Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, M-U

SAVEPREVSSP-Save Previous Shadow Stack Pointer

Opcode/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F3 0F 01 EA (mod!=11, /5, RM=010)

V/V

CET_SS

Save a restore-shadow-stack token on previous shadow stack.

SAVEPREVSSP

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Push a restore-shadow-stack token on the previous shadow stack at the next 8 byte aligned boundary. The

previous SSP is obtained from the previous-ssp token at the top of the current shadow stack.

Operation

IF CPL = 3

IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0

THEN #UD; FI;

ELSE

IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0

THEN #UD; FI;

FI;

IF SSP not aligned to 8 bytes

THEN #GP(0); FI;

(* Pop the “previous-ssp” token from current shadow stack *)

previous_ssp_token = ShadowStackPop8B(SSP)

(* If the CF flag indicates there was a alignment hole on current shadow stack then pop that alignment hole *)

(* Note that the alignment hole must be zero and can be present only when in legacy/compatibility mode *)

IF RFLAGS.CF == 1 AND (IA32_EFER.LMA AND CS.L)

#GP(0)

FI;

IF RFLAGS.CF == 1

must_be_zero = ShadowStackPop4B(SSP)

IF must_be_zero != 0 THEN #GP(0)

FI;

(* Previous SSP token must have the bit 1 set *)

IF ((previous_ssp_token & 0x02) == 0)

THEN #GP(0); (* bit 1 was 0 *)

IF ((IA32_EFER.LMA AND CS.L) = 0 AND previous_ssp_token [63:32] != 0)

THEN #GP(0); FI; (* If compatibility/legacy mode and SSP not in 4G *)

(* Save Prev SSP from previous_ssp_token to the old shadow stack at next 8 byte aligned address *)

old_SSP = previous_ssp_token & ~0x03

temp := (old_SSP | (IA32_EFER.LMA & CS.L));

Shadow_stack_store 4 bytes of 0 to (old_SSP - 4)

old_SSP := old_SSP & ~0x07;

SAVEPREVSSP-Save Previous Shadow Stack Pointer

Vol. 2B

4-599

INSTRUCTION SET REFERENCE, M-U

Shadow_stack_store 8 bytes of temp to (old_SSP - 8)

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

SAVEPREVSSP void _saveprevssp(void);

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If SSP not 8 byte aligned.

If alignment hole on shadow stack is not 0.

If bit 1 of the previous-ssp token is not set to 1.

If in 32-bit/compatibility mode and SSP recorded in previous-ssp token is beyond 4G.

#PF(fault-code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

The SAVEPREVSSP instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The SAVEPREVSSP instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same as protected mode exceptions.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

If CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If SSP not 8 byte aligned.

If carry flag is set.

If bit 1 of the previous-ssp token is not set to 1.

#PF(fault-code)

If a page fault occurs.

4-600

Vol. 2B

SAVEPREVSSP-Save Previous Shadow Stack Pointer

INSTRUCTION SET REFERENCE, M-U

SBB-Integer Subtraction With Borrow

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

1C ib

SBB AL, imm8

Valid

Subtract with borrow imm8 from AL.

1D iw

SBB AX, imm16

Valid

Subtract with borrow imm16 from AX.

1D id

SBB EAX, imm32

Valid

Subtract with borrow imm32 from EAX.

REX.W + 1D id

SBB RAX, imm32

Valid

N.E.

Subtract with borrow sign-extended imm.32

to 64-bits from RAX.

80 /3 ib

SBB r/m8, imm8

Valid

Subtract with borrow imm8 from r/m8.

REX + 80 /3 ib

SBB r/m8¹, imm8

Valid

N.E.

Subtract with borrow imm8 from r/m8.

81 /3 iw

SBB r/m16, imm16

Valid

Subtract with borrow imm16 from r/m16.

81 /3 id

SBB r/m32, imm32

Valid

Subtract with borrow imm32 from r/m32.

REX.W + 81 /3 id

SBB r/m64, imm32

Valid

N.E.

Subtract with borrow sign-extended imm32 to

64-bits from r/m64.

83 /3 ib

SBB r/m16, imm8

Valid

Subtract with borrow sign-extended imm8

from r/m16.

83 /3 ib

SBB r/m32, imm8

Valid

Subtract with borrow sign-extended imm8

from r/m32.

REX.W + 83 /3 ib

SBB r/m64, imm8

Valid

N.E.

Subtract with borrow sign-extended imm8

from r/m64.

18 /r

SBB r/m8, r8

Valid

Subtract with borrow r8 from r/m8.

REX + 18 /r

SBB r/m8¹, r8

Valid

N.E.

Subtract with borrow r8 from r/m8.

19 /r

SBB r/m16, r16

Valid

Subtract with borrow r16 from r/m16.

19 /r

SBB r/m32, r32

Valid

Subtract with borrow r32 from r/m32.

REX.W + 19 /r

SBB r/m64, r64

Valid

N.E.

Subtract with borrow r64 from r/m64.

1A /r

SBB r8, r/m8

Valid

Subtract with borrow r/m8 from r8.

REX + 1A /r

SBB r8¹, r/m8¹

Valid

N.E.

Subtract with borrow r/m8 from r8.

1B /r

SBB r16, r/m16

Valid

Subtract with borrow r/m16 from r16.

1B /r

SBB r32, r/m32

Valid

Subtract with borrow r/m32 from r32.

REX.W + 1B /r

SBB r64, r/m64

Valid

N.E.

Subtract with borrow r/m64 from r64.

NOTES:

1. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

AL/AX/EAX/RAX

imm8/16/32

N/A

ModRM:r/m (w)

imm8/16/32

N/A

ModRM:r/m (w)

ModRM:reg (r)

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Adds the source operand (second operand) and the carry (CF) flag, and subtracts the result from the destination

operand (first operand). The result of the subtraction is stored in the destination operand. The destination operand

can be a register or a memory location; the source operand can be an immediate, a register, or a memory location.

SBB-Integer Subtraction With Borrow

Vol. 2B

4-601

INSTRUCTION SET REFERENCE, M-U

(However, two memory operands cannot be used in one instruction.) The state of the CF flag represents a borrow

from a previous subtraction.

When an immediate value is used as an operand, it is sign-extended to the length of the destination operand

format.

The SBB instruction does not distinguish between signed or unsigned operands. Instead, the processor evaluates

the result for both data types and sets the OF and CF flags to indicate a borrow in the signed or unsigned result,

respectively. The SF flag indicates the sign of the signed result.

The SBB instruction is usually executed as part of a multibyte or multiword subtraction in which a SUB instruction

is followed by a SBB instruction.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

DEST := (DEST - (SRC + CF));

Intel C/C++ Compiler Intrinsic Equivalent

SBB extern unsigned char _subborrow_u8(unsigned char c_in, unsigned char src1, unsigned char src2, unsigned char *diff_out);

SBB extern unsigned char _subborrow_u16(unsigned char c_in, unsigned short src1, unsigned short src2, unsigned short *diff_out);

SBB extern unsigned char _subborrow_u32(unsigned char c_in, unsigned int src1, unsigned char int, unsigned int *diff_out);

SBB extern unsigned char _subborrow_u64(unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64

*diff_out);

Flags Affected

The OF, SF, ZF, AF, PF, and CF flags are set according to the result.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

4-602

Vol. 2B

SBB-Integer Subtraction With Borrow

INSTRUCTION SET REFERENCE, M-U

SCAS/SCASB/SCASW/SCASD-Scan String

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

SCAS m8

Valid

Compare AL with byte at ES:(E)DI or RDI, then set

status flags.¹

SCAS m16

Valid

Compare AX with word at ES:(E)DI or RDI, then set

status flags.¹

SCAS m32

Valid

Compare EAX with doubleword at ES(E)DI or RDI then

set status flags.¹

REX.W + AF

SCAS m64

Valid

N.E.

Compare RAX with quadword at RDI or EDI then set

status flags.

SCASB

Valid

Compare AL with byte at ES:(E)DI or RDI then set

status flags.¹

SCASW

Valid

Compare AX with word at ES:(E)DI or RDI then set

status flags.¹

SCASD

Valid

Compare EAX with doubleword at ES:(E)DI or RDI

then set status flags.¹

REX.W + AF

SCASQ

Valid

N.E.

Compare RAX with quadword at RDI or EDI then set

status flags.

NOTES:

1. In 64-bit mode, only 64-bit (RDI) and 32-bit (EDI) address sizes are supported. In non-64-bit mode, only 32-bit (EDI) and 16-bit (DI)

address sizes are supported.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

In non-64-bit modes and in default 64-bit mode: this instruction compares a byte, word, doubleword or quadword

specified using a memory operand with the value in AL, AX, or EAX. It then sets status flags in EFLAGS recording

the results. The memory operand address is read from ES:(E)DI register (depending on the address-size attribute

of the instruction and the current operational mode). Note that ES cannot be overridden with a segment override

prefix.

At the assembly-code level, two forms of this instruction are allowed. The explicit-operand form and the no-oper-

ands form. The explicit-operand form (specified using the SCAS mnemonic) allows a memory operand to be speci-

fied explicitly. The memory operand must be a symbol that indicates the size and location of the operand value. The

comparisons, AX for word comparisons, EAX for doubleword comparisons). The explicit-operand form is provided

to allow documentation. Note that the documentation provided by this form can be misleading. That is, the

memory operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword) but it

does not have to specify the correct location. The location is always specified by ES:(E)DI.

The no-operands form of the instruction uses a short form of SCAS. Again, ES:(E)DI is assumed to be the memory

operand and AL, AX, or EAX is assumed to be the register operand. The size of operands is selected by the

mnemonic: SCASB (byte comparison), SCASW (word comparison), or SCASD (doubleword comparison).

After the comparison, the (E)DI register is incremented or decremented automatically according to the setting of

the DF flag in the EFLAGS register. If the DF flag is 0, the (E)DI register is incremented; if the DF flag is 1, the (E)DI

ations, and by 4 for doubleword operations.

4-604

Vol. 2B

SCAS/SCASB/SCASW/SCASD-Scan String

INSTRUCTION SET REFERENCE, M-U

SCAS, SCASB, SCASW, SCASD, and SCASQ can be preceded by the REP prefix for block comparisons of ECX bytes,

words, doublewords, or quadwords. Often, however, these instructions will be used in a LOOP construct that takes

some action based on the setting of status flags. See “REP/REPE/REPZ /REPNE/REPNZ-Repeat String Operation

Prefix” in this chapter for a description of the REP prefix.

In 64-bit mode, the instruction’s default address size is 64-bits, 32-bit address size is supported using the prefix

67H. Using a REX prefix in the form of REX.W promotes operation on doubleword operand to 64 bits. The 64-bit no-

operand mnemonic is SCASQ. Address of the memory operand is specified in either RDI or EDI, and

AL/AX/EAX/RAX may be used as the register operand. After a comparison, the destination register is incremented

or decremented by the current operand size (depending on the value of the DF flag). See the summary chart at the

beginning of this section for encoding data and limits.

