# instructions

platform: MIPS32
mnem: TLTI
description:
Trap if Less Than Immediate                                                                                        TLTI


   31                26 25            21 20             16 15                                                      0

        REGIMM                                 TLTI
                                rs                                                 immediate
         000001                                01010

             6                  5                5                                    16


       Format: TLTI rs, immediate                                                                MIPS32 (MIPS II)

       Purpose:

       To compare a GPR to a constant and do a conditional trap

       Description: if rs < immediate then Trap

       Compare the contents of GPR rs and the 16-bit signed immediate as signed integers; if GPR rs is less than immediate,
       then take a Trap exception.

       Restrictions:

       None

       Operation:

           if GPR[rs] < sign_extend(immediate) then
               SignalException(Trap)
           endif

       Exceptions:

       Trap


platform: MIPS32
mnem: TLTIU
description:
Trap if Less Than Immediate Unsigned                                                                              TLTIU


   31               26 25              21 20            16 15                                                        0

        REGIMM                                  TLTIU
                                rs                                                  immediate
         000001                                 01011

            6                   5                 5                                     16


       Format: TLTIU rs, immediate                                                                MIPS32 (MIPS II)

       Purpose:

       To compare a GPR to a constant and do a conditional trap

       Description: if rs < immediate then Trap

       Compare the contents of GPR rs and the 16-bit sign-extended immediate as unsigned integers; if GPR rs is less than
       immediate, then take a Trap exception.

       Because the 16-bit immediate is sign-extended before comparison, the instruction can represent the smallest or largest
       unsigned numbers. The representable values are at the minimum [0, 32767] or maximum [max_unsigned-32767,
       max_unsigned] end of the unsigned range.

       Restrictions:

       None

       Operation:

           if (0 || GPR[rs]) < (0 || sign_extend(immediate)) then
               SignalException(Trap)
           endif

       Exceptions:

       Trap


platform: MIPS32
mnem: TLTU
description:
Trap if Less Than Unsigned                                                                                     TLTU


   31                26 25              21 20            16 15                              6  5                0

         SPECIAL                                                                                     TLTU
                                rs                rt                         code
         000000                                                                                     110011

            6                    5                 5                          10                       6


       Format: TLTU rs, rt                                                                     MIPS32 (MIPS II)

       Purpose:

       To compare GPRs and do a conditional trap

       Description: if rs < rt then Trap

       Compare the contents of GPR rs and GPR rt as unsigned integers; if GPR rs is less than GPR rt, then take a Trap
       exception.

       The contents of the code field are ignored by hardware and may be used to encode information for system software.
       To retrieve the information, system software must load the instruction word from memory.

       Restrictions:

       None

       Operation:

           if (0 || GPR[rs]) < (0 || GPR[rt]) then
                SignalException(Trap)
           endif

       Exceptions:

       Trap


platform: MIPS32
mnem: TNE
description:
Trap if Not Equal                                                                                               TNE


   31                26 25              21 20            16 15                              6  5                0

        SPECIAL                                                                                      TNE
                                rs                rt                         code
         000000                                                                                     110110

            6                    5                 5                          10                       6


       Format: TNE rs, rt                                                                      MIPS32 (MIPS II)

       Purpose:

       To compare GPRs and do a conditional trap

       Description: if rs != rt then Trap

       Compare the contents of GPR rs and GPR rt as signed integers; if GPR rs is not equal to GPR rt, then take a Trap
       exception.

       The contents of the code field are ignored by hardware and may be used to encode information for system software.
       To retrieve the information, system software must load the instruction word from memory.

       Restrictions:

       None

       Operation:

           if GPR[rs] != GPR[rt] then
                     SignalException(Trap)
           endif

       Exceptions:

       Trap


platform: MIPS32
mnem: TNEI
description:
Trap if Not Equal                                                                                                 TNEI


   31                26 25              21 20          16 15                                                       0

        REGIMM                                 TNEI
                                 rs                                               immediate
         000001                                01110

             6                   5              5                                    16


       Format: TNEI rs, immediate                                                              MIPS32 (MIPS II)

       Purpose:

       To compare a GPR to a constant and do a conditional trap

       Description: if rs != immediate then Trap

       Compare the contents of GPR rs and the 16-bit signed immediate as signed integers; if GPR rs is not equal to imme-
       diate, then take a Trap exception.

       Restrictions:

       None

       Operation:

           if GPR[rs] != sign_extend(immediate) then
                SignalException(Trap)
           endif

       Exceptions:

       Trap


platform: MIPS32
mnem: TRUNC.W.fmt
description:
Floating Point Truncate to Word Fixed Point                                                                     TRUNC.W.fmt


         31              26 25              21 20              16 15               11 10             6   5                   0

              COP1                                     0                                                      TRUNC.W
                                   fmt                                     fs               fd
              010001                                00000                                                       001101

                6                   5                  5                    5                5                    6


           Format: TRUNC.W.S fd, fs                                                                      MIPS32 (MIPS II)
                      TRUNC.W.D fd, fs                                                                   MIPS32 (MIPS II)

           Purpose:

           To convert an FP value to 32-bit fixed point, rounding toward zero

           Description: fd <- convert_and_round(fs)

           The value in FPR fs, in format fmt, is converted to a value in 32-bit word fixed point format using rounding toward
           zero (rounding mode 1). The result is placed in FPR fd.

           When the source value is Infinity, NaN, or rounds to an integer outside the range -2^31 to 2^31-1, the result cannot be
           represented correctly and an IEEE Invalid Operation condition exists. In this case the Invalid Operation flag is set in
           the FCSR. If the Invalid Operation Enable bit is set in the FCSR, no result is written to fd and an Invalid Operation
           exception is taken immediately. Otherwise, the default result, 2^31-1, is written to fd.

           Restrictions:

           The fields fs and fd must specify valid FPRs; fs for type fmt and fd for word fixed point; if they are not valid, the result
           is UNPREDICTABLE.

           The operand must be a value in format fmt; if it is not, the result is UNPREDICTABLE and the value of the operand
           FPR becomes UNPREDICTABLE.

