Content      ..     64      65      66      67     ..

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 66

INSTRUCTION SET REFERENCE, A-L

ARPL—Adjust RPL Field of Segment Selector

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

63 /r

ARPL r/m16, r16

MR

N. E.

Valid

Adjust RPL of r/m16 to not less than RPL of

r16.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MR

ModRM:r/m (w)

ModRM:reg (r)

N/A

N/A

Description

Compares the RPL fields of two segment selectors. The first operand (the destination operand) contains one

segment selector and the second operand (source operand) contains the other. (The RPL field is located in bits 0

and 1 of each operand.) If the RPL field of the destination operand is less than the RPL field of the source operand,

the ZF flag is set and the RPL field of the destination operand is increased to match that of the source operand.

Otherwise, the ZF flag is cleared and no change is made to the destination operand. (The destination operand can

be a word register or a memory location; the source operand must be a word register.)

The ARPL instruction is provided for use by operating-system procedures (however, it can also be used by applica-

tions). It is generally used to adjust the RPL of a segment selector that has been passed to the operating system

by an application program to match the privilege level of the application program. Here the segment selector

passed to the operating system is placed in the destination operand and segment selector for the application

program’s code segment is placed in the source operand. (The RPL field in the source operand represents the priv-

ilege level of the application program.) Execution of the ARPL instruction then ensures that the RPL of the segment

selector received by the operating system is no lower (does not have a higher privilege) than the privilege level of

the application program (the segment selector for the application program’s code segment can be read from the

stack following a procedure call).

This instruction executes as described in compatibility mode and legacy mode. It is not encodable in 64-bit mode.

See “Checking Caller Access Privileges” in Chapter 3, “Protected-Mode Memory Management,” of the Intel® 64 and

IA-32 Architectures Software Developer’s Manual, Volume 3A, for more information about the use of this instruc-

tion.

Operation

IF 64-BIT MODE

THEN

See MOVSXD;

ELSE

IF DEST[RPL] < SRC[RPL]

THEN

ZF := 1;

DEST[RPL] := SRC[RPL];

ELSE

ZF := 0;

FI;

FI;

Flags Affected

The ZF flag is set to 1 if the RPL field of the destination operand is less than that of the source operand; otherwise,

it is set to 0.

ARPL—Adjust RPL Field of Segment Selector

Vol. 2A

3-93

INSTRUCTION SET REFERENCE, A-L

BEXTR—Bit Field Extract

Opcode/Instruction

Op/

64/32

CPUID

Description

En

-bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F7 /r

RMV

V/V

BMI1

Contiguous bitwise extract from r/m32 using r32b as control; store

BEXTR r32a, r/m32, r32b

result in r32a.

VEX.LZ.0F38.W1 F7 /r

RMV

V/N.E.

BMI1

Contiguous bitwise extract from r/m64 using r64b as control; store

BEXTR r64a, r/m64, r64b

result in r64a.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMV

ModRM:reg (w)

ModRM:r/m (r)

VEX.vvvv (r)

N/A

Description

Extracts contiguous bits from the first source operand (the second operand) using an index value and length value

specified in the second source operand (the third operand). Bit 7:0 of the second source operand specifies the

starting bit position of bit extraction. A START value exceeding the operand size will not extract any bits from the

second source operand. Bit 15:8 of the second source operand specifies the maximum number of bits (LENGTH)

beginning at the START position to extract. Only bit positions up to (OperandSize -1) of the first source operand are

extracted. The extracted bits are written to the destination register, starting from the least significant bit. All higher

order bits in the destination operand (starting at bit position LENGTH) are zeroed. The destination register is

cleared if no bits are extracted.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

START := SRC2[7:0];

LEN := SRC2[15:8];

TEMP := ZERO_EXTEND_TO_512 (SRC1 );

DEST := ZERO_EXTEND(TEMP[START+LEN -1: START]);

ZF := (DEST = 0);

Flags Affected

ZF is updated based on the result. AF, SF, and PF are undefined. All other flags are cleared.

Intel C/C++ Compiler Intrinsic Equivalent

BEXTR:

unsigned __int32 _bextr_u32(unsigned __int32 src, unsigned __int32 start. unsigned __int32 len);

BEXTR:

unsigned __int64 _bextr_u64(unsigned __int64 src, unsigned __int32 start. unsigned __int32 len);

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions”; additionally:

#UD

If VEX.W = 1.

BEXTR—Bit Field Extract

Vol. 2A

3-95

INSTRUCTION SET REFERENCE, A-L

BLENDPD—Blend Packed Double Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

En

Mode

Feature

Flag

66 0F 3A 0D /r ib

RMI

V/V

SSE4_1

Select packed double precision floating-point

values from xmm1 and xmm2/m128 from

BLENDPD xmm1, xmm2/m128, imm8

mask specified in imm8 and store the values

into xmm1.

VEX.128.66.0F3A.WIG 0D /r ib

RVMI

V/V

AVX

Select packed double precision floating-point

Values from xmm2 and xmm3/m128 from

VBLENDPD xmm1, xmm2, xmm3/m128, imm8

mask in imm8 and store the values in xmm1.

VEX.256.66.0F3A.WIG 0D /r ib

RVMI

V/V

AVX

Select packed double precision floating-point

Values from ymm2 and ymm3/m256 from

VBLENDPD ymm1, ymm2, ymm3/m256, imm8

mask in imm8 and store the values in ymm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

N/A

RVMI

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8[3:0]

Description

Double-precision floating-point values from the second source operand (third operand) are conditionally merged

with values from the first source operand (second operand) and written to the destination operand (first operand).

The immediate bits [3:0] determine whether the corresponding double precision floating-point value in the desti-

nation is copied from the second source or first source. If a bit in the mask, corresponding to a word, is ”1”, then

the double precision floating-point value in the second source operand is copied, else the value in the first source

operand is copied.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

YMM register destination are unmodified.

VEX.128 encoded version: the first source operand is an XMM register. The second source operand is an XMM

register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of

the corresponding YMM register destination are zeroed.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

register or a 256-bit memory location. The destination operand is a YMM register.

