implicit mask operand for BLENDVPS is defined to be the architectural register

XMM0.

128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128)

of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined

to be the architectural register XMM0. An attempt to execute BLENDVPS with a VEX prefix will cause #UD.

VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second

source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. VEX.W

must be 0, otherwise, the instruction will #UD.

VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source

operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. VEX.W must be 0, otherwise, the instruction will #UD.

VBLENDVPS permits the mask to be any XMM or YMM register. In contrast, BLENDVPS treats XMM0 implicitly as the

mask and do not support non-destructive destination operation.

3-102

Vol. 2A

BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

Operation

BLENDVPS (128-bit Legacy SSE Version)

MASK := XMM0

IF (MASK[31] = 0) THEN DEST[31:0] := DEST[31:0]

ELSE DEST [31:0] := SRC[31:0] FI

IF (MASK[63] = 0) THEN DEST[63:32] := DEST[63:32]

ELSE DEST [63:32] := SRC[63:32] FI

IF (MASK[95] = 0) THEN DEST[95:64] := DEST[95:64]

ELSE DEST [95:64] := SRC[95:64] FI

IF (MASK[127] = 0) THEN DEST[127:96] := DEST[127:96]

ELSE DEST [127:96] := SRC[127:96] FI

DEST[MAXVL-1:128] (Unmodified)

VBLENDVPS (VEX.128 Encoded Version)

MASK := SRC3

IF (MASK[31] = 0) THEN DEST[31:0] := SRC1[31:0]

ELSE DEST [31:0] := SRC2[31:0] FI

IF (MASK[63] = 0) THEN DEST[63:32] := SRC1[63:32]

ELSE DEST [63:32] := SRC2[63:32] FI

IF (MASK[95] = 0) THEN DEST[95:64] := SRC1[95:64]

ELSE DEST [95:64] := SRC2[95:64] FI

IF (MASK[127] = 0) THEN DEST[127:96] := SRC1[127:96]

ELSE DEST [127:96] := SRC2[127:96] FI

DEST[MAXVL-1:128] := 0

VBLENDVPS (VEX.256 Encoded Version)

MASK := SRC3

IF (MASK[31] = 0) THEN DEST[31:0] := SRC1[31:0]

ELSE DEST [31:0] := SRC2[31:0] FI

IF (MASK[63] = 0) THEN DEST[63:32] := SRC1[63:32]

ELSE DEST [63:32] := SRC2[63:32] FI

IF (MASK[95] = 0) THEN DEST[95:64] := SRC1[95:64]

ELSE DEST [95:64] := SRC2[95:64] FI

IF (MASK[127] = 0) THEN DEST[127:96] := SRC1[127:96]

ELSE DEST [127:96] := SRC2[127:96] FI

IF (MASK[159] = 0) THEN DEST[159:128] := SRC1[159:128]

ELSE DEST [159:128] := SRC2[159:128] FI

IF (MASK[191] = 0) THEN DEST[191:160] := SRC1[191:160]

ELSE DEST [191:160] := SRC2[191:160] FI

IF (MASK[223] = 0) THEN DEST[223:192] := SRC1[223:192]

ELSE DEST [223:192] := SRC2[223:192] FI

IF (MASK[255] = 0) THEN DEST[255:224] := SRC1[255:224]

ELSE DEST [255:224] := SRC2[255:224] FI

Intel C/C++ Compiler Intrinsic Equivalent

BLENDVPS __m128 _mm_blendv_ps(__m128 v1, __m128 v2, __m128 v3);

VBLENDVPS __m128 _mm_blendv_ps (__m128 a, __m128 b, __m128 mask);

VBLENDVPS __m256 _mm256_blendv_ps (__m256 a, __m256 b, __m256 mask);

SIMD Floating-Point Exceptions

None.

BLENDVPS-Variable Blend Packed Single Precision Floating-Point Values

Vol. 2A

3-103

INSTRUCTION SET REFERENCE, A-L

BLSI-Extract Lowest Set Isolated Bit

Opcode/Instruction

Op/

64/32-

CPUID

Description

bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F3 /3

V/V

BMI1

Extract lowest set bit from r/m32 and set that bit in r32.

BLSI r32, r/m32

VEX.LZ.0F38.W1 F3 /3

V/N.E.