           Operation:

               StoreFPR(fd, W, ConvertFmt(ValueFPR(fs, fmt), fmt, W))
     Exceptions:

     Coprocessor Unusable, Reserved Instruction

     Floating Point Exceptions:

     Inexact, Invalid Operation, Overflow, Unimplemented Operation


platform: MIPS32
mnem: WAIT
description:
   Enter Standby Mode                                                                                             WAIT


  31               26 25 24                                                                      6    5                0

        COP0            CO                                                                                  WAIT
                                                Implementation-Dependent Code
       010000           1                                                                                   100000

          6             1                                      19                                              6


    Format: WAIT                                                                                                MIPS32

    Purpose:

    Wait for Event

    Description:

    The WAIT instruction performs an implementation-dependent operation, usually involving a lower power mode.
    Software may use bits 24:6 of the instruction to communicate additional information to the processor, and the proces-
    sor may use this information as control for the lower power mode. A value of zero for bits 24:6 is the default and must
    be valid in all implementations.


    The WAIT instruction is typically implemented by stalling the pipeline at the completion of the instruction and enter-
    ing a lower power mode. The pipeline is restarted when an external event, such as an interrupt or external request
    occurs, and execution continues with the instruction following the WAIT instruction. It is implementation-dependent
    whether the pipeline restarts when a non-enabled interrupt is requested. In this case, software must poll for the cause
    of the restart. If the pipeline restarts as the result of an enabled interrupt, that interrupt is taken between the WAIT
    instruction and the following instruction (EPC for the interrupt points at the instruction following the WAIT instruc-
    tion).


    The assertion of any reset or NMI must restart the pipelihne and the corresponding exception myust be taken.

    Restrictions:

    The operation of the processor is UNDEFINED if a WAIT instruction is placed in the delay slot of a branch or a
    jump.
Enter Standby Mode (cont.)                                                               WAIT

 Operation:

      Enter implementation dependent lower power mode

 Exceptions:

  Coprocessor Unusable Exception


platform: MIPS32
mnem: XOR
description:
Exclusive OR                                                                                                XOR


   31              26 25              21 20         16 15             11 10            6   5                 0

        SPECIAL                                                                  0                XOR
                               rs             rt               rd
         000000                                                                00000             100110

           6                   5              5                5                5                   6


      Format: XOR rd, rs, rt                                                                MIPS32 (MIPS I)

      Purpose:

      To do a bitwise logical Exclusive OR

      Description: rd <- rs XOR rt

      Combine the contents of GPR rs and GPR rt in a bitwise logical Exclusive OR operation and place the result into
      GPR rd.

      Restrictions:

      None

      Operation:

          GPR[rd] <- GPR[rs] xor GPR[rt]

      Exceptions:

      None


platform: x86_64
mnem: AAA
description:
AAA-ASCII Adjust After Addition
Opcode                     Instruction                Op/   64-bit    Compat/ Description
                                                      En    Mode      Leg Mode
37                         AAA                        NP    Invalid   Valid       ASCII adjust AL after addition.



                                              Instruction Operand Encoding
  Op/En              Operand 1                 Operand 2                      Operand 3                      Operand 4
     NP                  NA                       NA                             NA                                 NA

Description
Adjusts the sum of two unpacked BCD values to create an unpacked BCD result. The AL register is the implied
source and destination operand for this instruction. The AAA instruction is only useful when it follows an ADD
instruction that adds (binary addition) two unpacked BCD values and stores a byte result in the AL register. The
AAA instruction then adjusts the contents of the AL register to contain the correct 1-digit unpacked BCD result.
If the addition produces a decimal carry, the AH register increments by 1, and the CF and AF flags are set. If there
was no decimal carry, the CF and AF flags are cleared and the AH register is unchanged. In either case, bits 4
through 7 of the AL register are set to 0.
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.

Operation
IF 64-Bit Mode
    THEN
         #UD;
    ELSE
         IF ((AL AND 0FH) > 9) or (AF = 1)
               THEN
                   AX <- AX + 106H;
                   AF <- 1;
                   CF <- 1;
               ELSE
                   AF <- 0;
                   CF <- 0;
         FI;
         AL <- AL AND 0FH;
FI;

Flags Affected
The AF and CF flags are set to 1 if the adjustment results in a decimal carry; otherwise they are set to 0. The OF,
SF, ZF, and PF flags are undefined.

Protected Mode Exceptions
#UD                     If the LOCK prefix is used.

Real-Address Mode Exceptions
Same exceptions as protected mode.

Virtual-8086 Mode Exceptions
Same exceptions as protected mode.





Compatibility Mode Exceptions
Same exceptions as protected mode.

64-Bit Mode Exceptions
#UD                      If in 64-bit mode.






platform: x86_64
mnem: AAD
description:
AAD-ASCII Adjust AX Before Division
Opcode                    Instruction                    Op/   64-bit    Compat/ Description
                                                         En    Mode      Leg Mode
D5 0A                     AAD                            NP    Invalid   Valid      ASCII adjust AX before division.
D5 ib                     AAD imm8                       NP    Invalid   Valid      Adjust AX before division to number base
                                                                                    imm8.



                                                Instruction Operand Encoding
  Op/En             Operand 1                      Operand 2                     Operand 3                     Operand 4
    NP                  NA                               NA                         NA                             NA

Description
Adjusts two unpacked BCD digits (the least-significant digit in the AL register and the most-significant digit in the
AH register) so that a division operation performed on the result will yield a correct unpacked BCD value. The AAD
instruction is only useful when it precedes a DIV instruction that divides (binary division) the adjusted value in the
AX register by an unpacked BCD value.
The AAD instruction sets the value in the AL register to (AL + (10 * AH)), and then clears the AH register to 00H.
The value in the AX register is then equal to the binary equivalent of the original unpacked two-digit (base 10)
number in registers AH and AL.
The generalized version of this instruction allows adjustment of two unpacked digits of any number base (see the
"Operation" section below), by setting the imm8 byte to the selected number base (for example, 08H for octal, 0AH
for decimal, or 0CH for base 12 numbers). The AAD mnemonic is interpreted by all assemblers to mean adjust
ASCII (base 10) values. To adjust values in another number base, the instruction must be hand coded in machine
code (D5 imm8).
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.

