Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, A-L

JMP-Jump

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

EB cb

JMP rel8

Valid

Jump short, RIP = RIP + 8-bit displacement sign

extended to 64-bits.

E9 cw

JMP rel16

N.S.

Valid

Jump near, relative, displacement relative to

next instruction. Not supported in 64-bit

mode.

E9 cd

JMP rel32

Valid

Jump near, relative, RIP = RIP + 32-bit

displacement sign extended to 64-bits.

FF /4

JMP r/m16

N.S.

Valid

Jump near, absolute indirect, address = zero-

extended r/m16. Not supported in 64-bit

mode.

FF /4

JMP r/m32

N.S.

Valid

Jump near, absolute indirect, address given in

r/m32. Not supported in 64-bit mode.

FF /4

JMP r/m64

Valid

N.E.

Jump near, absolute indirect, RIP = 64-Bit

offset from register or memory.

EA cd

JMP ptr16:16

Inv.

Valid

Jump far, absolute, address given in operand.

EA cp

JMP ptr16:32

Inv.

Valid

Jump far, absolute, address given in operand.

FF /5

JMP m16:16

Valid

Jump far, absolute indirect, address given in

m16:16.

FF /5

JMP m16:32

Valid

Jump far, absolute indirect, address given in

m16:32.

REX.W FF /5

JMP m16:64

Valid

N.E.

Jump far, absolute indirect, address given in

m16:64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

Segment + Absolute Address

N/A

Offset

N/A

ModRM:r/m (r)

N/A

Description

Transfers program control to a different point in the instruction stream without recording return information. The

destination (target) operand specifies the address of the instruction being jumped to. This operand can be an

immediate value, a general-purpose register, or a memory location.

This instruction can be used to execute four different types of jumps:

• Near jump-A jump to an instruction within the current code segment (the segment currently pointed to by the

CS register), sometimes referred to as an intrasegment jump.

• Short jump-A near jump where the jump range is limited to -128 to +127 from the current EIP value.

• Far jump-A jump to an instruction located in a different segment than the current code segment but at the

same privilege level, sometimes referred to as an intersegment jump.

• Task switch-A jump to an instruction located in a different task.

A task switch can only be executed in protected mode (see Chapter 8, in the Intel^®64 and IA-32 Architectures

Software Developer’s Manual, Volume 3A, for information on performing task switches with the JMP instruction).

Near and Short Jumps. When executing a near jump, the processor jumps to the address (within the current code

segment) that is specified with the target operand. The target operand specifies either an absolute offset (that is

an offset from the base of the code segment) or a relative offset (a signed displacement relative to the current

3-552

Vol. 2A

JMP-Jump

INSTRUCTION SET REFERENCE, A-L

value of the instruction pointer in the EIP register). A near jump to a relative offset of 8-bits (rel8) is referred to as

a short jump. The CS register is not changed on near and short jumps.

An absolute offset is specified indirectly in a general-purpose register or a memory location (r/m16 or r/m32). The

operand-size attribute determines the size of the target operand (16 or 32 bits). Absolute offsets are loaded

directly into the EIP register. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared,

resulting in a maximum instruction pointer size of 16 bits.

A relative offset (rel8, rel16, or rel32) is generally specified as a label in assembly code, but at the machine code

level, it is encoded as a signed 8-, 16-, or 32-bit immediate value. This value is added to the value in the EIP

relative offsets, the opcode (for short vs. near jumps) and the operand-size attribute (for near relative jumps)

determines the size of the target operand (8, 16, or 32 bits).

Far Jumps in Real-Address or Virtual-8086 Mode. When executing a far jump in real-address or virtual-8086 mode,

the processor jumps to the code segment and offset specified with the target operand. Here the target operand

specifies an absolute far address either directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory

location (m16:16 or m16:32). With the pointer method, the segment and address of the called procedure is

encoded in the instruction, using a 4-byte (16-bit operand size) or 6-byte (32-bit operand size) far address imme-

diate. With the indirect method, the target operand specifies a memory location that contains a 4-byte (16-bit

operand size) or 6-byte (32-bit operand size) far address. The far address is loaded directly into the CS and EIP

registers. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared.

Far Jumps in Protected Mode. When the processor is operating in protected mode, the JMP instruction can be used

to perform the following three types of far jumps:

• A far jump to a conforming or non-conforming code segment.

• A far jump through a call gate.

• A task switch.

(The JMP instruction cannot be used to perform inter-privilege-level far jumps.)

In protected mode, the processor always uses the segment selector part of the far address to access the corre-

sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate, task gate, or TSS) and access

rights determine the type of jump to be performed.

If the selected descriptor is for a code segment, a far jump to a code segment at the same privilege level is

performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,

a general-protection exception is generated.) A far jump to the same privilege level in protected mode is very

similar to one carried out in real-address or virtual-8086 mode. The target operand specifies an absolute far

address either directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or

m16:32). The operand-size attribute determines the size of the offset (16 or 32 bits) in the far address. The new

code segment selector and its descriptor are loaded into CS register, and the offset from the instruction is loaded

into the EIP register. Note that a call gate (described in the next paragraph) can also be used to perform far call to

a code segment at the same privilege level. Using this mechanism provides an extra level of indirection and is the

preferred method of making jumps between 16-bit and 32-bit code segments.

When executing a far jump through a call gate, the segment selector specified by the target operand identifies the

call gate. (The offset part of the target operand is ignored.) The processor then jumps to the code segment speci-

fied in the call gate descriptor and begins executing the instruction at the offset specified in the call gate. No stack

switch occurs. Here again, the target operand can specify the far address of the call gate either directly with a

pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32).

Executing a task switch with the JMP instruction is somewhat similar to executing a jump through a call gate. Here

the target operand specifies the segment selector of the task gate for the task being switched to (and the offset

part of the target operand is ignored). The task gate in turn points to the TSS for the task, which contains the

segment selectors for the task’s code and stack segments. The TSS also contains the EIP value for the next instruc-

tion that was to be executed before the task was suspended. This instruction pointer value is loaded into the EIP

The JMP instruction can also specify the segment selector of the TSS directly, which eliminates the indirection of the

task gate. See Chapter 8 in Intel^®64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for

detailed information on the mechanics of a task switch.

JMP-Jump

Vol. 2A

3-553

INSTRUCTION SET REFERENCE, A-L

Note that when you execute at task switch with a JMP instruction, the nested task flag (NT) is not set in the EFLAGS

previous task can thus not be carried out by executing the IRET instruction. Switching tasks with the JMP instruc-

tion differs in this regard from the CALL instruction which does set the NT flag and save the previous task link infor-

mation, allowing a return to the calling task with an IRET instruction.

Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 17, “Control-flow Enforcement Tech-

nology (CET)” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for CET details.

In 64-Bit Mode. The instruction’s operation size is fixed at 64 bits. If a selector points to a gate, then RIP equals the

64-bit displacement taken from gate; else RIP equals the zero-extended offset from the far pointer referenced in

the instruction.

See the summary chart at the beginning of this section for encoding data and limits.

Instruction ordering. Instructions following a far jump may be fetched from memory before earlier instructions

complete execution, but they will not execute (even speculatively) until all instructions prior to the far jump have

completed execution (the later instructions may execute before data stored by the earlier instructions have become

globally visible).

Instructions sequentially following a near indirect JMP instruction (i.e., those not at the target) may be executed

speculatively. If software needs to prevent this (e.g., in order to prevent a speculative execution side channel),

then an INT3 or LFENCE instruction opcode can be placed after the near indirect JMP in order to block speculative

execution.

Operation

IF near jump

IF 64-bit Mode

THEN

IF near relative jump

THEN

tempRIP := RIP + DEST; (* RIP is instruction following JMP instruction*)

ELSE (* Near absolute jump *)

tempRIP := DEST;

FI;

ELSE

IF near relative jump

THEN

tempEIP := EIP + DEST; (* EIP is instruction following JMP instruction*)

ELSE (* Near absolute jump *)

tempEIP := DEST;

FI;

IF (IA32_EFER.LMA = 0 or target mode = Compatibility mode)

and tempEIP outside code segment limit

THEN #GP(0); FI

IF 64-bit mode and tempRIP is not canonical

THEN #GP(0);

FI;

IF OperandSize = 32

THEN

EIP := tempEIP;

ELSE

IF OperandSize = 16

THEN (* OperandSize = 16 *)

EIP := tempEIP AND 0000FFFFH;

ELSE (* OperandSize = 64)

RIP := tempRIP;

3-554

Vol. 2A

JMP-Jump

INSTRUCTION SET REFERENCE, A-L

FI;

IF (JMP near indirect, absolute indirect)

IF EndbranchEnabledAndNotSuppressed(CPL)

IF CPL = 3

THEN

IF ( no 3EH prefix OR IA32_U_CET.NO_TRACK_EN == 0 )

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH

FI;

ELSE

IF ( no 3EH prefix OR IA32_S_CET.NO_TRACK_EN == 0 )

THEN

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

FI;

IF far jump and (PE = 0 or (PE = 1 AND VM = 1)) (* Real-address or virtual-8086 mode *)

THEN

tempEIP := DEST(Offset); (* DEST is ptr16:32 or [m16:32] *)

IF tempEIP is beyond code segment limit

THEN #GP(0); FI;

CS := DEST(segment selector); (* DEST is ptr16:32 or [m16:32] *)

IF OperandSize = 32

THEN

EIP := tempEIP; (* DEST is ptr16:32 or [m16:32] *)

ELSE (* OperandSize = 16 *)

EIP := tempEIP AND 0000FFFFH; (* Clear upper 16 bits *)

FI;

IF far jump and (PE = 1 and VM = 0)

(* IA-32e mode or protected mode, not virtual-8086 mode *)

THEN

IF effective address in the CS, DS, ES, FS, GS, or SS segment is illegal

or segment selector in target operand NULL

THEN #GP(0); FI;

IF segment selector index not within descriptor table limits

THEN #GP(new selector); FI;

Read type and access rights of segment descriptor;

IF (IA32_EFER.LMA = 0)

THEN

IF segment type is not a conforming or nonconforming code

segment, call gate, task gate, or TSS

THEN #GP(segment selector); FI;

ELSE

IF segment type is not a conforming or nonconforming code segment

call gate

THEN #GP(segment selector); FI;

FI;

Depending on type and access rights:

GO TO CONFORMING-CODE-SEGMENT;

GO TO NONCONFORMING-CODE-SEGMENT;

JMP-Jump

Vol. 2A

3-555

INSTRUCTION SET REFERENCE, A-L

GO TO CALL-GATE;

GO TO TASK-GATE;

GO TO TASK-STATE-SEGMENT;

ELSE

#GP(segment selector);

FI;

CONFORMING-CODE-SEGMENT:

IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1

THEN GP(new code segment selector); FI;

IF DPL > CPL

THEN #GP(segment selector); FI;

IF segment not present

THEN #NP(segment selector); FI;

tempEIP := DEST(Offset);

