Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, M-U

RORX — Rotate Right Logical Without Affecting Flags

Opcode/

Op/

64/32

CPUID

Description

Instruction

-bit

Feature

Mode

Flag

VEX.LZ.F2.0F3A.W0 F0 /r ib

RMI

V/V

BMI2

Rotate 32-bit r/m32 right imm8 times without affecting arithmetic

RORX r32, r/m32, imm8

flags.

VEX.LZ.F2.0F3A.W1 F0 /r ib

RMI

V/N.E.

BMI2

Rotate 64-bit r/m64 right imm8 times without affecting arithmetic

RORX r64, r/m64, imm8

flags.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (w)

ModRM:r/m (r)

imm8

N/A

Description

Rotates the bits of second operand right by the count value specified in imm8 without affecting arithmetic flags.

The RORX instruction does not read or write the arithmetic flags.

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An

attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation

IF (OperandSize = 32)

y := imm8 AND 1FH;

DEST := (SRC >> y) | (SRC << (32-y));

ELSEIF (OperandSize = 64 )

y := imm8 AND 3FH;

DEST := (SRC >> y) | (SRC << (64-y));

FI;

Flags Affected

None

Intel C/C++ Compiler Intrinsic Equivalent

Auto-generated from high-level language.

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-29, “Type 13 Class Exception Conditions”.

RORX — Rotate Right Logical Without Affecting Flags

Vol. 2B

4-577

INSTRUCTION SET REFERENCE, M-U

ROUNDPD—Round Packed Double Precision Floating-Point Values

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 3A 09 /r ib

RMI

V/V

SSE4_1

Round packed double precision floating-point

ROUNDPD xmm1, xmm2/m128, imm8

values in xmm2/m128 and place the result in

xmm1. The rounding mode is determined by

imm8.

VEX.128.66.0F3A.WIG 09 /r ib

RMI

V/V

AVX

Round packed double precision floating-point

VROUNDPD xmm1, xmm2/m128, imm8

values in xmm2/m128 and place the result in

xmm1. The rounding mode is determined by

imm8.

VEX.256.66.0F3A.WIG 09 /r ib

RMI

V/V

AVX

Round packed double precision floating-point

VROUNDPD ymm1, ymm2/m256, imm8

values in ymm2/m256 and place the result in

ymm1. The rounding mode is determined by

imm8.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (w)

ModRM:r/m (r)

imm8

N/A

Description

Round the 2 double precision floating-point values in the source operand (second operand) using the rounding

mode specified in the immediate operand (third operand) and place the results in the destination operand (first

operand). The rounding process rounds each input floating-point value to an integer value and returns the integer

result as a double precision floating-point value.

The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in

Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the

source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded

values for rounding-mode field).

The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an

SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before

rounding.

128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina-

tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding YMM

VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina-

tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are

zeroed.

VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination

operand is a YMM register.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

4-578

Vol. 2B

ROUNDPD—Round Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

3 2 1 0

Reserved

P — Precision Mask; 0: normal, 1: inexact

RS — Rounding select; 1: MXCSR.RC, 0: Imm8.RC

RC — Rounding mode

Figure 4-24. Bit Control Fields of Immediate Byte for ROUNDxx Instruction

Table 4-23. Rounding Modes and Encoding of Rounding Control (RC) Field

Rounding

RC Field

Description

Mode

Setting

Round to

00B

Rounded result is the closest to the infinitely precise result. If two values are equally close, the result is

nearest (even)

the even value (i.e., the integer value with the least-significant bit of zero).

Round down

01B

Rounded result is closest to but no greater than the infinitely precise result.

(toward −∞)

Round up

10B

Rounded result is closest to but no less than the infinitely precise result.

(toward +∞)

Round toward

11B

Rounded result is closest to but no greater in absolute value than the infinitely precise result.

zero (Truncate)

Operation

IF (imm[2] = ‘1)

THEN

// rounding mode is determined by MXCSR.RC

DEST[63:0] := ConvertDPFPToInteger_M(SRC[63:0]);

DEST[127:64] := ConvertDPFPToInteger_M(SRC[127:64]);

ELSE

// rounding mode is determined by IMM8.RC

DEST[63:0] := ConvertDPFPToInteger_Imm(SRC[63:0]);

DEST[127:64] := ConvertDPFPToInteger_Imm(SRC[127:64]);

ROUNDPD (128-bit Legacy SSE version)

DEST[63:0] := RoundToInteger(SRC[63:0]], ROUND_CONTROL)

DEST[127:64] := RoundToInteger(SRC[127:64]], ROUND_CONTROL)

DEST[MAXVL-1:128] (Unmodified)

VROUNDPD (VEX.128 encoded version)

DEST[63:0] := RoundToInteger(SRC[63:0]], ROUND_CONTROL)

DEST[127:64] := RoundToInteger(SRC[127:64]], ROUND_CONTROL)

DEST[MAXVL-1:128] := 0

VROUNDPD (VEX.256 encoded version)

DEST[63:0] := RoundToInteger(SRC[63:0], ROUND_CONTROL)

DEST[127:64] := RoundToInteger(SRC[127:64]], ROUND_CONTROL)

DEST[191:128] := RoundToInteger(SRC[191:128]], ROUND_CONTROL)

DEST[255:192] := RoundToInteger(SRC[255:192] ], ROUND_CONTROL)

ROUNDPD—Round Packed Double Precision Floating-Point Values

Vol. 2B

4-579

INSTRUCTION SET REFERENCE, M-U

Intel C/C++ Compiler Intrinsic Equivalent

__m128 _mm_round_pd(__m128d s1, int iRoundMode);

__m128 _mm_floor_pd(__m128d s1);

__m128 _mm_ceil_pd(__m128d s1)

__m256 _mm256_round_pd(__m256d s1, int iRoundMode);

__m256 _mm256_floor_pd(__m256d s1);

__m256 _mm256_ceil_pd(__m256d s1)

SIMD Floating-Point Exceptions

Invalid (signaled only if SRC = SNaN)

Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci-

sion exception is not signaled.)

Note that Denormal is not signaled by ROUNDPD.

Other Exceptions

See Table 2-19, “Type 2 Class Exception Conditions”; additionally:

#UD

If VEX.vvvv ≠ 1111B.

4-580

Vol. 2B

ROUNDPD—Round Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

ROUNDPS—Round Packed Single Precision Floating-Point Values

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 3A 08

RMI

V/V

SSE4_1

Round packed single precision floating-point

/r ib

values in xmm2/m128 and place the result in

ROUNDPS xmm1, xmm2/m128, imm8

xmm1. The rounding mode is determined by

imm8.

VEX.128.66.0F3A.WIG 08 /r ib

RMI

V/V

AVX

Round packed single precision floating-point

VROUNDPS xmm1, xmm2/m128, imm8

values in xmm2/m128 and place the result in

xmm1. The rounding mode is determined by

imm8.

VEX.256.66.0F3A.WIG 08 /r ib

RMI

V/V

AVX

Round packed single precision floating-point

VROUNDPS ymm1, ymm2/m256, imm8

values in ymm2/m256 and place the result in

ymm1. The rounding mode is determined by

imm8.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (w)

ModRM:r/m (r)

imm8

N/A

Description

Round the 4 single precision floating-point values in the source operand (second operand) using the rounding mode

specified in the immediate operand (third operand) and place the results in the destination operand (first operand).

The rounding process rounds each input floating-point value to an integer value and returns the integer result as a

single precision floating-point value.

The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in

Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the

source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded

values for rounding-mode field).

The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an

SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before

rounding.

128-bit Legacy SSE version: The second source can be an XMM register or 128-bit memory location. The destina-

tion is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding YMM

VEX.128 encoded version: the source operand second source operand or a 128-bit memory location. The destina-

tion operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are

zeroed.

VEX.256 encoded version: The source operand is a YMM register or a 256-bit memory location. The destination

operand is a YMM register.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD.

ROUNDPS—Round Packed Single Precision Floating-Point Values

Vol. 2B

4-581

INSTRUCTION SET REFERENCE, M-U

Operation

IF (imm[2] = ‘1)

THEN

// rounding mode is determined by MXCSR.RC

DEST[31:0] := ConvertSPFPToInteger_M(SRC[31:0]);

DEST[63:32] := ConvertSPFPToInteger_M(SRC[63:32]);

DEST[95:64] := ConvertSPFPToInteger_M(SRC[95:64]);

DEST[127:96] := ConvertSPFPToInteger_M(SRC[127:96]);

ELSE

// rounding mode is determined by IMM8.RC

DEST[31:0] := ConvertSPFPToInteger_Imm(SRC[31:0]);

DEST[63:32] := ConvertSPFPToInteger_Imm(SRC[63:32]);

DEST[95:64] := ConvertSPFPToInteger_Imm(SRC[95:64]);

DEST[127:96] := ConvertSPFPToInteger_Imm(SRC[127:96]);

FI;

ROUNDPS(128-bit Legacy SSE version)

DEST[31:0] := RoundToInteger(SRC[31:0], ROUND_CONTROL)

DEST[63:32] := RoundToInteger(SRC[63:32], ROUND_CONTROL)

DEST[95:64] := RoundToInteger(SRC[95:64]], ROUND_CONTROL)

DEST[127:96] := RoundToInteger(SRC[127:96]], ROUND_CONTROL)

DEST[MAXVL-1:128] (Unmodified)

VROUNDPS (VEX.128 encoded version)

DEST[31:0] := RoundToInteger(SRC[31:0], ROUND_CONTROL)

DEST[63:32] := RoundToInteger(SRC[63:32], ROUND_CONTROL)

DEST[95:64] := RoundToInteger(SRC[95:64]], ROUND_CONTROL)

DEST[127:96] := RoundToInteger(SRC[127:96]], ROUND_CONTROL)

DEST[MAXVL-1:128] := 0

VROUNDPS (VEX.256 encoded version)

DEST[31:0] := RoundToInteger(SRC[31:0], ROUND_CONTROL)

DEST[63:32] := RoundToInteger(SRC[63:32], ROUND_CONTROL)

DEST[95:64] := RoundToInteger(SRC[95:64]], ROUND_CONTROL)

DEST[127:96] := RoundToInteger(SRC[127:96]], ROUND_CONTROL)

DEST[159:128] := RoundToInteger(SRC[159:128]], ROUND_CONTROL)

DEST[191:160] := RoundToInteger(SRC[191:160]], ROUND_CONTROL)

DEST[223:192] := RoundToInteger(SRC[223:192] ], ROUND_CONTROL)

DEST[255:224] := RoundToInteger(SRC[255:224] ], ROUND_CONTROL)

Intel C/C++ Compiler Intrinsic Equivalent

__m128 _mm_round_ps(__m128 s1, int iRoundMode);

__m128 _mm_floor_ps(__m128 s1);

__m128 _mm_ceil_ps(__m128 s1)

__m256 _mm256_round_ps(__m256 s1, int iRoundMode);

__m256 _mm256_floor_ps(__m256 s1);

__m256 _mm256_ceil_ps(__m256 s1)

4-582

Vol. 2B

ROUNDPS—Round Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

ROUNDSD—Round Scalar Double Precision Floating-Point Values

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 3A 0B /r ib

RMI

V/V

SSE4_1

Round the low packed double precision

ROUNDSD xmm1, xmm2/m64, imm8

floating-point value in xmm2/m64 and place

the result in xmm1. The rounding mode is

determined by imm8.