Operation
IF 64-Bit Mode
    THEN
         #UD;
    ELSE
         tempAL <- AL;
         tempAH <- AH;
         AL <- (tempAL + (tempAH * imm8)) AND FFH;
         (* imm8 is set to 0AH for the AAD mnemonic.*)
         AH <- 0;
FI;
The immediate value (imm8) is taken from the second byte of the instruction.

Flags Affected
The SF, ZF, and PF flags are set according to the resulting binary value in the AL register; the OF, AF, and CF flags
are undefined.

Protected Mode Exceptions
#UD                    If the LOCK prefix is used.

Real-Address Mode Exceptions
Same exceptions as protected mode.





Virtual-8086 Mode Exceptions
Same exceptions as protected mode.

Compatibility Mode Exceptions
Same exceptions as protected mode.

64-Bit Mode Exceptions
#UD                      If in 64-bit mode.






platform: x86_64
mnem: AAM
description:
AAM-ASCII Adjust AX After Multiply
Opcode                   Instruction                 Op/    64-bit     Compat/ Description
                                                     En     Mode       Leg Mode
D4 0A                    AAM                         NP     Invalid    Valid       ASCII adjust AX after multiply.
D4 ib                    AAM imm8                    NP     Invalid    Valid       Adjust AX after multiply to number base
                                                                                   imm8.



                                               Instruction Operand Encoding
  Op/En             Operand 1                   Operand 2                      Operand 3                     Operand 4
    NP                 NA                           NA                            NA                             NA

Description
Adjusts the result of the multiplication of two unpacked BCD values to create a pair of unpacked (base 10) BCD
values. The AX register is the implied source and destination operand for this instruction. The AAM instruction is
only useful when it follows an MUL instruction that multiplies (binary multiplication) two unpacked BCD values and
stores a word result in the AX register. The AAM instruction then adjusts the contents of the AX register to contain
the correct 2-digit unpacked (base 10) BCD result.
The generalized version of this instruction allows adjustment of the contents of the AX to create two unpacked
digits of any number base (see the "Operation" section below). Here, the imm8 byte is set to the selected number
base (for example, 08H for octal, 0AH for decimal, or 0CH for base 12 numbers). The AAM mnemonic is interpreted
by all assemblers to mean adjust to ASCII (base 10) values. To adjust to values in another number base, the
instruction must be hand coded in machine code (D4 imm8).
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.

Operation
IF 64-Bit Mode
    THEN
         #UD;
    ELSE
         tempAL <- AL;
         AH <- tempAL / imm8; (* imm8 is set to 0AH for the AAM mnemonic *)
         AL <- tempAL MOD imm8;
FI;
The immediate value (imm8) is taken from the second byte of the instruction.

Flags Affected
The SF, ZF, and PF flags are set according to the resulting binary value in the AL register. The OF, AF, and CF flags
are undefined.

Protected Mode Exceptions
#DE                   If an immediate value of 0 is used.
#UD                   If the LOCK prefix is used.

Real-Address Mode Exceptions
Same exceptions as protected mode.

Virtual-8086 Mode Exceptions
Same exceptions as protected mode.





Compatibility Mode Exceptions
Same exceptions as protected mode.

64-Bit Mode Exceptions
#UD                      If in 64-bit mode.






platform: x86_64
mnem: AAS
description:
AAS-ASCII Adjust AL After Subtraction
Opcode                     Instruction                Op/   64-bit    Compat/ Description
                                                      En    Mode      Leg Mode
3F                         AAS                        NP    Invalid   Valid       ASCII adjust AL after subtraction.



                                              Instruction Operand Encoding
   Op/En              Operand 1                 Operand 2                     Operand 3                      Operand 4
     NP                   NA                          NA                         NA                              NA

Description
Adjusts the result of the subtraction of two unpacked BCD values to create a unpacked BCD result. The AL register
is the implied source and destination operand for this instruction. The AAS instruction is only useful when it follows
a SUB instruction that subtracts (binary subtraction) one unpacked BCD value from another and stores a byte
result in the AL register. The AAA instruction then adjusts the contents of the AL register to contain the correct 1-
digit unpacked BCD result.
If the subtraction produced a decimal carry, the AH register decrements by 1, and the CF and AF flags are set. If no
decimal carry occurred, the CF and AF flags are cleared, and the AH register is unchanged. In either case, the AL
register is left with its top four bits set to 0.
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.

Operation
IF 64-bit mode
    THEN
         #UD;
    ELSE
         IF ((AL AND 0FH) > 9) or (AF = 1)
               THEN
                   AX <- AX - 6;
                   AH <- AH - 1;
                   AF <- 1;
                   CF <- 1;
                   AL <- AL AND 0FH;
               ELSE
                   CF <- 0;
                   AF <- 0;
                   AL <- AL AND 0FH;
         FI;
FI;

Flags Affected
The AF and CF flags are set to 1 if there is a decimal borrow; otherwise, they are cleared to 0. The OF, SF, ZF, and
PF flags are undefined.

Protected Mode Exceptions
#UD                     If the LOCK prefix is used.

Real-Address Mode Exceptions
Same exceptions as protected mode.





Virtual-8086 Mode Exceptions
Same exceptions as protected mode.

Compatibility Mode Exceptions
Same exceptions as protected mode.