IF OperandSize = 16

THEN tempEIP := tempEIP AND 0000FFFFH;

FI;

IF (IA32_EFER.LMA = 0 or target mode = Compatibility mode) and

tempEIP outside code segment limit

THEN #GP(0); FI

IF tempEIP is non-canonical

THEN #GP(0); FI;

IF ShadowStackEnabled(CPL)

IF (IA32_EFER.LMA and DEST(segment selector).L) = 0

(* If target is legacy or compatibility mode then the SSP must be in low 4GB *)

IF (SSP & 0xFFFFFFFF00000000 != 0)

THEN #GP(0); FI;

FI;

CS := DEST[segment selector]; (* Segment descriptor information also loaded *)

CS(RPL) := CPL

EIP := tempEIP;

IF EndbranchEnabled(CPL)

IF CPL = 3

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_U_CET.SUPPRESS = 0

ELSE

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_S_CET.SUPPRESS = 0

FI;

END;

NONCONFORMING-CODE-SEGMENT:

IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1

THEN GP(new code segment selector); FI;

IF (RPL > CPL) OR (DPL ≠ CPL)

THEN #GP(code segment selector); FI;

IF segment not present

THEN #NP(segment selector); FI;

tempEIP := DEST(Offset);

IF OperandSize = 16

THEN tempEIP := tempEIP AND 0000FFFFH; FI;

IF (IA32_EFER.LMA = 0 OR target mode = Compatibility mode)

3-556

Vol. 2A

JMP-Jump

INSTRUCTION SET REFERENCE, A-L

and tempEIP outside code segment limit

THEN #GP(0); FI

IF tempEIP is non-canonical THEN #GP(0); FI;

IF ShadowStackEnabled(CPL)

IF (IA32_EFER.LMA and DEST(segment selector).L) = 0

(* If target is legacy or compatibility mode then the SSP must be in low 4GB *)

IF (SSP & 0xFFFFFFFF00000000 != 0)

THEN #GP(0); FI;

FI;

CS := DEST[segment selector]; (* Segment descriptor information also loaded *)

CS(RPL) := CPL;

EIP := tempEIP;

IF EndbranchEnabled(CPL)

IF CPL = 3

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_U_CET.SUPPRESS = 0

ELSE

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_S_CET.SUPPRESS = 0

FI;

END;

CALL-GATE:

IF call gate DPL < CPL

or call gate DPL < call gate segment-selector RPL

THEN #GP(call gate selector); FI;

IF call gate not present

THEN #NP(call gate selector); FI;

IF call gate code-segment selector is NULL

THEN #GP(0); FI;

IF call gate code-segment selector index outside descriptor table limits

THEN #GP(code segment selector); FI;

Read code segment descriptor;

IF code-segment segment descriptor does not indicate a code segment

or code-segment segment descriptor is conforming and DPL > CPL

or code-segment segment descriptor is non-conforming and DPL ≠ CPL

THEN #GP(code segment selector); FI;

IF IA32_EFER.LMA = 1 and (code-segment descriptor is not a 64-bit code segment

or code-segment segment descriptor has both L-Bit and D-bit set)

THEN #GP(code segment selector); FI;

IF code segment is not present

THEN #NP(code-segment selector); FI;

tempEIP := DEST(Offset);

IF GateSize = 16

THEN tempEIP := tempEIP AND 0000FFFFH; FI;

IF (IA32_EFER.LMA = 0 OR target mode = Compatibility mode) AND tempEIP

outside code segment limit

THEN #GP(0); FI

CS := DEST[SegmentSelector]; (* Segment descriptor information also loaded *)

CS(RPL) := CPL;

EIP := tempEIP;

JMP-Jump

Vol. 2A

3-557

INSTRUCTION SET REFERENCE, A-L

IF EndbranchEnabled(CPL)

IF CPL = 3

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH;

IA32_U_CET.SUPPRESS = 0

ELSE

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH;

IA32_S_CET.SUPPRESS = 0

FI;

END;

TASK-GATE:

IF task gate DPL < CPL

or task gate DPL < task gate segment-selector RPL

THEN #GP(task gate selector); FI;

IF task gate not present

THEN #NP(gate selector); FI;

Read the TSS segment selector in the task-gate descriptor;

IF TSS segment selector local/global bit is set to local

or index not within GDT limits

or descriptor is not a TSS segment

or TSS descriptor specifies that the TSS is busy

THEN #GP(TSS selector); FI;

IF TSS not present

THEN #NP(TSS selector); FI;

SWITCH-TASKS to TSS;

IF EIP not within code segment limit

THEN #GP(0); FI;

END;

TASK-STATE-SEGMENT:

IF TSS DPL < CPL

or TSS DPL < TSS segment-selector RPL

or TSS descriptor indicates TSS not available

THEN #GP(TSS selector); FI;

IF TSS is not present

THEN #NP(TSS selector); FI;

SWITCH-TASKS to TSS;

IF EIP not within code segment limit

THEN #GP(0); FI;

END;

Flags Affected

All flags are affected if a task switch occurs; no flags are affected if a task switch does not occur.

Protected Mode Exceptions

#GP(0)

If offset in target operand, call gate, or TSS is beyond the code segment limits.

If the segment selector in the destination operand, call gate, task gate, or TSS is NULL.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If target mode is compatibility mode and SSP is not in low 4GB.

3-558

Vol. 2A

JMP-Jump

INSTRUCTION SET REFERENCE, A-L

#GP(selector)

If the segment selector index is outside descriptor table limits.

If the segment descriptor pointed to by the segment selector in the destination operand is not

for a conforming-code segment, nonconforming-code segment, call gate, task gate, or task

state segment.

If the DPL for a nonconforming-code segment is not equal to the CPL

(When not using a call gate.) If the RPL for the segment’s segment selector is greater than the

CPL.

If the DPL for a conforming-code segment is greater than the CPL.

If the DPL from a call-gate, task-gate, or TSS segment descriptor is less than the CPL or than

the RPL of the call-gate, task-gate, or TSS’s segment selector.

If the segment descriptor for selector in a call gate does not indicate it is a code segment.

If the segment descriptor for the segment selector in a task gate does not indicate an available

TSS.

If the segment selector for a TSS has its local/global bit set for local.

If a TSS segment descriptor specifies that the TSS is busy or not available.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#NP (selector)

If the code segment being accessed is not present.

If call gate, task gate, or TSS not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3. (Only occurs when fetching target from memory.)

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If the target operand is beyond the code segment limits.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made. (Only occurs

when fetching target from memory.)

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same as 64-bit mode exceptions.

64-Bit Mode Exceptions

#GP(0)

If a memory address is non-canonical.

If target offset in destination operand is non-canonical.

If target offset in destination operand is beyond the new code segment limit.

If the segment selector in the destination operand is NULL.

If the code segment selector in the 64-bit gate is NULL.

If transitioning to compatibility mode and the SSP is beyond 4GB.

JMP-Jump

Vol. 2A

3-559

INSTRUCTION SET REFERENCE, A-L

#GP(selector)

If the code segment or 64-bit call gate is outside descriptor table limits.

If the code segment or 64-bit call gate overlaps non-canonical space.

If the segment descriptor from a 64-bit call gate is in non-canonical space.

If the segment descriptor pointed to by the segment selector in the destination operand is not

for a conforming-code segment, nonconforming-code segment, 64-bit call gate.

If the segment descriptor pointed to by the segment selector in the destination operand is a

code segment, and has both the D-bit and the L-bit set.

If the DPL for a nonconforming-code segment is not equal to the CPL, or the RPL for the

segment’s segment selector is greater than the CPL.

If the DPL for a conforming-code segment is greater than the CPL.

If the DPL from a 64-bit call-gate is less than the CPL or than the RPL of the 64-bit call-gate.

If the upper type field of a 64-bit call gate is not 0x0.

If the segment selector from a 64-bit call gate is beyond the descriptor table limits.

If the code segment descriptor pointed to by the selector in the 64-bit gate doesn't have the L-

bit set and the D-bit clear.

If the segment descriptor for a segment selector from the 64-bit call gate does not indicate it

is a code segment.

If the code segment is non-conforming and CPL ≠ DPL.

If the code segment is confirming and CPL < DPL.

#NP(selector)

If a code segment or 64-bit call gate is not present.

#UD

(64-bit mode only) If a far jump is direct to an absolute address in memory.

If the LOCK prefix is used.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

3-560

Vol. 2A

JMP-Jump

INSTRUCTION SET REFERENCE, A-L

KADDW/KADDB/KADDQ/KADDD-ADD Two Masks

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.0F.W0 4A /r

RVR

V/V

AVX512DQ

Add 16 bits masks in k2 and k3 and place result in k1.

KADDW k1, k2, k3

VEX.L1.66.0F.W0 4A /r

RVR

V/V

AVX512DQ

Add 8 bits masks in k2 and k3 and place result in k1.

KADDB k1, k2, k3

VEX.L1.0F.W1 4A /r

RVR

V/V

AVX512BW

Add 64 bits masks in k2 and k3 and place result in k1.

KADDQ k1, k2, k3

VEX.L1.66.0F.W1 4A /r

RVR

V/V

AVX512BW

Add 32 bits masks in k2 and k3 and place result in k1.

KADDD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Adds the vector mask k2 and the vector mask k3, and writes the result into vector mask k1.

Operation

KADDW

DEST[15:0] := SRC1[15:0] + SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KADDB

DEST[7:0] := SRC1[7:0] + SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KADDQ

DEST[63:0] := SRC1[63:0] + SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KADDD

DEST[31:0] := SRC1[31:0] + SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KADDW __mmask16 _kadd_mask16 (__mmask16 a, __mmask16 b);

KADDB __mmask8 _kadd_mask8 (__mmask8 a, __mmask8 b);

KADDQ __mmask64 _kadd_mask64 (__mmask64 a, __mmask64 b);

KADDD __mmask32 _kadd_mask32 (__mmask32 a, __mmask32 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

KADDW/KADDB/KADDQ/KADDD-ADD Two Masks

Vol. 2A

3-561

INSTRUCTION SET REFERENCE, A-L

KANDW/KANDB/KANDQ/KANDD-Bitwise Logical AND Masks

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.0F.W0 41 /r

RVR

V/V

AVX512F

Bitwise AND 16 bits masks k2 and k3 and place result in k1.

KANDW k1, k2, k3

VEX.L1.66.0F.W0 41 /r

RVR

V/V

AVX512DQ

Bitwise AND 8 bits masks k2 and k3 and place result in k1.

KANDB k1, k2, k3

VEX.L1.0F.W1 41 /r

RVR

V/V

AVX512BW

Bitwise AND 64 bits masks k2 and k3 and place result in k1.

KANDQ k1, k2, k3

VEX.L1.66.0F.W1 41 /r

RVR

V/V

AVX512BW

Bitwise AND 32 bits masks k2 and k3 and place result in k1.

KANDD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise AND between the vector mask k2 and the vector mask k3, and writes the result into vector mask

k1.