BMI1

Extract lowest set bit from r/m64, and set that bit in r64.

BLSI r64, r/m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

VEX.vvvv (w)

ModRM:r/m (r)

N/A

Description

Extracts the lowest set bit from the source operand and set the corresponding bit in the destination register. All

other bits in the destination operand are zeroed. If no bits are set in the source operand, BLSI sets all the bits in

the destination to 0 and sets ZF and CF.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

temp := (-SRC) bitwiseAND (SRC);

SF := temp[OperandSize -1];

ZF := (temp = 0);

IF SRC = 0

CF := 0;

ELSE

CF := 1;

DEST := temp;

Flags Affected

ZF and SF are updated based on the result. CF is set if the source is not zero. OF flags are cleared. AF and PF

flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BLSI unsigned __int32 _blsi_u32(unsigned __int32 src);

BLSI unsigned __int64 _blsi_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions.”

BLSI-Extract Lowest Set Isolated Bit

Vol. 2A

3-105

INSTRUCTION SET REFERENCE, A-L

BLSMSK-Get Mask Up to Lowest Set Bit

Opcode/Instruction

Op/

64/32-

CPUID

Description

bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F3 /2

V/V

BMI1

Set all lower bits in r32 to “1” starting from bit 0 to lowest set bit in

BLSMSK r32, r/m32

r/m32.

VEX.LZ.0F38.W1 F3 /2

V/N.E.

BMI1

Set all lower bits in r64 to “1” starting from bit 0 to lowest set bit in

BLSMSK r64, r/m64

r/m64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

VEX.vvvv (w)

ModRM:r/m (r)

N/A

Description

Sets all the lower bits of the destination operand to “1” up to and including lowest set bit (=1) in the source

operand. If source operand is zero, BLSMSK sets all bits of the destination operand to 1 and also sets CF to 1.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt

to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

temp := (SRC-1) XOR (SRC) ;

SF := temp[OperandSize -1];

ZF := 0;

IF SRC = 0

CF := 1;

ELSE

CF := 0;

DEST := temp;

Flags Affected

SF is updated based on the result. CF is set if the source if zero. ZF and OF flags are cleared. AF and PF flag are

undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BLSMSK unsigned __int32 _blsmsk_u32(unsigned __int32 src);

BLSMSK unsigned __int64 _blsmsk_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions.”

3-106

Vol. 2A

BLSMSK-Get Mask Up to Lowest Set Bit

INSTRUCTION SET REFERENCE, A-L

BLSR-Reset Lowest Set Bit

Opcode/Instruction

Op/

64/32-

CPUID

Description

bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F3 /1

V/V

BMI1

Reset lowest set bit of r/m32, keep all other bits of r/m32 and write

BLSR r32, r/m32

result to r32.

VEX.LZ.0F38.W1 F3 /1

V/N.E.

BMI1

Reset lowest set bit of r/m64, keep all other bits of r/m64 and write

BLSR r64, r/m64

result to r64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

VEX.vvvv (w)

ModRM:r/m (r)

N/A

Description

Copies all bits from the source operand to the destination operand and resets (=0) the bit position in the destina-

tion operand that corresponds to the lowest set bit of the source operand. If the source operand is zero BLSR sets

CF.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

temp := (SRC-1) bitwiseAND ( SRC );

SF := temp[OperandSize -1];

ZF := (temp = 0);

IF SRC = 0

CF := 1;

ELSE

CF := 0;

DEST := temp;

Flags Affected

ZF and SF flags are updated based on the result. CF is set if the source is zero. OF flag is cleared. AF and PF flags

are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BLSR unsigned __int32 _blsr_u32(unsigned __int32 src);

BLSR unsigned __int64 _blsr_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions.”

BLSR-Reset Lowest Set Bit

Vol. 2A

3-107

INSTRUCTION SET REFERENCE, A-L

BNDCL-Check Lower Bound

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F3 0F 1A /r

NE/V

MPX

Generate a #BR if the address in r/m32 is lower than the lower

BNDCL bnd, r/m32

bound in bnd.LB.