Operation

Non-64-bit Mode:

IF (Byte comparison)

THEN

temp := AL - SRC;

SetStatusFlags(temp);

THEN IF DF = 0

THEN (E)DI := (E)DI + 1;

ELSE (E)DI := (E)DI - 1; FI;

ELSE IF (Word comparison)

THEN

temp := AX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (E)DI := (E)DI + 2;

ELSE (E)DI := (E)DI - 2; FI;

FI;

ELSE IF (Doubleword comparison)

THEN

temp := EAX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (E)DI := (E)DI + 4;

ELSE (E)DI := (E)DI - 4; FI;

FI;

64-bit Mode:

IF (Byte comparison)

THEN

temp := AL - SRC;

SetStatusFlags(temp);

THEN IF DF = 0

THEN (R|E)DI := (R|E)DI + 1;

ELSE (R|E)DI := (R|E)DI - 1; FI;

ELSE IF (Word comparison)

THEN

temp := AX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (R|E)DI := (R|E)DI + 2;

ELSE (R|E)DI := (R|E)DI - 2; FI;

FI;

SCAS/SCASB/SCASW/SCASD-Scan String

Vol. 2B

4-605

INSTRUCTION SET REFERENCE, M-U

ELSE IF (Doubleword comparison)

THEN

temp := EAX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (R|E)DI := (R|E)DI + 4;

ELSE (R|E)DI := (R|E)DI - 4; FI;

FI;

ELSE IF (Quadword comparison using REX.W )

THEN

temp := RAX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (R|E)DI := (R|E)DI + 8;

ELSE (R|E)DI := (R|E)DI - 8;

FI;

Flags Affected

The OF, SF, ZF, AF, PF, and CF flags are set according to the temporary result of the comparison.

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the limit of the ES segment.

If the ES register contains a NULL segment selector.

If an illegal memory operand effective address in the ES segment is given.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

4-606

Vol. 2B

SCAS/SCASB/SCASW/SCASD-Scan String

INSTRUCTION SET REFERENCE, M-U

SENDUIPI-Send User Interprocessor Interrupt

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

F3 0F C7 /6

V/I

UINTR

Send interprocessor user interrupt.

SENDUIPI reg

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r)

N/A

Description

The SENDUIPI instruction sends the user interprocessor interrupt (IPI) indicated by its register operand. (The

operand always has 64 bits; operand-size overrides such as the prefix 66 are ignored.)

SENDUIPI uses a data structure called the user-interrupt target table (UITT). This table is located at the linear

address UITTADDR (in the IA32_UINTR_TT MSR); it comprises UITTSZ+1 16-byte entries, where UITTSZ =

IA32_UINT_MISC[31:0]. SENDUIPI uses the UITT entry (UITTE) indexed by the instruction's register operand.

Each UITTE has the following format:

• Bit 0: V, a valid bit.

• Bits 7:1 are reserved and must be 0.

• Bits 15:8: UV, the user-interrupt vector (in the range 0-63, so bits 15:14 must be 0).

• Bits 63:16 are reserved.

• Bits 127:64: UPIDADDR, the linear address of a user posted-interrupt descriptor (UPID). (UPIDADDR is 64-

byte aligned, so bits 69:64 of each UITTE must be 0.)

Each UPID has the following format (fields and bits not referenced are reserved):

• Bit 0 (ON) indicates an outstanding notification. If this bit is set, there is a notification outstanding for one or

more user interrupts in PIR.

• Bit 1 (SN) indicates that notifications should be suppressed. If this bit is set, agents (including SENDUIPI)

should not send notifications when posting user interrupts in this descriptor.

• Bits 23:16 (NV) contain the notification vector. This is used by agents sending user-interrupt notifications

(including SENDUIPI).

• Bits 63:32 (NDST) contain the notification destination. This is the target physical APIC ID (in xAPIC mode,

bits 47:40 are the 8-bit APIC ID; in x2APIC mode, the entire field forms the 32-bit APIC ID).

• Bits 127:64 (PIF) contain posted-interrupt requests. There is one bit for each user-interrupt vector. There is a

user-interrupt request for a vector if the corresponding bit is 1.

Although SENDUIPI may be executed at any privilege level, all of the instruction’s memory accesses (to a UITTE

and a UPID) are performed with supervisor privilege.

SENDUIPI sends a user interrupt by posting a user interrupt with vector V in the UPID referenced by UPIDADDR and

then sending, as an ordinary IPI, any notification interrupt specified in that UPID.

Operation

IF reg > UITTSZ;

THEN #GP(0);

FI;

read tempUITTE from 16 bytes at UITTADDR+ (reg « 4);

IF tempUITTE.V = 0 or tempUITTE sets any reserved bit

THEN #GP(0);

FI;

4-608

Vol. 2B

SENDUIPI-Send User Interprocessor Interrupt

INSTRUCTION SET REFERENCE, M-U

read tempUPID from 16 bytes at tempUITTE.UPIDADDR;// under lock

IF tempUPID sets any reserved bits or bits that must be zero

THEN #GP(0); // release lock

FI;

tempUPID.PIR[tempUITTE.UV] := 1;

IF tempUPID.SN = tempUPID.ON = 0

THEN

tempUPID.ON := 1;

sendNotify := 1;

ELSE sendNotify := 0;

FI;

write tempUPID to 16 bytes at tempUITTE.UPIDADDR;// release lock

IF sendNotify = 1

THEN

IF local APIC is in x2APIC mode

THEN send ordinary IPI with vector tempUPID.NV

to 32-bit physical APIC ID tempUPID.NDST;

ELSE send ordinary IPI with vector tempUPID.NV

to 8-bit physical APIC ID tempUPID.NDST[15:8];

FI;

Flags Affected

None.

Protected Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If executed inside an enclave.

If CR4.UINTR = 0.

If IA32_UINTR_TT[0] = 0.

If CPUID.07H.0H:EDX.UINTR[bit 5] = 0.

#PF

If a page fault occurs.

#GP

If the value of the register operand exceeds UITTSZ.

If the selected UITTE is not valid or sets any reserved bits.

If the selected UPID sets any reserved bits.

If there is an attempt to access memory using a linear address that is not canonical relative to

the current paging mode.

SENDUIPI-Send User Interprocessor Interrupt

Vol. 2B

4-609

INSTRUCTION SET REFERENCE, M-U

SERIALIZE-Serialize Instruction Execution

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

NP 0F 01 E8

V/V

SERIALIZE

Serialize instruction fetch and execution.

SERIALIZE

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Serializes instruction execution. Before the next instruction is fetched and executed, the SERIALIZE instruction

ensures that all modifications to flags, registers, and memory by previous instructions are completed, draining all

buffered writes to memory. This instruction is also a serializing instruction as defined in the section “Serializing

Instructions” in Chapter 9 of the Intel^®64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.

SERIALIZE does not modify registers, arithmetic flags, or memory.

Operation

Wait_On_Fetch_And_Execution_Of_Next_Instruction_Until(preceding_instructions_complete_and_preceding_stores_globally_visible);

Intel C/C++ Compiler Intrinsic Equivalent

SERIALIZE void _serialize(void);

SIMD Floating-Point Exceptions

None.

Other Exceptions

#UD

If the LOCK prefix is used.

If CPUID.07H.0H:EDX.SERIALIZE[bit 14] = 0.

4-610

Vol. 2B

SERIALIZE-Serialize Instruction Execution

INSTRUCTION SET REFERENCE, M-U

SETcc-Set Byte on Condition

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 97

SETA r/m8

Valid

Set byte if above (CF=0 and ZF=0).

REX + 0F 97

SETA r/m8¹

Valid

N.E.

Set byte if above (CF=0 and ZF=0).

0F 93

SETAE r/m8

Valid

Set byte if above or equal (CF=0).

REX + 0F 93

SETAE r/m8¹

Valid

N.E.

Set byte if above or equal (CF=0).

0F 92

SETB r/m8

Valid

Set byte if below (CF=1).

REX + 0F 92

SETB r/m8¹

Valid

N.E.

Set byte if below (CF=1).

0F 96

SETBE r/m8

Valid

Set byte if below or equal (CF=1 or ZF=1).

REX + 0F 96

SETBE r/m8¹

Valid

N.E.

Set byte if below or equal (CF=1 or ZF=1).

0F 92

SETC r/m8

Valid

Set byte if carry (CF=1).

REX + 0F 92

SETC r/m8¹

Valid

N.E.

Set byte if carry (CF=1).

0F 94

SETE r/m8

Valid

Set byte if equal (ZF=1).

REX + 0F 94

SETE r/m8¹

Valid

N.E.

Set byte if equal (ZF=1).

0F 9F

SETG r/m8

Valid

Set byte if greater (ZF=0 and SF=OF).

REX + 0F 9F

SETG r/m8¹

Valid

N.E.

Set byte if greater (ZF=0 and SF=OF).

0F 9D

SETGE r/m8

Valid

Set byte if greater or equal (SF=OF).

REX + 0F 9D

SETGE r/m8¹

Valid

N.E.

Set byte if greater or equal (SF=OF).

0F 9C

SETL r/m8

Valid

Set byte if less (SF≠ OF).

REX + 0F 9C

SETL r/m8¹

Valid

N.E.

Set byte if less (SF≠ OF).

0F 9E

SETLE r/m8

Valid

Set byte if less or equal (ZF=1 or SF≠ OF).

REX + 0F 9E

SETLE r/m8¹

Valid

N.E.

Set byte if less or equal (ZF=1 or SF≠ OF).

0F 96

SETNA r/m8

Valid

Set byte if not above (CF=1 or ZF=1).

REX + 0F 96

SETNA r/m8¹

Valid

N.E.

Set byte if not above (CF=1 or ZF=1).

0F 92

SETNAE r/m8

Valid

Set byte if not above or equal (CF=1).

REX + 0F 92

SETNAE r/m8¹

Valid

N.E.

Set byte if not above or equal (CF=1).

0F 93

SETNB r/m8

Valid

Set byte if not below (CF=0).

REX + 0F 93

SETNB r/m8¹

Valid

N.E.

Set byte if not below (CF=0).

0F 97

SETNBE r/m8

Valid

Set byte if not below or equal (CF=0 and ZF=0).

REX + 0F 97

SETNBE r/m8¹

Valid

N.E.

Set byte if not below or equal (CF=0 and ZF=0).

0F 93

SETNC r/m8

Valid

Set byte if not carry (CF=0).

REX + 0F 93

SETNC r/m8¹

Valid

N.E.

Set byte if not carry (CF=0).

0F 95

SETNE r/m8

Valid

Set byte if not equal (ZF=0).

REX + 0F 95

SETNE r/m8¹

Valid

N.E.

Set byte if not equal (ZF=0).

0F 9E

SETNG r/m8

Valid

Set byte if not greater (ZF=1 or SF≠ OF)

REX + 0F 9E

SETNG r/m8¹

Valid

N.E.

Set byte if not greater (ZF=1 or SF≠ OF).

0F 9C

SETNGE r/m8

Valid

Set byte if not greater or equal (SF≠ OF).

REX + 0F 9C

SETNGE r/m8¹

Valid

N.E.

Set byte if not greater or equal (SF≠ OF).

0F 9D

SETNL r/m8

Valid

Set byte if not less (SF=OF).

REX + 0F 9D

SETNL r/m8¹

Valid

N.E.

Set byte if not less (SF=OF).

0F 9F

SETNLE r/m8

Valid

Set byte if not less or equal (ZF=0 and SF=OF).

REX + 0F 9F

SETNLE r/m8¹

Valid

N.E.

Set byte if not less or equal (ZF=0 and SF=OF).

SETcc-Set Byte on Condition

Vol. 2B

4-611

INSTRUCTION SET REFERENCE, M-U

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 91

SETNO r/m8

Valid

Set byte if not overflow (OF=0).

REX + 0F 91

SETNO r/m8¹

Valid

N.E.

Set byte if not overflow (OF=0).

0F 9B

SETNP r/m8

Valid

Set byte if not parity (PF=0).

REX + 0F 9B

SETNP r/m8¹

Valid

N.E.

Set byte if not parity (PF=0).

0F 99

SETNS r/m8

Valid

Set byte if not sign (SF=0).

REX + 0F 99

SETNS r/m8¹

Valid

N.E.

Set byte if not sign (SF=0).

0F 95

SETNZ r/m8

Valid

Set byte if not zero (ZF=0).

REX + 0F 95

SETNZ r/m8¹

Valid

N.E.

Set byte if not zero (ZF=0).