Operation

KANDW

DEST[15:0] := SRC1[15:0] BITWISE AND SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KANDB

DEST[7:0] := SRC1[7:0] BITWISE AND SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KANDQ

DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KANDD

DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KANDW __mmask16 _mm512_kand(__mmask16 a, __mmask16 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

KANDW/KANDB/KANDQ/KANDD-Bitwise Logical AND Masks

Vol. 2A

3-563

INSTRUCTION SET REFERENCE, A-L

KANDNW/KANDNB/KANDNQ/KANDND-Bitwise Logical AND NOT Masks

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.0F.W0 42 /r

RVR

V/V

AVX512F

Bitwise AND NOT 16 bits masks k2 and k3 and place result in k1.

KANDNW k1, k2, k3

VEX.L1.66.0F.W0 42 /r

RVR

V/V

AVX512DQ

Bitwise AND NOT 8 bits masks k1 and k2 and place result in k1.

KANDNB k1, k2, k3

VEX.L1.0F.W1 42 /r

RVR

V/V

AVX512BW

Bitwise AND NOT 64 bits masks k2 and k3 and place result in k1.

KANDNQ k1, k2, k3

VEX.L1.66.0F.W1 42 /r

RVR

V/V

AVX512BW

Bitwise AND NOT 32 bits masks k2 and k3 and place result in k1.

KANDND k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise AND NOT between the vector mask k2 and the vector mask k3, and writes the result into vector

mask k1.

Operation

KANDNW

DEST[15:0] := (BITWISE NOT SRC1[15:0]) BITWISE AND SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KANDNB

DEST[7:0] := (BITWISE NOT SRC1[7:0]) BITWISE AND SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KANDNQ

DEST[63:0] := (BITWISE NOT SRC1[63:0]) BITWISE AND SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KANDND

DEST[31:0] := (BITWISE NOT SRC1[31:0]) BITWISE AND SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KANDNW __mmask16 _mm512_kandn(__mmask16 a, __mmask16 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

3-564

Vol. 2A

KANDNW/KANDNB/KANDNQ/KANDND-Bitwise Logical AND NOT Masks

INSTRUCTION SET REFERENCE, A-L

KMOVW/KMOVB/KMOVQ/KMOVD-Move From and to Mask Registers

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L0.0F.W0 90 /r

V/V

AVX512F

Move 16 bits mask from k2/m16 and store the result in k1.

KMOVW k1, k2/m16

VEX.L0.66.0F.W0 90 /r

V/V

AVX512DQ

Move 8 bits mask from k2/m8 and store the result in k1.

KMOVB k1, k2/m8

VEX.L0.0F.W1 90 /r

V/V

AVX512BW

Move 64 bits mask from k2/m64 and store the result in k1.

KMOVQ k1, k2/m64

VEX.L0.66.0F.W1 90 /r

V/V

AVX512BW

Move 32 bits mask from k2/m32 and store the result in k1.

KMOVD k1, k2/m32

VEX.L0.0F.W0 91 /r

V/V

AVX512F

Move 16 bits mask from k1 and store the result in m16.

KMOVW m16, k1

VEX.L0.66.0F.W0 91 /r

V/V

AVX512DQ

Move 8 bits mask from k1 and store the result in m8.

KMOVB m8, k1

VEX.L0.0F.W1 91 /r

V/V

AVX512BW

Move 64 bits mask from k1 and store the result in m64.

KMOVQ m64, k1

VEX.L0.66.0F.W1 91 /r

V/V

AVX512BW

Move 32 bits mask from k1 and store the result in m32.

KMOVD m32, k1

VEX.L0.0F.W0 92 /r

V/V

AVX512F

Move 16 bits mask from r32 to k1.

KMOVW k1, r32

VEX.L0.66.0F.W0 92 /r

V/V

AVX512DQ

Move 8 bits mask from r32 to k1.

KMOVB k1, r32

VEX.L0.F2.0F.W1 92 /r

V/I

AVX512BW

Move 64 bits mask from r64 to k1.

KMOVQ k1, r64

VEX.L0.F2.0F.W0 92 /r

V/V

AVX512BW

Move 32 bits mask from r32 to k1.

KMOVD k1, r32

VEX.L0.0F.W0 93 /r

V/V

AVX512F

Move 16 bits mask from k1 to r32.

KMOVW r32, k1

VEX.L0.66.0F.W0 93 /r

V/V

AVX512DQ

Move 8 bits mask from k1 to r32.

KMOVB r32, k1

VEX.L0.F2.0F.W1 93 /r

V/I

AVX512BW

Move 64 bits mask from k1 to r64.

KMOVQ r64, k1

VEX.L0.F2.0F.W0 93 /r

V/V

AVX512BW

Move 32 bits mask from k1 to r32.

KMOVD r32, k1

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (w)

ModRM:r/m (r)

ModRM:r/m (w, ModRM:[7:6] must not be 11b)

ModRM:reg (r)

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Copies values from the source operand (second operand) to the destination operand (first operand). The source

and destination operands can be mask registers, memory location or general purpose. The instruction cannot be

used to transfer data between general purpose registers and or memory locations.

KMOVW/KMOVB/KMOVQ/KMOVD-Move From and to Mask Registers

Vol. 2A

3-565

INSTRUCTION SET REFERENCE, A-L

When moving to a mask register, the result is zero extended to MAX_KL size (i.e., 64 bits currently). When moving

to a general-purpose register (GPR), the result is zero-extended to the size of the destination. In 32-bit mode, the

default GPR destination’s size is 32 bits. In 64-bit mode, the default GPR destination’s size is 64 bits. Note that

VEX.W can only be used to modify the size of the GPR operand in 64b mode.

Operation

KMOVW

IF *destination is a memory location*

DEST[15:0] := SRC[15:0]

IF *destination is a mask register or a GPR *

DEST := ZeroExtension(SRC[15:0])

KMOVB

IF *destination is a memory location*

DEST[7:0] := SRC[7:0]

IF *destination is a mask register or a GPR *

DEST := ZeroExtension(SRC[7:0])

KMOVQ

IF *destination is a memory location or a GPR*

DEST[63:0] := SRC[63:0]

IF *destination is a mask register*

DEST := ZeroExtension(SRC[63:0])

KMOVD

IF *destination is a memory location*

DEST[31:0] := SRC[31:0]

IF *destination is a mask register or a GPR *

DEST := ZeroExtension(SRC[31:0])

Intel C/C++ Compiler Intrinsic Equivalent

KMOVW __mmask16 _mm512_kmov(__mmask16 a);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

Instructions with RR operand encoding, see Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask

Instructions w/o Memory Arg).”

Instructions with RM or MR operand encoding, see Table 2-64, “TYPE K21 Exception Definition (VEX-Encoded

OpMask Instructions Addressing Memory).”

3-566

Vol. 2A

KMOVW/KMOVB/KMOVQ/KMOVD-Move From and to Mask Registers

INSTRUCTION SET REFERENCE, A-L

KNOTW/KNOTB/KNOTQ/KNOTD-NOT Mask Register

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L0.0F.W0 44 /r

V/V

AVX512F

Bitwise NOT of 16 bits mask k2.

KNOTW k1, k2

VEX.L0.66.0F.W0 44 /r

V/V

AVX512DQ

Bitwise NOT of 8 bits mask k2.

KNOTB k1, k2

VEX.L0.0F.W1 44 /r

V/V

AVX512BW

Bitwise NOT of 64 bits mask k2.

KNOTQ k1, k2

VEX.L0.66.0F.W1 44 /r

V/V

AVX512BW

Bitwise NOT of 32 bits mask k2.

KNOTD k1, k2

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise NOT of vector mask k2 and writes the result into vector mask k1.

Operation

KNOTW

DEST[15:0] := BITWISE NOT SRC[15:0]

DEST[MAX_KL-1:16] := 0

KNOTB

DEST[7:0] := BITWISE NOT SRC[7:0]

DEST[MAX_KL-1:8] := 0

KNOTQ

DEST[63:0] := BITWISE NOT SRC[63:0]

DEST[MAX_KL-1:64] := 0

KNOTD

DEST[31:0] := BITWISE NOT SRC[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KNOTW __mmask16 _mm512_knot(__mmask16 a);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

KNOTW/KNOTB/KNOTQ/KNOTD-NOT Mask Register

Vol. 2A

3-567

INSTRUCTION SET REFERENCE, A-L

KORW/KORB/KORQ/KORD-Bitwise Logical OR Masks

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.0F.W0 45 /r

RVR

V/V

AVX512F

Bitwise OR 16 bits masks k2 and k3 and place result in k1.

KORW k1, k2, k3

VEX.L1.66.0F.W0 45 /r

RVR

V/V

AVX512DQ

Bitwise OR 8 bits masks k2 and k3 and place result in k1.

KORB k1, k2, k3

VEX.L1.0F.W1 45 /r

RVR

V/V

AVX512BW

Bitwise OR 64 bits masks k2 and k3 and place result in k1.

KORQ k1, k2, k3

VEX.L1.66.0F.W1 45 /r

RVR

V/V

AVX512BW

Bitwise OR 32 bits masks k2 and k3 and place result in k1.

KORD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise OR between the vector mask k2 and the vector mask k3, and writes the result into vector mask

k1 (three-operand form).

Operation

KORW

DEST[15:0] := SRC1[15:0] BITWISE OR SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KORB

DEST[7:0] := SRC1[7:0] BITWISE OR SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KORQ

DEST[63:0] := SRC1[63:0] BITWISE OR SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KORD

DEST[31:0] := SRC1[31:0] BITWISE OR SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KORW __mmask16 _mm512_kor(__mmask16 a, __mmask16 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

3-568

Vol. 2A

KORW/KORB/KORQ/KORD-Bitwise Logical OR Masks

INSTRUCTION SET REFERENCE, A-L

KORTESTW/KORTESTB/KORTESTQ/KORTESTD-OR Masks and Set Flags

Opcode/

Op/E

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L0.0F.W0 98 /r

V/V

AVX512F

Bitwise OR 16 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTW k1, k2

VEX.L0.66.0F.W0 98 /r

V/V

AVX512DQ

Bitwise OR 8 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTB k1, k2

VEX.L0.0F.W1 98 /r

V/V

AVX512BW

Bitwise OR 64 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTQ k1, k2

VEX.L0.66.0F.W1 98 /r

V/V

AVX512BW

Bitwise OR 32 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTD k1, k2

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise OR between the vector mask register k2, and the vector mask register k1, and sets CF and ZF

based on the operation result.

ZF flag is set if both sources are 0x0. CF is set if, after the OR operation is done, the operation result is all 1’s.