Operation

BLENDPD (128-bit Legacy SSE version)

IF (IMM8[0] = 0)THEN DEST[63:0] := DEST[63:0]

ELSE DEST [63:0] := SRC[63:0] FI

IF (IMM8[1] = 0) THEN DEST[127:64] := DEST[127:64]

ELSE DEST [127:64] := SRC[127:64] FI

DEST[MAXVL-1:128] (Unmodified)

VBLENDPD (VEX.128 encoded version)

IF (IMM8[0] = 0)THEN DEST[63:0] := SRC1[63:0]

ELSE DEST [63:0] := SRC2[63:0] FI

IF (IMM8[1] = 0) THEN DEST[127:64] := SRC1[127:64]

ELSE DEST [127:64] := SRC2[127:64] FI

DEST[MAXVL-1:128] := 0

3-96

Vol. 2A

BLENDPD—Blend Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

BLENDPS—Blend Packed Single Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

En

Mode

Feature

Flag

66 0F 3A 0C /r ib

RMI

V/V

SSE4_1

Select packed single precision floating-point

values from xmm1 and xmm2/m128 from

BLENDPS xmm1, xmm2/m128, imm8

mask specified in imm8 and store the values

into xmm1.

VEX.128.66.0F3A.WIG 0C /r ib

RVMI

V/V

AVX

Select packed single precision floating-point

values from xmm2 and xmm3/m128 from

VBLENDPS xmm1, xmm2, xmm3/m128, imm8

mask in imm8 and store the values in xmm1.

VEX.256.66.0F3A.WIG 0C /r ib

RVMI

V/V

AVX

Select packed single precision floating-point

values from ymm2 and ymm3/m256 from

VBLENDPS ymm1, ymm2, ymm3/m256, imm8

mask in imm8 and store the values in ymm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

N/A

RVMI

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8

Description

Packed single precision floating-point values from the second source operand (third operand) are conditionally

merged with values from the first source operand (second operand) and written to the destination operand (first

operand). The immediate bits [7:0] determine whether the corresponding single precision floating-point value in

the destination is copied from the second source or first source. If a bit in the mask, corresponding to a word, is “1”,

then the single precision floating-point value in the second source operand is copied, else the value in the first

source operand is copied.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

YMM register destination are unmodified.

VEX.128 encoded version: The first source operand an XMM register. The second source operand is an XMM register

or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAXVL-1:128) of the

corresponding YMM register destination are zeroed.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

register or a 256-bit memory location. The destination operand is a YMM register.

Operation

BLENDPS (128-bit Legacy SSE version)

IF (IMM8[0] = 0) THEN DEST[31:0] :=DEST[31:0]

ELSE DEST [31:0] := SRC[31:0] FI

IF (IMM8[1] = 0) THEN DEST[63:32] := DEST[63:32]

ELSE DEST [63:32] := SRC[63:32] FI

IF (IMM8[2] = 0) THEN DEST[95:64] := DEST[95:64]

ELSE DEST [95:64] := SRC[95:64] FI

IF (IMM8[3] = 0) THEN DEST[127:96] := DEST[127:96]

ELSE DEST [127:96] := SRC[127:96] FI

DEST[MAXVL-1:128] (Unmodified)

3-98

Vol. 2A

BLENDPS—Blend Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

BLENDVPD—Variable Blend Packed Double Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

En

Mode

Feature

Flag

66 0F 38 15 /r

RM0

V/V

SSE4_1

Select packed double precision floating-point

values from xmm1 and xmm2 from mask

BLENDVPD xmm1, xmm2/m128 , <XMM0>

specified in XMM0 and store the values in

xmm1.

VEX.128.66.0F3A.W0 4B /r /is4

RVMR

V/V

AVX

Conditionally copy double precision floating-

point values from xmm2 or xmm3/m128 to

VBLENDVPD xmm1, xmm2, xmm3/m128, xmm4

xmm1, based on mask bits in the mask

operand, xmm4.

VEX.256.66.0F3A.W0 4B /r /is4

RVMR

V/V

AVX

Conditionally copy double precision floating-

point values from ymm2 or ymm3/m256 to

VBLENDVPD ymm1, ymm2, ymm3/m256, ymm4

ymm1, based on mask bits in the mask

operand, ymm4.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM0

ModRM:reg (r, w)

ModRM:r/m (r)

implicit XMM0

N/A

RVMR

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8[7:4]

Description

Conditionally copy each quadword data element of double precision floating-point value from the second source

operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits

are the most significant bit in each quadword element of the mask register.

Each quadword element of the destination operand is copied from:

• the corresponding quadword element in the second source operand, if a mask bit is “1”; or

• the corresponding quadword element in the first source operand, if a mask bit is “0”

The register assignment of the implicit mask operand for BLENDVPD is defined to be the architectural register

XMM0.

128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128)

of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined

to be the architectural register XMM0. An attempt to execute BLENDVPD with a VEX prefix will cause #UD.

VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second

source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. VEX.W

must be 0, otherwise, the instruction will #UD.

VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source

operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. VEX.W must be 0, otherwise, the instruction will #UD.

VBLENDVPD permits the mask to be any XMM or YMM register. In contrast, BLENDVPD treats XMM0 implicitly as the

mask and do not support non-destructive destination operation.

3-100

Vol. 2A

BLENDVPD—Variable Blend Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

BLENDVPS—Variable Blend Packed Single Precision Floating-Point Values

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

En

Mode

Feature

Flag

66 0F 38 14 /r

RM0

V/V

SSE4_1

Select packed single precision floating-point

values from xmm1 and xmm2/m128 from

BLENDVPS xmm1, xmm2/m128, <XMM0>

mask specified in XMM0 and store the values

into xmm1.

VEX.128.66.0F3A.W0 4A /r /is4

RVMR

V/V

AVX

Conditionally copy single precision floating-

point values from xmm2 or xmm3/m128 to

VBLENDVPS xmm1, xmm2, xmm3/m128, xmm4

xmm1, based on mask bits in the specified

mask operand, xmm4.

VEX.256.66.0F3A.W0 4A /r /is4

RVMR

V/V

AVX

Conditionally copy single precision floating-

point values from ymm2 or ymm3/m256 to

VBLENDVPS ymm1, ymm2, ymm3/m256, ymm4

ymm1, based on mask bits in the specified

mask register, ymm4.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM0

ModRM:reg (r, w)

ModRM:r/m (r)

implicit XMM0

N/A

RVMR

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8[7:4]

Description

Conditionally copy each dword data element of single precision floating-point value from the second source

operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits

are the most significant bit in each dword element of the mask register.