0F 90

SETO r/m8

Valid

Set byte if overflow (OF=1)

REX + 0F 90

SETO r/m8¹

Valid

N.E.

Set byte if overflow (OF=1).

0F 9A

SETP r/m8

Valid

Set byte if parity (PF=1).

REX + 0F 9A

SETP r/m8¹

Valid

N.E.

Set byte if parity (PF=1).

0F 9A

SETPE r/m8

Valid

Set byte if parity even (PF=1).

REX + 0F 9A

SETPE r/m8¹

Valid

N.E.

Set byte if parity even (PF=1).

0F 9B

SETPO r/m8

Valid

Set byte if parity odd (PF=0).

REX + 0F 9B

SETPO r/m8¹

Valid

N.E.

Set byte if parity odd (PF=0).

0F 98

SETS r/m8

Valid

Set byte if sign (SF=1).

REX + 0F 98

SETS r/m8¹

Valid

N.E.

Set byte if sign (SF=1).

0F 94

SETZ r/m8

Valid

Set byte if zero (ZF=1).

REX + 0F 94

SETZ r/m8¹

Valid

N.E.

Set byte if zero (ZF=1).

NOTES:

1. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Sets the destination operand to 0 or 1 depending on the settings of the status flags (CF, SF, OF, ZF, and PF) in the

EFLAGS register. The destination operand points to a byte register or a byte in memory. The condition code suffix

(cc) indicates the condition being tested for.

The terms “above” and “below” are associated with the CF flag and refer to the relationship between two unsigned

integer values. The terms “greater” and “less” are associated with the SF and OF flags and refer to the relationship

between two signed integer values.

Many of the SETcc instruction opcodes have alternate mnemonics. For example, SETG (set byte if greater) and

SETNLE (set if not less or equal) have the same opcode and test for the same condition: ZF equals 0 and SF equals

OF. These alternate mnemonics are provided to make code more intelligible. Appendix B, “EFLAGS Condition

Codes,” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, shows the alternate

mnemonics for various test conditions.

Some languages represent a logical one as an integer with all bits set. This representation can be obtained by

choosing the logically opposite condition for the SETcc instruction, then decrementing the result. For example, to

test for overflow, use the SETNO instruction, then decrement the result.

4-612

Vol. 2B

SETcc-Set Byte on Condition

INSTRUCTION SET REFERENCE, M-U

The reg field of the ModR/M byte is not used for the SETCC instruction and those opcode bits are ignored by the

processor.

In IA-64 mode, the operand size is fixed at 8 bits. Use of REX prefix enable uniform addressing to additional byte

registers. Otherwise, this instruction’s operation is the same as in legacy mode and compatibility mode.

Operation

IF condition

THEN DEST := 1;

ELSE DEST := 0;

FI;

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

SETcc-Set Byte on Condition

Vol. 2B

4-613

INSTRUCTION SET REFERENCE, M-U

SETSSBSY-Mark Shadow Stack Busy

Opcode/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

F3 0F 01 E8

V/V

CET_SS

Set busy flag in supervisor shadow stack token reference by

SETSSBSY

IA32_PL0_SSP.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

The SETSSBSY instruction verifies the presence of a non-busy supervisor shadow stack token at the address in the

IA32_PL0_SSP MSR and marks it busy. Following successful execution of the instruction, the SSP is set to the value

of the IA32_PL0_SSP MSR.

Operation

IF (CR4.CET = 0)

THEN #UD; FI;

IF (IA32_S_CET.SH_STK_EN = 0)

THEN #UD; FI;

IF CPL > 0

THEN GP(0); FI;

SSP_LA = IA32_PL0_SSP

If SSP_LA not aligned to 8 bytes

THEN #GP(0); FI;

expected_token_value = SSP_LA

(* busy bit must not be set *)

new_token_value

= SSP_LA | BUSY_BIT

(* set busy bit; bit position 0 *)

IF shadow_stack_lock_cmpxchg8B(SSP_LA, new_token_value, expected_token_value) != expected_token_value

THEN #CP(SETSSBSY); FI;

SSP = SSP_LA

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

SETSSBSYvoid _setssbsy(void);

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

IF IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If IA32_PL0_SSP not aligned to 8 bytes.

If CPL is not 0.

#CP(setssbsy)

If busy bit in token is set.

If in 32-bit or compatibility mode, and the address in token is not below 4G.

4-614

Vol. 2B

SETSSBSY-Mark Shadow Stack Busy

INSTRUCTION SET REFERENCE, M-U

SFENCE-Store Fence

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

NP 0F AE F8

SFENCE

Valid

Serializes store operations.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Orders processor execution relative to all memory stores prior to the SFENCE instruction. The processor ensures

that every store prior to SFENCE is globally visible before any store after SFENCE becomes globally visible. The

SFENCE instruction is ordered with respect to memory stores, other SFENCE instructions, MFENCE instructions,

and any serializing instructions (such as the CPUID instruction). It is not ordered with respect to memory loads or

the LFENCE instruction.

Weakly ordered memory types can be used to achieve higher processor performance through such techniques as

out-of-order issue, write-combining, and write-collapsing. The degree to which a consumer of data recognizes or

knows that the data is weakly ordered varies among applications and may be unknown to the producer of this data.

The SFENCE instruction provides a performance-efficient way of ensuring store ordering between routines that

produce weakly-ordered results and routines that consume this data.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

Specification of the instruction's opcode above indicates a ModR/M byte of F8. For this instruction, the processor

ignores the r/m field of the ModR/M byte. Thus, SFENCE is encoded by any opcode of the form 0F AE Fx, where x is

in the range 8-F.

Operation

Wait_On_Following_Stores_Until(preceding_stores_globally_visible);

Intel C/C++ Compiler Intrinsic Equivalent

void _mm_sfence(void)

Exceptions (All Operating Modes)

#UD

If CPUID.01H:EDX.SSE[bit 25] = 0.

If the LOCK prefix is used.

4-616

Vol. 2B

SFENCE-Store Fence

INSTRUCTION SET REFERENCE, M-U

SGDT-Store Global Descriptor Table Register

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 /0

SGDT m

Valid

Store GDTR to m.

NOTES:

1. See the IA-32 Architecture Compatibility section below.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the content of the global descriptor table register (GDTR) in the destination operand. The destination

operand specifies a memory location.

In legacy or compatibility mode, the destination operand is a 6-byte memory location. If the operand-size attribute

is 16 or 32 bits, the 16-bit limit field of the register is stored in the low 2 bytes of the memory location and the 32-

bit base address is stored in the high 4 bytes.

In 64-bit mode, the operand size is fixed at 8+2 bytes. The instruction stores an 8-byte base and a 2-byte limit.

SGDT is useful only by operating-system software. However, it can be used in application programs without causing

an exception to be generated if CR4.UMIP = 0. See “LGDT/LIDT-Load Global/Interrupt Descriptor Table Register”

in Chapter 3, Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A, for information on

loading the GDTR and IDTR.

IA-32 Architecture Compatibility

The 16-bit form of the SGDT is compatible with the Intel 286 processor if the upper 8 bits are not referenced. The

Intel 286 processor fills these bits with 1s; processor generations later than the Intel 286 processor fill these bits

with 0s.

Operation

IF instruction is SGDT

IF OperandSize =16 or OperandSize = 32 (* Legacy or Compatibility Mode *)

THEN

DEST[0:15] := GDTR(Limit);

DEST[16:47] := GDTR(Base); (* Full 32-bit base address stored *)

FI;

ELSE (* 64-bit Mode *)

DEST[0:15] := GDTR(Limit);

DEST[16:79] := GDTR(Base); (* Full 64-bit base address stored *)

FI;

Flags Affected

None.

SGDT-Store Global Descriptor Table Register

Vol. 2B

4-617

INSTRUCTION SET REFERENCE, M-U

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If CR4.UMIP = 1 and CPL > 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

Virtual-8086 Mode Exceptions

#UD

If the LOCK prefix is used.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If CR4.UMIP = 1.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#UD

If the LOCK prefix is used.

#GP(0)

If the memory address is in a non-canonical form.

If CR4.UMIP = 1 and CPL > 0.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

4-618

Vol. 2B

SGDT-Store Global Descriptor Table Register

INSTRUCTION SET REFERENCE, M-U

SHA1RNDS4-Perform Four Rounds of SHA1 Operation

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 3A CC /r ib

RMI

V/V

SHA

Performs four rounds of SHA1 operation operating on SHA1 state

SHA1RNDS4 xmm1,

(A,B,C,D) from xmm1, with a pre-computed sum of the next 4 round

xmm2/m128, imm8

message dwords and state variable E from xmm2/m128. The

immediate byte controls logic functions and round constants.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

Description

The SHA1RNDS4 instruction performs four rounds of SHA1 operation using an initial SHA1 state (A,B,C,D) from the

first operand (which is a source operand and the destination operand) and some pre-computed sum of the next 4

round message dwords, and state variable E from the second operand (a source operand). The updated SHA1 state

(A,B,C,D) after four rounds of processing is stored in the destination operand.

Operation

SHA1RNDS4

The function f() and Constant K are dependent on the value of the immediate.

IF ( imm8[1:0] = 0 )

THEN f() := f0(), K := K₀;

ELSE IF ( imm8[1:0] = 1 )

THEN f() := f1(), K := K₁;

ELSE IF ( imm8[1:0] = 2 )

THEN f() := f2(), K := K₂;

ELSE IF ( imm8[1:0] = 3 )

THEN f() := f3(), K := K3;

FI;

A := SRC1[127:96];

B := SRC1[95:64];

C := SRC1[63:32];

D := SRC1[31:0];

W₀E := SRC2[127:96];

W₁ := SRC2[95:64];

W₂ := SRC2[63:32];

W₃ := SRC2[31:0];

Round i = 0 operation:

A_1 := f (B, C, D) + (A ROL 5) +W₀E +K;

B_1 := A;

C_1 := B ROL 30;

D_1 := C;

E_1 := D;

FOR i = 1 to 3

A_(i +1) := f (B_i, C_i, D_i) + (A_i ROL 5) +W_i+ E_i +K;

SHA1RNDS4-Perform Four Rounds of SHA1 Operation

Vol. 2B

4-619

INSTRUCTION SET REFERENCE, M-U

SHA1NEXTE-Calculate SHA1 State Variable E After Four Rounds

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 38 C8 /r

V/V

SHA

Calculates SHA1 state variable E after four rounds of operation

SHA1NEXTE xmm1,

from the current SHA1 state variable A in xmm1. The calculated

xmm2/m128

value of the SHA1 state variable E is added to the scheduled

dwords in xmm2/m128, and stored with some of the scheduled

dwords in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

The SHA1NEXTE calculates the SHA1 state variable E after four rounds of operation from the current SHA1 state

variable A in the destination operand. The calculated value of the SHA1 state variable E is added to the source

operand, which contains the scheduled dwords.

Operation

SHA1NEXTE

TMP := (SRC1[127:96] ROL 30);

DEST[127:96] := SRC2[127:96] + TMP;

DEST[95:64] := SRC2[95:64];

DEST[63:32] := SRC2[63:32];

DEST[31:0] := SRC2[31:0];

Intel C/C++ Compiler Intrinsic Equivalent

SHA1NEXTE __m128i _mm_sha1nexte_epu32(__m128i, __m128i);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

SHA1NEXTE-Calculate SHA1 State Variable E After Four Rounds

Vol. 2B

4-621

INSTRUCTION SET REFERENCE, M-U

SHA1MSG1-Perform an Intermediate Calculation for the Next Four SHA1 Message Dwords

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 38 C9 /r

V/V

SHA

Performs an intermediate calculation for the next four SHA1 mes-

SHA1MSG1 xmm1,

sage dwords using previous message dwords from xmm1 and

xmm2/m128

xmm2/m128, storing the result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

The SHA1MSG1 instruction is one of two SHA1 message scheduling instructions. The instruction performs an inter-

mediate calculation for the next four SHA1 message dwords.