Operation

KORTESTW

TMP[15:0] := DEST[15:0] BITWISE OR SRC[15:0]

IF(TMP[15:0]=0)

THEN ZF := 1

ELSE ZF := 0

FI;

IF(TMP[15:0]=FFFFh)

THEN CF := 1

ELSE CF := 0

FI;

KORTESTB

TMP[7:0] := DEST[7:0] BITWISE OR SRC[7:0]

IF(TMP[7:0]=0)

THEN ZF := 1

ELSE ZF := 0

FI;

IF(TMP[7:0]==FFh)

THEN CF := 1

ELSE CF := 0

FI;

KORTESTW/KORTESTB/KORTESTQ/KORTESTD-OR Masks and Set Flags

Vol. 2A

3-569

INSTRUCTION SET REFERENCE, A-L

KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD-Shift Left Mask Registers

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L0.66.0F3A.W1 32 /r

RRI

V/V

AVX512F

Shift left 16 bits in k2 by immediate and write result in k1.

KSHIFTLW k1, k2, imm8

VEX.L0.66.0F3A.W0 32 /r

RRI

V/V

AVX512DQ

Shift left 8 bits in k2 by immediate and write result in k1.

KSHIFTLB k1, k2, imm8

VEX.L0.66.0F3A.W1 33 /r

RRI

V/V

AVX512BW

Shift left 64 bits in k2 by immediate and write result in k1.

KSHIFTLQ k1, k2, imm8

VEX.L0.66.0F3A.W0 33 /r

RRI

V/V

AVX512BW

Shift left 32 bits in k2 by immediate and write result in k1.

KSHIFTLD k1, k2, imm8

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RRI

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

imm8

Description

Shifts 8/16/32/64 bits in the second operand (source operand) left by the count specified in immediate byte and

place the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destina-

tion are zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for

word shift), 31 (for doubleword shift) or 63 (for quadword shift).

Operation

KSHIFTLW

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=15

THEN DEST[15:0] := SRC1[15:0] << COUNT;

FI;

KSHIFTLB

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=7

THEN DEST[7:0] := SRC1[7:0] << COUNT;

FI;

KSHIFTLQ

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=63

THEN DEST[63:0] := SRC1[63:0] << COUNT;

FI;

KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD-Shift Left Mask Registers

Vol. 2A

3-571

INSTRUCTION SET REFERENCE, A-L

KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD-Shift Right Mask Registers

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L0.66.0F3A.W1 30 /r

RRI

V/V

AVX512F

Shift right 16 bits in k2 by immediate and write result in k1.

KSHIFTRW k1, k2, imm8

VEX.L0.66.0F3A.W0 30 /r

RRI

V/V

AVX512DQ

Shift right 8 bits in k2 by immediate and write result in k1.

KSHIFTRB k1, k2, imm8

VEX.L0.66.0F3A.W1 31 /r

RRI

V/V

AVX512BW

Shift right 64 bits in k2 by immediate and write result in k1.

KSHIFTRQ k1, k2, imm8

VEX.L0.66.0F3A.W0 31 /r

RRI

V/V

AVX512BW

Shift right 32 bits in k2 by immediate and write result in k1.

KSHIFTRD k1, k2, imm8

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RRI

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

imm8

Description

Shifts 8/16/32/64 bits in the second operand (source operand) right by the count specified in immediate and place

the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destination are

zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for word shift),

31 (for doubleword shift) or 63 (for quadword shift).

Operation

KSHIFTRW

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=15

THEN DEST[15:0] := SRC1[15:0] >> COUNT;

FI;

KSHIFTRB

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=7

THEN DEST[7:0] := SRC1[7:0] >> COUNT;

FI;

KSHIFTRQ

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=63

THEN DEST[63:0] := SRC1[63:0] >> COUNT;

FI;

KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD-Shift Right Mask Registers

Vol. 2A

3-573

INSTRUCTION SET REFERENCE, A-L

KTESTW/KTESTB/KTESTQ/KTESTD-Packed Bit Test Masks and Set Flags

Opcode/

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L0.0F.W0 99 /r

V/V

AVX512DQ

Set ZF and CF depending on sign bit AND and ANDN of 16 bits mask

KTESTW k1, k2

VEX.L0.66.0F.W0 99 /r

V/V

AVX512DQ

Set ZF and CF depending on sign bit AND and ANDN of 8 bits mask reg-

KTESTB k1, k2

ister sources.

VEX.L0.0F.W1 99 /r

V/V

AVX512BW

Set ZF and CF depending on sign bit AND and ANDN of 64 bits mask

KTESTQ k1, k2

VEX.L0.66.0F.W1 99 /r

V/V

AVX512BW

Set ZF and CF depending on sign bit AND and ANDN of 32 bits mask

KTESTD k1, k2

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise comparison of the bits of the first source operand and corresponding bits in the second source

operand. If the AND operation produces all zeros, the ZF is set else the ZF is clear. If the bitwise AND operation of

the inverted first source operand with the second source operand produces all zeros the CF is set else the CF is

clear. Only the EFLAGS register is updated.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

KTESTW

TEMP[15:0] := SRC2[15:0] AND SRC1[15:0]

IF (TEMP[15:0] = = 0)

THEN ZF :=1;

ELSE ZF := 0;

FI;

TEMP[15:0] := SRC2[15:0] AND NOT SRC1[15:0]

IF (TEMP[15:0] = = 0)

THEN CF :=1;

ELSE CF := 0;

FI;

AF := OF := PF := SF := 0;

KTESTB

TEMP[7:0] := SRC2[7:0] AND SRC1[7:0]

IF (TEMP[7:0] = = 0)

THEN ZF :=1;

ELSE ZF := 0;

FI;

TEMP[7:0] := SRC2[7:0] AND NOT SRC1[7:0]

IF (TEMP[7:0] = = 0)

THEN CF :=1;

ELSE CF := 0;

FI;

AF := OF := PF := SF := 0;

KTESTW/KTESTB/KTESTQ/KTESTD-Packed Bit Test Masks and Set Flags

Vol. 2A

3-575

INSTRUCTION SET REFERENCE, A-L

KUNPCKBW/KUNPCKWD/KUNPCKDQ-Unpack for Mask Registers

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.66.0F.W0 4B /r

RVR

V/V

AVX512F

Unpack 8-bit masks in k2 and k3 and write word result in k1.

KUNPCKBW k1, k2, k3

VEX.L1.0F.W0 4B /r

RVR

V/V

AVX512BW

Unpack 16-bit masks in k2 and k3 and write doubleword result

KUNPCKWD k1, k2, k3

in k1.

VEX.L1.0F.W1 4B /r

RVR

V/V

AVX512BW

Unpack 32-bit masks in k2 and k3 and write quadword result in

KUNPCKDQ k1, k2, k3

k1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Unpacks the lower 8/16/32 bits of the second and third operands (source operands) into the low part of the first

operand (destination operand), starting from the low bytes. The result is zero-extended in the destination.

Operation

KUNPCKBW

DEST[7:0] := SRC2[7:0]

DEST[15:8] := SRC1[7:0]

DEST[MAX_KL-1:16] := 0

KUNPCKWD

DEST[15:0] := SRC2[15:0]

DEST[31:16] := SRC1[15:0]

DEST[MAX_KL-1:32] := 0

KUNPCKDQ

DEST[31:0] := SRC2[31:0]

DEST[63:32] := SRC1[31:0]

DEST[MAX_KL-1:64] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KUNPCKBW __mmask16 _mm512_kunpackb(__mmask16 a, __mmask16 b);

KUNPCKDQ __mmask64 _mm512_kunpackd(__mmask64 a, __mmask64 b);

KUNPCKWD __mmask32 _mm512_kunpackw(__mmask32 a, __mmask32 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

KUNPCKBW/KUNPCKWD/KUNPCKDQ-Unpack for Mask Registers

Vol. 2A

3-577

INSTRUCTION SET REFERENCE, A-L

KXNORW/KXNORB/KXNORQ/KXNORD-Bitwise Logical XNOR Masks

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.0F.W0 46 /r

RVR

V/V

AVX512F

Bitwise XNOR 16-bit masks k2 and k3 and place result in k1.

KXNORW k1, k2, k3

VEX.L1.66.0F.W0 46 /r

RVR

V/V

AVX512DQ

Bitwise XNOR 8-bit masks k2 and k3 and place result in k1.

KXNORB k1, k2, k3

VEX.L1.0F.W1 46 /r

RVR

V/V

AVX512BW

Bitwise XNOR 64-bit masks k2 and k3 and place result in k1.

KXNORQ k1, k2, k3

VEX.L1.66.0F.W1 46 /r

RVR

V/V

AVX512BW

Bitwise XNOR 32-bit masks k2 and k3 and place result in k1.

KXNORD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise XNOR between the vector mask k2 and the vector mask k3, and writes the result into vector

mask k1 (three-operand form).

Operation

KXNORW

DEST[15:0] := NOT (SRC1[15:0] BITWISE XOR SRC2[15:0])

DEST[MAX_KL-1:16] := 0

KXNORB

DEST[7:0] := NOT (SRC1[7:0] BITWISE XOR SRC2[7:0])

DEST[MAX_KL-1:8] := 0

KXNORQ

DEST[63:0] := NOT (SRC1[63:0] BITWISE XOR SRC2[63:0])

DEST[MAX_KL-1:64] := 0

KXNORD

DEST[31:0] := NOT (SRC1[31:0] BITWISE XOR SRC2[31:0])

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KXNORW __mmask16 _mm512_kxnor(__mmask16 a, __mmask16 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

3-578

Vol. 2A

KXNORW/KXNORB/KXNORQ/KXNORD-Bitwise Logical XNOR Masks

INSTRUCTION SET REFERENCE, A-L

KXORW/KXORB/KXORQ/KXORD-Bitwise Logical XOR Masks

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

VEX.L1.0F.W0 47 /r

RVR

V/V

AVX512F

Bitwise XOR 16-bit masks k2 and k3 and place result in k1.

KXORW k1, k2, k3

VEX.L1.66.0F.W0 47 /r

RVR

V/V

AVX512DQ

Bitwise XOR 8-bit masks k2 and k3 and place result in k1.

KXORB k1, k2, k3

VEX.L1.0F.W1 47 /r

RVR

V/V

AVX512BW

Bitwise XOR 64-bit masks k2 and k3 and place result in k1.

KXORQ k1, k2, k3

VEX.L1.66.0F.W1 47 /r

RVR

V/V

AVX512BW

Bitwise XOR 32-bit masks k2 and k3 and place result in k1.

KXORD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise XOR between the vector mask k2 and the vector mask k3, and writes the result into vector mask

k1 (three-operand form).

Operation

KXORW

DEST[15:0] := SRC1[15:0] BITWISE XOR SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KXORB

DEST[7:0] := SRC1[7:0] BITWISE XOR SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KXORQ

DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KXORD

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KXORW __mmask16 _mm512_kxor(__mmask16 a, __mmask16 b);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg).”

KXORW/KXORB/KXORQ/KXORD-Bitwise Logical XOR Masks

Vol. 2A

3-579

INSTRUCTION SET REFERENCE, A-L

LAHF-Load Status Flags Into AH Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

LAHF

Invalid¹

Valid

Load: AH := EFLAGS(SF:ZF:0:AF:0:PF:1:CF).

NOTES:

1. Valid in specific steppings; see Description section.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

This instruction executes as described above in compatibility mode and legacy mode. It is valid in 64-bit mode only

if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1.