Each quadword element of the destination operand is copied from:

• the corresponding dword element in the second source operand, if a mask bit is “1”; or

• the corresponding dword element in the first source operand, if a mask bit is “0”.

The register assignment of the implicit mask operand for BLENDVPS is defined to be the architectural register

XMM0.

128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (MAXVL-1:128)

of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined

to be the architectural register XMM0. An attempt to execute BLENDVPS with a VEX prefix will cause #UD.

VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second

source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. The upper bits (MAXVL-1:128) of the corresponding YMM register (destination register) are zeroed. VEX.W

must be 0, otherwise, the instruction will #UD.

VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source

operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and

encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is

ignored. VEX.W must be 0, otherwise, the instruction will #UD.

VBLENDVPS permits the mask to be any XMM or YMM register. In contrast, BLENDVPS treats XMM0 implicitly as the

mask and do not support non-destructive destination operation.

3-102

Vol. 2A

BLENDVPS—Variable Blend Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, A-L

BLSI—Extract Lowest Set Isolated Bit

Opcode/Instruction

Op/

64/32

CPUID

Description

En

-bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F3 /3

VM

V/V

BMI1

Extract lowest set bit from r/m32 and set that bit in r32.

BLSI r32, r/m32

VEX.LZ.0F38.W1 F3 /3

VM

V/N.E.

BMI1

Extract lowest set bit from r/m64, and set that bit in r64.

BLSI r64, r/m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

VM

VEX.vvvv (w)

ModRM:r/m (r)

N/A

N/A

Description

Extracts the lowest set bit from the source operand and set the corresponding bit in the destination register. All

other bits in the destination operand are zeroed. If no bits are set in the source operand, BLSI sets all the bits in

the destination to 0 and sets ZF and CF.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

temp := (-SRC) bitwiseAND (SRC);

SF := temp[OperandSize -1];

ZF := (temp = 0);

IF SRC = 0

CF := 0;

ELSE

CF := 1;

FI

DEST := temp;

Flags Affected

ZF and SF are updated based on the result. CF is set if the source is not zero. OF flags are cleared. AF and PF

flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BLSI:

unsigned __int32 _blsi_u32(unsigned __int32 src);

BLSI:

unsigned __int64 _blsi_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions”.

BLSI—Extract Lowest Set Isolated Bit

Vol. 2A

3-105

INSTRUCTION SET REFERENCE, A-L

BLSMSK—Get Mask Up to Lowest Set Bit

Opcode/Instruction

Op/

64/32

CPUID

Description

En

-bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F3 /2

VM

V/V

BMI1

Set all lower bits in r32 to “1” starting from bit 0 to lowest set bit in

BLSMSK r32, r/m32

r/m32.

VEX.LZ.0F38.W1 F3 /2

VM

V/N.E.

BMI1

Set all lower bits in r64 to “1” starting from bit 0 to lowest set bit in

BLSMSK r64, r/m64

r/m64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

VM

VEX.vvvv (w)

ModRM:r/m (r)

N/A

N/A

Description

Sets all the lower bits of the destination operand to “1” up to and including lowest set bit (=1) in the source

operand. If source operand is zero, BLSMSK sets all bits of the destination operand to 1 and also sets CF to 1.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt

to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

temp := (SRC-1) XOR (SRC) ;

SF := temp[OperandSize -1];

ZF := 0;

IF SRC = 0

CF := 1;

ELSE

CF := 0;

FI

DEST := temp;

Flags Affected

SF is updated based on the result. CF is set if the source if zero. ZF and OF flags are cleared. AF and PF flag are

undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BLSMSK:

unsigned __int32 _blsmsk_u32(unsigned __int32 src);

BLSMSK:

unsigned __int64 _blsmsk_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions”.

3-106

Vol. 2A

BLSMSK—Get Mask Up to Lowest Set Bit

INSTRUCTION SET REFERENCE, A-L

BLSR—Reset Lowest Set Bit

Opcode/Instruction

Op/

64/32

CPUID

Description

En

-bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F3 /1

VM

V/V

BMI1

Reset lowest set bit of r/m32, keep all other bits of r/m32 and write

BLSR r32, r/m32

result to r32.

VEX.LZ.0F38.W1 F3 /1

VM

V/N.E.

BMI1

Reset lowest set bit of r/m64, keep all other bits of r/m64 and write

BLSR r64, r/m64

result to r64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

VM

VEX.vvvv (w)

ModRM:r/m (r)

N/A

N/A

Description

Copies all bits from the source operand to the destination operand and resets (=0) the bit position in the destina-

tion operand that corresponds to the lowest set bit of the source operand. If the source operand is zero BLSR sets

CF.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

temp := (SRC-1) bitwiseAND ( SRC );

SF := temp[OperandSize -1];

ZF := (temp = 0);

IF SRC = 0

CF := 1;

ELSE

CF := 0;

FI

DEST := temp;

Flags Affected

ZF and SF flags are updated based on the result. CF is set if the source is zero. OF flag is cleared. AF and PF flags

are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BLSR:

unsigned __int32 _blsr_u32(unsigned __int32 src);

BLSR:

unsigned __int64 _blsr_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions”.

BLSR—Reset Lowest Set Bit

Vol. 2A

3-107

INSTRUCTION SET REFERENCE, A-L

BNDCL—Check Lower Bound

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

F3 0F 1A /r

RM

NE/V

MPX

Generate a #BR if the address in r/m32 is lower than the lower

BNDCL bnd, r/m32

bound in bnd.LB.

F3 0F 1A /r

RM

V/NE

MPX

Generate a #BR if the address in r/m64 is lower than the lower

BNDCL bnd, r/m64

bound in bnd.LB.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RM

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Compare the address in the second operand with the lower bound in bnd. The second operand can be either a

register or memory operand. If the address is lower than the lower bound in bnd.LB, it will set BNDSTATUS to 01H

and signal a #BR exception.

This instruction does not cause any memory access, and does not read or write any flags.