VEX.LIG.66.0F3A.WIG 0B /r ib

RVMI

V/V

AVX

Round the low packed double precision

VROUNDSD xmm1, xmm2, xmm3/m64, imm8

floating-point value in xmm3/m64 and place

the result in xmm1. The rounding mode is

determined by imm8. Upper packed double

precision floating-point value (bits[127:64])

from xmm2 is copied to xmm1[127:64].

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (w)

ModRM:r/m (r)

imm8

N/A

RVMI

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8

Description

Round the double precision floating-point value in the lower qword of the source operand (second operand) using

the rounding mode specified in the immediate operand (third operand) and place the result in the destination

operand (first operand). The rounding process rounds a double precision floating-point input to an integer value

and returns the integer result as a double precision floating-point value in the lowest position. The upper double

precision floating-point value in the destination is retained.

The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in

Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the

source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded

values for rounding-mode field).

The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an

SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before

rounding.

128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL-

1:64) of the corresponding YMM destination register remain unchanged.

VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed.

Operation

IF (imm[2] = ‘1)

THEN

// rounding mode is determined by MXCSR.RC

DEST[63:0] := ConvertDPFPToInteger_M(SRC[63:0]);

ELSE

// rounding mode is determined by IMM8.RC

DEST[63:0] := ConvertDPFPToInteger_Imm(SRC[63:0]);

FI;

DEST[127:63] remains unchanged ;

ROUNDSD (128-bit Legacy SSE version)

DEST[63:0] := RoundToInteger(SRC[63:0], ROUND_CONTROL)

DEST[MAXVL-1:64] (Unmodified)

4-584

Vol. 2B

ROUNDSD—Round Scalar Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

VROUNDSD (VEX.128 encoded version)

DEST[63:0] := RoundToInteger(SRC2[63:0], ROUND_CONTROL)

DEST[127:64] := SRC1[127:64]

DEST[MAXVL-1:128] := 0

Intel C/C++ Compiler Intrinsic Equivalent

ROUNDSD:

__m128d mm_round_sd(__m128d dst, __m128d s1, int iRoundMode);

__m128d mm_floor_sd(__m128d dst, __m128d s1);

__m128d mm_ceil_sd(__m128d dst, __m128d s1);

SIMD Floating-Point Exceptions

Invalid (signaled only if SRC = SNaN)

Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci-

sion exception is not signaled.)

Note that Denormal is not signaled by ROUNDSD.

Other Exceptions

See Table 2-20, “Type 3 Class Exception Conditions”.

ROUNDSD—Round Scalar Double Precision Floating-Point Values

Vol. 2B

4-585

INSTRUCTION SET REFERENCE, M-U

ROUNDSS—Round Scalar Single Precision Floating-Point Values

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 3A 0A /r ib

RMI

V/V

SSE4_1

Round the low packed single precision

ROUNDSS xmm1, xmm2/m32, imm8

floating-point value in xmm2/m32 and place

the result in xmm1. The rounding mode is

determined by imm8.

VEX.LIG.66.0F3A.WIG 0A /r ib

RVMI

V/V

AVX

Round the low packed single precision

VROUNDSS xmm1, xmm2, xmm3/m32, imm8

floating-point value in xmm3/m32 and place

the result in xmm1. The rounding mode is

determined by imm8. Also, upper packed

single precision floating-point values

(bits[127:32]) from xmm2 are copied to

xmm1[127:32].

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMI

ModRM:reg (w)

ModRM:r/m (r)

imm8

N/A

RVMI

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

imm8

Description

Round the single precision floating-point value in the lowest dword of the source operand (second operand) using

the rounding mode specified in the immediate operand (third operand) and place the result in the destination

operand (first operand). The rounding process rounds a single precision floating-point input to an integer value and

returns the result as a single precision floating-point value in the lowest position. The upper three single precision

floating-point values in the destination are retained.

The immediate operand specifies control fields for the rounding operation, three bit fields are defined and shown in

Figure 4-24. Bit 3 of the immediate byte controls processor behavior for a precision exception, bit 2 selects the

source of rounding mode control. Bits 1:0 specify a non-sticky rounding-mode value (Table 4-23 lists the encoded

values for rounding-mode field).

The Precision Floating-Point Exception is signaled according to the immediate operand. If any source operand is an

SNaN then it will be converted to a QNaN. If DAZ is set to ‘1 then denormals will be converted to zero before

rounding.

128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL-

1:32) of the corresponding YMM destination register remain unchanged.

VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed.

Operation

IF (imm[2] = ‘1)

THEN

// rounding mode is determined by MXCSR.RC

DEST[31:0] := ConvertSPFPToInteger_M(SRC[31:0]);

ELSE

// rounding mode is determined by IMM8.RC

DEST[31:0] := ConvertSPFPToInteger_Imm(SRC[31:0]);

FI;

DEST[127:32] remains unchanged ;

ROUNDSS (128-bit Legacy SSE version)

DEST[31:0] := RoundToInteger(SRC[31:0], ROUND_CONTROL)

DEST[MAXVL-1:32] (Unmodified)

4-586

Vol. 2B

ROUNDSS—Round Scalar Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

VROUNDSS (VEX.128 encoded version)

DEST[31:0] := RoundToInteger(SRC2[31:0], ROUND_CONTROL)

DEST[127:32] := SRC1[127:32]

DEST[MAXVL-1:128] := 0

Intel C/C++ Compiler Intrinsic Equivalent

ROUNDSS:

__m128 mm_round_ss(__m128 dst, __m128 s1, int iRoundMode);

__m128 mm_floor_ss(__m128 dst, __m128 s1);

__m128 mm_ceil_ss(__m128 dst, __m128 s1);

SIMD Floating-Point Exceptions

Invalid (signaled only if SRC = SNaN)

Precision (signaled only if imm[3] = ‘0; if imm[3] = ‘1, then the Precision Mask in the MXSCSR is ignored and preci-

sion exception is not signaled.)

Note that Denormal is not signaled by ROUNDSS.

Other Exceptions

See Table 2-20, “Type 3 Class Exception Conditions”.

ROUNDSS—Round Scalar Single Precision Floating-Point Values

Vol. 2B

4-587

INSTRUCTION SET REFERENCE, M-U

RSM—Resume From System Management Mode

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F AA

RSM

Valid

Resume operation of interrupted program.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Returns program control from system management mode (SMM) to the application program or operating-system

procedure that was interrupted when the processor received an SMM interrupt. The processor’s state is restored

from the dump created upon entering SMM. If the processor detects invalid state information during state restora-

tion, it enters the shutdown state. The following invalid information can cause a shutdown:

• Any reserved bit of CR4 is set to 1.

• Any illegal combination of bits in CR0, such as (PG=1 and PE=0) or (NW=1 and CD=0).

•

(Intel Pentium and Intel486™ processors only.) The value stored in the state dump base field is not a 32-KByte

aligned address.

The contents of the model-specific registers are not affected by a return from SMM.

The SMM state map used by RSM supports resuming processor context for non-64-bit modes and 64-bit mode.

See Chapter 32, “System Management Mode,” in the Intel® 64 and IA-32 Architectures Software Developer’s

Manual, Volume 3C, for more information about SMM and the behavior of the RSM instruction.

Operation

ReturnFromSMM;

IF (IA-32e mode supported) or (CPUID DisplayFamily_DisplayModel = 06H_0CH )

THEN

ProcessorState := Restore(SMMDump(IA-32e SMM STATE MAP));

Else

ProcessorState := Restore(SMMDump(Non-32-Bit-Mode SMM STATE MAP));

Flags Affected

All.

Protected Mode Exceptions

#UD

If an attempt is made to execute this instruction when the processor is not in SMM.

If the LOCK prefix is used.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

4-588

Vol. 2B

RSM—Resume From System Management Mode

INSTRUCTION SET REFERENCE, M-U

RSQRTPS—Compute Reciprocals of Square Roots of Packed Single Precision Floating-Point

Values

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 52 /r

V/V

SSE

Computes the approximate reciprocals of the

square roots of the packed single precision

RSQRTPS xmm1, xmm2/m128

floating-point values in xmm2/m128 and

stores the results in xmm1.

VEX.128.0F.WIG 52 /r

V/V

AVX

Computes the approximate reciprocals of the

square roots of packed single precision values

VRSQRTPS xmm1, xmm2/m128

in xmm2/mem and stores the results in xmm1.

VEX.256.0F.WIG 52 /r

V/V

AVX

Computes the approximate reciprocals of the

square roots of packed single precision values

VRSQRTPS ymm1, ymm2/m256

in ymm2/mem and stores the results in ymm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Performs a SIMD computation of the approximate reciprocals of the square roots of the four packed single precision

floating-point values in the source operand (second operand) and stores the packed single precision floating-point

results in the destination operand. The source operand can be an XMM register or a 128-bit memory location. The

destination operand is an XMM register. See Figure 10-5 in the Intel® 64 and IA-32 Architectures Software Devel-

oper’s Manual, Volume 1, for an illustration of a SIMD single precision floating-point operation.