Operation

IF 64-Bit Mode

THEN

IF CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1;

THEN AH := RFLAGS(SF:ZF:0:AF:0:PF:1:CF);

ELSE #UD;

FI;

ELSE

AH := EFLAGS(SF:ZF:0:AF:0:PF:1:CF);

FI;

Flags Affected

None. The state of the flags in the EFLAGS register is not affected.

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD

If CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 0.

If the LOCK prefix is used.

3-580

Vol. 2A

LAHF-Load Status Flags Into AH Register

INSTRUCTION SET REFERENCE, A-L

LAR-Load Access Rights Byte

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 02 /r

LAR r16, r16/m16

Valid

r16 := access rights referenced by r16/m16

0F 02 /r

LAR reg, r32/m16¹

Valid

reg := access rights referenced by r32/m16

NOTES:

1. For all loads (regardless of source or destination sizing) only bits 16-0 are used. Other bits are ignored.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Loads the access rights from the segment descriptor specified by the second operand (source operand) into the

first operand (destination operand) and sets the ZF flag in the flag register. The source operand (which can be a

source operand is a memory address, only 16 bits of data are accessed. The destination operand is a general-

purpose register.

The processor performs access checks as part of the loading process. Once loaded in the destination register, soft-

ware can perform additional checks on the access rights information.

The access rights for a segment descriptor include fields located in the second doubleword (bytes 4-7) of the

segment descriptor. The following fields are loaded by the LAR instruction:

• Bits 7:0 are returned as 0

• Bits 11:8 return the segment type.

• Bit 12 returns the S flag.

• Bits 14:13 return the DPL.

• Bit 15 returns the P flag.

• The following fields are returned only if the operand size is greater than 16 bits:

- Bits 19:16 are undefined.

- Bit 20 returns the software-available bit in the descriptor.

- Bit 21 returns the L flag.

- Bit 22 returns the D/B flag.

- Bit 23 returns the G flag.

- Bits 31:24 are returned as 0.

This instruction performs the following checks before it loads the access rights in the destination register:

• Checks that the segment selector is not NULL.

• Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being

accessed

• Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for

(can be accessed with) the LAR instruction. The valid system segment and gate descriptor types are given in

Table 3-53.

• If the segment is not a conforming code segment, it checks that the specified segment descriptor is visible at

the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of the segment

selector).

If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no

access rights are loaded in the destination operand.

LAR-Load Access Rights Byte

Vol. 2A

3-581

INSTRUCTION SET REFERENCE, A-L

The LAR instruction can only be executed in protected mode and IA-32e mode.

Table 3-53. Segment and Gate Types

Type

Protected Mode

IA-32e Mode

Name

Valid

Name

Valid

Reserved

Available 16-bit TSS

Yes

Reserved

LDT

Yes

LDT

Yes

Busy 16-bit TSS

Yes

Reserved

16-bit call gate

Yes

Reserved

16-bit/32-bit task gate

Yes

Reserved

16-bit interrupt gate

Reserved

16-bit trap gate

Reserved

Available 32-bit TSS

Yes

Available 64-bit TSS

Yes

Reserved

Busy 32-bit TSS

Yes

Busy 64-bit TSS

Yes

32-bit call gate

Yes

64-bit call gate

Yes

Reserved

32-bit interrupt gate

64-bit interrupt gate

32-bit trap gate

64-bit trap gate

Operation

IF Offset(SRC) > descriptor table limit

THEN

ZF := 0;

ELSE

SegmentDescriptor := descriptor referenced by SRC;

IF SegmentDescriptor(Type) ≠ conforming code segment

and (CPL > DPL) or (RPL > DPL)

or SegmentDescriptor(Type) is not valid for instruction

THEN

ZF := 0;

ELSE

DEST := access rights from SegmentDescriptor as given in Description section;

ZF := 1;

FI;

Flags Affected

The ZF flag is set to 1 if the access rights are loaded successfully; otherwise, it is cleared to 0.

3-582

Vol. 2A

LAR-Load Access Rights Byte

INSTRUCTION SET REFERENCE, A-L

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and the memory operand effective address is unaligned while

the current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

The LAR instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The LAR instruction cannot be executed in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If the memory operand effective address referencing the SS segment is in a non-canonical

form.

#GP(0)

If the memory operand effective address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and the memory operand effective address is unaligned while

the current privilege level is 3.

#UD

If the LOCK prefix is used.

LAR-Load Access Rights Byte

Vol. 2A

3-583

INSTRUCTION SET REFERENCE, A-L

LDDQU-Load Unaligned Integer 128 Bits

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

F2 0F F0 /r

V/V

SSE3

Load unaligned data from mem and return

double quadword in xmm1.

LDDQU xmm1, mem

VEX.128.F2.0F.WIG F0 /r

V/V

AVX

Load unaligned packed integer values from

mem to xmm1.

VLDDQU xmm1, m128

VEX.256.F2.0F.WIG F0 /r

V/V

AVX

Load unaligned packed integer values from

mem to ymm1.

VLDDQU ymm1, m256

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

The instruction is functionally similar to (V)MOVDQU ymm/xmm, m256/m128 for loading from memory. That is:

32/16 bytes of data starting at an address specified by the source memory operand (second operand) are fetched

from memory and placed in a destination register (first operand). The source operand need not be aligned on a

32/16-byte boundary. Up to 64/32 bytes may be loaded from memory; this is implementation dependent.

This instruction may improve performance relative to (V)MOVDQU if the source operand crosses a cache line

boundary. In situations that require the data loaded by (V)LDDQU be modified and stored to the same location, use

(V)MOVDQU or (V)MOVDQA instead of (V)LDDQU. To move a double quadword to or from memory locations that

are known to be aligned on 16-byte boundaries, use the (V)MOVDQA instruction.

Implementation Notes

• If the source is aligned to a 32/16-byte boundary, based on the implementation, the 32/16 bytes may be

loaded more than once. For that reason, the usage of (V)LDDQU should be avoided when using uncached or

write-combining (WC) memory regions. For uncached or WC memory regions, keep using (V)MOVDQU.

• This instruction is a replacement for (V)MOVDQU (load) in situations where cache line splits significantly affect

performance. It should not be used in situations where store-load forwarding is performance critical. If

performance of store-load forwarding is critical to the application, use (V)MOVDQA store-load pairs when data

is 256/128-bit aligned or (V)MOVDQU store-load pairs when data is 256/128-bit unaligned.

• If the memory address is not aligned on 32/16-byte boundary, some implementations may load up to 64/32

bytes and return 32/16 bytes in the destination. Some processor implementations may issue multiple loads to

access the appropriate 32/16 bytes. Developers of multi-threaded or multi-processor software should be aware

that on these processors the loads will be performed in a non-atomic way.

• If alignment checking is enabled (CR0.AM = 1, RFLAGS.AC = 1, and CPL = 3), an alignment-check exception

(#AC) may or may not be generated (depending on processor implementation) when the memory address is

not aligned on an 8-byte boundary.

In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15).

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD.

Operation

LDDQU (128-bit Legacy SSE Version)

DEST[127:0] := SRC[127:0]

DEST[MAXVL-1:128] (Unmodified)

3-584

Vol. 2A

LDDQU-Load Unaligned Integer 128 Bits

INSTRUCTION SET REFERENCE, A-L

LDMXCSR-Load MXCSR Register

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

NP 0F AE /2

V/V

SSE

Load MXCSR register from m32.

LDMXCSR m32

VEX.LZ.0F.WIG AE /2

V/V

AVX

Load MXCSR register from m32.

VLDMXCSR m32

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Loads the source operand into the MXCSR control/status register. The source operand is a 32-bit memory location.

See “MXCSR Control and Status Register” in Chapter 10, of the Intel^® 64 and IA-32 Architectures Software Devel-

oper’s Manual, Volume 1, for a description of the MXCSR register and its contents.

The LDMXCSR instruction is typically used in conjunction with the (V)STMXCSR instruction, which stores the

contents of the MXCSR register in memory.

The default MXCSR value at reset is 1F80H.

If a (V)LDMXCSR instruction clears a SIMD floating-point exception mask bit and sets the corresponding exception

flag bit, a SIMD floating-point exception will not be immediately generated. The exception will be generated only

upon the execution of the next instruction that meets both conditions below:

• the instruction must operate on an XMM or YMM register operand,

• the instruction causes that particular SIMD floating-point exception to be reported.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

If VLDMXCSR is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause an

#UD exception.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

MXCSR := m32;

C/C++ Compiler Intrinsic Equivalent

_mm_setcsr(unsigned int i)

Numeric Exceptions

None.

Other Exceptions

See Table 2-22, “Type 5 Class Exception Conditions,” additionally:

#GP

For an attempt to set reserved bits in MXCSR.

#UD

If VEX.vvvv ≠ 1111B.

3-586

Vol. 2A

LDMXCSR-Load MXCSR Register

INSTRUCTION SET REFERENCE, A-L

LDS/LES/LFS/LGS/LSS-Load Far Pointer

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

C5 /r

LDS r16,m16:16

Invalid

Valid

Load DS:r16 with far pointer from memory.

C5 /r

LDS r32,m16:32

Invalid

Valid

Load DS:r32 with far pointer from memory.

0F B2 /r

LSS r16,m16:16

Valid

Load SS:r16 with far pointer from memory.

0F B2 /r

LSS r32,m16:32

Valid

Load SS:r32 with far pointer from memory.

REX + 0F B2 /r

LSS r64,m16:64

Valid

N.E.

Load SS:r64 with far pointer from memory.

C4 /r

LES r16,m16:16

Invalid

Valid

Load ES:r16 with far pointer from memory.

C4 /r

LES r32,m16:32

Invalid

Valid

Load ES:r32 with far pointer from memory.

0F B4 /r

LFS r16,m16:16

Valid

Load FS:r16 with far pointer from memory.

0F B4 /r

LFS r32,m16:32

Valid

Load FS:r32 with far pointer from memory.

REX + 0F B4 /r

LFS r64,m16:64

Valid

N.E.

Load FS:r64 with far pointer from memory.

0F B5 /r

LGS r16,m16:16

Valid

Load GS:r16 with far pointer from memory.

0F B5 /r

LGS r32,m16:32

Valid

Load GS:r32 with far pointer from memory.

REX + 0F B5 /r

LGS r64,m16:64

Valid

N.E.

Load GS:r64 with far pointer from memory.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Loads a far pointer (segment selector and offset) from the second operand (source operand) into a segment

memory depending on the current setting of the operand-size attribute (32 bits or 16 bits, respectively). The

instruction opcode and the destination operand specify a segment register/general-purpose register pair. The 16-

bit segment selector from the source operand is loaded into the segment register specified with the opcode (DS,

SS, ES, FS, or GS). The 32-bit or 16-bit offset is loaded into the register specified with the destination operand.