Operation

BNDCL BND, reg

IF reg < BND.LB Then

BNDSTATUS := 01H;

#BR;

FI;

BNDCL BND, mem

TEMP := LEA(mem);

IF TEMP < BND.LB Then

BNDSTATUS := 01H;

#BR;

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDCL void

_bnd_chk_ptr_lbounds(const void *q)

Flags Affected

None

Protected Mode Exceptions

#BR

If lower bound check fails.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

3-108

Vol. 2A

BNDCL—Check Lower Bound

INSTRUCTION SET REFERENCE, A-L

BNDCU/BNDCN—Check Upper Bound

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

F2 0F 1A /r

RM

NE/V

MPX

Generate a #BR if the address in r/m32 is higher than the upper

BNDCU bnd, r/m32

bound in bnd.UB (bnb.UB in 1's complement form).

F2 0F 1A /r

RM

V/NE

MPX

Generate a #BR if the address in r/m64 is higher than the upper

BNDCU bnd, r/m64

bound in bnd.UB (bnb.UB in 1's complement form).

F2 0F 1B /r

RM

NE/V

MPX

Generate a #BR if the address in r/m32 is higher than the upper

BNDCN bnd, r/m32

bound in bnd.UB (bnb.UB not in 1's complement form).

F2 0F 1B /r

RM

V/NE

MPX

Generate a #BR if the address in r/m64 is higher than the upper

BNDCN bnd, r/m64

bound in bnd.UB (bnb.UB not in 1's complement form).

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RM

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Compare the address in the second operand with the upper bound in bnd. The second operand can be either a

register or a memory operand. If the address is higher than the upper bound in bnd.UB, it will set BNDSTATUS to

01H and signal a #BR exception.

BNDCU perform 1’s complement operation on the upper bound of bnd first before proceeding with address compar-

ison. BNDCN perform address comparison directly using the upper bound in bnd that is already reverted out of 1’s

complement form.

This instruction does not cause any memory access, and does not read or write any flags.

Effective address computation of m32/64 has identical behavior to LEA

Operation

BNDCU BND, reg

IF reg > NOT(BND.UB) Then

BNDSTATUS := 01H;

#BR;

FI;

BNDCU BND, mem

TEMP := LEA(mem);

IF TEMP > NOT(BND.UB) Then

BNDSTATUS := 01H;

#BR;

FI;

BNDCN BND, reg

IF reg > BND.UB Then

BNDSTATUS := 01H;

#BR;

FI;

3-110

Vol. 2A

BNDCU/BNDCN—Check Upper Bound

INSTRUCTION SET REFERENCE, A-L

BNDLDX—Load Extended Bounds Using Address Translation

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

NP 0F 1A /r

RM

V/V

MPX

Load the bounds stored in a bound table entry (BTE) into bnd with

BNDLDX bnd, mib

address translation using the base of mib and conditional on the

index of mib matching the pointer value in the BTE.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

SIB.base (r): Address of pointer

RM

ModRM:reg (w)

N/A

SIB.index(r)

Description

BNDLDX uses the linear address constructed from the base register and displacement of the SIB-addressing form

of the memory operand (mib) to perform address translation to access a bound table entry and conditionally load

the bounds in the BTE to the destination. The destination register is updated with the bounds in the BTE, if the

content of the index register of mib matches the pointer value stored in the BTE.

If the pointer value comparison fails, the destination is updated with INIT bounds (lb = 0x0, ub = 0x0) (note: as

articulated earlier, the upper bound is represented using 1's complement, therefore, the 0x0 value of upper bound

allows for access to full memory).

This instruction does not cause memory access to the linear address of mib nor the effective address referenced by

the base, and does not read or write any flags.

Segment overrides apply to the linear address computation with the base of mib, and are used during address

translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be

linear address. There are no segmentation checks performed on the base of mib.

The base of mib will not be checked for canonical address violation as it does not access memory.

Any encoding of this instruction that does not specify base or index register will treat those registers as zero

(constant). The reg-reg form of this instruction will remain a NOP.

The scale field of the SIB byte has no effect on these instructions and is ignored.

The bound register may be partially updated on memory faults. The order in which memory operands are loaded is

implementation specific.

Operation

base := mib.SIB.base ? mib.SIB.base + Disp: 0;

ptr_value := mib.SIB.index ? mib.SIB.index : 0;

Outside 64-bit mode

A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 );

A_BT[31:0] := LoadFrom(A_BDE );

IF A_BT[0] equal 0 Then

BNDSTATUS := A_BDE | 02H;

#BR;

FI;

A_BTE[31:0] := (Zero_extend32(base[11:2] « 4) + (A_BT[31:2] « 2 );

Temp_lb[31:0] := LoadFrom(A_BTE);

Temp_ub[31:0] := LoadFrom(A_BTE + 4);

Temp_ptr[31:0] := LoadFrom(A_BTE + 8);

IF Temp_ptr equal ptr_value Then

BND.LB := Temp_lb;

BND.UB := Temp_ub;

3-112

Vol. 2A

BNDLDX—Load Extended Bounds Using Address Translation

INSTRUCTION SET REFERENCE, A-L

ELSE

BND.LB := 0;

BND.UB := 0;

FI;

In 64-bit mode

A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );¹

A_BT[63:0] := LoadFrom(A_BDE);

IF A_BT[0] equal 0 Then

BNDSTATUS := A_BDE | 02H;

#BR;

FI;

A_BTE[63:0] := (Zero_extend64(base[19:3] « 5) + (A_BT[63:3] « 3 );

Temp_lb[63:0] := LoadFrom(A_BTE);

Temp_ub[63:0] := LoadFrom(A_BTE + 8);

Temp_ptr[63:0] := LoadFrom(A_BTE + 16);

IF Temp_ptr equal ptr_value Then

BND.LB := Temp_lb;

BND.UB := Temp_ub;

ELSE

BND.LB := 0;

BND.UB := 0;

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDLDX: Generated by compiler as needed.

Flags Affected

None

Protected Mode Exceptions

#BR

If the bound directory entry is invalid.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

If DS register contains a NULL segment selector.

#PF(fault code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-

ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Appendix E.3.1 of Intel® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 1.

BNDLDX—Load Extended Bounds Using Address Translation

Vol. 2A

3-113

INSTRUCTION SET REFERENCE, A-L

BNDMK—Make Bounds

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

F3 0F 1B /r

RM

NE/V

MPX

Make lower and upper bounds from m32 and store them in bnd.

BNDMK bnd, m32

F3 0F 1B /r

RM

V/NE

MPX

Make lower and upper bounds from m64 and store them in bnd.