The relative error for this approximation is:

|Relative Error| ≤ 1.5 ∗ 2⁻¹²

The RSQRTPS instruction is not affected by the rounding control bits in the MXCSR register. When a source value is

a 0.0, an ∞ of the sign of the source value is returned. A denormal source value is treated as a 0.0 (of the same

sign). When a source value is a negative value (other than −0.0), a floating-point indefinite is returned. When a

source value is an SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN is returned.

In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers

(XMM8-XMM15).

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

YMM register destination are unmodified.

VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination

operand is an XMM register. The upper bits (MAXVL-1:128) of the corresponding YMM register destination are

zeroed.

VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

4-590

Vol. 2B

RSQRTPS—Compute Reciprocals of Square Roots of Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

Operation

RSQRTPS (128-bit Legacy SSE version)

DEST[31:0] := APPROXIMATE(1/SQRT(SRC[31:0]))

DEST[63:32] := APPROXIMATE(1/SQRT(SRC1[63:32]))

DEST[95:64] := APPROXIMATE(1/SQRT(SRC1[95:64]))

DEST[127:96] := APPROXIMATE(1/SQRT(SRC2[127:96]))

DEST[MAXVL-1:128] (Unmodified)

VRSQRTPS (VEX.128 encoded version)

DEST[31:0] := APPROXIMATE(1/SQRT(SRC[31:0]))

DEST[63:32] := APPROXIMATE(1/SQRT(SRC1[63:32]))

DEST[95:64] := APPROXIMATE(1/SQRT(SRC1[95:64]))

DEST[127:96] := APPROXIMATE(1/SQRT(SRC2[127:96]))

DEST[MAXVL-1:128] := 0

VRSQRTPS (VEX.256 encoded version)

DEST[31:0] := APPROXIMATE(1/SQRT(SRC[31:0]))

DEST[63:32] := APPROXIMATE(1/SQRT(SRC1[63:32]))

DEST[95:64] := APPROXIMATE(1/SQRT(SRC1[95:64]))

DEST[127:96] := APPROXIMATE(1/SQRT(SRC2[127:96]))

DEST[159:128] := APPROXIMATE(1/SQRT(SRC2[159:128]))

DEST[191:160] := APPROXIMATE(1/SQRT(SRC2[191:160]))

DEST[223:192] := APPROXIMATE(1/SQRT(SRC2[223:192]))

DEST[255:224] := APPROXIMATE(1/SQRT(SRC2[255:224]))

Intel C/C++ Compiler Intrinsic Equivalent

RSQRTPS:

__m128 _mm_rsqrt_ps(__m128 a)

RSQRTPS:

__m256 _mm256_rsqrt_ps (__m256 a);

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-21, “Type 4 Class Exception Conditions”; additionally:

#UD

If VEX.vvvv ≠ 1111B.

RSQRTPS—Compute Reciprocals of Square Roots of Packed Single Precision Floating-Point Values

Vol. 2B

4-591

INSTRUCTION SET REFERENCE, M-U

RSQRTSS—Compute Reciprocal of Square Root of Scalar Single Precision Floating-Point Value

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F3 0F 52 /r

V/V

SSE

Computes the approximate reciprocal of the

square root of the low single precision

RSQRTSS xmm1, xmm2/m32

floating-point value in xmm2/m32 and stores

the results in xmm1.

VEX.LIG.F3.0F.WIG 52 /r

RVM

V/V

AVX

Computes the approximate reciprocal of the

VRSQRTSS xmm1, xmm2, xmm3/m32

square root of the low single precision

floating-point value in xmm3/m32 and stores

the results in xmm1. Also, upper single

precision floating-point values (bits[127:32])

from xmm2 are copied to xmm1[127:32].

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

RVM

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Computes an approximate reciprocal of the square root of the low single precision floating-point value in the source

operand (second operand) stores the single precision floating-point result in the destination operand. The source

operand can be an XMM register or a 32-bit memory location. The destination operand is an XMM register. The

three high-order doublewords of the destination operand remain unchanged. See Figure 10-6 in the Intel® 64 and

IA-32 Architectures Software Developer’s Manual, Volume 1, for an illustration of a scalar single precision floating-

point operation.

The relative error for this approximation is:

|Relative Error| ≤ 1.5 ∗ 2⁻¹²

The RSQRTSS instruction is not affected by the rounding control bits in the MXCSR register. When a source value is

a 0.0, an ∞ of the sign of the source value is returned. A denormal source value is treated as a 0.0 (of the same

sign). When a source value is a negative value (other than −0.0), a floating-point indefinite is returned. When a

source value is an SNaN or QNaN, the SNaN is converted to a QNaN or the source QNaN is returned.

In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers

(XMM8-XMM15).

128-bit Legacy SSE version: The first source operand and the destination operand are the same. Bits (MAXVL-

1:32) of the corresponding YMM destination register remain unchanged.

VEX.128 encoded version: Bits (MAXVL-1:128) of the destination YMM register are zeroed.

Operation

RSQRTSS (128-bit Legacy SSE version)

DEST[31:0] := APPROXIMATE(1/SQRT(SRC2[31:0]))

DEST[MAXVL-1:32] (Unmodified)

VRSQRTSS (VEX.128 encoded version)

DEST[31:0] := APPROXIMATE(1/SQRT(SRC2[31:0]))

DEST[127:32] := SRC1[127:32]

DEST[MAXVL-1:128] := 0

4-592

Vol. 2B

RSQRTSS—Compute Reciprocal of Square Root of Scalar Single Precision Floating-Point Value

INSTRUCTION SET REFERENCE, M-U

RSTORSSP—Restore Saved Shadow Stack Pointer

Opcode/

Op/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

F3 0F 01 /5 (mod!=11, /5, memory only)

V/V

CET_SS

Restore SSP.

RSTORSSP m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r, w)

N/A

Description

Restores SSP from the shadow-stack-restore token pointed to by m64. If the SSP restore was successful then the

instruction replaces the shadow-stack-restore token with a previous-ssp token. The instruction sets the CF flag to

indicate whether the SSP address recorded in the shadow-stack-restore token that was processed was 4 byte

aligned, i.e., whether an alignment hole was created when the restore-shadow-stack token was pushed on this

shadow stack.

Following RSTORSSP if a restore-shadow-stack token needs to be saved on the previous shadow stack, use the

SAVEPREVSSP instruction.

If pushing a restore-shadow-stack token on the previous shadow stack is not required, the previous-ssp token can

be popped using the INCSSPQ instruction. If the CF flag was set to indicate presence of an alignment hole, an addi-

tional INCSSPD instruction is needed to advance the SSP past the alignment hole.

Operation

IF CPL = 3

IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0

THEN #UD; FI;

ELSE

IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0

THEN #UD; FI;

FI;

SSP_LA = Linear_Address(mem operand)

IF SSP_LA not aligned to 8 bytes

THEN #GP(0); FI;

previous_ssp_token = SSP | (IA32_EFER.LMA AND CS.L) | 0x02

Start Atomic Execution

restore_ssp_token = Locked shadow_stack_load 8 bytes from SSP_LA

fault = 0

IF ((restore_ssp_token & 0x03) != (IA32_EFER.LMA & CS.L))

THEN fault = 1; FI;

(* If L flag in token does not match IA32_EFER.LMA & CS.L or bit 1 is not 0 *)

IF ((IA32_EFER.LMA AND CS.L) = 0 AND restore_ssp_token[63:32] != 0)

THEN fault = 1; FI;

(* If compatibility/legacy mode and SSP to be restored not below 4G *)

TMP = restore_ssp_token & ~0x01

TMP = (TMP - 8)

TMP = TMP & ~0x07

IF TMP != SSP_LA

4-594

Vol. 2B

RSTORSSP—Restore Saved Shadow Stack Pointer

INSTRUCTION SET REFERENCE, M-U

THEN fault = 1; FI;

(* If address in token does not match the requested top of stack *)

TMP = (fault == 0) ? previous_ssp_token : restore_ssp_token

shadow_stack_store 8 bytes of TMP to SSP_LA and release lock

End Atomic Execution

IF fault == 1

THEN #CP(RSTORSSP); FI;

SSP = SSP_LA

// Set the CF if the SSP in the restore token was 4 byte aligned, i.e., there is an alignment hole

RFLAGS.CF = (restore_ssp_token & 0x04) ? 1 : 0;

RFLAGS.ZF,PF,AF,OF,SF := 0;

Flags Affected

CF is set to indicate if the shadow stack pointer in the restore token was 4 byte aligned, else it is cleared. ZF,

PF, AF, OF, and SF are cleared.

C/C++ Compiler Intrinsic Equivalent

RSTORSSP void _rstorssp(void *);

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If linear address of memory operand not 8 byte aligned.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If destination is located in a non-writeable segment.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#CP(rstorssp)

If L bit in token does not match (IA32_EFER.LMA & CS.L).

If address in token does not match linear address of memory operand.

If in 32-bit or compatibility mode and the address in token is not below 4G.

#PF(fault-code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

The RSTORSSP instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The RSTORSSP instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same as protected mode exceptions.

RSTORSSP—Restore Saved Shadow Stack Pointer

Vol. 2B

4-595

INSTRUCTION SET REFERENCE, M-U

SAHF—Store AH Into Flags

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

SAHF

Invalid*

Valid

Loads SF, ZF, AF, PF, and CF from AH into the

EFLAGS register.

NOTES:

1. Valid in specific steppings. See Description section.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Loads the SF, ZF, AF, PF, and CF flags of the EFLAGS register with values from the corresponding bits in the AH

bits (1, 3, and 5) in the EFLAGS register remain as shown in the “Operation” section below.

This instruction executes as described above in compatibility mode and legacy mode. It is valid in 64-bit mode only

if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1.

Operation

IF IA-64 Mode

THEN

IF CPUID.80000001H.ECX[0] = 1;

THEN

RFLAGS(SF:ZF:0:AF:0:PF:1:CF) := AH;

ELSE

#UD;

ELSE

EFLAGS(SF:ZF:0:AF:0:PF:1:CF) := AH;

FI;

Flags Affected

The SF, ZF, AF, PF, and CF flags are loaded with values from the AH register. Bits 1, 3, and 5 of the EFLAGS register

are unaffected, with the values remaining 1, 0, and 0, respectively.