64-Bit Mode Exceptions
#UD                      If in 64-bit mode.






platform: x86_64
mnem: ADC
description:
ADC-Add with Carry
Opcode                     Instruction                  Op/    64-bit      Compat/ Description
                                                        En     Mode        Leg Mode
14 ib                      ADC AL, imm8                 I      Valid       Valid       Add with carry imm8 to AL.
15 iw                      ADC AX, imm16                I      Valid       Valid       Add with carry imm16 to AX.
15 id                      ADC EAX, imm32               I      Valid       Valid       Add with carry imm32 to EAX.
REX.W + 15 id              ADC RAX, imm32               I      Valid       N.E.        Add with carry imm32 sign extended to 64-
                                                                                       bits to RAX.
80 /2 ib                   ADC r/m8, imm8               MI     Valid       Valid       Add with carry imm8 to r/m8.
                                      *
REX + 80 /2 ib             ADC r/m8 , imm8              MI     Valid       N.E.        Add with carry imm8 to r/m8.
81 /2 iw                   ADC r/m16, imm16             MI     Valid       Valid       Add with carry imm16 to r/m16.
81 /2 id                   ADC r/m32, imm32             MI     Valid       Valid       Add with CF imm32 to r/m32.
REX.W + 81 /2 id           ADC r/m64, imm32             MI     Valid       N.E.        Add with CF imm32 sign extended to 64-bits
                                                                                       to r/m64.
83 /2 ib                   ADC r/m16, imm8              MI     Valid       Valid       Add with CF sign-extended imm8 to r/m16.
83 /2 ib                   ADC r/m32, imm8              MI     Valid       Valid       Add with CF sign-extended imm8 into r/m32.
REX.W + 83 /2 ib           ADC r/m64, imm8              MI     Valid       N.E.        Add with CF sign-extended imm8 into r/m64.
10 /r                      ADC r/m8, r8                 MR     Valid       Valid       Add with carry byte register to r/m8.
REX + 10 /r                ADC r/m8*, r8*               MR     Valid       N.E.        Add with carry byte register to r/m64.
11 /r                      ADC r/m16, r16               MR     Valid       Valid       Add with carry r16 to r/m16.
11 /r                      ADC r/m32, r32               MR     Valid       Valid       Add with CF r32 to r/m32.
REX.W + 11 /r              ADC r/m64, r64               MR     Valid       N.E.        Add with CF r64 to r/m64.
12 /r                      ADC r8, r/m8                 RM     Valid       Valid       Add with carry r/m8 to byte register.
REX + 12 /r                ADC r8*, r/m8*               RM     Valid       N.E.        Add with carry r/m64 to byte register.
13 /r                      ADC r16, r/m16               RM     Valid       Valid       Add with carry r/m16 to r16.
13 /r                      ADC r32, r/m32               RM     Valid       Valid       Add with CF r/m32 to r32.
REX.W + 13 /r              ADC r64, r/m64               RM     Valid       N.E.        Add with CF r/m64 to r64.
NOTES:
*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.



                                                 Instruction Operand Encoding
   Op/En              Operand 1                    Operand 2                       Operand 3                      Operand 4
    RM             ModRM:reg (r, w)              ModRM:r/m (r)                        NA                              NA
    MR             ModRM:r/m (r, w)              ModRM:reg (r)                        NA                              NA
    MI             ModRM:r/m (r, w)                  imm8                             NA                              NA
        I          AL/AX/EAX/RAX                     imm8                             NA                              NA

Description
Adds the destination operand (first operand), the source operand (second operand), and the carry (CF) flag and
stores the result in the destination operand. The destination operand can be a register or a memory location; the
source operand can be an immediate, a register, or a memory location. (However, two memory operands cannot be
used in one instruction.) The state of the CF flag represents a carry from a previous addition. When an immediate
value is used as an operand, it is sign-extended to the length of the destination operand format.





The ADC instruction does not distinguish between signed or unsigned operands. Instead, the processor evaluates
the result for both data types and sets the OF and CF flags to indicate a carry in the signed or unsigned result,
respectively. The SF flag indicates the sign of the signed result.
The ADC instruction is usually executed as part of a multibyte or multiword addition in which an ADD instruction is
followed by an ADC instruction.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
DEST <- DEST + SRC + CF;

Intel C/C++ Compiler Intrinsic Equivalent
ADC:       extern unsigned char _addcarry_u8(unsigned char c_in, unsigned char src1, unsigned char src2, unsigned char *sum_out);

ADC:       extern unsigned char _addcarry_u16(unsigned char c_in, unsigned short src1, unsigned short src2, unsigned short
*sum_out);

ADC:       extern unsigned char _addcarry_u32(unsigned char c_in, unsigned int src1, unsigned char int, unsigned int *sum_out);

ADC:       extern unsigned char _addcarry_u64(unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64
*sum_out);

Flags Affected
The OF, SF, ZF, AF, CF, and PF flags are set according to the result.

Protected Mode Exceptions
#GP(0)                 If the destination is located in a non-writable segment.
                       If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                       If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
                       selector.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made while the
                       current privilege level is 3.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions
#GP                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                    If a memory operand effective address is outside the SS segment limit.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.





Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.






platform: x86_64
mnem: ADCX
description:
ADCX - Unsigned Integer Addition of Two Operands with Carry Flag
 Opcode/                                 Op/    64/32bit      CPUID      Description
 Instruction                             En     Mode          Feature
                                                Support       Flag
 66 0F 38 F6 /r                          RM     V/V           ADX        Unsigned addition of r32 with CF, r/m32 to r32, writes CF.
 ADCX r32, r/m32
 66 REX.w 0F 38 F6 /r                    RM     V/NE          ADX        Unsigned addition of r64 with CF, r/m64 to r64, writes CF.
 ADCX r64, r/m64



                                                    Instruction Operand Encoding
      Op/En                 Operand 1                      Operand 2                    Operand 3                    Operand 4
       RM                ModRM:reg (r, w)                ModRM:r/m (r)                      NA                           NA

Description
Performs an unsigned addition of the destination operand (first operand), the source operand (second operand)
and the carry-flag (CF) and stores the result in the destination operand. The destination operand is a general-
purpose register, whereas the source operand can be a general-purpose register or memory location. The state of
CF can represent a carry from a previous addition. The instruction sets the CF flag with the carry generated by the
unsigned addition of the operands.
The ADCX instruction is executed in the context of multi-precision addition, where we add a series of operands with
a carry-chain. At the beginning of a chain of additions, we need to make sure the CF is in a desired initial state.
Often, this initial state needs to be 0, which can be achieved with an instruction to zero the CF (e.g. XOR).
This instruction is supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 64-
bit mode.
In 64-bit mode, the default operation size is 32 bits. Using a REX Prefix in the form of REX.R permits access to addi-
tional registers (R8-15). Using REX Prefix in the form of REX.W promotes operation to 64 bits.
ADCX executes normally either inside or outside a transaction region.
Note: ADCX defines the OF flag differently than the ADD/ADC instructions as defined in Intel 64 and IA-32 Archi-
tectures Software Developer's Manual, Volume 2A.