BNDMK bnd, m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RM

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Makes bounds from the second operand and stores the lower and upper bounds in the bound register bnd. The

second operand must be a memory operand. The content of the base register from the memory operand is stored

in the lower bound bnd.LB. The 1's complement of the effective address of m32/m64 is stored in the upper bound

b.UB. Computation of m32/m64 has identical behavior to LEA.

This instruction does not cause any memory access, and does not read or write any flags.

If the instruction did not specify base register, the lower bound will be zero. The reg-reg form of this instruction

retains legacy behavior (NOP).

The instruction causes an invalid-opcode exception (#UD) if executed in 64-bit mode with RIP-relative addressing.

Operation

BND.LB := SRCMEM.base;

IF 64-bit mode Then

BND.UB := NOT(LEA.64_bits(SRCMEM));

ELSE

BND.UB := Zero_Extend.64_bits(NOT(LEA.32_bits(SRCMEM)));

FI;

Intel C/C++ Compiler Intrinsic Equivalent

BNDMKvoid * _bnd_set_ptr_bounds(const void * q, size_t size);

Flags Affected

None

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

BNDMK—Make Bounds

Vol. 2A

3-115

INSTRUCTION SET REFERENCE, A-L

BNDMOV—Move Bounds

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

66 0F 1A /r

RM

NE/V

MPX

Move lower and upper bound from bnd2/m64 to bound register

BNDMOV bnd1, bnd2/m64

bnd1.

66 0F 1A /r

RM

V/NE

MPX

Move lower and upper bound from bnd2/m128 to bound register

BNDMOV bnd1, bnd2/m128

bnd1.

66 0F 1B /r

MR

NE/V

MPX

Move lower and upper bound from bnd2 to bnd1/m64.

BNDMOV bnd1/m64, bnd2

66 0F 1B /r

MR

V/NE

MPX

Move lower and upper bound from bnd2 to bound register

BNDMOV bnd1/m128, bnd2

bnd1/m128.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RM

ModRM:reg (w)

ModRM:r/m (r)

N/A

MR

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the

destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction.

The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5.

BNDMOV to memory in 64-bit mode

Upper Bound (UB)

Lower Bound (LB)

16

8

0

Byte offset

BNDMOV to memory in 32-bit mode

Upper Bound (UB)

Lower Bound (LB)

16

8

4

0

Byte offset

Figure 3-5. Memory Layout of BNDMOV to/from Memory

This instruction does not change flags.

Operation

BNDMOV register to register

DEST.LB := SRC.LB;

DEST.UB := SRC.UB;

BNDMOV—Move Bounds

Vol. 2A

3-117

INSTRUCTION SET REFERENCE, A-L

BNDSTX—Store Extended Bounds Using Address Translation

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

NP 0F 1B /r

MR

V/V

MPX

Store the bounds in bnd and the pointer value in the index regis-

BNDSTX mib, bnd

ter of mib to a bound table entry (BTE) with address translation

using the base of mib.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

SIB.base (r): Address of pointer

MR

ModRM:reg (r)

N/A

SIB.index(r)

Description

BNDSTX uses the linear address constructed from the displacement and base register of the SIB-addressing form

of the memory operand (mib) to perform address translation to store to a bound table entry. The bounds in the

source operand bnd are written to the lower and upper bounds in the BTE. The content of the index register of mib

is written to the pointer value field in the BTE.

This instruction does not cause memory access to the linear address of mib nor the effective address referenced by

the base, and does not read or write any flags.

Segment overrides apply to the linear address computation with the base of mib, and are used during address

translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be

linear address. There are no segmentation checks performed on the base of mib.

The base of mib will not be checked for canonical address violation as it does not access memory.

Any encoding of this instruction that does not specify base or index register will treat those registers as zero

(constant). The reg-reg form of this instruction will remain a NOP.

The scale field of the SIB byte has no effect on these instructions and is ignored.

The bound register may be partially updated on memory faults. The order in which memory operands are loaded is

implementation specific.

Operation

base := mib.SIB.base ? mib.SIB.base + Disp: 0;

ptr_value := mib.SIB.index ? mib.SIB.index : 0;

Outside 64-bit mode

A_BDE[31:0] := (Zero_extend32(base[31:12] « 2) + (BNDCFG[31:12] «12 );

A_BT[31:0] := LoadFrom(A_BDE);

IF A_BT[0] equal 0 Then

BNDSTATUS := A_BDE | 02H;

#BR;

FI;

A_DEST[31:0] := (Zero_extend32(base[11:2] « 4) + (A_BT[31:2] « 2 ); // address of Bound table entry

A_DEST[8][31:0] := ptr_value;

A_DEST[0][31:0] := BND.LB;

A_DEST[4][31:0] := BND.UB;

3-120

Vol. 2A

BNDSTX—Store Extended Bounds Using Address Translation

INSTRUCTION SET REFERENCE, A-L

In 64-bit mode

A_BDE[63:0] := (Zero_extend64(base[47+MAWA:20] « 3) + (BNDCFG[63:12] «12 );¹

A_BT[63:0] := LoadFrom(A_BDE);

IF A_BT[0] equal 0 Then

BNDSTATUS := A_BDE | 02H;

#BR;

FI;

A_DEST[63:0] := (Zero_extend64(base[19:3] « 5) + (A_BT[63:3] « 3 ); // address of Bound table entry

A_DEST[16][63:0] := ptr_value;

A_DEST[0][63:0] := BND.LB;

A_DEST[8][63:0] := BND.UB;

Intel C/C++ Compiler Intrinsic Equivalent

BNDSTX: _bnd_store_ptr_bounds(const void **ptr_addr, const void *ptr_val);

Flags Affected

None

Protected Mode Exceptions

#BR

If the bound directory entry is invalid.

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 67H prefix is not used and CS.D=0.

If 67H prefix is used and CS.D=1.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

If DS register contains a NULL segment selector.

If the destination operand points to a non-writable segment

#PF(fault code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

Virtual-8086 Mode Exceptions

#UD

If the LOCK prefix is used.

If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.

If 16-bit addressing is used.

#GP(0)

If a destination effective address of the Bound Table entry is outside the DS segment limit.

#PF(fault code)

If a page fault occurs.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-

ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Appendix E.3.1 of Intel® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 1.