Protected Mode Exceptions

None.

Real-Address Mode Exceptions

None.

Virtual-8086 Mode Exceptions

None.

Compatibility Mode Exceptions

None.

SAHF—Store AH Into Flags

Vol. 2B

4-597

INSTRUCTION SET REFERENCE, M-U

SAL/SAR/SHL/SHR—Shift

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

D0 /4

SAL r/m8, 1

Valid

Multiply r/m8 by 2, once.

REX + D0 /4

SAL r/m8², 1

Valid

N.E.

Multiply r/m8 by 2, once.

D2 /4

SAL r/m8, CL

Valid

Multiply r/m8 by 2, CL times.

REX + D2 /4

SAL r/m8², CL

Valid

N.E.

Multiply r/m8 by 2, CL times.

C0 /4 ib

SAL r/m8, imm8

Valid

Multiply r/m8 by 2, imm8 times.

REX + C0 /4 ib

SAL r/m8², imm8

Valid

N.E.

Multiply r/m8 by 2, imm8 times.

D1 /4

SAL r/m16, 1

Valid

Multiply r/m16 by 2, once.

D3 /4

SAL r/m16, CL

Valid

Multiply r/m16 by 2, CL times.

C1 /4 ib

SAL r/m16, imm8

Valid

Multiply r/m16 by 2, imm8 times.

D1 /4

SAL r/m32, 1

Valid

Multiply r/m32 by 2, once.

REX.W + D1 /4

SAL r/m64, 1

Valid

N.E.

Multiply r/m64 by 2, once.

D3 /4

SAL r/m32, CL

Valid

Multiply r/m32 by 2, CL times.

REX.W + D3 /4

SAL r/m64, CL

Valid

N.E.

Multiply r/m64 by 2, CL times.

C1 /4 ib

SAL r/m32, imm8

Valid

Multiply r/m32 by 2, imm8 times.

REX.W + C1 /4 ib

SAL r/m64, imm8

Valid

N.E.

Multiply r/m64 by 2, imm8 times.

D0 /7

SAR r/m8, 1

Valid

Signed divide³ r/m8 by 2, once.

REX + D0 /7

SAR r/m8², 1

Valid

N.E.

Signed divide³ r/m8 by 2, once.

D2 /7

SAR r/m8, CL

Valid

Signed divide³ r/m8 by 2, CL times.

REX + D2 /7

SAR r/m8², CL

Valid

N.E.

Signed divide³ r/m8 by 2, CL times.

C0 /7 ib

SAR r/m8, imm8

Valid

Signed divide³ r/m8 by 2, imm8 times.

REX + C0 /7 ib

SAR r/m8², imm8

Valid

N.E.

Signed divide³ r/m8 by 2, imm8 times.

D1 /7

SAR r/m16,1

Valid

Signed divide³ r/m16 by 2, once.

D3 /7

SAR r/m16, CL

Valid

Signed divide³ r/m16 by 2, CL times.

C1 /7 ib

SAR r/m16, imm8

Valid

Signed divide³r/m16 by 2, imm8 times.

D1 /7

SAR r/m32, 1

Valid

Signed divide³ r/m32 by 2, once.

REX.W + D1 /7

SAR r/m64, 1

Valid

N.E.

Signed divide³ r/m64 by 2, once.

D3 /7

SAR r/m32, CL

Valid

Signed divide³r/m32 by 2, CL times.

REX.W + D3 /7

SAR r/m64, CL

Valid

N.E.

Signed divide³r/m64 by 2, CL times.

C1 /7 ib

SAR r/m32, imm8

Valid

Signed divide³r/m32 by 2, imm8 times.

REX.W + C1 /7 ib

SAR r/m64, imm8

Valid

N.E.

Signed divide³r/m64 by 2, imm8 times

D0 /4

SHL r/m8, 1

Valid

Multiply r/m8 by 2, once.

REX + D0 /4

SHL r/m8², 1

Valid

N.E.

Multiply r/m8 by 2, once.

D2 /4

SHL r/m8, CL

Valid

Multiply r/m8 by 2, CL times.

REX + D2 /4

SHL r/m8², CL

Valid

N.E.

Multiply r/m8 by 2, CL times.

C0 /4 ib

SHL r/m8, imm8

Valid

Multiply r/m8 by 2, imm8 times.

REX + C0 /4 ib

SHL r/m8², imm8

Valid

N.E.

Multiply r/m8 by 2, imm8 times.

D1 /4

SHL r/m16,1

Valid

Multiply r/m16 by 2, once.

D3 /4

SHL r/m16, CL

Valid

Multiply r/m16 by 2, CL times.

C1 /4 ib

SHL r/m16, imm8

Valid

Multiply r/m16 by 2, imm8 times.

D1 /4

SHL r/m32,1

Valid

Multiply r/m32 by 2, once.

SAL/SAR/SHL/SHR—Shift

Vol. 2B

4-599

INSTRUCTION SET REFERENCE, M-U

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

REX.W + D1 /4

SHL r/m64,1

Valid

N.E.

Multiply r/m64 by 2, once.

D3 /4

SHL r/m32, CL

Valid

Multiply r/m32 by 2, CL times.

REX.W + D3 /4

SHL r/m64, CL

Valid

N.E.

Multiply r/m64 by 2, CL times.

C1 /4 ib

SHL r/m32, imm8

Valid

Multiply r/m32 by 2, imm8 times.

REX.W + C1 /4 ib

SHL r/m64, imm8

Valid

N.E.

Multiply r/m64 by 2, imm8 times.

D0 /5

SHR r/m8,1

Valid

Unsigned divide r/m8 by 2, once.

REX + D0 /5

SHR r/m8², 1

Valid

N.E.

Unsigned divide r/m8 by 2, once.

D2 /5

SHR r/m8, CL

Valid

Unsigned divide r/m8 by 2, CL times.

REX + D2 /5

SHR r/m8², CL

Valid

N.E.

Unsigned divide r/m8 by 2, CL times.

C0 /5 ib

SHR r/m8, imm8

Valid

Unsigned divide r/m8 by 2, imm8 times.

REX + C0 /5 ib

SHR r/m8², imm8

Valid

N.E.

Unsigned divide r/m8 by 2, imm8 times.

D1 /5

SHR r/m16, 1

Valid

Unsigned divide r/m16 by 2, once.

D3 /5

SHR r/m16, CL

Valid

Unsigned divide r/m16 by 2, CL times

C1 /5 ib

SHR r/m16, imm8

Valid

Unsigned divide r/m16 by 2, imm8 times.

D1 /5

SHR r/m32, 1

Valid

Unsigned divide r/m32 by 2, once.

REX.W + D1 /5

SHR r/m64, 1

Valid

N.E.

Unsigned divide r/m64 by 2, once.

D3 /5

SHR r/m32, CL

Valid

Unsigned divide r/m32 by 2, CL times.

REX.W + D3 /5

SHR r/m64, CL

Valid

N.E.

Unsigned divide r/m64 by 2, CL times.

C1 /5 ib

SHR r/m32, imm8

Valid

Unsigned divide r/m32 by 2, imm8 times.

REX.W + C1 /5 ib

SHR r/m64, imm8

Valid

N.E.

Unsigned divide r/m64 by 2, imm8 times.

NOTES:

1. See the IA-32 Architecture Compatibility section below.

2. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

3. Not the same form of division as IDIV; rounding is toward negative infinity.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r, w)

N/A

ModRM:r/m (r, w)

N/A

ModRM:r/m (r, w)

imm8

N/A

Description

Shifts the bits in the first operand (destination operand) to the left or right by the number of bits specified in the

second operand (count operand). Bits shifted beyond the destination operand boundary are first shifted into the CF

flag, then discarded. At the end of the shift operation, the CF flag contains the last bit shifted out of the destination

operand.

The destination operand can be a register or a memory location. The count operand can be an immediate value or

the CL register. The count is masked to 5 bits (or 6 bits if in 64-bit mode and REX.W is used). The count range is

limited to 0 to 31 (or 63 if 64-bit mode and REX.W is used). A special opcode encoding is provided for a count of 1.

The shift arithmetic left (SAL) and shift logical left (SHL) instructions perform the same operation; they shift the

bits in the destination operand to the left (toward more significant bit locations). For each shift count, the most

significant bit of the destination operand is shifted into the CF flag, and the least significant bit is cleared (see

Figure 7-7 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1).

4-600

Vol. 2B

SAL/SAR/SHL/SHR—Shift

INSTRUCTION SET REFERENCE, M-U

The shift arithmetic right (SAR) and shift logical right (SHR) instructions shift the bits of the destination operand to

the right (toward less significant bit locations). For each shift count, the least significant bit of the destination

operand is shifted into the CF flag, and the most significant bit is either set or cleared depending on the instruction

type. The SHR instruction clears the most significant bit (see Figure 7-8 in the Intel® 64 and IA-32 Architectures

Software Developer’s Manual, Volume 1); the SAR instruction sets or clears the most significant bit to correspond

to the sign (most significant bit) of the original value in the destination operand. In effect, the SAR instruction fills

the empty bit position’s shifted value with the sign of the unshifted value (see Figure 7-9 in the Intel® 64 and IA-32

Architectures Software Developer’s Manual, Volume 1).

The SAR and SHR instructions can be used to perform signed or unsigned division, respectively, of the destination

operand by powers of 2. For example, using the SAR instruction to shift a signed integer 1 bit to the right divides

the value by 2.

Using the SAR instruction to perform a division operation does not produce the same result as the IDIV instruction.

The quotient from the IDIV instruction is rounded toward zero, whereas the “quotient” of the SAR instruction is

rounded toward negative infinity. This difference is apparent only for negative numbers. For example, when the

IDIV instruction is used to divide -9 by 4, the result is -2 with a remainder of -1. If the SAR instruction is used to

shift -9 right by two bits, the result is -3 and the “remainder” is +3; however, the SAR instruction stores only the

most significant bit of the remainder (in the CF flag).