If one of these instructions is executed in protected mode, additional information from the segment descriptor

pointed to by the segment selector in the source operand is loaded in the hidden part of the selected segment

Also in protected mode, a NULL selector (values 0000 through 0003) can be loaded into DS, ES, FS, or GS registers

without causing a protection exception. (Any subsequent reference to a segment whose corresponding segment

the segment occurs.)

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.W promotes

operation to specify a source operand referencing an 80-bit pointer (16-bit selector, 64-bit offset) in memory. Using

a REX prefix in the form of REX.R permits access to additional registers (R8-R15). See the summary chart at the

beginning of this section for encoding data and limits.

Operation

64-BIT_MODE

IF SS is loaded

THEN

IF SegmentSelector = NULL and ( (RPL = 3) or

(RPL ≠ 3 and RPL ≠ CPL) )

THEN #GP(0);

ELSE IF descriptor is in non-canonical space

LDS/LES/LFS/LGS/LSS-Load Far Pointer

Vol. 2A

3-587

INSTRUCTION SET REFERENCE, A-L

THEN #GP(selector); FI;

ELSE IF Segment selector index is not within descriptor table limits

or segment selector RPL ≠ CPL

or access rights indicate nonwritable data segment

or DPL ≠ CPL

THEN #GP(selector); FI;

ELSE IF Segment marked not present

THEN #SS(selector); FI;

FI;

SS := SegmentSelector(SRC);

SS := SegmentDescriptor([SRC]);

ELSE IF attempt to load DS, or ES

THEN #UD;

ELSE IF FS, or GS is loaded with non-NULL segment selector

THEN IF Segment selector index is not within descriptor table limits

or access rights indicate segment neither data nor readable code segment

or segment is data or nonconforming-code segment

and ( RPL > DPL or CPL > DPL)

THEN #GP(selector); FI;

ELSE IF Segment marked not present

THEN #NP(selector); FI;

FI;

SegmentRegister := SegmentSelector(SRC) ;

SegmentRegister := SegmentDescriptor([SRC]);

FI;

ELSE IF FS, or GS is loaded with a NULL selector:

THEN

SegmentRegister := NULLSelector;

SegmentRegister(DescriptorValidBit) := 0; FI; (* Hidden flag;

not accessible by software *)

FI;

DEST := Offset(SRC);

PREOTECTED MODE OR COMPATIBILITY MODE;

IF SS is loaded

THEN

IF SegementSelector = NULL

THEN #GP(0);

ELSE IF Segment selector index is not within descriptor table limits

or segment selector RPL ≠ CPL

or access rights indicate nonwritable data segment

or DPL ≠ CPL

THEN #GP(selector); FI;

ELSE IF Segment marked not present

THEN #SS(selector); FI;

FI;

SS := SegmentSelector(SRC);

SS := SegmentDescriptor([SRC]);

ELSE IF DS, ES, FS, or GS is loaded with non-NULL segment selector

THEN IF Segment selector index is not within descriptor table limits

or access rights indicate segment neither data nor readable code segment

or segment is data or nonconforming-code segment

and (RPL > DPL or CPL > DPL)

THEN #GP(selector); FI;

ELSE IF Segment marked not present

3-588

Vol. 2A

LDS/LES/LFS/LGS/LSS-Load Far Pointer

INSTRUCTION SET REFERENCE, A-L

THEN #NP(selector); FI;

FI;

SegmentRegister := SegmentSelector(SRC) AND RPL;

SegmentRegister := SegmentDescriptor([SRC]);

FI;

ELSE IF DS, ES, FS, or GS is loaded with a NULL selector:

THEN

SegmentRegister := NULLSelector;

SegmentRegister(DescriptorValidBit) := 0; FI; (* Hidden flag;

not accessible by software *)

FI;

DEST := Offset(SRC);

Real-Address or Virtual-8086 Mode

SegmentRegister := SegmentSelector(SRC); FI;

DEST := Offset(SRC);

Flags Affected

None.

Protected Mode Exceptions

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

#GP(0)

If a NULL selector is loaded into the SS register.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#GP(selector)

If the SS register is being loaded and any of the following is true: the segment selector index

is not within the descriptor table limits, the segment selector RPL is not equal to CPL, the

segment is a non-writable data segment, or DPL is not equal to CPL.

If the DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and any of

the following is true: the segment selector index is not within descriptor table limits, the

segment is neither a data nor a readable code segment, or the segment is a data or noncon-

forming-code segment and both RPL and CPL are greater than DPL.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#SS(selector)

If the SS register is being loaded and the segment is marked not present.

#NP(selector)

If DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and the

segment is marked not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

LDS/LES/LFS/LGS/LSS-Load Far Pointer

Vol. 2A

3-589

INSTRUCTION SET REFERENCE, A-L

Virtual-8086 Mode Exceptions

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#GP(0)

If the memory address is in a non-canonical form.

If a NULL selector is attempted to be loaded into the SS register in compatibility mode.

If a NULL selector is attempted to be loaded into the SS register in CPL3 and 64-bit mode.

If a NULL selector is attempted to be loaded into the SS register in non-CPL3 and 64-bit mode

where its RPL is not equal to CPL.

#GP(Selector)

If the FS, or GS register is being loaded with a non-NULL segment selector and any of the

following is true: the segment selector index is not within descriptor table limits, the memory

address of the descriptor is non-canonical, the segment is neither a data nor a readable code

segment, or the segment is a data or nonconforming-code segment and both RPL and CPL are

greater than DPL.

If the SS register is being loaded and any of the following is true: the segment selector index

is not within the descriptor table limits, the memory address of the descriptor is non-canonical,

the segment selector RPL is not equal to CPL, the segment is a nonwritable data segment, or

DPL is not equal to CPL.

#SS(0)

If a memory operand effective address is non-canonical

#SS(Selector)

If the SS register is being loaded and the segment is marked not present.

#NP(selector)

If FS, or GS register is being loaded with a non-NULL segment selector and the segment is

marked not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

3-590

Vol. 2A

LDS/LES/LFS/LGS/LSS-Load Far Pointer

INSTRUCTION SET REFERENCE, A-L

LDTILECFG-Load Tile Configuration

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.NP.0F38.W0 49 !(11):000:bbb

V/N.E.

AMX-TILE

Load tile configuration as specified in m512.

LDTILECFG m512

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:r/m (r)

N/A

Description

The LDTILECFG instruction takes an operand containing a pointer to a 64-byte memory location containing the

description of the tiles to be supported. In order to configure the tiles, the AMX-TILE bit in CPUID must be set and

the operating system has to have enabled the tiles architecture.

The memory area contains the palette and describes how many tiles are being used and defines each tile in terms

of rows and column bytes. Requests must be compatible with the restrictions provided by CPUID; see Table 3-10

below.

Table 3-10. Memory Area Layout

Byte(s)

Field Name

Description

palette

Palette selects the supported configuration of the tiles that will be used.

start_row

start_row is used for storing the restart values for interrupted operations.

2-15

reserved, must be zero

16-17

tile0.colsb

Tile 0 bytes per row.

18-19

tile1.colsb

Tile 1 bytes per row.

20-21

tile2.colsb

Tile 2 bytes per row.

(sequence continues)

30-31

tile7.colsb

Tile 7 bytes per row.

32-47

reserved, must be zero

tile0.rows

Tile 0 rows.

tile1.rows

Tile 1 rows.

tile2.rows

Tile 2 rows.

(sequence continues)

tile7.rows

Tile 7 rows.

56-63

reserved, must be zero

If a tile row and column pair is not used to specify tile parameters, they must have the value zero. All enabled tiles

(based on the palette) must be configured. Specifying tile parameters for more tiles than the implementation limit

or the palette limit results in a #GP fault.

If the palette_id is zero, that signifies the INIT state for both TILECFG and TILEDATA. Tiles are zeroed in the INIT

state. The only legal non-INIT value for palette_id is 1.

Any attempt to execute the LDTILECFG instruction inside an Intel TSX transaction will result in a transaction abort.

LDTILECFG-Load Tile Configuration

Vol. 2A

3-591

INSTRUCTION SET REFERENCE, A-L

Operation

LDTILECFG mem

error := False

buf := read_memory(mem, 64)

temp_tilecfg.palette_id := buf.byte[0]

if temp_tilecfg.palette_id > max_palette:

error := True

if not xcr0_supports_palette(temp_tilecfg.palette_id):

error := True

if temp_tilecfg.palette_id !=0:

temp_tilecfg.start_row := buf.byte[1]

if buf.byte[2..15] is nonzero:

error := True

p := 16

# configure columns

for n in 0 ... palette_table[temp_tilecfg.palette_id].max_names-1:

temp_tilecfg.t[n].colsb:= buf.word[p/2]

p := p + 2

if temp_tilecfg.t[n].colsb > palette_table[temp_tilecfg.palette_id].bytes_per_row:

error := True

if nonzero(buf[p...47]):

error := True

# configure rows

p := 48

for n in 0 ... palette_table[temp_tilecfg.palette_id].max_names-1:

temp_tilecfg.t[n].rows:= buf.byte[p]

if temp_tilecfg.t[n].rows > palette_table[temp_tilecfg.palette_id].max_rows:

error := True

p := p + 1

if nonzero(buf[p...63]):

error := True

# validate each tile's row & col configs are reasonable and enable the valid tiles

for n in 0 ... palette_table[temp_tilecfg.palette_id].max_names-1:

if temp_tilecfg.t[n].rows !=0 and temp_tilecfg.t[n].colsb != 0:

temp_tilecfg.t[n].valid := 1

elif temp_tilecfg.t[n].rows == 0 and temp_tilecfg.t[n].colsb == 0:

temp_tilecfg.t[n].valid := 0

else:

error := True// one of rows or colsbwas 0 but not both.

if error:

#GP

elif temp_tilecfg.palette_id == 0:

TILES_CONFIGURED := 0// init state

tilecfg := 0// equivalent to 64B of zeros

zero_all_tile_data()

else:

tilecfg := temp_tilecfg

zero_all_tile_data()

TILES_CONFIGURED := 1

3-592

Vol. 2A

LDTILECFG-Load Tile Configuration

INSTRUCTION SET REFERENCE, A-L

LEA-Load Effective Address

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

8D /r

LEA r16,m

Valid

Store effective address for m in register r16.

8D /r

LEA r32,m

Valid

Store effective address for m in register r32.

REX.W + 8D /r

LEA r64,m

Valid

N.E.

Store effective address for m in register r64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Computes the effective address of the second operand (the source operand) and stores it in the first operand

(destination operand). The source operand is a memory address (offset part) specified with one of the processors

addressing modes; the destination operand is a general-purpose register. The address-size and operand-size attri-

butes affect the action performed by this instruction, as shown in the following table. The operand-size attribute of

the instruction is determined by the chosen register; the address-size attribute is determined by the attribute of

the code segment.

Table 3-54. Non-64-bit Mode LEA Operation with Address and Operand Size Attributes

Operand Size

Address Size

Action Performed

16-bit effective address is calculated and stored in requested 16-bit register destination.

32-bit effective address is calculated. The lower 16 bits of the address are stored in the

requested 16-bit register destination.