BNDSTX—Store Extended Bounds Using Address Translation

Vol. 2A

3-121

INSTRUCTION SET REFERENCE, A-L

BOUND—Check Array Index Against Bounds

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

62 /r

BOUND r16, m16&16

RM

Invalid

Valid

Check if r16 (array index) is within bounds

specified by m16&16.

62 /r

BOUND r32, m32&32

RM

Invalid

Valid

Check if r32 (array index) is within bounds

specified by m32&32.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM

ModRM:reg (r)

ModRM:r/m (r)

N/A

N/A

Description

BOUND determines if the first operand (array index) is within the bounds of an array specified the second operand

(bounds operand). The array index is a signed integer located in a register. The bounds operand is a memory loca-

tion that contains a pair of signed doubleword-integers (when the operand-size attribute is 32) or a pair of signed

word-integers (when the operand-size attribute is 16). The first doubleword (or word) is the lower bound of the

array and the second doubleword (or word) is the upper bound of the array. The array index must be greater than

or equal to the lower bound and less than or equal to the upper bound plus the operand size in bytes. If the index

is not within bounds, a BOUND range exceeded exception (#BR) is signaled. When this exception is generated, the

saved return instruction pointer points to the BOUND instruction.

The bounds limit data structure (two words or doublewords containing the lower and upper limits of the array) is

usually placed just before the array itself, making the limits addressable via a constant offset from the beginning of

the array. Because the address of the array already will be present in a register, this practice avoids extra bus

cycles to obtain the effective address of the array bounds.

This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.

Operation

IF 64bit Mode

THEN

#UD;

ELSE

IF (ArrayIndex < LowerBound OR ArrayIndex > UpperBound) THEN

(* Below lower bound or above upper bound *)

IF <equation for PL enabled> THEN BNDSTATUS := 0

#BR;

FI;

FI;

Flags Affected

None.

BOUND—Check Array Index Against Bounds

Vol. 2A

3-123

INSTRUCTION SET REFERENCE, A-L

BSF—Bit Scan Forward

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F BC /r

BSF r16, r/m16

RM

Valid

Valid

Bit scan forward on r/m16.

0F BC /r

BSF r32, r/m32

RM

Valid

Valid

Bit scan forward on r/m32.

REX.W + 0F BC /r

BSF r64, r/m64

RM

Valid

N.E.

Bit scan forward on r/m64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM

ModRM:reg (w)

ModRM:r/m (r)

N/A

N/A

Description

Searches the source operand (second operand) for the least significant set bit (1 bit). If a least significant 1 bit is

found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a

memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source

operand. If the content of the source operand is 0, the content of the destination operand is undefined.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

IF SRC = 0

THEN

ZF := 1;

DEST is undefined;

ELSE

ZF := 0;

temp := 0;

WHILE Bit(SRC, temp) = 0

DO

temp := temp + 1;

OD;

DEST := temp;

FI;

Flags Affected

The ZF flag is set to 1 if the source operand is 0; otherwise, the ZF flag is cleared. The CF, OF, SF, AF, and PF flags

are undefined.

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

BSF—Bit Scan Forward

Vol. 2A

3-125

INSTRUCTION SET REFERENCE, A-L

BSR—Bit Scan Reverse

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F BD /r

BSR r16, r/m16

RM

Valid

Valid

Bit scan reverse on r/m16.

0F BD /r

BSR r32, r/m32

RM

Valid

Valid

Bit scan reverse on r/m32.

REX.W + 0F BD /r

BSR r64, r/m64

RM

Valid

N.E.

Bit scan reverse on r/m64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RM

ModRM:reg (w)

ModRM:r/m (r)

N/A

N/A

Description

Searches the source operand (second operand) for the most significant set bit (1 bit). If a most significant 1 bit is

found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a

memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source

operand. If the content source operand is 0, the content of the destination operand is undefined.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

IF SRC = 0

THEN

ZF := 1;

DEST is undefined;

ELSE

ZF := 0;

temp := OperandSize - 1;

WHILE Bit(SRC, temp) = 0

DO

temp := temp - 1;

OD;

DEST := temp;

FI;

Flags Affected

The ZF flag is set to 1 if the source operand is 0; otherwise, the ZF flag is cleared. The CF, OF, SF, AF, and PF flags

are undefined.

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

BSR—Bit Scan Reverse

Vol. 2A

3-127

INSTRUCTION SET REFERENCE, A-L

BSWAP—Byte Swap

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F C8+rd

BSWAP r32

O

Valid*

Valid

Reverses the byte order of a 32-bit register.

REX.W + 0F C8+rd

BSWAP r64

O

Valid

N.E.

Reverses the byte order of a 64-bit register.

NOTES:

* See IA-32 Architecture Compatibility section below.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

O

opcode + rd (r, w)

N/A

N/A

N/A

Description

Reverses the byte order of a 32-bit or 64-bit (destination) register. This instruction is provided for converting little-

endian values to big-endian format and vice versa. To swap bytes in a word value (16-bit register), use the XCHG

instruction. When the BSWAP instruction references a 16-bit register, the result is undefined.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

IA-32 Architecture Legacy Compatibility

The BSWAP instruction is not supported on IA-32 processors earlier than the Intel486™ processor family. For

compatibility with this instruction, software should include functionally equivalent code for execution on Intel

processors earlier than the Intel486 processor family.

Operation

TEMP := DEST

IF 64-bit mode AND OperandSize = 64

THEN

DEST[7:0] := TEMP[63:56];

DEST[15:8] := TEMP[55:48];

DEST[23:16] := TEMP[47:40];

DEST[31:24] := TEMP[39:32];

DEST[39:32] := TEMP[31:24];

DEST[47:40] := TEMP[23:16];

DEST[55:48] := TEMP[15:8];

DEST[63:56] := TEMP[7:0];

ELSE

DEST[7:0] := TEMP[31:24];

DEST[15:8] := TEMP[23:16];

DEST[23:16] := TEMP[15:8];

DEST[31:24] := TEMP[7:0];

FI;

Flags Affected

None.

Exceptions (All Operating Modes)

#UD

If the LOCK prefix is used.

BSWAP—Byte Swap

Vol. 2A

3-129

INSTRUCTION SET REFERENCE, A-L

BT—Bit Test

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F A3 /r

BT r/m16, r16

MR

Valid

Valid

Store selected bit in CF flag.