The OF flag is affected only on 1-bit shifts. For left shifts, the OF flag is set to 0 if the most-significant bit of the

result is the same as the CF flag (that is, the top two bits of the original operand were the same); otherwise, it is

set to 1. For the SAR instruction, the OF flag is cleared for all 1-bit shifts. For the SHR instruction, the OF flag is set

to the most-significant bit of the original operand.

In 64-bit mode, the instruction’s default operation size is 32 bits and the mask width for CL is 5 bits. Using a REX

prefix in the form of REX.R permits access to additional registers (R8-R15). Using a REX prefix in the form of REX.W

promotes operation to 64-bits and sets the mask width for CL to 6 bits. See the summary chart at the beginning of

this section for encoding data and limits.

IA-32 Architecture Compatibility

The 8086 does not mask the shift count. However, all other IA-32 processors (starting with the Intel 286 processor)

do mask the shift count to 5 bits, resulting in a maximum count of 31. This masking is done in all operating modes

(including the virtual-8086 mode) to reduce the maximum execution time of the instructions.

Operation

IF 64-Bit Mode and using REX.W

THEN

countMASK := 3FH;

ELSE

countMASK := 1FH;

tempCOUNT := (COUNT AND countMASK);

tempDEST := DEST;

WHILE (tempCOUNT ≠ 0)

IF instruction is SAL or SHL

THEN

CF := MSB(DEST);

ELSE (* Instruction is SAR or SHR *)

CF := LSB(DEST);

FI;

IF instruction is SAL or SHL

THEN

DEST := DEST ∗ 2;

ELSE

IF instruction is SAR

SAL/SAR/SHL/SHR—Shift

Vol. 2B

4-601

INSTRUCTION SET REFERENCE, M-U

THEN

DEST := DEST / 2; (* Signed divide, rounding toward negative infinity *)

ELSE (* Instruction is SHR *)

DEST := DEST / 2 ; (* Unsigned divide *)

FI;

tempCOUNT := tempCOUNT - 1;

OD;

(* Determine overflow for the various instructions *)

IF (COUNT and countMASK) = 1

THEN

IF instruction is SAL or SHL

THEN

OF := MSB(DEST) XOR CF;

ELSE

IF instruction is SAR

THEN

OF := 0;

ELSE (* Instruction is SHR *)

OF := MSB(tempDEST);

FI;

ELSE IF (COUNT AND countMASK) = 0

THEN

All flags unchanged;

ELSE (* COUNT not 1 or 0 *)

OF := undefined;

FI;

Flags Affected

The CF flag contains the value of the last bit shifted out of the destination operand; it is undefined for SHL and SHR

instructions where the count is greater than or equal to the size (in bits) of the destination operand. The OF flag is

affected only for 1-bit shifts (see “Description” above); otherwise, it is undefined. The SF, ZF, and PF flags are set

according to the result. If the count is 0, the flags are not affected. For a non-zero count, the AF flag is undefined.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

4-602

Vol. 2B

SAL/SAR/SHL/SHR—Shift

INSTRUCTION SET REFERENCE, M-U

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

SAL/SAR/SHL/SHR—Shift

Vol. 2B

4-603

INSTRUCTION SET REFERENCE, M-U

SARX/SHLX/SHRX—Shift Without Affecting Flags

Opcode/

Op/

64/32-

CPUID

Description

Instruction

bit

Feature

Mode

Flag

VEX.LZ.F3.0F38.W0 F7 /r

RMV

V/V

BMI2

Shift r/m32 arithmetically right with count specified in r32b.

SARX r32a, r/m32, r32b

VEX.LZ.66.0F38.W0 F7 /r

RMV

V/V

BMI2

Shift r/m32 logically left with count specified in r32b.

SHLX r32a, r/m32, r32b

VEX.LZ.F2.0F38.W0 F7 /r

RMV

V/V

BMI2

Shift r/m32 logically right with count specified in r32b.

SHRX r32a, r/m32, r32b

VEX.LZ.F3.0F38.W1 F7 /r

RMV

V/N.E.

BMI2

Shift r/m64 arithmetically right with count specified in r64b.

SARX r64a, r/m64, r64b

VEX.LZ.66.0F38.W1 F7 /r

RMV

V/N.E.

BMI2

Shift r/m64 logically left with count specified in r64b.

SHLX r64a, r/m64, r64b

VEX.LZ.F2.0F38.W1 F7 /r

RMV

V/N.E.

BMI2

Shift r/m64 logically right with count specified in r64b.

SHRX r64a, r/m64, r64b

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

RMV

ModRM:reg (w)

ModRM:r/m (r)

VEX.vvvv (r)

N/A

Description

Shifts the bits of the first source operand (the second operand) to the left or right by a COUNT value specified in the

second source operand (the third operand). The result is written to the destination operand (the first operand).

The shift arithmetic right (SARX) and shift logical right (SHRX) instructions shift the bits of the destination operand

to the right (toward less significant bit locations), SARX keeps and propagates the most significant bit (sign bit)

while shifting.

The logical shift left (SHLX) shifts the bits of the destination operand to the left (toward more significant bit loca-

tions).

This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in

64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An attempt

to execute this instruction with VEX.L not equal to 0 will cause #UD.

If the value specified in the first source operand exceeds OperandSize -1, the COUNT value is masked.

SARX,SHRX, and SHLX instructions do not update flags.

Operation

TEMP := SRC1;

IF VEX.W1 and CS.L = 1

THEN

countMASK := 3FH;

ELSE

countMASK := 1FH;

COUNT := (SRC2 AND countMASK)

DEST[OperandSize -1] = TEMP[OperandSize -1];

DO WHILE (COUNT ≠ 0)

IF instruction is SHLX

THEN

DEST[] := DEST *2;

4-604

Vol. 2B

SARX/SHLX/SHRX—Shift Without Affecting Flags

INSTRUCTION SET REFERENCE, M-U

SAVEPREVSSP—Save Previous Shadow Stack Pointer

Opcode/

Op/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

F3 0F 01 EA (mod!=11, /5, RM=010)

V/V

CET_SS

Save a restore-shadow-stack token on previous shadow

SAVEPREVSSP

stack.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Push a restore-shadow-stack token on the previous shadow stack at the next 8 byte aligned boundary. The

previous SSP is obtained from the previous-ssp token at the top of the current shadow stack.

Operation

IF CPL = 3

IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0

THEN #UD; FI;

ELSE

IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0

THEN #UD; FI;

FI;

IF SSP not aligned to 8 bytes

THEN #GP(0); FI;

(* Pop the “previous-ssp” token from current shadow stack *)

previous_ssp_token = ShadowStackPop8B(SSP)

(* If the CF flag indicates there was a alignment hole on current shadow stack then pop that alignment hole *)

(* Note that the alignment hole must be zero and can be present only when in legacy/compatibility mode *)

IF RFLAGS.CF == 1 AND (IA32_EFER.LMA AND CS.L)

#GP(0)

FI;

IF RFLAGS.CF == 1

must_be_zero = ShadowStackPop4B(SSP)

IF must_be_zero != 0 THEN #GP(0)

FI;

(* Previous SSP token must have the bit 1 set *)

IF ((previous_ssp_token & 0x02) == 0)

THEN #GP(0); (* bit 1 was 0 *)

IF ((IA32_EFER.LMA AND CS.L) = 0 AND previous_ssp_token [63:32] != 0)

THEN #GP(0); FI; (* If compatibility/legacy mode and SSP not in 4G *)

(* Save Prev SSP from previous_ssp_token to the old shadow stack at next 8 byte aligned address *)

old_SSP = previous_ssp_token & ~0x03

temp := (old_SSP | (IA32_EFER.LMA & CS.L));

Shadow_stack_store 4 bytes of 0 to (old_SSP - 4)

old_SSP := old_SSP & ~0x07;

4-606

Vol. 2B

SAVEPREVSSP—Save Previous Shadow Stack Pointer

INSTRUCTION SET REFERENCE, M-U

Shadow_stack_store 8 bytes of temp to (old_SSP - 8)

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

SAVEPREVSSP void _saveprevssp(void);

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

IF CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

IF CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If SSP not 8 byte aligned.

If alignment hole on shadow stack is not 0.

If bit 1 of the previous-ssp token is not set to 1.

If in 32-bit/compatibility mode and SSP recorded in previous-ssp token is beyond 4G.

#PF(fault-code)

If a page fault occurs.

Real-Address Mode Exceptions

#UD

The SAVEPREVSSP instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The SAVEPREVSSP instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same as protected mode exceptions.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

If CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If SSP not 8 byte aligned.

If carry flag is set.

If bit 1 of the previous-ssp token is not set to 1.

#PF(fault-code)

If a page fault occurs.

SAVEPREVSSP—Save Previous Shadow Stack Pointer

Vol. 2B

4-607

INSTRUCTION SET REFERENCE, M-U

SBB—Integer Subtraction With Borrow

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

1C ib

SBB AL, imm8

Valid

Subtract with borrow imm8 from AL.

1D iw

SBB AX, imm16

Valid

Subtract with borrow imm16 from AX.

1D id

SBB EAX, imm32

Valid

Subtract with borrow imm32 from EAX.

REX.W + 1D id

SBB RAX, imm32

Valid

N.E.

Subtract with borrow sign-extended imm.32

to 64-bits from RAX.

80 /3 ib

SBB r/m8, imm8

Valid

Subtract with borrow imm8 from r/m8.

REX + 80 /3 ib

SBB r/m8¹, imm8

Valid

N.E.

Subtract with borrow imm8 from r/m8.

81 /3 iw

SBB r/m16, imm16

Valid

Subtract with borrow imm16 from r/m16.

81 /3 id

SBB r/m32, imm32

Valid

Subtract with borrow imm32 from r/m32.

REX.W + 81 /3 id

SBB r/m64, imm32

Valid

N.E.

Subtract with borrow sign-extended imm32 to

64-bits from r/m64.

83 /3 ib

SBB r/m16, imm8

Valid

Subtract with borrow sign-extended imm8

from r/m16.

83 /3 ib

SBB r/m32, imm8

Valid

Subtract with borrow sign-extended imm8

from r/m32.