Operation
IF OperandSize is 64-bit
    THEN CF:DEST[63:0] <- DEST[63:0] + SRC[63:0] + CF;
    ELSE CF:DEST[31:0] <- DEST[31:0] + SRC[31:0] + CF;
FI;

Flags Affected
CF is updated based on result. OF, SF, ZF, AF and PF flags are unmodified.

Intel C/C++ Compiler Intrinsic Equivalent
unsigned char _addcarryx_u32 (unsigned char c_in, unsigned int src1, unsigned int src2, unsigned int *sum_out);
unsigned char _addcarryx_u64 (unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64 *sum_out);

SIMD Floating-Point Exceptions
None

Protected Mode Exceptions
#UD                      If the LOCK prefix is used.
                         If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)                   For an illegal address in the SS segment.



#GP(0)              For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
                    If the DS, ES, FS, or GS register is used to access memory and it contains a null segment
                    selector.
#PF(fault-code)     For a page fault.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.

Real-Address Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)              For an illegal address in the SS segment.
#GP(0)              If any part of the operand lies outside the effective address space from 0 to FFFFH.

Virtual-8086 Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)              For an illegal address in the SS segment.
#GP(0)              If any part of the operand lies outside the effective address space from 0 to FFFFH.
#PF(fault-code)     For a page fault.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     For a page fault.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.






platform: x86_64
mnem: ADD
description:
ADD-Add
Opcode                    Instruction                   Op/   64-bit       Compat/ Description
                                                        En    Mode         Leg Mode
04 ib                     ADD AL, imm8                  I     Valid        Valid        Add imm8 to AL.
05 iw                     ADD AX, imm16                 I     Valid        Valid        Add imm16 to AX.
05 id                     ADD EAX, imm32                I     Valid        Valid        Add imm32 to EAX.
REX.W + 05 id             ADD RAX, imm32                I     Valid        N.E.         Add imm32 sign-extended to 64-bits to RAX.
80 /0 ib                  ADD r/m8, imm8                MI    Valid        Valid        Add imm8 to r/m8.
REX + 80 /0 ib            ADD r/m8*, imm8               MI    Valid        N.E.         Add sign-extended imm8 to r/m64.
81 /0 iw                  ADD r/m16, imm16              MI    Valid        Valid        Add imm16 to r/m16.
81 /0 id                  ADD r/m32, imm32              MI    Valid        Valid        Add imm32 to r/m32.
REX.W + 81 /0 id          ADD r/m64, imm32              MI    Valid        N.E.         Add imm32 sign-extended to 64-bits to
                                                                                        r/m64.
83 /0 ib                  ADD r/m16, imm8               MI    Valid        Valid        Add sign-extended imm8 to r/m16.
83 /0 ib                  ADD r/m32, imm8               MI    Valid        Valid        Add sign-extended imm8 to r/m32.
REX.W + 83 /0 ib          ADD r/m64, imm8               MI    Valid        N.E.         Add sign-extended imm8 to r/m64.
00 /r                     ADD r/m8, r8                  MR    Valid        Valid        Add r8 to r/m8.
                                     *    *
REX + 00 /r               ADD r/m8 , r8                 MR    Valid        N.E.         Add r8 to r/m8.
01 /r                     ADD r/m16, r16                MR    Valid        Valid        Add r16 to r/m16.
01 /r                     ADD r/m32, r32                MR    Valid        Valid        Add r32 to r/m32.
REX.W + 01 /r             ADD r/m64, r64                MR    Valid        N.E.         Add r64 to r/m64.
02 /r                     ADD r8, r/m8                  RM    Valid        Valid        Add r/m8 to r8.
                                 *        *
REX + 02 /r               ADD r8 , r/m8                 RM    Valid        N.E.         Add r/m8 to r8.
03 /r                     ADD r16, r/m16                RM    Valid        Valid        Add r/m16 to r16.
03 /r                     ADD r32, r/m32                RM    Valid        Valid        Add r/m32 to r32.
REX.W + 03 /r             ADD r64, r/m64                RM    Valid        N.E.         Add r/m64 to r64.
NOTES:
*In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.



                                                 Instruction Operand Encoding
  Op/En             Operand 1                     Operand 2                        Operand 3                     Operand 4
   RM            ModRM:reg (r, w)                ModRM:r/m (r)                        NA                             NA
   MR            ModRM:r/m (r, w)                ModRM:reg (r)                        NA                             NA
   MI            ModRM:r/m (r, w)                    imm8                             NA                             NA
    I            AL/AX/EAX/RAX                       imm8                             NA                             NA

Description
Adds the destination operand (first operand) and the source operand (second operand) and then stores the result
in the destination operand. The destination operand can be a register or a memory location; the source operand
can be an immediate, a register, or a memory location. (However, two memory operands cannot be used in one
instruction.) When an immediate value is used as an operand, it is sign-extended to the length of the destination
operand format.
The ADD instruction performs integer addition. It evaluates the result for both signed and unsigned integer oper-
ands and sets the CF and OF flags to indicate a carry (overflow) in the signed or unsigned result, respectively. The
SF flag indicates the sign of the signed result.



This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
DEST <- DEST + SRC;

Flags Affected
The OF, SF, ZF, AF, CF, and PF flags are set according to the result.