Operation

SHA1MSG1

W0 := SRC1[127:96] ;

W1 := SRC1[95:64] ;

W2 := SRC1[63: 32] ;

W3 := SRC1[31: 0] ;

W4 := SRC2[127:96] ;

W5 := SRC2[95:64] ;

DEST[127:96] := W2 XOR W0;

DEST[95:64] := W3 XOR W1;

DEST[63:32] := W4 XOR W2;

DEST[31:0] := W5 XOR W3;

Intel C/C++ Compiler Intrinsic Equivalent

SHA1MSG1 __m128i _mm_sha1msg1_epu32(__m128i, __m128i);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

4-622

Vol. 2B

SHA1MSG1-Perform an Intermediate Calculation for the Next Four SHA1 Message Dwords

INSTRUCTION SET REFERENCE, M-U

SHA1MSG2-Perform a Final Calculation for the Next Four SHA1 Message Dwords

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 38 CA /r

V/V

SHA

Performs the final calculation for the next four SHA1 message

SHA1MSG2 xmm1,

dwords using intermediate results from xmm1 and the previous

xmm2/m128

message dwords from xmm2/m128, storing the result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

The SHA1MSG2 instruction is one of two SHA1 message scheduling instructions. The instruction performs the final

calculation to derive the next four SHA1 message dwords.

Operation

SHA1MSG2

W13 := SRC2[95:64] ;

W14 := SRC2[63: 32] ;

W15 := SRC2[31: 0] ;

W16 := (SRC1[127:96] XOR W13 ) ROL 1;

W17 := (SRC1[95:64] XOR W14) ROL 1;

W18 := (SRC1[63: 32] XOR W15) ROL 1;

W19 := (SRC1[31: 0] XOR W16) ROL 1;

DEST[127:96] := W16;

DEST[95:64] := W17;

DEST[63:32] := W18;

DEST[31:0] := W19;

Intel C/C++ Compiler Intrinsic Equivalent

SHA1MSG2 __m128i _mm_sha1msg2_epu32(__m128i, __m128i);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

SHA1MSG2-Perform a Final Calculation for the Next Four SHA1 Message Dwords

Vol. 2B

4-623

INSTRUCTION SET REFERENCE, M-U

SHA256RNDS2-Perform Two Rounds of SHA256 Operation

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 38 CB /r

RMI

V/V

SHA

Perform 2 rounds of SHA256 operation using an initial SHA256

SHA256RNDS2 xmm1,

state (C,D,G,H) from xmm1, an initial SHA256 state (A,B,E,F) from

xmm2/m128, <XMM0>

xmm2/m128, and a pre-computed sum of the next 2 round mes-

sage dwords and the corresponding round constants from the

implicit operand XMM0, storing the updated SHA256 state

(A,B,E,F) result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

Implicit XMM0 (r)

Description

The SHA256RNDS2 instruction performs 2 rounds of SHA256 operation using an initial SHA256 state (C,D,G,H)

from the first operand, an initial SHA256 state (A,B,E,F) from the second operand, and a pre-computed sum of the

next 2 round message dwords and the corresponding round constants from the implicit operand xmm0. Note that

only the two lower dwords of XMM0 are used by the instruction.

The updated SHA256 state (A,B,E,F) is written to the first operand, and the second operand can be used as the

updated state (C,D,G,H) in later rounds.

Operation

SHA256RNDS2

A_0 := SRC2[127:96];

B_0 := SRC2[95:64];

C_0 := SRC1[127:96];

D_0 := SRC1[95:64];

E_0 := SRC2[63:32];

F_0 := SRC2[31:0];

G_0 := SRC1[63:32];

H_0 := SRC1[31:0];

WK₀ := XMM0[31: 0];

WK₁ := XMM0[63: 32];

FOR i = 0 to 1

A_(i +1) := Ch (E_i, F_i, G_i) +Σ₁( E_i) +WK_i+ H_i + Maj(A_i , B_i, C_i) +Σ₀( A_i);

B_(i +1) := A_i;

C_(i +1) := B_i ;

D_(i +1) := C_i;

E_(i +1) := Ch (E_i, F_i, G_i) +Σ₁( E_i) +WK_i+ H_i + D_i;

F_(i +1) := E_i ;

G_(i +1) := F_i;

H_(i +1) := G_i;

ENDFOR

DEST[127:96] := A_2;

DEST[95:64] := B_2;

DEST[63:32] := E_2;

DEST[31:0] := F_2;

4-624

Vol. 2B

SHA256RNDS2-Perform Two Rounds of SHA256 Operation

INSTRUCTION SET REFERENCE, M-U

SHA256MSG1-Perform an Intermediate Calculation for the Next Four SHA256 Message

Dwords

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 38 CC /r

V/V

SHA

Performs an intermediate calculation for the next four SHA256

SHA256MSG1 xmm1,

message dwords using previous message dwords from xmm1 and

xmm2/m128

xmm2/m128, storing the result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

The SHA256MSG1 instruction is one of two SHA256 message scheduling instructions. The instruction performs an

intermediate calculation for the next four SHA256 message dwords.

Operation

SHA256MSG1

W4 := SRC2[31: 0] ;

W3 := SRC1[127:96] ;

W2 := SRC1[95:64] ;

W1 := SRC1[63: 32] ;

W0 := SRC1[31: 0] ;

DEST[127:96] := W3 + σ₀( W4);

DEST[95:64] := W2 + σ₀( W3);

DEST[63:32] := W1 + σ₀( W2);

DEST[31:0] := W0 + σ₀( W1);

Intel C/C++ Compiler Intrinsic Equivalent

SHA256MSG1 __m128i _mm_sha256msg1_epu32(__m128i, __m128i);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

4-626

Vol. 2B

SHA256MSG1-Perform an Intermediate Calculation for the Next Four SHA256 Message Dwords

INSTRUCTION SET REFERENCE, M-U

SHA256MSG2-Perform a Final Calculation for the Next Four SHA256 Message Dwords

Opcode/

Op/En

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 38 CD /r

V/V

SHA

Performs the final calculation for the next four SHA256 message

SHA256MSG2 xmm1,

dwords using previous message dwords from xmm1 and

xmm2/m128

xmm2/m128, storing the result in xmm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

The SHA256MSG2 instruction is one of two SHA2 message scheduling instructions. The instruction performs the

final calculation for the next four SHA256 message dwords.

Operation

SHA256MSG2

W14 := SRC2[95:64] ;

W15 := SRC2[127:96] ;

W16 := SRC1[31: 0] + σ₁( W14) ;

W17 := SRC1[63: 32] + σ₁( W15) ;

W18 := SRC1[95: 64] + σ₁( W16) ;

W19 := SRC1[127: 96] + σ₁( W17) ;

DEST[127:96] := W19 ;

DEST[95:64] := W18 ;

DEST[63:32] := W17 ;

DEST[31:0] := W16;

Intel C/C++ Compiler Intrinsic Equivalent

SHA256MSG2 __m128i _mm_sha256msg2_epu32(__m128i, __m128i);

Flags Affected

None.

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions.”

SHA256MSG2-Perform a Final Calculation for the Next Four SHA256 Message Dwords

Vol. 2B

4-627

INSTRUCTION SET REFERENCE, M-U

SHLD-Double Precision Shift Left

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F A4 /r ib

SHLD r/m16, r16, imm8

MRI

Valid

Shift r/m16 to left imm8 places while shifting

bits from r16 in from the right.

0F A5 /r

SHLD r/m16, r16, CL

MRC

Valid

Shift r/m16 to left CL places while shifting bits

from r16 in from the right.

0F A4 /r ib

SHLD r/m32, r32, imm8

MRI

Valid

Shift r/m32 to left imm8 places while shifting

bits from r32 in from the right.

REX.W + 0F A4 /r ib

SHLD r/m64, r64, imm8

MRI

Valid

N.E.

Shift r/m64 to left imm8 places while shifting

bits from r64 in from the right.

0F A5 /r

SHLD r/m32, r32, CL

MRC

Valid

Shift r/m32 to left CL places while shifting bits

from r32 in from the right.

REX.W + 0F A5 /r

SHLD r/m64, r64, CL

MRC

Valid

N.E.

Shift r/m64 to left CL places while shifting bits

from r64 in from the right.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MRI

ModRM:r/m (w)

ModRM:reg (r)

imm8

N/A

MRC

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

The SHLD instruction is used for multi-precision shifts of 64 bits or more.

The instruction shifts the first operand (destination operand) to the left the number of bits specified by the third

operand (count operand). The second operand (source operand) provides bits to shift in from the right (starting

with bit 0 of the destination operand).

The destination operand can be a register or a memory location; the source operand is a register. The count

operand is an unsigned integer that can be stored in an immediate byte or in the CL register. If the count operand

is CL, the shift count is the logical AND of CL and a count mask. In non-64-bit modes and default 64-bit mode; only

bits 0 through 4 of the count are used. This masks the count to a value between 0 and 31. If a count is greater than

the operand size, the result is undefined.

If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand. For a 1-bit

shift, the OF flag is set if a sign change occurred; otherwise, it is cleared. If the count operand is 0, flags are not

affected.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits

(upgrading the count mask to 6 bits). See the summary chart at the beginning of this section for encoding data and

limits.

Operation

IF (In 64-Bit Mode and REX.W = 1)

THEN COUNT := COUNT MOD 64;

ELSE COUNT := COUNT MOD 32;

SIZE := OperandSize;

IF COUNT = 0

THEN

No operation;

ELSE

4-628

Vol. 2B

SHLD-Double Precision Shift Left

INSTRUCTION SET REFERENCE, M-U

IF COUNT > SIZE

THEN (* Bad parameters *)

DEST is undefined;

CF, OF, SF, ZF, AF, PF are undefined;

ELSE (* Perform the shift *)

CF := BIT[DEST, SIZE - COUNT];

(* Last bit shifted out on exit *)

FOR i := SIZE - 1 DOWN TO COUNT

Bit(DEST, i) := Bit(DEST, i - COUNT);

OD;

FOR i := COUNT - 1 DOWN TO 0

BIT[DEST, i] := BIT[SRC, i - COUNT + SIZE];

OD;

FI;

Flags Affected

If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand and the SF,

ZF, and PF flags are set according to the value of the result. For a 1-bit shift, the OF flag is set if a sign change

occurred; otherwise, it is cleared. For shifts greater than 1 bit, the OF flag is undefined. If a shift occurs, the AF flag

is undefined. If the count operand is 0, the flags are not affected. If the count is greater than the operand size, the

flags are undefined.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

SHLD-Double Precision Shift Left

Vol. 2B

4-629

INSTRUCTION SET REFERENCE, M-U

SHRD-Double Precision Shift Right

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F AC /r ib

SHRD r/m16, r16, imm8

MRI

Valid

Shift r/m16 to right imm8 places while

shifting bits from r16 in from the left.

0F AD /r

SHRD r/m16, r16, CL

MRC

Valid

Shift r/m16 to right CL places while shifting

bits from r16 in from the left.

0F AC /r ib

SHRD r/m32, r32, imm8

MRI

Valid

Shift r/m32 to right imm8 places while

shifting bits from r32 in from the left.

REX.W + 0F AC /r ib

SHRD r/m64, r64, imm8

MRI

Valid

N.E.

Shift r/m64 to right imm8 places while

shifting bits from r64 in from the left.

0F AD /r

SHRD r/m32, r32, CL

MRC

Valid

Shift r/m32 to right CL places while shifting

bits from r32 in from the left.

REX.W + 0F AD /r

SHRD r/m64, r64, CL

MRC

Valid

N.E.