REX.W + 83 /3 ib

SBB r/m64, imm8

Valid

N.E.

Subtract with borrow sign-extended imm8

from r/m64.

18 /r

SBB r/m8, r8

Valid

Subtract with borrow r8 from r/m8.

REX + 18 /r

SBB r/m8¹, r8

Valid

N.E.

Subtract with borrow r8 from r/m8.

19 /r

SBB r/m16, r16

Valid

Subtract with borrow r16 from r/m16.

19 /r

SBB r/m32, r32

Valid

Subtract with borrow r32 from r/m32.

REX.W + 19 /r

SBB r/m64, r64

Valid

N.E.

Subtract with borrow r64 from r/m64.

1A /r

SBB r8, r/m8

Valid

Subtract with borrow r/m8 from r8.

REX + 1A /r

SBB r8¹, r/m8¹

Valid

N.E.

Subtract with borrow r/m8 from r8.

1B /r

SBB r16, r/m16

Valid

Subtract with borrow r/m16 from r16.

1B /r

SBB r32, r/m32

Valid

Subtract with borrow r/m32 from r32.

REX.W + 1B /r

SBB r64, r/m64

Valid

N.E.

Subtract with borrow r/m64 from r64.

NOTES:

1. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

AL/AX/EAX/RAX

imm8/16/32

N/A

ModRM:r/m (w)

imm8/16/32

N/A

ModRM:r/m (w)

ModRM:reg (r)

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

4-608

Vol. 2B

SBB—Integer Subtraction With Borrow

INSTRUCTION SET REFERENCE, M-U

Description

Adds the source operand (second operand) and the carry (CF) flag, and subtracts the result from the destination

operand (first operand). The result of the subtraction is stored in the destination operand. The destination operand

can be a register or a memory location; the source operand can be an immediate, a register, or a memory location.

(However, two memory operands cannot be used in one instruction.) The state of the CF flag represents a borrow

from a previous subtraction.

When an immediate value is used as an operand, it is sign-extended to the length of the destination operand

format.

The SBB instruction does not distinguish between signed or unsigned operands. Instead, the processor evaluates

the result for both data types and sets the OF and CF flags to indicate a borrow in the signed or unsigned result,

respectively. The SF flag indicates the sign of the signed result.

The SBB instruction is usually executed as part of a multibyte or multiword subtraction in which a SUB instruction

is followed by a SBB instruction.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

Operation

DEST := (DEST - (SRC + CF));

Intel C/C++ Compiler Intrinsic Equivalent

SBB:

extern unsigned char _subborrow_u8(unsigned char c_in, unsigned char src1, unsigned char src2, unsigned char *diff_out);

SBB:

extern unsigned char _subborrow_u16(unsigned char c_in, unsigned short src1, unsigned short src2, unsigned short

*diff_out);

SBB:

extern unsigned char _subborrow_u32(unsigned char c_in, unsigned int src1, unsigned char int, unsigned int *diff_out);

SBB:

extern unsigned char _subborrow_u64(unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned

__int64 *diff_out);

Flags Affected

The OF, SF, ZF, AF, PF, and CF flags are set according to the result.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

SBB—Integer Subtraction With Borrow

Vol. 2B

4-609

INSTRUCTION SET REFERENCE, M-U

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

4-610

Vol. 2B

SBB—Integer Subtraction With Borrow

INSTRUCTION SET REFERENCE, M-U

SCAS/SCASB/SCASW/SCASD—Scan String

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

SCAS m8

Valid

Compare AL with byte at ES:(E)DI or RDI, then

set status flags.¹

SCAS m16

Valid

Compare AX with word at ES:(E)DI or RDI, then

set status flags.¹

SCAS m32

Valid

Compare EAX with doubleword at ES(E)DI or

RDI then set status flags.¹

REX.W + AF

SCAS m64

Valid

N.E.

Compare RAX with quadword at RDI or EDI

then set status flags.

SCASB

Valid

Compare AL with byte at ES:(E)DI or RDI then

set status flags.¹

SCASW

Valid

Compare AX with word at ES:(E)DI or RDI then

set status flags.¹

SCASD

Valid

Compare EAX with doubleword at ES:(E)DI or

RDI then set status flags.¹

REX.W + AF

SCASQ

Valid

N.E.

Compare RAX with quadword at RDI or EDI

then set status flags.

NOTES:

1. In 64-bit mode, only 64-bit (RDI) and 32-bit (EDI) address sizes are supported. In non-64-bit mode, only 32-bit (EDI) and 16-bit (DI)

address sizes are supported.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

In non-64-bit modes and in default 64-bit mode: this instruction compares a byte, word, doubleword or quadword

specified using a memory operand with the value in AL, AX, or EAX. It then sets status flags in EFLAGS recording

the results. The memory operand address is read from ES:(E)DI register (depending on the address-size attribute

of the instruction and the current operational mode). Note that ES cannot be overridden with a segment override

prefix.

At the assembly-code level, two forms of this instruction are allowed. The explicit-operand form and the no-oper-

ands form. The explicit-operand form (specified using the SCAS mnemonic) allows a memory operand to be spec-

ified explicitly. The memory operand must be a symbol that indicates the size and location of the operand value.

The register operand is then automatically selected to match the size of the memory operand (AL register for byte

comparisons, AX for word comparisons, EAX for doubleword comparisons). The explicit-operand form is provided

to allow documentation. Note that the documentation provided by this form can be misleading. That is, the

memory operand symbol must specify the correct type (size) of the operand (byte, word, or doubleword) but it

does not have to specify the correct location. The location is always specified by ES:(E)DI.

The no-operands form of the instruction uses a short form of SCAS. Again, ES:(E)DI is assumed to be the memory

operand and AL, AX, or EAX is assumed to be the register operand. The size of operands is selected by the

mnemonic: SCASB (byte comparison), SCASW (word comparison), or SCASD (doubleword comparison).

After the comparison, the (E)DI register is incremented or decremented automatically according to the setting of

the DF flag in the EFLAGS register. If the DF flag is 0, the (E)DI register is incremented; if the DF flag is 1, the (E)DI

ations, and by 4 for doubleword operations.

SCAS/SCASB/SCASW/SCASD—Scan String

Vol. 2B

4-611

INSTRUCTION SET REFERENCE, M-U

SCAS, SCASB, SCASW, SCASD, and SCASQ can be preceded by the REP prefix for block comparisons of ECX bytes,

words, doublewords, or quadwords. Often, however, these instructions will be used in a LOOP construct that takes

some action based on the setting of status flags. See “REP/REPE/REPZ /REPNE/REPNZ—Repeat String Operation

Prefix” in this chapter for a description of the REP prefix.

In 64-bit mode, the instruction’s default address size is 64-bits, 32-bit address size is supported using the prefix

67H. Using a REX prefix in the form of REX.W promotes operation on doubleword operand to 64 bits. The 64-bit no-

operand mnemonic is SCASQ. Address of the memory operand is specified in either RDI or EDI, and

AL/AX/EAX/RAX may be used as the register operand. After a comparison, the destination register is incremented

or decremented by the current operand size (depending on the value of the DF flag). See the summary chart at the

beginning of this section for encoding data and limits.

Operation

Non-64-bit Mode:

IF (Byte comparison)

THEN

temp := AL − SRC;

SetStatusFlags(temp);

THEN IF DF = 0

THEN (E)DI := (E)DI + 1;

ELSE (E)DI := (E)DI - 1; FI;

ELSE IF (Word comparison)

THEN

temp := AX − SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (E)DI := (E)DI + 2;

ELSE (E)DI := (E)DI - 2; FI;

FI;

ELSE IF (Doubleword comparison)

THEN

temp := EAX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (E)DI := (E)DI + 4;

ELSE (E)DI := (E)DI - 4; FI;

FI;

64-bit Mode:

IF (Byte cmparison)

THEN

temp := AL − SRC;

SetStatusFlags(temp);

THEN IF DF = 0

THEN (R|E)DI := (R|E)DI + 1;

ELSE (R|E)DI := (R|E)DI - 1; FI;

ELSE IF (Word comparison)

THEN

temp := AX − SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (R|E)DI := (R|E)DI + 2;

4-612

Vol. 2B

SCAS/SCASB/SCASW/SCASD—Scan String

INSTRUCTION SET REFERENCE, M-U

ELSE (R|E)DI := (R|E)DI - 2; FI;

FI;

ELSE IF (Doubleword comparison)

THEN

temp := EAX - SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (R|E)DI := (R|E)DI + 4;

ELSE (R|E)DI := (R|E)DI - 4; FI;

FI;

ELSE IF (Quadword comparison using REX.W )

THEN

temp := RAX − SRC;

SetStatusFlags(temp);

IF DF = 0

THEN (R|E)DI := (R|E)DI + 8;

ELSE (R|E)DI := (R|E)DI - 8;

FI;

Flags Affected

The OF, SF, ZF, AF, PF, and CF flags are set according to the temporary result of the comparison.

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the limit of the ES segment.

If the ES register contains a NULL segment selector.

If an illegal memory operand effective address in the ES segment is given.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

SCAS/SCASB/SCASW/SCASD—Scan String

Vol. 2B

4-613

INSTRUCTION SET REFERENCE, M-U

SENDUIPI—Send User Interprocessor Interrupt

Opcode/

Op/

64/32

CPUID Feature

Description

Instruction

bit Mode

Flag

Support

F3 0F C7 /6

V/I

UINTR

Send interprocessor user interrupt.

SENDUIPI reg

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r)

N/A

Description

The SENDUIPI instruction sends the user interprocessor interrupt (IPI) indicated by its register operand. (The

operand always has 64 bits; operand-size overrides such as the prefix 66 are ignored.)

SENDUIPI uses a data structure called the user-interrupt target table (UITT). This table is located at the linear

address UITTADDR (in the IA32_UINTR_TT MSR); it comprises UITTSZ+1 16-byte entries, where UITTSZ =

IA32_UINT_MISC[31:0]. SENDUIPI uses the UITT entry (UITTE) indexed by the instruction's register operand.

Each UITTE has the following format:

• Bit 0: V, a valid bit.

• Bits 7:1 are reserved and must be 0.