Protected Mode Exceptions
#GP(0)               If the destination is located in a non-writable segment.
                     If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                     If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
                     selector.
#SS(0)               If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)      If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made while the
                     current privilege level is 3.
#UD                  If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions
#GP                  If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                  If a memory operand effective address is outside the SS segment limit.
#UD                  If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions
#GP(0)               If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)               If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)      If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made.
#UD                  If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)               If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)               If the memory address is in a non-canonical form.
#PF(fault-code)      If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made while the
                     current privilege level is 3.
#UD                  If the LOCK prefix is used but the destination is not a memory operand.






platform: x86_64
mnem: ADDPD
description:
ADDPD-Add Packed Double-Precision Floating-Point Values
 Opcode/                               Op /    64/32        CPUID          Description
 Instruction                           En      bit Mode     Feature
                                               Support      Flag
 66 0F 58 /r                           RM      V/V          SSE2           Add packed double-precision floating-point values from
 ADDPD xmm1, xmm2/m128                                                     xmm2/mem to xmm1 and store result in xmm1.
 VEX.NDS.128.66.0F.WIG 58 /r           RVM     V/V          AVX            Add packed double-precision floating-point values from
 VADDPD xmm1,xmm2,                                                         xmm3/mem to xmm2 and store result in xmm1.
 xmm3/m128
 VEX.NDS.256.66.0F.WIG 58 /r           RVM     V/V          AVX            Add packed double-precision floating-point values from
 VADDPD ymm1, ymm2,                                                        ymm3/mem to ymm2 and store result in ymm1.
 ymm3/m256
 EVEX.NDS.128.66.0F.W1 58 /r           FV      V/V          AVX512VL       Add packed double-precision floating-point values from
 VADDPD xmm1 {k1}{z}, xmm2,                                 AVX512F        xmm3/m128/m64bcst to xmm2 and store result in xmm1
 xmm3/m128/m64bcst                                                         with writemask k1.
 EVEX.NDS.256.66.0F.W1 58 /r           FV      V/V          AVX512VL       Add packed double-precision floating-point values from
 VADDPD ymm1 {k1}{z}, ymm2,                                 AVX512F        ymm3/m256/m64bcst to ymm2 and store result in ymm1
 ymm3/m256/m64bcst                                                         with writemask k1.
 EVEX.NDS.512.66.0F.W1 58 /r           FV      V/V          AVX512F        Add packed double-precision floating-point values from
 VADDPD zmm1 {k1}{z}, zmm2,                                                zmm3/m512/m64bcst to zmm2 and store result in zmm1
 zmm3/m512/m64bcst{er}                                                     with writemask k1.



                                                     Instruction Operand Encoding
        Op/En                  Operand 1                    Operand 2                     Operand 3                 Operand 4
         RM                 ModRM:reg (r, w)               ModRM:r/m (r)                      NA                        NA
         RVM                 ModRM:reg (w)                   VEX.vvvv                    ModRM:r/m (r)                  NA
       FV-RVM                ModRM:reg (w)                  EVEX.vvvv                    ModRM:r/m (r)                  NA

Description
Add two, four or eight packed double-precision floating-point values from the first source operand to the second
source operand, and stores the packed double-precision floating-point results in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with
writemask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAX_VL-1:256)
of the corresponding ZMM register destination are zeroed.
VEX.128 encoded version: the first source operand is a XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAX_VL-1:128)
of the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper Bits (MAX_VL-1:128) of the corresponding
ZMM register destination are unmodified.

Operation
VADDPD (EVEX encoded versions) when src2 operand is a vector register
(KL, VL) = (2, 128), (4, 256), (8, 512)
IF (VL = 512) AND (EVEX.b = 1)
    THEN
         SET_RM(EVEX.RC);
    ELSE


         SET_RM(MXCSR.RM);
FI;
FOR j <- 0 TO KL-1
    i <- j * 64
    IF k1[j] OR *no writemask*
         THEN DEST[i+63:i] <- SRC1[i+63:i] + SRC2[i+63:i]
         ELSE
              IF *merging-masking*                ; merging-masking
                   THEN *DEST[i+63:i] remains unchanged*
                   ELSE                           ; zeroing-masking
                        DEST[i+63:i] <- 0
              FI
    FI;
ENDFOR
DEST[MAX_VL-1:VL] <- 0

VADDPD (EVEX encoded versions) when src2 operand is a memory source
(KL, VL) = (2, 128), (4, 256), (8, 512)

FOR j <- 0 TO KL-1
   i <- j * 64
   IF k1[j] OR *no writemask*
        THEN
             IF (EVEX.b = 1)
                  THEN
                       DEST[i+63:i] <- SRC1[i+63:i] + SRC2[63:0]
                  ELSE
                       DEST[i+63:i] <- SRC1[i+63:i] + SRC2[i+63:i]
             FI;
        ELSE
             IF *merging-masking*                 ; merging-masking
                  THEN *DEST[i+63:i] remains unchanged*
                  ELSE                            ; zeroing-masking
                       DEST[i+63:i] <- 0
             FI
   FI;
ENDFOR
DEST[MAX_VL-1:VL] <- 0

VADDPD (VEX.256 encoded version)
DEST[63:0] <- SRC1[63:0] + SRC2[63:0]
DEST[127:64] <- SRC1[127:64] + SRC2[127:64]
DEST[191:128] <- SRC1[191:128] + SRC2[191:128]
DEST[255:192] <- SRC1[255:192] + SRC2[255:192]
DEST[MAX_VL-1:256] <- 0
.