F3 0F 1A /r

V/NE

MPX

Generate a #BR if the address in r/m64 is lower than the lower

BNDCL bnd, r/m64

bound in bnd.LB.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Compare the address in the second operand with the lower bound in bnd. The second operand can be either a

and signal a #BR exception.

This instruction does not cause any memory access, and does not read or write any flags.

Operation

BNDCL BND, reg

IF reg < BND.LB Then

BNDSTATUS := 01H;

#BR;

FI;

BNDCL BND, mem

TEMP := LEA(mem);

IF TEMP < BND.LB Then

BNDSTATUS := 01H;

#BR;

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDCL void _bnd_chk_ptr_lbounds(const void *q)

Flags Affected

None

Protected Mode Exceptions

#BR

If lower bound check fails.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

3-108

Vol. 2A

BNDCL-Check Lower Bound

INSTRUCTION SET REFERENCE, A-L

BNDCU/BNDCN-Check Upper Bound

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F2 0F 1A /r

NE/V

MPX

Generate a #BR if the address in r/m32 is higher than the upper

BNDCU bnd, r/m32

bound in bnd.UB (bnb.UB in 1's complement form).

F2 0F 1A /r

V/NE

MPX

Generate a #BR if the address in r/m64 is higher than the upper

BNDCU bnd, r/m64

bound in bnd.UB (bnb.UB in 1's complement form).

F2 0F 1B /r

NE/V

MPX

Generate a #BR if the address in r/m32 is higher than the upper

BNDCN bnd, r/m32

bound in bnd.UB (bnb.UB not in 1's complement form).

F2 0F 1B /r

V/NE

MPX

Generate a #BR if the address in r/m64 is higher than the upper

BNDCN bnd, r/m64

bound in bnd.UB (bnb.UB not in 1's complement form).

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Compare the address in the second operand with the upper bound in bnd. The second operand can be either a

01H and signal a #BR exception.

BNDCU perform 1’s complement operation on the upper bound of bnd first before proceeding with address compar-

ison. BNDCN perform address comparison directly using the upper bound in bnd that is already reverted out of 1’s

complement form.

This instruction does not cause any memory access, and does not read or write any flags.

Effective address computation of m32/64 has identical behavior to LEA

Operation

BNDCU BND, reg

IF reg > NOT(BND.UB) Then

BNDSTATUS := 01H;

#BR;

FI;

BNDCU BND, mem

TEMP := LEA(mem);

IF TEMP > NOT(BND.UB) Then

BNDSTATUS := 01H;

#BR;

FI;

BNDCN BND, reg

IF reg > BND.UB Then

BNDSTATUS := 01H;

#BR;

FI;

3-110

Vol. 2A

BNDCU/BNDCN-Check Upper Bound

INSTRUCTION SET REFERENCE, A-L

BNDCN BND, mem

TEMP := LEA(mem);

IF TEMP > BND.UB Then

BNDSTATUS := 01H;

#BR;

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDCU .void _bnd_chk_ptr_ubounds(const void *q)

Flags Affected

None

Protected Mode Exceptions

#BR

If upper bound check fails.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

Real-Address Mode Exceptions

#BR

If upper bound check fails.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

Virtual-8086 Mode Exceptions

#BR

If upper bound check fails.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD

If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.

Same exceptions as in protected mode.

BNDCU/BNDCN-Check Upper Bound

Vol. 2A

3-111

INSTRUCTION SET REFERENCE, A-L

BNDLDX-Load Extended Bounds Using Address Translation

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 1A /r

V/V

MPX

Load the bounds stored in a bound table entry (BTE) into bnd with

BNDLDX bnd, mib

address translation using the base of mib and conditional on the

index of mib matching the pointer value in the BTE.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

SIB.base (r): Address of pointer

ModRM:reg (w)

N/A

SIB.index(r)

Description

BNDLDX uses the linear address constructed from the base register and displacement of the SIB-addressing form

of the memory operand (mib) to perform address translation to access a bound table entry and conditionally load

the bounds in the BTE to the destination. The destination register is updated with the bounds in the BTE, if the

content of the index register of mib matches the pointer value stored in the BTE.

If the pointer value comparison fails, the destination is updated with INIT bounds (lb = 0x0, ub = 0x0) (note: as

articulated earlier, the upper bound is represented using 1's complement, therefore, the 0x0 value of upper bound

allows for access to full memory).