• Bits 15:8: UV, the user-interrupt vector (in the range 0-63, so bits 15:14 must be 0).

• Bits 63:16 are reserved.

• Bits 127:64: UPIDADDR, the linear address of a user posted-interrupt descriptor (UPID). (UPIDADDR is 64-

byte aligned, so bits 69:64 of each UITTE must be 0.)

Each UPID has the following format (fields and bits not referenced are reserved):

• Bit 0 (ON) indicates an outstanding notification. If this bit is set, there is a notification outstanding for one or

more user interrupts in PIR.

• Bit 1 (SN) indicates that notifications should be suppressed. If this bit is set, agents (including SENDUIPI)

should not send notifications when posting user interrupts in this descriptor.

• Bits 23:16 (NV) contain the notification vector. This is used by agents sending user-interrupt notifications

(including SENDUIPI).

• Bits 63:32 (NDST) contain the notification destination. This is the target physical APIC ID (in xAPIC mode,

bits 47:40 are the 8-bit APIC ID; in x2APIC mode, the entire field forms the 32-bit APIC ID).

• Bits 127:64 (PIF) contain posted-interrupt requests. There is one bit for each user-interrupt vector. There is a

user-interrupt request for a vector if the corresponding bit is 1.

Although SENDUIPI may be executed at any privilege level, all of the instruction’s memory accesses (to a UITTE

and a UPID) are performed with supervisor privilege.

SENDUIPI sends a user interrupt by posting a user interrupt with vector V in the UPID referenced by UPIDADDR

and then sending, as an ordinary IPI, any notification interrupt specified in that UPID.

Operation

IF reg > UITTSZ;

THEN #GP(0);

FI;

read tempUITTE from 16 bytes at UITTADDR+ (reg « 4);

IF tempUITTE.V = 0 or tempUITTE sets any reserved bit

THEN #GP(0);

FI;

read tempUPID from 16 bytes at tempUITTE.UPIDADDR;// under lock

SENDUIPI—Send User Interprocessor Interrupt

Vol. 2B

4-615

INSTRUCTION SET REFERENCE, M-U

IF tempUPID sets any reserved bits or bits that must be zero

THEN #GP(0); // release lock

FI;

tempUPID.PIR[tempUITTE.UV] := 1;

IF tempUPID.SN = tempUPID.ON = 0

THEN

tempUPID.ON := 1;

sendNotify := 1;

ELSE sendNotify := 0;

FI;

write tempUPID to 16 bytes at tempUITTE.UPIDADDR;// release lock

IF sendNotify = 1

THEN

IF local APIC is in x2APIC mode

THEN send ordinary IPI with vector tempUPID.NV

to 32-bit physical APIC ID tempUPID.NDST;

ELSE send ordinary IPI with vector tempUPID.NV

to 8-bit physical APIC ID tempUPID.NDST[15:8];

FI;

Flags Affected

None.

Protected Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

The SENDUIPI instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If executed inside an enclave.

If CR4.UINTR = 0.

If IA32_UINTR_TT[0] = 0.

If CPUID.07H.0H:EDX.UINTR[bit 5] = 0.

#PF

If a page fault occurs.

#GP

If the value of the register operand exceeds UITTSZ.

If the selected UITTE is not valid or sets any reserved bits.

If the selected UPID sets any reserved bits.

If there is an attempt to access memory using a linear address that is not canonical relative to

the current paging mode.

4-616

Vol. 2B

SENDUIPI—Send User Interprocessor Interrupt

INSTRUCTION SET REFERENCE, M-U

SERIALIZE—Serialize Instruction Execution

Opcode/

Op/

64/32

CPUID Feature

Description

Instruction

bit Mode

Flag

Support

NP 0F 01 E8

V/V

SERIALIZE

Serialize instruction fetch and execution.

SERIALIZE

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Serializes instruction execution. Before the next instruction is fetched and executed, the SERIALIZE instruction

ensures that all modifications to flags, registers, and memory by previous instructions are completed, draining all

buffered writes to memory. This instruction is also a serializing instruction as defined in the section “Serializing

Instructions” in Chapter 9 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.

SERIALIZE does not modify registers, arithmetic flags, or memory.

Operation

Wait_On_Fetch_And_Execution_Of_Next_Instruction_Until(preceding_instructions_complete_and_preceding_stores_globally_visible);

Intel C/C++ Compiler Intrinsic Equivalent

SERIALIZE void _serialize(void);

SIMD Floating-Point Exceptions

None.

Other Exceptions

#UD

If the LOCK prefix is used.

If CPUID.07H.0H:EDX.SERIALIZE[bit 14] = 0.

SERIALIZE—Serialize Instruction Execution

Vol. 2B

4-617

INSTRUCTION SET REFERENCE, M-U

SETcc—Set Byte on Condition

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 97

SETA r/m8

Valid

Set byte if above (CF=0 and ZF=0).

REX + 0F 97

SETA r/m8¹

Valid

N.E.

Set byte if above (CF=0 and ZF=0).

0F 93

SETAE r/m8

Valid

Set byte if above or equal (CF=0).

REX + 0F 93

SETAE r/m8¹

Valid

N.E.

Set byte if above or equal (CF=0).

0F 92

SETB r/m8

Valid

Set byte if below (CF=1).

REX + 0F 92

SETB r/m8¹

Valid

N.E.

Set byte if below (CF=1).

0F 96

SETBE r/m8

Valid

Set byte if below or equal (CF=1 or ZF=1).

REX + 0F 96

SETBE r/m8¹

Valid

N.E.

Set byte if below or equal (CF=1 or ZF=1).

0F 92

SETC r/m8

Valid

Set byte if carry (CF=1).

REX + 0F 92

SETC r/m8¹

Valid

N.E.

Set byte if carry (CF=1).

0F 94

SETE r/m8

Valid

Set byte if equal (ZF=1).

REX + 0F 94

SETE r/m8¹

Valid

N.E.

Set byte if equal (ZF=1).

0F 9F

SETG r/m8

Valid

Set byte if greater (ZF=0 and SF=OF).

REX + 0F 9F

SETG r/m8¹

Valid

N.E.

Set byte if greater (ZF=0 and SF=OF).

0F 9D

SETGE r/m8

Valid

Set byte if greater or equal (SF=OF).

REX + 0F 9D

SETGE r/m8¹

Valid

N.E.

Set byte if greater or equal (SF=OF).

0F 9C

SETL r/m8

Valid

Set byte if less (SF≠ OF).

REX + 0F 9C

SETL r/m8¹

Valid

N.E.

Set byte if less (SF≠ OF).

0F 9E

SETLE r/m8

Valid

Set byte if less or equal (ZF=1 or SF≠ OF).

REX + 0F 9E

SETLE r/m8¹

Valid

N.E.

Set byte if less or equal (ZF=1 or SF≠ OF).

0F 96

SETNA r/m8

Valid

Set byte if not above (CF=1 or ZF=1).

REX + 0F 96

SETNA r/m8¹

Valid

N.E.

Set byte if not above (CF=1 or ZF=1).

0F 92

SETNAE r/m8

Valid

Set byte if not above or equal (CF=1).

REX + 0F 92

SETNAE r/m8¹

Valid

N.E.

Set byte if not above or equal (CF=1).

0F 93

SETNB r/m8

Valid

Set byte if not below (CF=0).

REX + 0F 93

SETNB r/m8¹

Valid

N.E.

Set byte if not below (CF=0).

0F 97

SETNBE r/m8

Valid

Set byte if not below or equal (CF=0 and

ZF=0).

REX + 0F 97

SETNBE r/m8¹

Valid

N.E.

Set byte if not below or equal (CF=0 and

ZF=0).

0F 93

SETNC r/m8

Valid

Set byte if not carry (CF=0).

REX + 0F 93

SETNC r/m8¹

Valid

N.E.

Set byte if not carry (CF=0).

0F 95

SETNE r/m8

Valid

Set byte if not equal (ZF=0).

REX + 0F 95

SETNE r/m8¹

Valid

N.E.

Set byte if not equal (ZF=0).

0F 9E

SETNG r/m8

Valid

Set byte if not greater (ZF=1 or SF≠ OF)

REX + 0F 9E

SETNG r/m8¹

Valid

N.E.

Set byte if not greater (ZF=1 or SF≠ OF).

0F 9C

SETNGE r/m8

Valid

Set byte if not greater or equal (SF≠ OF).

REX + 0F 9C

SETNGE r/m8¹

Valid

N.E.

Set byte if not greater or equal (SF≠ OF).

0F 9D

SETNL r/m8

Valid

Set byte if not less (SF=OF).

REX + 0F 9D

SETNL r/m8¹

Valid

N.E.

Set byte if not less (SF=OF).

0F 9F

SETNLE r/m8

Valid

Set byte if not less or equal (ZF=0 and SF=OF).

4-618

Vol. 2B

SETcc—Set Byte on Condition

INSTRUCTION SET REFERENCE, M-U

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

REX + 0F 9F

SETNLE r/m8¹

Valid

N.E.

Set byte if not less or equal (ZF=0 and SF=OF).

0F 91

SETNO r/m8

Valid

Set byte if not overflow (OF=0).

REX + 0F 91

SETNO r/m8¹

Valid

N.E.

Set byte if not overflow (OF=0).

0F 9B

SETNP r/m8

Valid

Set byte if not parity (PF=0).

REX + 0F 9B

SETNP r/m8¹

Valid

N.E.

Set byte if not parity (PF=0).

0F 99

SETNS r/m8

Valid

Set byte if not sign (SF=0).

REX + 0F 99

SETNS r/m8¹

Valid

N.E.

Set byte if not sign (SF=0).

0F 95

SETNZ r/m8

Valid

Set byte if not zero (ZF=0).

REX + 0F 95

SETNZ r/m8¹

Valid

N.E.

Set byte if not zero (ZF=0).

0F 90

SETO r/m8

Valid

Set byte if overflow (OF=1)

REX + 0F 90

SETO r/m8¹

Valid

N.E.

Set byte if overflow (OF=1).

0F 9A

SETP r/m8

Valid

Set byte if parity (PF=1).

REX + 0F 9A

SETP r/m8¹

Valid

N.E.