VADDPD (VEX.128 encoded version)
DEST[63:0] <- SRC1[63:0] + SRC2[63:0]
DEST[127:64] <- SRC1[127:64] + SRC2[127:64]
DEST[MAX_VL-1:128] <- 0

ADDPD (128-bit Legacy SSE version)
DEST[63:0] <- DEST[63:0] + SRC[63:0]
DEST[127:64] <- DEST[127:64] + SRC[127:64]
DEST[MAX_VL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VADDPD __m512d _mm512_add_pd (__m512d a, __m512d b);
VADDPD __m512d _mm512_mask_add_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);
VADDPD __m512d _mm512_maskz_add_pd (__mmask8 k, __m512d a, __m512d b);
VADDPD __m256d _mm256_mask_add_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);
VADDPD __m256d _mm256_maskz_add_pd (__mmask8 k, __m256d a, __m256d b);
VADDPD __m128d _mm_mask_add_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);
VADDPD __m128d _mm_maskz_add_pd (__mmask8 k, __m128d a, __m128d b);
VADDPD __m512d _mm512_add_round_pd (__m512d a, __m512d b, int);
VADDPD __m512d _mm512_mask_add_round_pd (__m512d s, __mmask8 k, __m512d a, __m512d b, int);
VADDPD __m512d _mm512_maskz_add_round_pd (__mmask8 k, __m512d a, __m512d b, int);
ADDPD __m256d _mm256_add_pd (__m256d a, __m256d b);
ADDPD __m128d _mm_add_pd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions
Overflow, Underflow, Invalid, Precision, Denormal

Other Exceptions
VEX-encoded instruction, see Exceptions Type 2.
EVEX-encoded instruction, see Exceptions Type E2.






platform: x86_64
mnem: ADDPS
description:
ADDPS-Add Packed Single-Precision Floating-Point Values
 Opcode/                                Op /   64/32       CPUID      Description
 Instruction                            En     bit Mode    Feature
                                               Support     Flag
 0F 58 /r                               RM     V/V         SSE        Add packed single-precision floating-point values from
 ADDPS xmm1, xmm2/m128                                                xmm2/m128 to xmm1 and store result in xmm1.
 VEX.NDS.128.0F.WIG 58 /r               RVM    V/V         AVX        Add packed single-precision floating-point values from
 VADDPS xmm1,xmm2, xmm3/m128                                          xmm3/m128 to xmm2 and store result in xmm1.
 VEX.NDS.256.0F.WIG 58 /r               RVM    V/V         AVX        Add packed single-precision floating-point values from
 VADDPS ymm1, ymm2, ymm3/m256                                         ymm3/m256 to ymm2 and store result in ymm1.
 EVEX.NDS.128.0F.W0 58 /r               FV     V/V         AVX512VL   Add packed single-precision floating-point values from
 VADDPS xmm1 {k1}{z}, xmm2,                                AVX512F    xmm3/m128/m32bcst to xmm2 and store result in
 xmm3/m128/m32bcst                                                    xmm1 with writemask k1.
 EVEX.NDS.256.0F.W0 58 /r               FV     V/V         AVX512VL   Add packed single-precision floating-point values from
 VADDPS ymm1 {k1}{z}, ymm2,                                AVX512F    ymm3/m256/m32bcst to ymm2 and store result in
 ymm3/m256/m32bcst                                                    ymm1 with writemask k1.
 EVEX.NDS.512.0F.W0 58 /r               FV     V/V         AVX512F    Add packed single-precision floating-point values from
 VADDPS zmm1 {k1}{z}, zmm2,                                           zmm3/m512/m32bcst to zmm2 and store result in
 zmm3/m512/m32bcst {er}                                               zmm1 with writemask k1.



                                               Instruction Operand Encoding
      Op/En             Operand 1                    Operand 2                Operand 3                     Operand 4
       RM            ModRM:reg (r, w)             ModRM:r/m (r)                  NA                            NA
       RVM            ModRM:reg (w)                  VEX.vvvv              ModRM:r/m (r)                       NA
     FV-RVM           ModRM:reg (w)                  EVEX.vvvv             ModRM:r/m (r)                       NA

Description
Add four, eight or sixteen packed single-precision floating-point values from the first source operand with the
second source operand, and stores the packed single-precision floating-point results in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector broadcasted from a
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with
writemask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAX_VL-1:256)
of the corresponding ZMM register destination are zeroed.
VEX.128 encoded version: the first source operand is a XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAX_VL-1:128)
of the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper Bits (MAX_VL-1:128) of the corresponding
ZMM register destination are unmodified.

Operation
VADDPS (EVEX encoded versions) when src2 operand is a register
(KL, VL) = (4, 128), (8, 256), (16, 512)
IF (VL = 512) AND (EVEX.b = 1)
    THEN
         SET_RM(EVEX.RC);
    ELSE
         SET_RM(MXCSR.RM);




FI;
FOR j <- 0 TO KL-1
    i <- j * 32
    IF k1[j] OR *no writemask*
         THEN DEST[i+31:i] <- SRC1[i+31:i] + SRC2[i+31:i]
         ELSE
              IF *merging-masking*                ; merging-masking
                   THEN *DEST[i+31:i] remains unchanged*
                   ELSE                           ; zeroing-masking
                        DEST[i+31:i] <- 0
              FI
    FI;
ENDFOR;
DEST[MAX_VL-1:VL] <- 0

VADDPS (EVEX encoded versions) when src2 operand is a memory source
(KL, VL) = (4, 128), (8, 256), (16, 512)

FOR j <- 0 TO KL-1
   i <-j * 32
   IF k1[j] OR *no writemask*
        THEN
             IF (EVEX.b = 1)
                  THEN
                       DEST[i+31:i] <- SRC1[i+31:i] + SRC2[31:0]
                  ELSE
                       DEST[i+31:i] <- SRC1[i+31:i] + SRC2[i+31:i]
             FI;
        ELSE
             IF *merging-masking*                 ; merging-masking
                  THEN *DEST[i+31:i] remains unchanged*
                  ELSE                            ; zeroing-masking
                       DEST[i+31:i] <- 0
             FI
   FI;
ENDFOR;
DEST[MAX_VL-1:VL] <- 0





VADDPS (VEX.256 encoded version)
DEST[31:0] <- SRC1[31:0] + SRC2[31:0]
DEST[63:32] <- SRC1[63:32] + SRC2[63:32]
DEST[95:64] <- SRC1[95:64] + SRC2[95:64]
DEST[127:96] <- SRC1[127:96] + SRC2[127:96]
DEST[159:128] <- SRC1[159:128] + SRC2[159:128]
DEST[191:160]<- SRC1[191:160] + SRC2[191:160]
DEST[223:192] <- SRC1[223:192] + SRC2[223:192]
DEST[255:224] <- SRC1[255:224] + SRC2[255:224].
DEST[MAX_VL-1:256] <- 0