16-bit effective address is calculated. The 16-bit address is zero-extended and stored in the

requested 32-bit register destination.

32-bit effective address is calculated and stored in the requested 32-bit register destination.

Different assemblers may use different algorithms based on the size attribute and symbolic reference of the source

operand.

In 64-bit mode, the instruction’s destination operand is governed by operand size attribute, the default operand

size is 32 bits. Address calculation is governed by address size attribute, the default address size is 64-bits. In 64-

bit mode, address size of 16 bits is not encodable. See Table 3-55.

Table 3-55. 64-bit Mode LEA Operation with Address and Operand Size Attributes

Operand Size

Address Size

Action Performed

32-bit effective address is calculated (using 67H prefix). The lower 16 bits of the address are

stored in the requested 16-bit register destination (using 66H prefix).

64-bit effective address is calculated (default address size). The lower 16 bits of the address

are stored in the requested 16-bit register destination (using 66H prefix).

32-bit effective address is calculated (using 67H prefix) and stored in the requested 32-bit

64-bit effective address is calculated (default address size) and the lower 32 bits of the

address are stored in the requested 32-bit register destination.

32-bit effective address is calculated (using 67H prefix), zero-extended to 64-bits, and stored

in the requested 64-bit register destination (using REX.W).

64-bit effective address is calculated (default address size) and all 64-bits of the address are

stored in the requested 64-bit register destination (using REX.W).

3-594

Vol. 2A

LEA-Load Effective Address

INSTRUCTION SET REFERENCE, A-L

Operation

IF OperandSize = 16 and AddressSize = 16

THEN

DEST := EffectiveAddress(SRC); (* 16-bit address *)

ELSE IF OperandSize = 16 and AddressSize = 32

THEN

temp := EffectiveAddress(SRC); (* 32-bit address *)

DEST := temp[0:15]; (* 16-bit address *)

FI;

ELSE IF OperandSize = 32 and AddressSize = 16

THEN

temp := EffectiveAddress(SRC); (* 16-bit address *)

DEST := ZeroExtend(temp); (* 32-bit address *)

FI;

ELSE IF OperandSize = 32 and AddressSize = 32

THEN

DEST := EffectiveAddress(SRC); (* 32-bit address *)

FI;

ELSE IF OperandSize = 16 and AddressSize = 64

THEN

temp := EffectiveAddress(SRC); (* 64-bit address *)

DEST := temp[0:15]; (* 16-bit address *)

FI;

ELSE IF OperandSize = 32 and AddressSize = 64

THEN

temp := EffectiveAddress(SRC); (* 64-bit address *)

DEST := temp[0:31]; (* 16-bit address *)

FI;

ELSE IF OperandSize = 64 and AddressSize = 64

THEN

DEST := EffectiveAddress(SRC); (* 64-bit address *)

FI;

Flags Affected

None.

Protected Mode Exceptions

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode.

LEA-Load Effective Address

Vol. 2A

3-595

INSTRUCTION SET REFERENCE, A-L

LEAVE-High Level Procedure Exit

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

LEAVE

Valid

Set SP to BP, then pop BP.

LEAVE

N.E.

Valid

Set ESP to EBP, then pop EBP.

LEAVE

Valid

N.E.

Set RSP to RBP, then pop RBP.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Releases the stack frame set up by an earlier ENTER instruction. The LEAVE instruction copies the frame pointer (in

the EBP register) into the stack pointer register (ESP), which releases the stack space allocated to the stack frame.

The old frame pointer (the frame pointer for the calling procedure that was saved by the ENTER instruction) is then

popped from the stack into the EBP register, restoring the calling procedure’s stack frame.

A RET instruction is commonly executed following a LEAVE instruction to return program control to the calling

procedure.

See “Procedure Calls for Block-Structured Languages” in Chapter 7 of the Intel^® 64 and IA-32 Architectures Soft-

ware Developer’s Manual, Volume 1, for detailed information on the use of the ENTER and LEAVE instructions.

In 64-bit mode, the instruction’s default operation size is 64 bits; 32-bit operation cannot be encoded. See the

summary chart at the beginning of this section for encoding data and limits.

Operation

IF StackAddressSize = 32

THEN

ESP := EBP;

ELSE IF StackAddressSize = 64

THEN RSP := RBP; FI;

ELSE IF StackAddressSize = 16

THEN SP := BP; FI;

FI;

IF OperandSize = 32

THEN EBP := Pop();

ELSE IF OperandSize = 64

THEN RBP := Pop(); FI;

ELSE IF OperandSize = 16

THEN BP := Pop(); FI;

FI;

Flags Affected

None.

3-596

Vol. 2A

LEAVE-High Level Procedure Exit

INSTRUCTION SET REFERENCE, A-L

Protected Mode Exceptions

#SS(0)

If the EBP register points to a location that is not within the limits of the current stack

segment.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If the EBP register points to a location outside of the effective address space from 0 to FFFFH.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If the EBP register points to a location outside of the effective address space from 0 to FFFFH.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If the stack address is in a non-canonical form.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

LEAVE-High Level Procedure Exit

Vol. 2A

3-597

INSTRUCTION SET REFERENCE, A-L

LFENCE-Load Fence

Opcode /

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F AE E8

V/V

SSE2

Serializes load operations.

LFENCE

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Performs a serializing operation on all load-from-memory instructions that were issued prior the LFENCE instruc-

tion. Specifically, LFENCE does not execute until all prior instructions have completed locally, and no later instruc-

tion begins execution until LFENCE completes. In particular, an instruction that loads from memory and that

precedes an LFENCE receives data from memory prior to completion of the LFENCE. (An LFENCE that follows an

instruction that stores to memory might complete before the data being stored have become globally visible.)

Instructions following an LFENCE may be fetched from memory before the LFENCE, but they will not execute (even

speculatively) until the LFENCE completes.

Weakly ordered memory types can be used to achieve higher processor performance through such techniques as

out-of-order issue and speculative reads. The degree to which a consumer of data recognizes or knows that the

data is weakly ordered varies among applications and may be unknown to the producer of this data. The LFENCE

instruction provides a performance-efficient way of ensuring load ordering between routines that produce weakly-

ordered results and routines that consume that data.

Processors are free to fetch and cache data speculatively from regions of system memory that use the WB, WC, and

WT memory types. This speculative fetching can occur at any time and is not tied to instruction execution. Thus, it

is not ordered with respect to executions of the LFENCE instruction; data can be brought into the caches specula-

tively just before, during, or after the execution of an LFENCE instruction.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

Specification of the instruction's opcode above indicates a ModR/M byte of E8. For this instruction, the processor

ignores the r/m field of the ModR/M byte. Thus, LFENCE is encoded by any opcode of the form 0F AE Ex, where x is

in the range 8-F.

Operation

Wait_On_Following_Instructions_Until(preceding_instructions_complete);

Intel C/C++ Compiler Intrinsic Equivalent

void _mm_lfence(void)

Exceptions (All Modes of Operation)

#UD

If CPUID.01H:EDX.SSE2[bit 26] = 0.

If the LOCK prefix is used.

3-598

Vol. 2A

LFENCE-Load Fence

INSTRUCTION SET REFERENCE, A-L

LGDT/LIDT-Load Global/Interrupt Descriptor Table Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 /2

LGDT m16&32

N.E.

Valid

Load m into GDTR.

0F 01 /3

LIDT m16&32

N.E.

Valid

Load m into IDTR.

0F 01 /2

LGDT m16&64

Valid

N.E.

Load m into GDTR.

0F 01 /3

LIDT m16&64

Valid

N.E.

Load m into IDTR.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Loads the values in the source operand into the global descriptor table register (GDTR) or the interrupt descriptor

table register (IDTR). The source operand specifies a 6-byte memory location that contains the base address (a

linear address) and the limit (size of table in bytes) of the global descriptor table (GDT) or the interrupt descriptor

table (IDT). If operand-size attribute is 32 bits, a 16-bit limit (lower 2 bytes of the 6-byte data operand) and a 32-

bit base address (upper 4 bytes of the data operand) are loaded into the register. If the operand-size attribute

is 16 bits, a 16-bit limit (lower 2 bytes) and a 24-bit base address (third, fourth, and fifth byte) are loaded. Here,

the high-order byte of the operand is not used and the high-order byte of the base address in the GDTR or IDTR is

filled with zeros.

The LGDT and LIDT instructions are used only in operating-system software; they are not used in application

programs. They are the only instructions that directly load a linear address (that is, not a segment-relative

address) and a limit in protected mode. They are commonly executed in real-address mode to allow processor

initialization prior to switching to protected mode.

In 64-bit mode, the instruction’s operand size is fixed at 8+2 bytes (an 8-byte base and a 2-byte limit). See the

summary chart at the beginning of this section for encoding data and limits.

See “SGDT-Store Global Descriptor Table Register” in Chapter 4, of the Intel^® 64 and IA-32 Architectures Soft-

ware Developer’s Manual, Volume 2B, for information on storing the contents of the GDTR and IDTR.

LGDT/LIDT-Load Global/Interrupt Descriptor Table Register

Vol. 2A

3-599

INSTRUCTION SET REFERENCE, A-L

Operation

IF Instruction is LIDT

THEN

IF OperandSize = 16

THEN

IDTR(Limit) := SRC[0:15];

IDTR(Base) := SRC[16:47] AND 00FFFFFFH;

ELSE IF 32-bit Operand Size

THEN

IDTR(Limit) := SRC[0:15];

IDTR(Base) := SRC[16:47];

FI;

ELSE IF 64-bit Operand Size (* In 64-Bit Mode *)

THEN

IDTR(Limit) := SRC[0:15];

IDTR(Base) := SRC[16:79];

FI;

ELSE (* Instruction is LGDT *)

IF OperandSize = 16

THEN

GDTR(Limit) := SRC[0:15];

GDTR(Base) := SRC[16:47] AND 00FFFFFFH;

ELSE IF 32-bit Operand Size

THEN

GDTR(Limit) := SRC[0:15];

GDTR(Base) := SRC[16:47];

FI;

ELSE IF 64-bit Operand Size (* In 64-Bit Mode *)

THEN

GDTR(Limit) := SRC[0:15];

GDTR(Base) := SRC[16:79];

FI;

Flags Affected

None.

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

#GP(0)

If the current privilege level is not 0.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

3-600

Vol. 2A

LGDT/LIDT-Load Global/Interrupt Descriptor Table Register

INSTRUCTION SET REFERENCE, A-L

LLDT-Load Local Descriptor Table Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 00 /2

LLDT r/m16

Valid

Load segment selector r/m16 into LDTR.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Loads the source operand into the segment selector field of the local descriptor table register (LDTR). The source

operand (a general-purpose register or a memory location) contains a segment selector that points to a local

descriptor table (LDT). After the segment selector is loaded in the LDTR, the processor uses the segment selector

to locate the segment descriptor for the LDT in the global descriptor table (GDT). It then loads the segment limit

and base address for the LDT from the segment descriptor into the LDTR. The segment registers DS, ES, SS, FS,

GS, and CS are not affected by this instruction, nor is the LDTR field in the task state segment (TSS) for the current

task.