0F A3 /r

BT r/m32, r32

MR

Valid

Valid

Store selected bit in CF flag.

REX.W + 0F A3 /r

BT r/m64, r64

MR

Valid

N.E.

Store selected bit in CF flag.

0F BA /4 ib

BT r/m16, imm8

MI

Valid

Valid

Store selected bit in CF flag.

0F BA /4 ib

BT r/m32, imm8

MI

Valid

Valid

Store selected bit in CF flag.

REX.W + 0F BA /4 ib

BT r/m64, imm8

MI

Valid

N.E.

Store selected bit in CF flag.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MR

ModRM:r/m (r)

ModRM:reg (r)

N/A

N/A

MI

ModRM:r/m (r)

imm8

N/A

N/A

Description

Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by

the bit offset (specified by the second operand) and stores the value of the bit in the CF flag. The bit base operand

can be a register or a memory location; the bit offset operand can be a register or an immediate value:

• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset

operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit

mode).

• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory

that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be

referenced by the offset operand depends on the operand size.

See also: Bit(BitBase, BitOffset) on page 3-11.

Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-

tion with the displacement field of the memory operand. In this case, the low-order 3 or 5 bits (3 for 16-bit oper-

ands, 5 for 32-bit operands) of the immediate bit offset are stored in the immediate bit offset field, and the high-

order bits are shifted and combined with the byte displacement in the addressing mode by the assembler. The

processor will ignore the high order bits if they are not zero.

When accessing a bit in memory, the processor may access 4 bytes starting from the memory address for a 32-bit

operand size, using by the following relationship:

Effective Address + (4 ∗ (BitOffset DIV 32))

Or, it may access 2 bytes starting from the memory address for a 16-bit operand, using this relationship:

Effective Address + (2 ∗ (BitOffset DIV 16))

It may do so even when only a single byte needs to be accessed to reach the given bit. When using this bit

addressing mechanism, software should avoid referencing areas of memory close to address space holes. In partic-

ular, it should avoid references to memory-mapped I/O registers. Instead, software should use the MOV instruc-

tions to load from or store to these addresses, and use the register form of these instructions to manipulate the

data.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit oper-

ands. See the summary chart at the beginning of this section for encoding data and limits.

Operation

CF := Bit(BitBase, BitOffset);

3-130

Vol. 2A

BT—Bit Test

INSTRUCTION SET REFERENCE, A-L

BTC—Bit Test and Complement

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F BB /r

BTC r/m16, r16

MR

Valid

Valid

Store selected bit in CF flag and complement.

0F BB /r

BTC r/m32, r32

MR

Valid

Valid

Store selected bit in CF flag and complement.

REX.W + 0F BB /r

BTC r/m64, r64

MR

Valid

N.E.

Store selected bit in CF flag and complement.

0F BA /7 ib

BTC r/m16, imm8

MI

Valid

Valid

Store selected bit in CF flag and complement.

0F BA /7 ib

BTC r/m32, imm8

MI

Valid

Valid

Store selected bit in CF flag and complement.

REX.W + 0F BA /7 ib

BTC r/m64, imm8

MI

Valid

N.E.

Store selected bit in CF flag and complement.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MR

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

N/A

MI

ModRM:r/m (r, w)

imm8

N/A

N/A

Description

Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by

the bit offset operand (second operand), stores the value of the bit in the CF flag, and complements the selected

bit in the bit string. The bit base operand can be a register or a memory location; the bit offset operand can be a

register or an immediate value:

• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset

operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit

mode). This allows any bit position to be selected.

• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory

that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be

referenced by the offset operand depends on the operand size.

See also: Bit(BitBase, BitOffset) on page 3-11.

Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-

tion with the displacement field of the memory operand. See “BT—Bit Test” in this chapter for more information on

this addressing mechanism.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

CF := Bit(BitBase, BitOffset);

Bit(BitBase, BitOffset) := NOT Bit(BitBase, BitOffset);

Flags Affected

The CF flag contains the value of the selected bit before it is complemented. The ZF flag is unaffected. The OF, SF,

AF, and PF flags are undefined.

3-132

Vol. 2A

BTC—Bit Test and Complement

INSTRUCTION SET REFERENCE, A-L

BTR—Bit Test and Reset

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F B3 /r

BTR r/m16, r16

MR

Valid

Valid

Store selected bit in CF flag and clear.

0F B3 /r

BTR r/m32, r32

MR

Valid

Valid

Store selected bit in CF flag and clear.

REX.W + 0F B3 /r

BTR r/m64, r64

MR

Valid

N.E.

Store selected bit in CF flag and clear.

0F BA /6 ib

BTR r/m16, imm8

MI

Valid

Valid

Store selected bit in CF flag and clear.

0F BA /6 ib

BTR r/m32, imm8

MI

Valid

Valid

Store selected bit in CF flag and clear.

REX.W + 0F BA /6 ib

BTR r/m64, imm8

MI

Valid

N.E.

Store selected bit in CF flag and clear.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MR

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

N/A

MI

ModRM:r/m (r, w)

imm8

N/A

N/A

Description

Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by

the bit offset operand (second operand), stores the value of the bit in the CF flag, and clears the selected bit in the

bit string to 0. The bit base operand can be a register or a memory location; the bit offset operand can be a register

or an immediate value:

• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset

operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit

mode). This allows any bit position to be selected.

• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory

that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be

referenced by the offset operand depends on the operand size.

See also: Bit(BitBase, BitOffset) on page 3-11.

Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-

tion with the displacement field of the memory operand. See “BT—Bit Test” in this chapter for more information on

this addressing mechanism.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

CF := Bit(BitBase, BitOffset);

Bit(BitBase, BitOffset) := 0;

Flags Affected

The CF flag contains the value of the selected bit before it is cleared. The ZF flag is unaffected. The OF, SF, AF, and

PF flags are undefined.

3-134

Vol. 2A

BTR—Bit Test and Reset

INSTRUCTION SET REFERENCE, A-L

BTS—Bit Test and Set

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

0F AB /r

BTS r/m16, r16

MR

Valid

Valid

Store selected bit in CF flag and set.

0F AB /r

BTS r/m32, r32

MR

Valid

Valid

Store selected bit in CF flag and set.