Shift r/m64 to right CL places while shifting

bits from r64 in from the left.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MRI

ModRM:r/m (w)

ModRM:reg (r)

imm8

N/A

MRC

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

The SHRD instruction is useful for multi-precision shifts of 64 bits or more.

The instruction shifts the first operand (destination operand) to the right the number of bits specified by the third

operand (count operand). The second operand (source operand) provides bits to shift in from the left (starting with

the most significant bit of the destination operand).

The destination operand can be a register or a memory location; the source operand is a register. The count

operand is an unsigned integer that can be stored in an immediate byte or the CL register. If the count operand is

CL, the shift count is the logical AND of CL and a count mask. In non-64-bit modes and default 64-bit mode, the

width of the count mask is 5 bits. Only bits 0 through 4 of the count register are used (masking the count to a value

between 0 and 31). If the count is greater than the operand size, the result is undefined.

If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand. For a 1-bit

shift, the OF flag is set if a sign change occurred; otherwise, it is cleared. If the count operand is 0, flags are not

affected.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits

(upgrading the count mask to 6 bits). See the summary chart at the beginning of this section for encoding data and

limits.

Operation

IF (In 64-Bit Mode and REX.W = 1)

THEN COUNT := COUNT MOD 64;

ELSE COUNT := COUNT MOD 32;

SIZE := OperandSize;

IF COUNT = 0

THEN

No operation;

ELSE

SHRD-Double Precision Shift Right

Vol. 2B

4-631

INSTRUCTION SET REFERENCE, M-U

IF COUNT > SIZE

THEN (* Bad parameters *)

DEST is undefined;

CF, OF, SF, ZF, AF, PF are undefined;

ELSE (* Perform the shift *)

CF := BIT[DEST, COUNT - 1]; (* Last bit shifted out on exit *)

FOR i := 0 TO SIZE - 1 - COUNT

BIT[DEST, i] := BIT[DEST, i + COUNT];

OD;

FOR i := SIZE - COUNT TO SIZE - 1

BIT[DEST,i] := BIT[SRC, i + COUNT - SIZE];

OD;

FI;

Flags Affected

If the count is 1 or greater, the CF flag is filled with the last bit shifted out of the destination operand and the SF, ZF,

and PF flags are set according to the value of the result. For a 1-bit shift, the OF flag is set if a sign change occurred;

otherwise, it is cleared. For shifts greater than 1 bit, the OF flag is undefined. If a shift occurs, the AF flag is unde-

fined. If the count operand is 0, the flags are not affected. If the count is greater than the operand size, the flags

are undefined.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

4-632

Vol. 2B

SHRD-Double Precision Shift Right

INSTRUCTION SET REFERENCE, M-U

SHUFPD-Packed Interleave Shuffle of Pairs of Double Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F C6 /r ib

V/V

SSE2

Shuffle two pairs of double precision floating-point

SHUFPD xmm1, xmm2/m128, imm8

values from xmm1 and xmm2/m128 using imm8 to

select from each pair, interleaved result is stored in

xmm1.

VEX.128.66.0F.WIG C6 /r ib

V/V

AVX

Shuffle two pairs of double precision floating-point

VSHUFPD xmm1, xmm2, xmm3/m128,

values from xmm2 and xmm3/m128 using imm8 to

imm8

select from each pair, interleaved result is stored in

xmm1.

VEX.256.66.0F.WIG C6 /r ib

V/V

AVX

Shuffle four pairs of double precision floating-point

VSHUFPD ymm1, ymm2, ymm3/m256,

values from ymm2 and ymm3/m256 using imm8 to

imm8

select from each pair, interleaved result is stored in

xmm1.

EVEX.128.66.0F.W1 C6 /r ib

V/V

AVX512VL

Shuffle two pairs of double precision floating-point

VSHUFPD xmm1{k1}{z}, xmm2,

AVX512F

values from xmm2 and xmm3/m128/m64bcst using

xmm3/m128/m64bcst, imm8

imm8 to select from each pair. store interleaved

results in xmm1 subject to writemask k1.

EVEX.256.66.0F.W1 C6 /r ib

V/V

AVX512VL

Shuffle four pairs of double precision floating-point

VSHUFPD ymm1{k1}{z}, ymm2,

AVX512F

values from ymm2 and ymm3/m256/m64bcst using

ymm3/m256/m64bcst, imm8

imm8 to select from each pair. store interleaved

results in ymm1 subject to writemask k1.

EVEX.512.66.0F.W1 C6 /r ib

V/V

AVX512F

Shuffle eight pairs of double precision floating-point

VSHUFPD zmm1{k1}{z}, zmm2,

values from zmm2 and zmm3/m512/m64bcst using

zmm3/m512/m64bcst, imm8

imm8 to select from each pair. store interleaved

results in zmm1 subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

imm8

Description

Selects a double precision floating-point value of an input pair using a bit control and move to a designated element

of the destination operand. The low-to-high order of double precision element of the destination operand is inter-

leaved between the first source operand and the second source operand at the granularity of input pair of 128 bits.

Each bit in the imm8 byte, starting from bit 0, is the select control of the corresponding element of the destination

to received the shuffled result of an input pair.

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be

a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a

64-bit memory location The destination operand is a ZMM/YMM/XMM register updated according to the writemask.

The select controls are the lower 8/4/2 bits of the imm8 byte.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

of the imm8 byte, imm8[7:4) are ignored.

VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM

4-634

Vol. 2B

SHUFPD-Packed Interleave Shuffle of Pairs of Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

the corresponding ZMM register destination are zeroed. The select controls are the bit 1:0 of the imm8 byte,

imm8[7:2) are ignored.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation operand and the first source operand is the same and is an XMM register. The upper bits (MAXVL-1:128) of

the corresponding ZMM register destination are unmodified. The select controls are the bit 1:0 of the imm8 byte,

imm8[7:2) are ignored.

SRC1

SRC2

DEST

Y2 or Y3

X2 or X3

Y0 or Y1

X0 or X1

Figure 4-25. 256-bit VSHUFPD Operation of Four Pairs of Double Precision Floating-Point Values

Operation

VSHUFPD (EVEX Encoded Versions When SRC2 is a Vector Register)

(KL, VL) = (2, 128), (4, 256), (8, 512)

IF IMM0[0] = 0

THEN TMP_DEST[63:0] := SRC1[63:0]

ELSE TMP_DEST[63:0] := SRC1[127:64] FI;

IF IMM0[1] = 0

THEN TMP_DEST[127:64] := SRC2[63:0]

ELSE TMP_DEST[127:64] := SRC2[127:64] FI;

IF VL >= 256

IF IMM0[2] = 0

THEN TMP_DEST[191:128] := SRC1[191:128]

ELSE TMP_DEST[191:128] := SRC1[255:192] FI;

IF IMM0[3] = 0

THEN TMP_DEST[255:192] := SRC2[191:128]

ELSE TMP_DEST[255:192] := SRC2[255:192] FI;

FI;

IF VL >= 512

IF IMM0[4] = 0

THEN TMP_DEST[319:256] := SRC1[319:256]

ELSE TMP_DEST[319:256] := SRC1[383:320] FI;

IF IMM0[5] = 0

THEN TMP_DEST[383:320] := SRC2[319:256]

ELSE TMP_DEST[383:320] := SRC2[383:320] FI;

IF IMM0[6] = 0

THEN TMP_DEST[447:384] := SRC1[447:384]

ELSE TMP_DEST[447:384] := SRC1[511:448] FI;

IF IMM0[7] = 0

THEN TMP_DEST[511:448] := SRC2[447:384]

ELSE TMP_DEST[511:448] := SRC2[511:448] FI;

FI;

FOR j := 0 TO KL-1

i := j * 64

SHUFPD-Packed Interleave Shuffle of Pairs of Double Precision Floating-Point Values

Vol. 2B

4-635

INSTRUCTION SET REFERENCE, M-U

IF k1[j] OR *no writemask*

THEN DEST[i+63:i] := TMP_DEST[i+63:i]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+63:i] remains unchanged*

ELSE *zeroing-masking*

; zeroing-masking

DEST[i+63:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VSHUFPD (EVEX Encoded Versions When SRC2 is Memory)

(KL, VL) = (2, 128), (4, 256), (8, 512)

FOR j := 0 TO KL-1

i := j * 64

IF (EVEX.b = 1)

THEN TMP_SRC2[i+63:i] := SRC2[63:0]

ELSE TMP_SRC2[i+63:i] := SRC2[i+63:i]

FI;

ENDFOR;

IF IMM0[0] = 0

THEN TMP_DEST[63:0] := SRC1[63:0]

ELSE TMP_DEST[63:0] := SRC1[127:64] FI;

IF IMM0[1] = 0

THEN TMP_DEST[127:64] := TMP_SRC2[63:0]

ELSE TMP_DEST[127:64] := TMP_SRC2[127:64] FI;

IF VL >= 256

IF IMM0[2] = 0

THEN TMP_DEST[191:128] := SRC1[191:128]

ELSE TMP_DEST[191:128] := SRC1[255:192] FI;

IF IMM0[3] = 0

THEN TMP_DEST[255:192] := TMP_SRC2[191:128]

ELSE TMP_DEST[255:192] := TMP_SRC2[255:192] FI;

FI;

IF VL >= 512

IF IMM0[4] = 0

THEN TMP_DEST[319:256] := SRC1[319:256]

ELSE TMP_DEST[319:256] := SRC1[383:320] FI;

IF IMM0[5] = 0

THEN TMP_DEST[383:320] := TMP_SRC2[319:256]

ELSE TMP_DEST[383:320] := TMP_SRC2[383:320] FI;

IF IMM0[6] = 0

THEN TMP_DEST[447:384] := SRC1[447:384]

ELSE TMP_DEST[447:384] := SRC1[511:448] FI;

IF IMM0[7] = 0

THEN TMP_DEST[511:448] := TMP_SRC2[447:384]

ELSE TMP_DEST[511:448] := TMP_SRC2[511:448] FI;

FI;

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask*

THEN DEST[i+63:i] := TMP_DEST[i+63:i]

4-636

Vol. 2B

SHUFPD-Packed Interleave Shuffle of Pairs of Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+63:i] remains unchanged*

ELSE *zeroing-masking*

; zeroing-masking

DEST[i+63:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VSHUFPD (VEX.256 Encoded Version)

IF IMM0[0] = 0

THEN DEST[63:0] := SRC1[63:0]

ELSE DEST[63:0] := SRC1[127:64] FI;

IF IMM0[1] = 0

THEN DEST[127:64] := SRC2[63:0]

ELSE DEST[127:64] := SRC2[127:64] FI;

IF IMM0[2] = 0

THEN DEST[191:128] := SRC1[191:128]

ELSE DEST[191:128] := SRC1[255:192] FI;

IF IMM0[3] = 0

THEN DEST[255:192] := SRC2[191:128]

ELSE DEST[255:192] := SRC2[255:192] FI;

DEST[MAXVL-1:256] (Unmodified)

VSHUFPD (VEX.128 Encoded Version)

IF IMM0[0] = 0

THEN DEST[63:0] := SRC1[63:0]

ELSE DEST[63:0] := SRC1[127:64] FI;

IF IMM0[1] = 0

THEN DEST[127:64] := SRC2[63:0]

ELSE DEST[127:64] := SRC2[127:64] FI;

DEST[MAXVL-1:128] := 0

VSHUFPD (128-bit Legacy SSE Version)

IF IMM0[0] = 0

THEN DEST[63:0] := SRC1[63:0]

ELSE DEST[63:0] := SRC1[127:64] FI;

IF IMM0[1] = 0

THEN DEST[127:64] := SRC2[63:0]

ELSE DEST[127:64] := SRC2[127:64] FI;

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSHUFPD __m512d _mm512_shuffle_pd(__m512d a, __m512d b, int imm);

VSHUFPD __m512d _mm512_mask_shuffle_pd(__m512d s, __mmask8 k, __m512d a, __m512d b, int imm);

VSHUFPD __m512d _mm512_maskz_shuffle_pd( __mmask8 k, __m512d a, __m512d b, int imm);

VSHUFPD __m256d _mm256_shuffle_pd (__m256d a, __m256d b, const int select);

VSHUFPD __m256d _mm256_mask_shuffle_pd(__m256d s, __mmask8 k, __m256d a, __m256d b, int imm);

VSHUFPD __m256d _mm256_maskz_shuffle_pd( __mmask8 k, __m256d a, __m256d b, int imm);

SHUFPD __m128d _mm_shuffle_pd (__m128d a, __m128d b, const int select);

VSHUFPD __m128d _mm_mask_shuffle_pd(__m128d s, __mmask8 k, __m128d a, __m128d b, int imm);

VSHUFPD __m128d _mm_maskz_shuffle_pd( __mmask8 k, __m128d a, __m128d b, int imm);

SHUFPD-Packed Interleave Shuffle of Pairs of Double Precision Floating-Point Values

Vol. 2B

4-637

INSTRUCTION SET REFERENCE, M-U

SHUFPS-Packed Interleave Shuffle of Quadruplets of Single Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F C6 /r ib

V/V

SSE

Select from quadruplet of single precision floating-point

SHUFPS xmm1, xmm3/m128, imm8

values in xmm1 and xmm2/m128 using imm8,

interleaved result pairs are stored in xmm1.