If bits 2-15 of the source operand are 0, LDTR is marked invalid and the LLDT instruction completes silently.

However, all subsequent references to descriptors in the LDT (except by the LAR, VERR, VERW or LSL instructions)

cause a general protection exception (#GP).

The operand-size attribute has no effect on this instruction.

The LLDT instruction is provided for use in operating-system software; it should not be used in application

programs. This instruction can only be executed in protected mode or 64-bit mode.

In 64-bit mode, the operand size is fixed at 16 bits.

Operation

IF SRC(Offset) > descriptor table limit

THEN #GP(segment selector); FI;

IF segment selector is valid

Read segment descriptor;

IF SegmentDescriptor(Type) ≠ LDT

THEN #GP(segment selector); FI;

IF segment descriptor is not present

THEN #NP(segment selector); FI;

LDTR(SegmentSelector) := SRC;

LDTR(SegmentDescriptor) := GDTSegmentDescriptor;

ELSE LDTR := INVALID

FI;

Flags Affected

None.

3-602

Vol. 2A

LLDT-Load Local Descriptor Table Register

INSTRUCTION SET REFERENCE, A-L

Protected Mode Exceptions

#GP(0)

If the current privilege level is not 0.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#GP(selector)

If the selector operand does not point into the Global Descriptor Table or if the entry in the GDT

is not a Local Descriptor Table.

Segment selector is beyond GDT limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#NP(selector)

If the LDT descriptor is not present.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

The LLDT instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The LLDT instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the current privilege level is not 0.

If the memory address is in a non-canonical form.

#GP(selector)

If the selector operand does not point into the Global Descriptor Table or if the entry in the GDT

is not a Local Descriptor Table.

Segment selector is beyond GDT limit.

#NP(selector)

If the LDT descriptor is not present.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

LLDT-Load Local Descriptor Table Register

Vol. 2A

3-603

INSTRUCTION SET REFERENCE, A-L

LMSW-Load Machine Status Word

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 /6

LMSW r/m16

Valid

Loads r/m16 in machine status word of CR0.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Loads the source operand into the machine status word, bits 0 through 15 of register CR0. The source operand can

be a 16-bit general-purpose register or a memory location. Only the low-order 4 bits of the source operand (which

contains the PE, MP, EM, and TS flags) are loaded into CR0. The PG, CD, NW, AM, WP, NE, and ET flags of CR0 are

not affected. The operand-size attribute has no effect on this instruction.

If the PE flag of the source operand (bit 0) is set to 1, the instruction causes the processor to switch to protected

mode. While in protected mode, the LMSW instruction cannot be used to clear the PE flag and force a switch back

to real-address mode.

The LMSW instruction is provided for use in operating-system software; it should not be used in application

programs. In protected or virtual-8086 mode, it can only be executed at CPL 0.

This instruction is provided for compatibility with the Intel 286 processor; programs and procedures intended to

run on IA-32 and Intel 64 processors beginning with Intel386 processors should use the MOV (control registers)

instruction to load the whole CR0 register. The MOV CR0 instruction can be used to set and clear the PE flag in CR0,

allowing a procedure or program to switch between protected and real-address modes.

This instruction is a serializing instruction.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode. Note that the operand size is fixed

at 16 bits.

See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 26 of the Intel^® 64 and IA-32 Archi-

tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in

VMX non-root operation.

Operation

CR0[0:3] := SRC[0:3];

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If the current privilege level is not 0.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#UD

If the LOCK prefix is used.

3-604

Vol. 2A

LMSW-Load Machine Status Word

INSTRUCTION SET REFERENCE, A-L

LOADIWKEY-Load Internal Wrapping Key With Key Locker

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

F3 0F 38 DC 11:rrr:bbb

V/V

Load internal wrapping key from xmm1, xmm2, and

LOADIWKEY xmm1, xmm2, <EAX>, <XMM0>

XMM0.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r)

ModRM:r/m (r)

Implicit EAX (r)

Implicit XMM0 (r)

Description

The LOADIWKEY¹ instruction writes the Key Locker internal wrapping key, which is called IWKey. This IWKey is

used by the ENCODEKEY* instructions to wrap keys into handles. Conversely, the AESENC/DEC*KL instructions use

IWKey to unwrap those keys from the handles and help verify the handle integrity. For security reasons, no instruc-

tion is designed to allow software to directly read the IWKey value.

IWKey includes two cryptographic keys as well as metadata. The two cryptographic keys are loaded from register

sources so that LOADIWKEY can be executed without the keys ever being in memory.

The key input operands are:

• The 256-bit encryption key is loaded from the two explicit operands.

• The 128-bit integrity key is loaded from the implicit operand XMM0.

The implicit operand EAX specifies the KeySource and whether backing up the key is permitted:

• EAX[0] - When set, the wrapping key being initialized is not permitted to be backed up to platform-scoped

storage.

• EAX[4:1] - This specifies the KeySource, which is the type of key. Currently only two encodings are supported.

A KeySource of 0 indicates that the key input operands described above should be directly stored as the internal

wrapping keys. LOADIWKEY with a KeySource of 1 will have random numbers from the on-chip random number

generator XORed with the source registers (including XMM0) so that the software that executes the

LOADIWKEY does not know the actual IWKey encryption and integrity keys. Software can choose to put

additional random data into the source registers so that other sources of random data are combined with the

hardware random number generator supplied value. Software should always check ZF after executing

LOADIWKEY with KeySource of 1 as this operation may fail due to it being unable to get sufficient full-entropy

data from the on-chip random number generator. Both KeySource of 0 and 1 specify that IWKey be used with

the AES-GCM-SIV algorithm. CPUID.19H.ECX[1] enumerates support for KeySource of 1. All other KeySource

encodings are reserved.

• EAX[31:5] - Reserved.

1. Further details on Key Locker and usage of this instruction can be found here:

https://software.intel.com/content/www/us/en/develop/download/intel-key-locker-specification.html.

3-606

Vol. 2A

LOADIWKEY-Load Internal Wrapping Key With Key Locker

INSTRUCTION SET REFERENCE, A-L

Operation

LOADIWKEY

IF CPL > 0

// LOADKWKEY only allowed at ring 0 (supervisor mode)

THEN #GP (0); FI;

IF EAX[4:1] > 1

// Reserved KeySource encoding used

THEN #GP (0); FI;

IF EAX[31:5] != 0

// Reserved bit in EAX is set

THEN #GP (0); FI;

IF EAX[0] AND (CPUID.19H.ECX[0] == 0)

// NoBackup is not supported on this part

THEN #GP (0); FI;

IF (EAX[4:1] == 1) AND (CPUID.19H.ECX[1] == 0)

// KeySource of 1 is not supported on this part

THEN #GP (0); FI;

IF (EAX[4:1] == 0)

// KeySource of 0

THEN

IWKey.Encryption Key[127:0] := SRC2[127:0]:

IWKey.Encryption Key[255:128] := SRC1[127:0];

IWKey.IntegrityKey[127:0] := XMM0[127:0];

IWKey.NoBackup = EAX [0];

IWKey.KeySource = EAX [4:1];

RFLAGS.ZF := 0;

ELSE

// KeySource of 1. See RDSEED definition for details of randomness

IF HW_NRND_GEN.ready == 1

// Full-entropy random data from RDSEED hardware block was received

THEN

IWKey.Encryption Key[127:0] := SRC2[127:0] XOR HW_NRND_GEN.data[127:0];

IWKey.Encryption Key[255:128] := SRC1[127:0] XOR HW_NRND_GEN.data[255:128];

IWKey.IntegrityKey[127:0] := XMM0[127:0] XOR HW_NRND_GEN.data[383:256];

IWKey.NoBackup = EAX [0];

IWKey.KeySource = EAX [4:1];

RFLAGS.ZF := 0;

ELSE

// Random data was not returned from RDSEED hardware block. IWKey was not loaded

RFLAGS.ZF := 1;

FI;

RFLAGS.OF, SF, AF, PF, CF := 0;

Flags Affected

ZF is set to 0 if the operation succeeded and set to 1 if the operation failed due to full-entropy random data not

being received from RDSEED. The other arithmetic flags (OF, SF, AF, PF, CF) are cleared to 0.

Intel C/C++ Compiler Intrinsic Equivalent

LOADIWKEY

void _mm_loadiwkey(unsigned int ctl, __m128i intkey, __m128i enkey_lo, __m128i enkey_hi);

LOADIWKEY-Load Internal Wrapping Key With Key Locker

Vol. 2A

3-607

INSTRUCTION SET REFERENCE, A-L

LOCK-Assert LOCK# Signal Prefix

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

LOCK

Valid

Asserts LOCK# signal for duration of the

accompanying instruction.

NOTES:

1. See IA-32 Architecture Compatibility section below.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Causes the processor’s LOCK# signal to be asserted during execution of the accompanying instruction (turns the

instruction into an atomic instruction). In a multiprocessor environment, the LOCK# signal ensures that the

processor has exclusive use of any shared memory while the signal is asserted.

In most IA-32 and all Intel 64 processors, locking may occur without the LOCK# signal being asserted. See the “IA-

32 Architecture Compatibility” section below for more details.

The LOCK prefix can be prepended only to the following instructions and only to those forms of the instructions

where the destination operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCH8B,

CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD, and XCHG. If the LOCK prefix is used with one of

these instructions and the source operand is a memory operand, an undefined opcode exception (#UD) may be

generated. An undefined opcode exception will also be generated if the LOCK prefix is used with any instruction not

in the above list. The XCHG instruction always asserts the LOCK# signal regardless of the presence or absence of

the LOCK prefix.

The LOCK prefix is typically used with the BTS instruction to perform a read-modify-write operation on a memory

location in shared memory environment.

The integrity of the LOCK prefix is not affected by the alignment of the memory field. Memory locking is observed

for arbitrarily misaligned fields.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

IA-32 Architecture Compatibility

Beginning with the P6 family processors, when the LOCK prefix is prefixed to an instruction and the memory area

being accessed is cached internally in the processor, the LOCK# signal is generally not asserted. Instead, only the

processor’s cache is locked. Here, the processor’s cache coherency mechanism ensures that the operation is

carried out atomically with regards to memory. See “Effects of a Locked Operation on Internal Processor Caches”

in Chapter 9 of Intel^®64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, the for more informa-

tion on locking of caches.

Operation

AssertLOCK#(DurationOfAccompaningInstruction);

Flags Affected

None.

Protected Mode Exceptions

#UD

If the LOCK prefix is used with an instruction not listed: ADD, ADC, AND, BTC, BTR, BTS,

CMPXCHG, CMPXCH8B, CMPXCHG16B, DEC, INC, NEG, NOT, OR, SBB, SUB, XOR, XADD,

XCHG.

Other exceptions can be generated by the instruction when the LOCK prefix is applied.

LOCK-Assert LOCK# Signal Prefix

Vol. 2A

3-609

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 26