This instruction does not cause memory access to the linear address of mib nor the effective address referenced by

the base, and does not read or write any flags.

Segment overrides apply to the linear address computation with the base of mib, and are used during address

translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be

linear address. There are no segmentation checks performed on the base of mib.

The base of mib will not be checked for canonical address violation as it does not access memory.

Any encoding of this instruction that does not specify base or index register will treat those registers as zero

(constant). The reg-reg form of this instruction will remain a NOP.

The scale field of the SIB byte has no effect on these instructions and is ignored.

The bound register may be partially updated on memory faults. The order in which memory operands are loaded is

implementation specific.

Operation

base := mib.SIB.base ? mib.SIB.base + Disp: 0;

ptr_value := mib.SIB.index ? mib.SIB.index : 0;

Outside 64-bit Mode

A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 );

A_BT[31:0] := LoadFrom(A_BDE );

IF A_BT[0] equal 0 Then

BNDSTATUS := A_BDE | 02H;

#BR;

FI;

A_BTE[31:0] := (Zero_extend32(base[11:2] « 4) + (A_BT[31:2] « 2 );

Temp_lb[31:0] := LoadFrom(A_BTE);

Temp_ub[31:0] := LoadFrom(A_BTE + 4);

Temp_ptr[31:0] := LoadFrom(A_BTE + 8);

IF Temp_ptr equal ptr_value Then

BND.LB := Temp_lb;

BND.UB := Temp_ub;

3-112

Vol. 2A

BNDLDX-Load Extended Bounds Using Address Translation

INSTRUCTION SET REFERENCE, A-L

ELSE

BND.LB := 0;

BND.UB := 0;

FI;

In 64-bit Mode

A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );¹

A_BT[63:0] := LoadFrom(A_BDE);

IF A_BT[0] equal 0 Then

BNDSTATUS := A_BDE | 02H;

#BR;

FI;

A_BTE[63:0] := (Zero_extend64(base[19:3] « 5) + (A_BT[63:3] « 3 );

Temp_lb[63:0] := LoadFrom(A_BTE);

Temp_ub[63:0] := LoadFrom(A_BTE + 8);

Temp_ptr[63:0] := LoadFrom(A_BTE + 16);

IF Temp_ptr equal ptr_value Then

BND.LB := Temp_lb;

BND.UB := Temp_ub;

ELSE

BND.LB := 0;

BND.UB := 0;

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDLDX: Generated by compiler as needed.

Flags Affected

None.

Protected Mode Exceptions

#BR

If the bound directory entry is invalid.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

If DS register contains a NULL segment selector.

#PF(fault code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-

ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Appendix E.3.1 of Intel^® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 1.

BNDLDX-Load Extended Bounds Using Address Translation

Vol. 2A

3-113

INSTRUCTION SET REFERENCE, A-L

Virtual-8086 Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

#PF(fault code)

If a page fault occurs.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#BR

If the bound directory entry is invalid.

#UD

If ModRM is RIP relative.

If the LOCK prefix is used.

If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.

#GP(0)

If the memory address (A_BDE or A_BTE) is in a non-canonical form.

#PF(fault code)

If a page fault occurs.

3-114

Vol. 2A

BNDLDX-Load Extended Bounds Using Address Translation

INSTRUCTION SET REFERENCE, A-L

BNDMK-Make Bounds

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F3 0F 1B /r

NE/V

MPX

Make lower and upper bounds from m32 and store them in bnd.

BNDMK bnd, m32

F3 0F 1B /r

V/NE

MPX

Make lower and upper bounds from m64 and store them in bnd.

BNDMK bnd, m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Makes bounds from the second operand and stores the lower and upper bounds in the bound register bnd. The

second operand must be a memory operand. The content of the base register from the memory operand is stored

in the lower bound bnd.LB. The 1's complement of the effective address of m32/m64 is stored in the upper bound

b.UB. Computation of m32/m64 has identical behavior to LEA.

This instruction does not cause any memory access, and does not read or write any flags.

If the instruction did not specify base register, the lower bound will be zero. The reg-reg form of this instruction

retains legacy behavior (NOP).

The instruction causes an invalid-opcode exception (#UD) if executed in 64-bit mode with RIP-relative addressing.