VEX.128.0F.WIG C6 /r ib

V/V

AVX

Select from quadruplet of single precision floating-point

VSHUFPS xmm1, xmm2, xmm3/m128,

values in xmm1 and xmm2/m128 using imm8,

imm8

interleaved result pairs are stored in xmm1.

VEX.256.0F.WIG C6 /r ib

V/V

AVX

Select from quadruplet of single precision floating-point

VSHUFPS ymm1, ymm2, ymm3/m256,

values in ymm2 and ymm3/m256 using imm8,

imm8

interleaved result pairs are stored in ymm1.

EVEX.128.0F.W0 C6 /r ib

V/V

AVX512VL

Select from quadruplet of single precision floating-point

VSHUFPS xmm1{k1}{z}, xmm2,

AVX512F

values in xmm1 and xmm2/m128 using imm8,

xmm3/m128/m32bcst, imm8

interleaved result pairs are stored in xmm1, subject to

writemask k1.

EVEX.256.0F.W0 C6 /r ib

V/V

AVX512VL

Select from quadruplet of single precision floating-point

VSHUFPS ymm1{k1}{z}, ymm2,

AVX512F

values in ymm2 and ymm3/m256 using imm8,

ymm3/m256/m32bcst, imm8

interleaved result pairs are stored in ymm1, subject to

writemask k1.

EVEX.512.0F.W0 C6 /r ib

V/V

AVX512F

Select from quadruplet of single precision floating-point

VSHUFPS zmm1{k1}{z}, zmm2,

values in zmm2 and zmm3/m512 using imm8,

zmm3/m512/m32bcst, imm8

interleaved result pairs are stored in zmm1, subject to

writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

imm8

Description

Selects a single precision floating-point value of an input quadruplet using a two-bit control and move to a desig-

nated element of the destination operand. Each 64-bit element-pair of a 128-bit lane of the destination operand is

interleaved between the corresponding lane of the first source operand and the second source operand at the gran-

ularity 128 bits. Each two bits in the imm8 byte, starting from bit 0, is the select control of the corresponding

element of a 128-bit lane of the destination to received the shuffled result of an input quadruplet. The two lower

elements of a 128-bit lane in the destination receives shuffle results from the quadruple of the first source operand.

The next two elements of the destination receives shuffle results from the quadruple of the second source operand.

EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be

a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a

32-bit memory location. The destination operand is a ZMM/YMM/XMM register updated according to the writemask.

imm8[7:0] provides 4 select controls for each applicable 128-bit lane of the destination.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

controls for the high and low 128-bit of the destination.

VEX.128 encoded version: The first source operand is a XMM register. The second source operand can be a XMM

the corresponding ZMM register destination are zeroed. Imm8[7:0] provides 4 select controls for each element of

the destination.

SHUFPS-Packed Interleave Shuffle of Quadruplets of Single Precision Floating-Point Values

Vol. 2B

4-639

INSTRUCTION SET REFERENCE, M-U

128-bit Legacy SSE version: The source can be an XMM register or an 128-bit memory location. The destination is

not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding ZMM

SRC1

SRC2

DEST

Y7 .. Y4

X7 .. X4

Y3 ..Y0

X3 .. X0

Figure 4-26. 256-bit VSHUFPS Operation of Selection from Input Quadruplet and Pair-wise Interleaved Result

Operation

Select4(SRC, control) {

CASE (control[1:0]) OF

0: TMP := SRC[31:0];

1: TMP := SRC[63:32];

2: TMP := SRC[95:64];

3: TMP := SRC[127:96];

ESAC;

RETURN TMP

}

VPSHUFPS (EVEX Encoded Versions When SRC2 is a Vector Register)

(KL, VL) = (4, 128), (8, 256), (16, 512)

TMP_DEST[31:0] := Select4(SRC1[127:0], imm8[1:0]);

TMP_DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]);

TMP_DEST[95:64] := Select4(SRC2[127:0], imm8[5:4]);

TMP_DEST[127:96] := Select4(SRC2[127:0], imm8[7:6]);

IF VL >= 256

TMP_DEST[159:128] := Select4(SRC1[255:128], imm8[1:0]);

TMP_DEST[191:160] := Select4(SRC1[255:128], imm8[3:2]);

TMP_DEST[223:192] := Select4(SRC2[255:128], imm8[5:4]);

TMP_DEST[255:224] := Select4(SRC2[255:128], imm8[7:6]);

FI;

IF VL >= 512

TMP_DEST[287:256] := Select4(SRC1[383:256], imm8[1:0]);

TMP_DEST[319:288] := Select4(SRC1[383:256], imm8[3:2]);

TMP_DEST[351:320] := Select4(SRC2[383:256], imm8[5:4]);

TMP_DEST[383:352] := Select4(SRC2[383:256], imm8[7:6]);

TMP_DEST[415:384] := Select4(SRC1[511:384], imm8[1:0]);

TMP_DEST[447:416] := Select4(SRC1[511:384], imm8[3:2]);

TMP_DEST[479:448] := Select4(SRC2[511:384], imm8[5:4]);

TMP_DEST[511:480] := Select4(SRC2[511:384], imm8[7:6]);

FI;

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask*

4-640

Vol. 2B

SHUFPS-Packed Interleave Shuffle of Quadruplets of Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

THEN DEST[i+31:i] := TMP_DEST[i+31:i]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+31:i] remains unchanged*

ELSE *zeroing-masking*

; zeroing-masking

DEST[i+31:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VPSHUFPS (EVEX Encoded Versions When SRC2 is Memory)

(KL, VL) = (4, 128), (8, 256), (16, 512)

FOR j := 0 TO KL-1

i := j * 32

IF (EVEX.b = 1)

THEN TMP_SRC2[i+31:i] := SRC2[31:0]

ELSE TMP_SRC2[i+31:i] := SRC2[i+31:i]

FI;

ENDFOR;

TMP_DEST[31:0] := Select4(SRC1[127:0], imm8[1:0]);

TMP_DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]);

TMP_DEST[95:64] := Select4(TMP_SRC2[127:0], imm8[5:4]);

TMP_DEST[127:96] := Select4(TMP_SRC2[127:0], imm8[7:6]);

IF VL >= 256

TMP_DEST[159:128] := Select4(SRC1[255:128], imm8[1:0]);

TMP_DEST[191:160] := Select4(SRC1[255:128], imm8[3:2]);

TMP_DEST[223:192] := Select4(TMP_SRC2[255:128], imm8[5:4]);

TMP_DEST[255:224] := Select4(TMP_SRC2[255:128], imm8[7:6]);

FI;

IF VL >= 512

TMP_DEST[287:256] := Select4(SRC1[383:256], imm8[1:0]);

TMP_DEST[319:288] := Select4(SRC1[383:256], imm8[3:2]);

TMP_DEST[351:320] := Select4(TMP_SRC2[383:256], imm8[5:4]);

TMP_DEST[383:352] := Select4(TMP_SRC2[383:256], imm8[7:6]);

TMP_DEST[415:384] := Select4(SRC1[511:384], imm8[1:0]);

TMP_DEST[447:416] := Select4(SRC1[511:384], imm8[3:2]);

TMP_DEST[479:448] := Select4(TMP_SRC2[511:384], imm8[5:4]);

TMP_DEST[511:480] := Select4(TMP_SRC2[511:384], imm8[7:6]);

FI;

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask*

THEN DEST[i+31:i] := TMP_DEST[i+31:i]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+31:i] remains unchanged*

ELSE *zeroing-masking*

; zeroing-masking

DEST[i+31:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

SHUFPS-Packed Interleave Shuffle of Quadruplets of Single Precision Floating-Point Values

Vol. 2B

4-641

INSTRUCTION SET REFERENCE, M-U

VSHUFPS (VEX.256 Encoded Version)

DEST[31:0] := Select4(SRC1[127:0], imm8[1:0]);

DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]);

DEST[95:64] := Select4(SRC2[127:0], imm8[5:4]);

DEST[127:96] := Select4(SRC2[127:0], imm8[7:6]);

DEST[159:128] := Select4(SRC1[255:128], imm8[1:0]);

DEST[191:160] := Select4(SRC1[255:128], imm8[3:2]);

DEST[223:192] := Select4(SRC2[255:128], imm8[5:4]);

DEST[255:224] := Select4(SRC2[255:128], imm8[7:6]);

DEST[MAXVL-1:256] := 0

VSHUFPS (VEX.128 Encoded Version)

DEST[31:0] := Select4(SRC1[127:0], imm8[1:0]);

DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]);

DEST[95:64] := Select4(SRC2[127:0], imm8[5:4]);

DEST[127:96] := Select4(SRC2[127:0], imm8[7:6]);

DEST[MAXVL-1:128] := 0

SHUFPS (128-bit Legacy SSE Version)

DEST[31:0] := Select4(SRC1[127:0], imm8[1:0]);

DEST[63:32] := Select4(SRC1[127:0], imm8[3:2]);

DEST[95:64] := Select4(SRC2[127:0], imm8[5:4]);

DEST[127:96] := Select4(SRC2[127:0], imm8[7:6]);

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSHUFPS __m512 _mm512_shuffle_ps(__m512 a, __m512 b, int imm);

VSHUFPS __m512 _mm512_mask_shuffle_ps(__m512 s, __mmask16 k, __m512 a, __m512 b, int imm);

VSHUFPS __m512 _mm512_maskz_shuffle_ps(__mmask16 k, __m512 a, __m512 b, int imm);

VSHUFPS __m256 _mm256_shuffle_ps (__m256 a, __m256 b, const int select);

VSHUFPS __m256 _mm256_mask_shuffle_ps(__m256 s, __mmask8 k, __m256 a, __m256 b, int imm);

VSHUFPS __m256 _mm256_maskz_shuffle_ps(__mmask8 k, __m256 a, __m256 b, int imm);

SHUFPS __m128 _mm_shuffle_ps (__m128 a, __m128 b, const int select);

VSHUFPS __m128 _mm_mask_shuffle_ps(__m128 s, __mmask8 k, __m128 a, __m128 b, int imm);

VSHUFPS __m128 _mm_maskz_shuffle_ps(__mmask8 k, __m128 a, __m128 b, int imm);

SIMD Floating-Point Exceptions

None.

Other Exceptions

Non-EVEX-encoded instruction, see Table 2-21, “Type 4 Class Exception Conditions.”