Set byte if parity (PF=1).

0F 9A

SETPE r/m8

Valid

Set byte if parity even (PF=1).

REX + 0F 9A

SETPE r/m8¹

Valid

N.E.

Set byte if parity even (PF=1).

0F 9B

SETPO r/m8

Valid

Set byte if parity odd (PF=0).

REX + 0F 9B

SETPO r/m8¹

Valid

N.E.

Set byte if parity odd (PF=0).

0F 98

SETS r/m8

Valid

Set byte if sign (SF=1).

REX + 0F 98

SETS r/m8¹

Valid

N.E.

Set byte if sign (SF=1).

0F 94

SETZ r/m8

Valid

Set byte if zero (ZF=1).

REX + 0F 94

SETZ r/m8¹

Valid

N.E.

Set byte if zero (ZF=1).

NOTES:

1. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Sets the destination operand to 0 or 1 depending on the settings of the status flags (CF, SF, OF, ZF, and PF) in the

EFLAGS register. The destination operand points to a byte register or a byte in memory. The condition code suffix

(cc) indicates the condition being tested for.

The terms “above” and “below” are associated with the CF flag and refer to the relationship between two unsigned

integer values. The terms “greater” and “less” are associated with the SF and OF flags and refer to the relationship

between two signed integer values.

Many of the SETcc instruction opcodes have alternate mnemonics. For example, SETG (set byte if greater) and

SETNLE (set if not less or equal) have the same opcode and test for the same condition: ZF equals 0 and SF equals

OF. These alternate mnemonics are provided to make code more intelligible. Appendix B, “EFLAGS Condition

Codes,” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, shows the alternate

mnemonics for various test conditions.

Some languages represent a logical one as an integer with all bits set. This representation can be obtained by

choosing the logically opposite condition for the SETcc instruction, then decrementing the result. For example, to

test for overflow, use the SETNO instruction, then decrement the result.

SETcc—Set Byte on Condition

Vol. 2B

4-619

INSTRUCTION SET REFERENCE, M-U

The reg field of the ModR/M byte is not used for the SETCC instruction and those opcode bits are ignored by the

processor.

In IA-64 mode, the operand size is fixed at 8 bits. Use of REX prefix enable uniform addressing to additional byte

registers. Otherwise, this instruction’s operation is the same as in legacy mode and compatibility mode.

Operation

IF condition

THEN DEST := 1;

ELSE DEST := 0;

FI;

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

4-620

Vol. 2B

SETcc—Set Byte on Condition

INSTRUCTION SET REFERENCE, M-U

SETSSBSY—Mark Shadow Stack Busy

Opcode/

Op/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

F3 0F 01 E8

V/V

CET_SS

Set busy flag in supervisor shadow stack token reference by

SETSSBSY

IA32_PL0_SSP.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

The SETSSBSY instruction verifies the presence of a non-busy supervisor shadow stack token at the address in the

IA32_PL0_SSP MSR and marks it busy. Following successful execution of the instruction, the SSP is set to the value

of the IA32_PL0_SSP MSR.

Operation

IF (CR4.CET = 0)

THEN #UD; FI;

IF (IA32_S_CET.SH_STK_EN = 0)

THEN #UD; FI;

IF CPL > 0

THEN GP(0); FI;

SSP_LA = IA32_PL0_SSP

If SSP_LA not aligned to 8 bytes

THEN #GP(0); FI;

expected_token_value = SSP_LA

(* busy bit must not be set *)

new_token_value

= SSP_LA | BUSY_BIT

(* set busy bit; bit position 0 *)

IF shadow_stack_lock_cmpxchg8B(SSP_LA, new_token_value, expected_token_value) != expected_token_value

THEN #CP(SETSSBSY); FI;

SSP = SSP_LA

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

SETSSBSY void _setssbsy(void);

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

IF IA32_S_CET.SH_STK_EN = 0.

#GP(0)

If IA32_PL0_SSP not aligned to 8 bytes.

If CPL is not 0.

#CP(setssbsy)

If busy bit in token is set.

If in 32-bit or compatibility mode, and the address in token is not below 4G.

#PF(fault-code)

If a page fault occurs.

SETSSBSY—Mark Shadow Stack Busy

Vol. 2B

4-621

INSTRUCTION SET REFERENCE, M-U

SFENCE—Store Fence

Opcode*

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

NP 0F AE F8

SFENCE

Valid

Serializes store operations.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Orders processor execution relative to all memory stores prior to the SFENCE instruction. The processor ensures

that every store prior to SFENCE is globally visible before any store after SFENCE becomes globally visible. The

SFENCE instruction is ordered with respect to memory stores, other SFENCE instructions, MFENCE instructions,

and any serializing instructions (such as the CPUID instruction). It is not ordered with respect to memory loads or

the LFENCE instruction.

Weakly ordered memory types can be used to achieve higher processor performance through such techniques as

out-of-order issue, write-combining, and write-collapsing. The degree to which a consumer of data recognizes or

knows that the data is weakly ordered varies among applications and may be unknown to the producer of this data.

The SFENCE instruction provides a performance-efficient way of ensuring store ordering between routines that

produce weakly-ordered results and routines that consume this data.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

Specification of the instruction's opcode above indicates a ModR/M byte of F8. For this instruction, the processor

ignores the r/m field of the ModR/M byte. Thus, SFENCE is encoded by any opcode of the form 0F AE Fx, where x

is in the range 8-F.

Operation

Wait_On_Following_Stores_Until(preceding_stores_globally_visible);

Intel C/C++ Compiler Intrinsic Equivalent

void _mm_sfence(void)

Exceptions (All Operating Modes)

#UD

If CPUID.01H:EDX.SSE[bit 25] = 0.

If the LOCK prefix is used.

SFENCE—Store Fence

Vol. 2B

4-623

INSTRUCTION SET REFERENCE, M-U

SGDT—Store Global Descriptor Table Register

Opcode¹

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 /0

SGDT m

Valid

Store GDTR to m.

NOTES:

1. See the IA-32 Architecture Compatibility section below.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the content of the global descriptor table register (GDTR) in the destination operand. The destination

operand specifies a memory location.

In legacy or compatibility mode, the destination operand is a 6-byte memory location. If the operand-size attribute

is 16 or 32 bits, the 16-bit limit field of the register is stored in the low 2 bytes of the memory location and the 32-

bit base address is stored in the high 4 bytes.

In 64-bit mode, the operand size is fixed at 8+2 bytes. The instruction stores an 8-byte base and a 2-byte limit.

SGDT is useful only by operating-system software. However, it can be used in application programs without causing

an exception to be generated if CR4.UMIP = 0. See “LGDT/LIDT—Load Global/Interrupt Descriptor Table Register”

in Chapter 3, Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 2A, for information on

loading the GDTR and IDTR.

IA-32 Architecture Compatibility

The 16-bit form of the SGDT is compatible with the Intel 286 processor if the upper 8 bits are not referenced. The

Intel 286 processor fills these bits with 1s; processor generations later than the Intel 286 processor fill these bits

with 0s.

Operation

IF instruction is SGDT

IF OperandSize =16 or OperandSize = 32 (* Legacy or Compatibility Mode *)

THEN

DEST[0:15] := GDTR(Limit);

DEST[16:47] := GDTR(Base); (* Full 32-bit base address stored *)

FI;

ELSE (* 64-bit Mode *)

DEST[0:15] := GDTR(Limit);

DEST[16:79] := GDTR(Base); (* Full 64-bit base address stored *)

FI;

Flags Affected

None.

4-624

Vol. 2B

SGDT—Store Global Descriptor Table Register

INSTRUCTION SET REFERENCE, M-U

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If CR4.UMIP = 1 and CPL > 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

Virtual-8086 Mode Exceptions

#UD

If the LOCK prefix is used.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If CR4.UMIP = 1.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#UD

If the LOCK prefix is used.

#GP(0)

If the memory address is in a non-canonical form.

If CR4.UMIP = 1 and CPL > 0.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while CPL = 3.

SGDT—Store Global Descriptor Table Register

Vol. 2B

4-625

INSTRUCTION SET REFERENCE, M-U

SHA1RNDS4—Perform Four Rounds of SHA1 Operation

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

NP 0F 3A CC /r ib

RMI

V/V

SHA

Performs four rounds of SHA1 operation operating on SHA1 state

SHA1RNDS4 xmm1,

(A,B,C,D) from xmm1, with a pre-computed sum of the next 4

xmm2/m128, imm8

round message dwords and state variable E from xmm2/m128.

The immediate byte controls logic functions and round constants.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RMI

ModRM:reg (r, w)

ModRM:r/m (r)

imm8

Description

The SHA1RNDS4 instruction performs four rounds of SHA1 operation using an initial SHA1 state (A,B,C,D) from the

first operand (which is a source operand and the destination operand) and some pre-computed sum of the next 4

round message dwords, and state variable E from the second operand (a source operand). The updated SHA1 state

(A,B,C,D) after four rounds of processing is stored in the destination operand.

Operation

SHA1RNDS4

The function f() and Constant K are dependent on the value of the immediate.

IF ( imm8[1:0] = 0 )

THEN f() := f0(), K := K₀;

ELSE IF ( imm8[1:0] = 1 )

THEN f() := f1(), K := K₁;

ELSE IF ( imm8[1:0] = 2 )

THEN f() := f2(), K := K₂;

ELSE IF ( imm8[1:0] = 3 )

THEN f() := f3(), K := K3;

FI;

A := SRC1[127:96];

B := SRC1[95:64];

C := SRC1[63:32];

D := SRC1[31:0];

W₀E := SRC2[127:96];

W₁ := SRC2[95:64];

W₂ := SRC2[63:32];

W₃ := SRC2[31:0];

Round i = 0 operation:

A_1 := f (B, C, D) + (A ROL 5) +W₀E +K;

B_1 := A;

C_1 := B ROL 30;

D_1 := C;

E_1 := D;

FOR i = 1 to 3

A_(i +1) := f (B_i, C_i, D_i) + (A_i ROL 5) +W_i+ E_i +K;

B_(i +1) := A_i;

4-626

Vol. 2B

SHA1RNDS4—Perform Four Rounds of SHA1 Operation

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 89