Operation

BND.LB := SRCMEM.base;

IF 64-bit mode Then

BND.UB := NOT(LEA.64_bits(SRCMEM));

ELSE

BND.UB := Zero_Extend.64_bits(NOT(LEA.32_bits(SRCMEM)));

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDMKvoid * _bnd_set_ptr_bounds(const void * q, size_t size);

Flags Affected

None.

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

BNDMK-Make Bounds

Vol. 2A

3-115

INSTRUCTION SET REFERENCE, A-L

BNDMOV-Move Bounds

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 1A /r

NE/V

MPX

Move lower and upper bound from bnd2/m64 to bound register

BNDMOV bnd1, bnd2/m64

bnd1.

66 0F 1A /r

V/NE

MPX

Move lower and upper bound from bnd2/m128 to bound register

BNDMOV bnd1, bnd2/m128

bnd1.

66 0F 1B /r

NE/V

MPX

Move lower and upper bound from bnd2 to bnd1/m64.

BNDMOV bnd1/m64, bnd2

66 0F 1B /r

V/NE

MPX

Move lower and upper bound from bnd2 to bound register

BNDMOV bnd1/m128, bnd2

bnd1/m128.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (w)

ModRM:r/m (r)

N/A

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the

destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction.

The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5.

BNDMOV to memory in 64-bit mode

Upper Bound (UB)

Lower Bound (LB)

Byte offset

BNDMOV to memory in 32-bit mode

Upper Bound (UB)

Lower Bound (LB)

Byte offset

Figure 3-5. Memory Layout of BNDMOV to/from Memory

This instruction does not change flags.

Operation

BNDMOV register to register

DEST.LB := SRC.LB;

DEST.UB := SRC.UB;

BNDMOV-Move Bounds

Vol. 2A

3-117

INSTRUCTION SET REFERENCE, A-L

BNDMOV from memory

IF 64-bit mode THEN

DEST.LB := LOAD_QWORD(SRC);

DEST.UB := LOAD_QWORD(SRC+8);

ELSE

DEST.LB := LOAD_DWORD_ZERO_EXT(SRC);

DEST.UB := LOAD_DWORD_ZERO_EXT(SRC+4);

FI;

BNDMOV to memory

IF 64-bit mode THEN

DEST[63:0] := SRC.LB;

DEST[127:64] := SRC.UB;

ELSE

DEST[31:0] := SRC.LB;

DEST[63:32] := SRC.UB;

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDMOV void * _bnd_copy_ptr_bounds(const void *q, const void *r)

Flags Affected

None.

Protected Mode Exceptions

#UD

If the LOCK prefix is used but the destination is not a memory operand.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

#SS(0)

If the memory operand effective address is outside the SS segment limit.

#GP(0)

If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the destination operand points to a non-writable segment

If the DS, ES, FS, or GS segment register contains a NULL segment selector.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.

#PF(fault code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used but the destination is not a memory operand.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If the memory operand effective address is outside the SS segment limit.

3-118

Vol. 2A

BNDMOV-Move Bounds

INSTRUCTION SET REFERENCE, A-L

Virtual-8086 Mode Exceptions

#UD

If the LOCK prefix is used but the destination is not a memory operand.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If the memory operand effective address is outside the SS segment limit.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.

#PF(fault code)

If a page fault occurs.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used but the destination is not a memory operand.

If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.

#SS(0)

If the memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.

#PF(fault code)

If a page fault occurs.

BNDMOV-Move Bounds

Vol. 2A

3-119

INSTRUCTION SET REFERENCE, A-L

BNDSTX-Store Extended Bounds Using Address Translation

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 1B /r

V/V

MPX

Store the bounds in bnd and the pointer value in the index register

BNDSTX mib, bnd

of mib to a bound table entry (BTE) with address translation using

the base of mib.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

SIB.base (r): Address of pointer

ModRM:reg (r)

N/A

SIB.index(r)

Description

BNDSTX uses the linear address constructed from the displacement and base register of the SIB-addressing form

of the memory operand (mib) to perform address translation to store to a bound table entry. The bounds in the

source operand bnd are written to the lower and upper bounds in the BTE. The content of the index register of mib

is written to the pointer value field in the BTE.