EVEX-encoded instruction, see Table 2-50, “Type E4NF Class Exception Conditions.”

4-642

Vol. 2B

SHUFPS-Packed Interleave Shuffle of Quadruplets of Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

SIDT-Store Interrupt Descriptor Table Register

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 /1

SIDT m

Valid

Store IDTR to m.

NOTES:

1. See the IA-32 Architecture Compatibility section below.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the content the interrupt descriptor table register (IDTR) in the destination operand. The destination

operand specifies a 6-byte memory location.

In non-64-bit modes, the 16-bit limit field of the register is stored in the low 2 bytes of the memory location and

the 32-bit base address is stored in the high 4 bytes.

In 64-bit mode, the operand size fixed at 8+2 bytes. The instruction stores 8-byte base and 2-byte limit values.

SIDT is only useful in operating-system software; however, it can be used in application programs without causing

an exception to be generated if CR4.UMIP = 0. See “LGDT/LIDT-Load Global/Interrupt Descriptor Table Register”

in Chapter 3, Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A, for information on

loading the GDTR and IDTR.

IA-32 Architecture Compatibility

The 16-bit form of SIDT is compatible with the Intel 286 processor if the upper 8 bits are not referenced. The Intel

286 processor fills these bits with 1s; processor generations later than the Intel 286 processor fill these bits with

0s.

Operation

IF instruction is SIDT

THEN

IF OperandSize =16 or OperandSize = 32 (* Legacy or Compatibility Mode *)

THEN

DEST[0:15] := IDTR(Limit);

DEST[16:47] := IDTR(Base); FI; (* Full 32-bit base address stored *)

ELSE (* 64-bit Mode *)

DEST[0:15] := IDTR(Limit);

DEST[16:79] := IDTR(Base); (* Full 64-bit base address stored *)

FI;

Flags Affected

None.

SIDT-Store Interrupt Descriptor Table Register

Vol. 2B

4-643

INSTRUCTION SET REFERENCE, M-U

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If CR4.UMIP = 1 and CPL > 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If CR4.UMIP = 1.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#UD

If the LOCK prefix is used.

#GP(0)

If the memory address is in a non-canonical form.

If CR4.UMIP = 1 and CPL > 0.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

4-644

Vol. 2B

SIDT-Store Interrupt Descriptor Table Register

INSTRUCTION SET REFERENCE, M-U

SLDT-Store Local Descriptor Table Register

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 00 /0

SLDT r/m16

Valid

Stores segment selector from LDTR in r/m16.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the segment selector from the local descriptor table register (LDTR) in the destination operand. The desti-

nation operand can be a general-purpose register or a memory location. The segment selector stored with this

instruction points to the segment descriptor (located in the GDT) for the current LDT. This instruction can only be

executed in protected mode.

Outside IA-32e mode, when the destination operand is a 32-bit register, the 16-bit segment selector is copied into

the low-order 16 bits of the register. The high-order 16 bits of the register are cleared for the Pentium 4, Intel Xeon,

and P6 family processors. They are undefined for Pentium, Intel486, and Intel386 processors. When the destina-

tion operand is a memory location, the segment selector is written to memory as a 16-bit quantity, regardless of

the operand size.

In compatibility mode, when the destination operand is a 32-bit register, the 16-bit segment selector is copied into

the low-order 16 bits of the register. The high-order 16 bits of the register are cleared. When the destination

operand is a memory location, the segment selector is written to memory as a 16-bit quantity, regardless of the

operand size.

In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). The

behavior of SLDT with a 64-bit register is to zero-extend the 16-bit selector and store it in the register. If the desti-

nation is memory and operand size is 64, SLDT will write the 16-bit selector to memory as a 16-bit quantity,

regardless of the operand size.

Operation

DEST := LDTR(SegmentSelector);

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If CR4.UMIP = 1 and CPL > 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

The SLDT instruction is not recognized in real-address mode.

SLDT-Store Local Descriptor Table Register

Vol. 2B

4-645

INSTRUCTION SET REFERENCE, M-U

SMSW-Store Machine Status Word

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 /4

SMSW r/m16

Valid

Store machine status word to r/m16.

0F 01 /4

SMSW r32/m16

Valid

Store machine status word in low-order 16

bits of r32/m16; high-order 16 bits of r32 are

undefined.

REX.W + 0F 01 /4

SMSW r64/m16

Valid

Store machine status word in low-order 16

bits of r64/m16; high-order 16 bits of r32 are

undefined.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the machine status word (bits 0 through 15 of control register CR0) into the destination operand. The desti-

nation operand can be a general-purpose register or a memory location.

In non-64-bit modes, when the destination operand is a 32-bit register, the low-order 16 bits of register CR0 are

copied into the low-order 16 bits of the register and the high-order 16 bits are undefined. When the destination

operand is a memory location, the low-order 16 bits of register CR0 are written to memory as a 16-bit quantity,

regardless of the operand size.

In 64-bit mode, the behavior of the SMSW instruction is defined by the following examples:

• SMSW r16 operand size 16, store CR0[15:0] in r16

• SMSW r32 operand size 32, zero-extend CR0[31:0], and store in r32

• SMSW r64 operand size 64, zero-extend CR0[63:0], and store in r64

• SMSW m16 operand size 16, store CR0[15:0] in m16

• SMSW m16 operand size 32, store CR0[15:0] in m16 (not m32)

• SMSW m16 operands size 64, store CR0[15:0] in m16 (not m64)

SMSW is only useful in operating-system software. However, it is not a privileged instruction and can be used in

application programs if CR4.UMIP = 0. It is provided for compatibility with the Intel 286 processor. Programs and

procedures intended to run on IA-32 and Intel 64 processors beginning with the Intel386 processors should use the

MOV CR instruction to load the machine status word.

See “Changes to Instruction Behavior in VMX Non-Root Operation” in Chapter 26 of the Intel^® 64 and IA-32 Archi-

tectures Software Developer’s Manual, Volume 3C, for more information about the behavior of this instruction in

VMX non-root operation.

Operation

DEST := CR0[15:0];

(* Machine status word *)

Flags Affected

None.

SMSW-Store Machine Status Word

Vol. 2B

4-647

INSTRUCTION SET REFERENCE, M-U

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If CR4.UMIP = 1 and CPL > 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If CR4.UMIP = 1.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

If CR4.UMIP = 1 and CPL > 0.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

#UD

If the LOCK prefix is used.

4-648

Vol. 2B

SMSW-Store Machine Status Word

INSTRUCTION SET REFERENCE, M-U

SQRTPD-Square Root of Double Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 51 /r

V/V

SSE2

Computes Square Roots of the packed double precision

SQRTPD xmm1, xmm2/m128

floating-point values in xmm2/m128 and stores the result in

xmm1.

VEX.128.66.0F.WIG 51 /r

V/V

AVX

Computes Square Roots of the packed double precision

VSQRTPD xmm1, xmm2/m128

floating-point values in xmm2/m128 and stores the result in

xmm1.

VEX.256.66.0F.WIG 51 /r

V/V

AVX

Computes Square Roots of the packed double precision

VSQRTPD ymm1, ymm2/m256

floating-point values in ymm2/m256 and stores the result in

ymm1.

EVEX.128.66.0F.W1 51 /r

V/V

AVX512VL

Computes Square Roots of the packed double precision

VSQRTPD xmm1 {k1}{z},

AVX512F

floating-point values in xmm2/m128/m64bcst and stores

xmm2/m128/m64bcst

the result in xmm1 subject to writemask k1.

EVEX.256.66.0F.W1 51 /r

V/V

AVX512VL

Computes Square Roots of the packed double precision

VSQRTPD ymm1 {k1}{z},

AVX512F

floating-point values in ymm2/m256/m64bcst and stores

ymm2/m256/m64bcst

the result in ymm1 subject to writemask k1.

EVEX.512.66.0F.W1 51 /r

V/V

AVX512F

Computes Square Roots of the packed double precision

VSQRTPD zmm1 {k1}{z},

floating-point values in zmm2/m512/m64bcst and stores

zmm2/m512/m64bcst{er}

the result in zmm1 subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Performs a SIMD computation of the square roots of the two, four or eight packed double precision floating-point

values in the source operand (the second operand) stores the packed double precision floating-point results in the

destination operand (the first operand).

EVEX encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or

a 512/256/128-bit vector broadcasted from a 64-bit memory location. The destination operand is a

ZMM/YMM/XMM register updated according to the writemask.

VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination

operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding ZMM register destination are

zeroed.

VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina-

tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are

zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina-

tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding ZMM

Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD.

SQRTPD-Square Root of Double Precision Floating-Point Values

Vol. 2B

4-649

INSTRUCTION SET REFERENCE, M-U

Operation

VSQRTPD (EVEX Encoded Versions)

(KL, VL) = (2, 128), (4, 256), (8, 512)

IF (VL = 512) AND (EVEX.b = 1) AND (SRC *is register*)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask* THEN

IF (EVEX.b = 1) AND (SRC *is memory*)

THEN DEST[i+63:i] := SQRT(SRC[63:0])

ELSE DEST[i+63:i] := SQRT(SRC[i+63:i])

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+63:i] remains unchanged*

ELSE

; zeroing-masking

DEST[i+63:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VSQRTPD (VEX.256 Encoded Version)

DEST[63:0] := SQRT(SRC[63:0])

DEST[127:64] := SQRT(SRC[127:64])

DEST[191:128] := SQRT(SRC[191:128])

DEST[255:192] := SQRT(SRC[255:192])

DEST[MAXVL-1:256] := 0

VSQRTPD (VEX.128 Encoded Version)

DEST[63:0] := SQRT(SRC[63:0])

DEST[127:64] := SQRT(SRC[127:64])

DEST[MAXVL-1:128] := 0

SQRTPD (128-bit Legacy SSE Version)

DEST[63:0] := SQRT(SRC[63:0])

DEST[127:64] := SQRT(SRC[127:64])

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSQRTPD __m512d _mm512_sqrt_round_pd(__m512d a, int r);

VSQRTPD __m512d _mm512_mask_sqrt_round_pd(__m512d s, __mmask8 k, __m512d a, int r);

VSQRTPD __m512d _mm512_maskz_sqrt_round_pd( __mmask8 k, __m512d a, int r);

VSQRTPD __m256d _mm256_sqrt_pd (__m256d a);

VSQRTPD __m256d _mm256_mask_sqrt_pd(__m256d s, __mmask8 k, __m256d a, int r);

VSQRTPD __m256d _mm256_maskz_sqrt_pd( __mmask8 k, __m256d a, int r);

SQRTPD __m128d _mm_sqrt_pd (__m128d a);

VSQRTPD __m128d _mm_mask_sqrt_pd(__m128d s, __mmask8 k, __m128d a, int r);

VSQRTPD __m128d _mm_maskz_sqrt_pd( __mmask8 k, __m128d a, int r);

4-650

Vol. 2B

SQRTPD-Square Root of Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

SQRTPS-Square Root of Single Precision Floating-Point Values

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

NP 0F 51 /r

V/V

SSE

Computes Square Roots of the packed single precision

SQRTPS xmm1, xmm2/m128

floating-point values in xmm2/m128 and stores the result in

xmm1.

VEX.128.0F.WIG 51 /r

V/V

AVX

Computes Square Roots of the packed single precision

VSQRTPS xmm1, xmm2/m128

floating-point values in xmm2/m128 and stores the result in

xmm1.

VEX.256.0F.WIG 51/r

V/V

AVX

Computes Square Roots of the packed single precision

VSQRTPS ymm1, ymm2/m256

floating-point values in ymm2/m256 and stores the result in

ymm1.