REX.W + 0F AB /r

BTS r/m64, r64

MR

Valid

N.E.

Store selected bit in CF flag and set.

0F BA /5 ib

BTS r/m16, imm8

MI

Valid

Valid

Store selected bit in CF flag and set.

0F BA /5 ib

BTS r/m32, imm8

MI

Valid

Valid

Store selected bit in CF flag and set.

REX.W + 0F BA /5 ib

BTS r/m64, imm8

MI

Valid

N.E.

Store selected bit in CF flag and set.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

MR

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

N/A

MI

ModRM:r/m (r, w)

imm8

N/A

N/A

Description

Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by

the bit offset operand (second operand), stores the value of the bit in the CF flag, and sets the selected bit in the

bit string to 1. The bit base operand can be a register or a memory location; the bit offset operand can be a register

or an immediate value:

• If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset

operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit

mode). This allows any bit position to be selected.

• If the bit base operand specifies a memory location, the operand represents the address of the byte in memory

that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be

referenced by the offset operand depends on the operand size.

See also: Bit(BitBase, BitOffset) on page 3-11.

Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-

tion with the displacement field of the memory operand. See “BT—Bit Test” in this chapter for more information on

this addressing mechanism.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

CF := Bit(BitBase, BitOffset);

Bit(BitBase, BitOffset) := 1;

Flags Affected

The CF flag contains the value of the selected bit before it is set. The ZF flag is unaffected. The OF, SF, AF, and PF

flags are undefined.

3-136

Vol. 2A

BTS—Bit Test and Set

INSTRUCTION SET REFERENCE, A-L

BZHI—Zero High Bits Starting with Specified Bit Position

Opcode/Instruction

Op/

64/32

CPUID

Description

En

-bit

Feature

Mode

Flag

VEX.LZ.0F38.W0 F5 /r

RMV

V/V

BMI2

Zero bits in r/m32 starting with the position in r32b, write result to

BZHI r32a, r/m32, r32b

r32a.

VEX.LZ.0F38.W1 F5 /r

RMV

V/N.E.

BMI2

Zero bits in r/m64 starting with the position in r64b, write result to

BZHI r64a, r/m64, r64b

r64a.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMV

ModRM:reg (w)

ModRM:r/m (r)

VEX.vvvv (r)

N/A

Description

BZHI copies the bits of the first source operand (the second operand) into the destination operand (the first

operand) and clears the higher bits in the destination according to the INDEX value specified by the second source

operand (the third operand). The INDEX is specified by bits 7:0 of the second source operand. The INDEX value is

saturated at the value of OperandSize -1. CF is set, if the number contained in the 8 low bits of the third operand is

greater than OperandSize -1.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt

to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

N := SRC2[7:0]

DEST := SRC1

IF (N < OperandSize)

DEST[OperandSize-1:N] := 0

FI

IF (N > OperandSize - 1)

CF := 1

ELSE

CF := 0

FI

Flags Affected

ZF, CF, and SF flags are updated based on the result. OF flag is cleared. AF and PF flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

BZHI:

unsigned __int32 _bzhi_u32(unsigned __int32 src, unsigned __int32 index);

BZHI:

unsigned __int64 _bzhi_u64(unsigned __int64 src, unsigned __int32 index);

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions”.

3-138

Vol. 2A

BZHI—Zero High Bits Starting with Specified Bit Position

INSTRUCTION SET REFERENCE, A-L

CALL—Call Procedure

Opcode

Instruction

Op/

64-bit

Compat/

Description

En

Mode

Leg Mode

E8 cw

CALL rel16

D

N.S.

Valid

Call near, relative, displacement relative to next

instruction.

E8 cd

CALL rel32

D

Valid

Valid

Call near, relative, displacement relative to next

instruction. 32-bit displacement sign extended to

64-bits in 64-bit mode.

FF /2

CALL r/m16

M

N.E.

Valid

Call near, absolute indirect, address given in r/m16.

FF /2

CALL r/m32

M

N.E.

Valid

Call near, absolute indirect, address given in r/m32.

FF /2

CALL r/m64

M

Valid

N.E.

Call near, absolute indirect, address given in r/m64.

9A cd

CALL ptr16:16

D

Invalid

Valid

Call far, absolute, address given in operand.

9A cp

CALL ptr16:32

D

Invalid

Valid

Call far, absolute, address given in operand.

FF /3

CALL m16:16

M

Valid

Valid

Call far, absolute indirect address given in m16:16.

In 32-bit mode: if selector points to a gate, then RIP

= 32-bit zero extended displacement taken from

gate; else RIP = zero extended 16-bit offset from

far pointer referenced in the instruction.

FF /3

CALL m16:32

M

Valid

Valid

In 64-bit mode: If selector points to a gate, then RIP

= 64-bit displacement taken from gate; else RIP =

zero extended 32-bit offset from far pointer

referenced in the instruction.

REX.W FF /3

CALL m16:64

M

Valid

N.E.

In 64-bit mode: If selector points to a gate, then RIP

= 64-bit displacement taken from gate; else RIP =

64-bit offset from far pointer referenced in the

instruction.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

D

Offset

N/A

N/A

N/A

M

ModRM:r/m (r)

N/A

N/A

N/A

Description

Saves procedure linking information on the stack and branches to the called procedure specified using the target

operand. The target operand specifies the address of the first instruction in the called procedure. The operand can

be an immediate value, a general-purpose register, or a memory location.

This instruction can be used to execute four types of calls:

• Near Call — A call to a procedure in the current code segment (the segment currently pointed to by the CS

register), sometimes referred to as an intra-segment call.

• Far Call — A call to a procedure located in a different segment than the current code segment, sometimes

referred to as an inter-segment call.

• Inter-privilege-level far call — A far call to a procedure in a segment at a different privilege level than that

of the currently executing program or procedure.

• Task switch — A call to a procedure located in a different task.

The latter two call types (inter-privilege-level call and task switch) can only be executed in protected mode. See

“Calling Procedures Using Call and RET” in Chapter 6 of the Intel® 64 and IA-32 Architectures Software Devel-

oper’s Manual, Volume 1, for additional information on near, far, and inter-privilege-level calls. See Chapter 8,

“Task Management,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for infor-

mation on performing task switches with the CALL instruction.

CALL—Call Procedure

Vol. 2A

3-139

Content      ..     64      65      66      67     ..