EVEX.128.0F.W0 51 /r

V/V

AVX512VL

Computes Square Roots of the packed single precision

VSQRTPS xmm1 {k1}{z},

AVX512F

floating-point values in xmm2/m128/m32bcst and stores the

xmm2/m128/m32bcst

result in xmm1 subject to writemask k1.

EVEX.256.0F.W0 51 /r

V/V

AVX512VL

Computes Square Roots of the packed single precision

VSQRTPS ymm1 {k1}{z},

AVX512F

floating-point values in ymm2/m256/m32bcst and stores the

ymm2/m256/m32bcst

result in ymm1 subject to writemask k1.

EVEX.512.0F.W0 51/r

V/V

AVX512F

Computes Square Roots of the packed single precision

VSQRTPS zmm1 {k1}{z},

floating-point values in zmm2/m512/m32bcst and stores the

zmm2/m512/m32bcst{er}

result in zmm1 subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Performs a SIMD computation of the square roots of the four, eight or sixteen packed single precision floating-point

values in the source operand (second operand) stores the packed single precision floating-point results in the desti-

nation operand.

EVEX.512 encoded versions: The source operand is a ZMM/YMM/XMM register, a 512/256/128-bit memory location

or a 512/256/128-bit vector broadcasted from a 32-bit memory location. The destination operand is a

ZMM/YMM/XMM register updated according to the writemask.

VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination

operand is a YMM register. The upper bits (MAXVL-1:256) of the corresponding ZMM register destination are

zeroed.

VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina-

tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding ZMM register destination are

zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina-

tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding ZMM

Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b otherwise instructions will #UD.

4-652

Vol. 2B

SQRTPS-Square Root of Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

Operation

VSQRTPS (EVEX Encoded Versions)

(KL, VL) = (4, 128), (8, 256), (16, 512)

IF (VL = 512) AND (EVEX.b = 1) AND (SRC *is register*)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask* THEN

IF (EVEX.b = 1) AND (SRC *is memory*)

THEN DEST[i+31:i] := SQRT(SRC[31:0])

ELSE DEST[i+31:i] := SQRT(SRC[i+31:i])

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+31:i] remains unchanged*

ELSE

; zeroing-masking

DEST[i+31:i] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VSQRTPS (VEX.256 Encoded Version)

DEST[31:0] := SQRT(SRC[31:0])

DEST[63:32] := SQRT(SRC[63:32])

DEST[95:64] := SQRT(SRC[95:64])

DEST[127:96] := SQRT(SRC[127:96])

DEST[159:128] := SQRT(SRC[159:128])

DEST[191:160] := SQRT(SRC[191:160])

DEST[223:192] := SQRT(SRC[223:192])

DEST[255:224] := SQRT(SRC[255:224])

VSQRTPS (VEX.128 Encoded Version)

DEST[31:0] := SQRT(SRC[31:0])

DEST[63:32] := SQRT(SRC[63:32])

DEST[95:64] := SQRT(SRC[95:64])

DEST[127:96] := SQRT(SRC[127:96])

DEST[MAXVL-1:128] := 0

SQRTPS (128-bit Legacy SSE Version)

DEST[31:0] := SQRT(SRC[31:0])

DEST[63:32] := SQRT(SRC[63:32])

DEST[95:64] := SQRT(SRC[95:64])

DEST[127:96] := SQRT(SRC[127:96])

DEST[MAXVL-1:128] (Unmodified)

SQRTPS-Square Root of Single Precision Floating-Point Values

Vol. 2B

4-653

INSTRUCTION SET REFERENCE, M-U

Intel C/C++ Compiler Intrinsic Equivalent

VSQRTPS __m512 _mm512_sqrt_round_ps(__m512 a, int r);

VSQRTPS __m512 _mm512_mask_sqrt_round_ps(__m512 s, __mmask16 k, __m512 a, int r);

VSQRTPS __m512 _mm512_maskz_sqrt_round_ps( __mmask16 k, __m512 a, int r);

VSQRTPS __m256 _mm256_sqrt_ps (__m256 a);

VSQRTPS __m256 _mm256_mask_sqrt_ps(__m256 s, __mmask8 k, __m256 a, int r);

VSQRTPS __m256 _mm256_maskz_sqrt_ps( __mmask8 k, __m256 a, int r);

SQRTPS __m128 _mm_sqrt_ps (__m128 a);

VSQRTPS __m128 _mm_mask_sqrt_ps(__m128 s, __mmask8 k, __m128 a, int r);

VSQRTPS __m128 _mm_maskz_sqrt_ps( __mmask8 k, __m128 a, int r);

SIMD Floating-Point Exceptions

Invalid, Precision, Denormal.

Other Exceptions

Non-EVEX-encoded instruction, see Table 2-19, “Type 2 Class Exception Conditions,” additionally:

#UD

If VEX.vvvv != 1111B.

EVEX-encoded instruction, see Table 2-46, “Type E2 Class Exception Conditions,” additionally:

#UD

If EVEX.vvvv != 1111B.

4-654

Vol. 2B

SQRTPS-Square Root of Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

SQRTSD-Compute Square Root of Scalar Double Precision Floating-Point Value

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F2 0F 51/r

V/V

SSE2

Computes square root of the low double precision floating-

SQRTSD xmm1,xmm2/m64

point value in xmm2/m64 and stores the results in xmm1.

VEX.LIG.F2.0F.WIG 51/r

V/V

AVX

Computes square root of the low double precision floating-

VSQRTSD xmm1,xmm2, xmm3/m64

point value in xmm3/m64 and stores the results in xmm1.

Also, upper double precision floating-point value

(bits[127:64]) from xmm2 is copied to xmm1[127:64].

EVEX.LLIG.F2.0F.W1 51/r

V/V

AVX512F

Computes square root of the low double precision floating-

VSQRTSD xmm1 {k1}{z}, xmm2,

point value in xmm3/m64 and stores the results in xmm1

xmm3/m64{er}

under writemask k1. Also, upper double precision floating-

point value (bits[127:64]) from xmm2 is copied to

xmm1[127:64].

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Tuple1 Scalar

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Computes the square root of the low double precision floating-point value in the second source operand and stores

the double precision floating-point result in the destination operand. The second source operand can be an XMM

128-bit Legacy SSE version: The first source operand and the destination operand are the same. The quadword at

bits 127:64 of the destination operand remains unchanged. Bits (MAXVL-1:64) of the corresponding destination

VEX.128 and EVEX encoded versions: Bits 127:64 of the destination operand are copied from the corresponding

bits of the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed.

EVEX encoded version: The low quadword element of the destination operand is updated according to the write-

mask.

Software should ensure VSQRTSD is encoded with VEX.L=0. Encoding VSQRTSD with VEX.L=1 may encounter

unpredictable behavior across different processor generations.

Operation

VSQRTSD (EVEX Encoded Version)

IF (EVEX.b = 1) AND (SRC2 *is register*)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

IF k1[0] or *no writemask*

THEN

DEST[63:0] := SQRT(SRC2[63:0])

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[63:0] remains unchanged*

ELSE

; zeroing-masking

SQRTSD-Compute Square Root of Scalar Double Precision Floating-Point Value

Vol. 2B

4-655

INSTRUCTION SET REFERENCE, M-U

THEN DEST[63:0] := 0

FI;

DEST[127:64] := SRC1[127:64]

DEST[MAXVL-1:128] := 0

VSQRTSD (VEX.128 Encoded Version)

DEST[63:0] := SQRT(SRC2[63:0])

DEST[127:64] := SRC1[127:64]

DEST[MAXVL-1:128] := 0

SQRTSD (128-bit Legacy SSE Version)

DEST[63:0] := SQRT(SRC[63:0])

DEST[MAXVL-1:64] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSQRTSD __m128d _mm_sqrt_round_sd(__m128d a, __m128d b, int r);

VSQRTSD __m128d _mm_mask_sqrt_round_sd(__m128d s, __mmask8 k, __m128d a, __m128d b, int r);

VSQRTSD __m128d _mm_maskz_sqrt_round_sd(__mmask8 k, __m128d a, __m128d b, int r);

SQRTSD __m128d _mm_sqrt_sd (__m128d a, __m128d b)

SIMD Floating-Point Exceptions

Invalid, Precision, Denormal.

Other Exceptions

Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions.”

EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions.”

4-656

Vol. 2B

SQRTSD-Compute Square Root of Scalar Double Precision Floating-Point Value

INSTRUCTION SET REFERENCE, M-U

SQRTSS-Compute Square Root of Scalar Single Precision Value

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F3 0F 51 /r

V/V

SSE

Computes square root of the low single precision floating-point

SQRTSS xmm1, xmm2/m32

value in xmm2/m32 and stores the results in xmm1.

VEX.LIG.F3.0F.WIG 51 /r

V/V

AVX

Computes square root of the low single precision floating-point

VSQRTSS xmm1, xmm2,

value in xmm3/m32 and stores the results in xmm1. Also, upper

xmm3/m32

single precision floating-point values (bits[127:32]) from xmm2

are copied to xmm1[127:32].

EVEX.LLIG.F3.0F.W0 51 /r

V/V

AVX512F

Computes square root of the low single precision floating-point

VSQRTSS xmm1 {k1}{z}, xmm2,

value in xmm3/m32 and stores the results in xmm1 under

xmm3/m32{er}

writemask k1. Also, upper single precision floating-point values

(bits[127:32]) from xmm2 are copied to xmm1[127:32].

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Tuple1 Scalar

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Computes the square root of the low single precision floating-point value in the second source operand and stores

the single precision floating-point result in the destination operand. The second source operand can be an XMM

128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL-

1:32) of the corresponding YMM destination register remain unchanged.

VEX.128 and EVEX encoded versions: Bits 127:32 of the destination operand are copied from the corresponding

bits of the first source operand. Bits (MAXVL-1:128) of the destination ZMM register are zeroed.

EVEX encoded version: The low doubleword element of the destination operand is updated according to the write-

mask.

Software should ensure VSQRTSS is encoded with VEX.L=0. Encoding VSQRTSS with VEX.L=1 may encounter

unpredictable behavior across different processor generations.

Operation

VSQRTSS (EVEX Encoded Version)

IF (EVEX.b = 1) AND (SRC2 *is register*)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

IF k1[0] or *no writemask*

THEN

DEST[31:0] := SQRT(SRC2[31:0])

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[31:0] remains unchanged*

ELSE

; zeroing-masking

DEST[31:0] := 0

FI;

SQRTSS-Compute Square Root of Scalar Single Precision Value

Vol. 2B

4-657

INSTRUCTION SET REFERENCE, M-U

FI;

DEST[127:32] := SRC1[127:32]

DEST[MAXVL-1:128] := 0

VSQRTSS (VEX.128 Encoded Version)

DEST[31:0] := SQRT(SRC2[31:0])

DEST[127:32] := SRC1[127:32]

DEST[MAXVL-1:128] := 0

SQRTSS (128-bit Legacy SSE Version)

DEST[31:0] := SQRT(SRC2[31:0])

DEST[MAXVL-1:32] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSQRTSS __m128 _mm_sqrt_round_ss(__m128 a, __m128 b, int r);

VSQRTSS __m128 _mm_mask_sqrt_round_ss(__m128 s, __mmask8 k, __m128 a, __m128 b, int r);

VSQRTSS __m128 _mm_maskz_sqrt_round_ss( __mmask8 k, __m128 a, __m128 b, int r);

SQRTSS __m128 _mm_sqrt_ss(__m128 a)

SIMD Floating-Point Exceptions

Invalid, Precision, Denormal.

Other Exceptions

Non-EVEX-encoded instruction, see Table 2-20, “Type 3 Class Exception Conditions.”

EVEX-encoded instruction, see Table 2-47, “Type E3 Class Exception Conditions.”

4-658

Vol. 2B

SQRTSS-Compute Square Root of Scalar Single Precision Value

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 38