VADDPS (VEX.128 encoded version)
DEST[31:0] <- SRC1[31:0] + SRC2[31:0]
DEST[63:32] <- SRC1[63:32] + SRC2[63:32]
DEST[95:64] <- SRC1[95:64] + SRC2[95:64]
DEST[127:96] <- SRC1[127:96] + SRC2[127:96]
DEST[MAX_VL-1:128] <- 0

ADDPS (128-bit Legacy SSE version)
DEST[31:0] <- SRC1[31:0] + SRC2[31:0]
DEST[63:32] <- SRC1[63:32] + SRC2[63:32]
DEST[95:64] <- SRC1[95:64] + SRC2[95:64]
DEST[127:96] <- SRC1[127:96] + SRC2[127:96]
DEST[MAX_VL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VADDPS __m512 _mm512_add_ps (__m512 a, __m512 b);
VADDPS __m512 _mm512_mask_add_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);
VADDPS __m512 _mm512_maskz_add_ps (__mmask16 k, __m512 a, __m512 b);
VADDPS __m256 _mm256_mask_add_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);
VADDPS __m256 _mm256_maskz_add_ps (__mmask8 k, __m256 a, __m256 b);
VADDPS __m128 _mm_mask_add_ps (__m128d s, __mmask8 k, __m128 a, __m128 b);
VADDPS __m128 _mm_maskz_add_ps (__mmask8 k, __m128 a, __m128 b);
VADDPS __m512 _mm512_add_round_ps (__m512 a, __m512 b, int);
VADDPS __m512 _mm512_mask_add_round_ps (__m512 s, __mmask16 k, __m512 a, __m512 b, int);
VADDPS __m512 _mm512_maskz_add_round_ps (__mmask16 k, __m512 a, __m512 b, int);
ADDPS __m256 _mm256_add_ps (__m256 a, __m256 b);
ADDPS __m128 _mm_add_ps (__m128 a, __m128 b);

SIMD Floating-Point Exceptions
Overflow, Underflow, Invalid, Precision, Denormal

Other Exceptions
VEX-encoded instruction, see Exceptions Type 2.
EVEX-encoded instruction, see Exceptions Type E2.






platform: x86_64
mnem: ADDSD
description:
ADDSD-Add Scalar Double-Precision Floating-Point Values
 Opcode/                            Op /     64/32        CPUID         Description
 Instruction                        En       bit Mode     Feature
                                             Support      Flag
 F2 0F 58 /r                        RM       V/V          SSE2          Add the low double-precision floating-point value from
 ADDSD xmm1, xmm2/m64                                                   xmm2/mem to xmm1 and store the result in xmm1.
 VEX.NDS.128.F2.0F.WIG 58 /r        RVM      V/V          AVX           Add the low double-precision floating-point value from
 VADDSD xmm1, xmm2,                                                     xmm3/mem to xmm2 and store the result in xmm1.
 xmm3/m64
 EVEX.NDS.LIG.F2.0F.W1 58 /r        T1S      V/V          AVX512F       Add the low double-precision floating-point value from
 VADDSD xmm1 {k1}{z},                                                   xmm3/m64 to xmm2 and store the result in xmm1 with
 xmm2, xmm3/m64{er}                                                     writemask k1.



                                                    Instruction Operand Encoding
        Op/En                    Operand 1                      Operand 2                 Operand 3                   Operand 4
          RM                 ModRM:reg (r, w)               ModRM:r/m (r)                     NA                         NA
         RVM                  ModRM:reg (w)                     VEX.vvvv                ModRM:r/m (r)                    NA
      T1S-RVM                 ModRM:reg (w)                     EVEX.vvvv               ModRM:r/m (r)                    NA

Description
Adds the low double-precision floating-point values from the second source operand and the first source operand
and stores the double-precision floating-point result in the destination operand.
The second source operand can be an XMM register or a 64-bit memory location. The first source and destination
operands are XMM registers.
128-bit Legacy SSE version: The first source and destination operands are the same. Bits (MAX_VL-1:64) of the
corresponding destination register remain unchanged.
EVEX and VEX.128 encoded version: The first source operand is encoded by EVEX.vvvv/VEX.vvvv. Bits (127:64) of
the XMM register destination are copied from corresponding bits in the first source operand. Bits (MAX_VL-1:128)
of the destination register are zeroed.
EVEX version: The low quadword element of the destination is updated according to the writemask.
Software should ensure VADDSD is encoded with VEX.L=0. Encoding VADDSD with VEX.L=1 may encounter
unpredictable behavior across different processor generations.

Operation
VADDSD (EVEX encoded version)
IF (EVEX.b = 1) AND SRC2 *is a register*
    THEN
         SET_RM(EVEX.RC);
    ELSE
         SET_RM(MXCSR.RM);
FI;
IF k1[0] or *no writemask*
    THEN      DEST[63:0] <- SRC1[63:0] + SRC2[63:0]
    ELSE
         IF *merging-masking*              ; merging-masking
              THEN *DEST[63:0] remains unchanged*
              ELSE                         ; zeroing-masking
                  THEN DEST[63:0] <- 0
         FI;
FI;
DEST[127:64] <- SRC1[127:64]



DEST[MAX_VL-1:128] <- 0

VADDSD (VEX.128 encoded version)
DEST[63:0] <-SRC1[63:0] + SRC2[63:0]
DEST[127:64] <-SRC1[127:64]
DEST[MAX_VL-1:128] <-0

ADDSD (128-bit Legacy SSE version)
DEST[63:0] <-DEST[63:0] + SRC[63:0]
DEST[MAX_VL-1:64] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VADDSD __m128d _mm_mask_add_sd (__m128d s, __mmask8 k, __m128d a, __m128d b);
VADDSD __m128d _mm_maskz_add_sd (__mmask8 k, __m128d a, __m128d b);
VADDSD __m128d _mm_add_round_sd (__m128d a, __m128d b, int);
VADDSD __m128d _mm_mask_add_round_sd (__m128d s, __mmask8 k, __m128d a, __m128d b, int);
VADDSD __m128d _mm_maskz_add_round_sd (__mmask8 k, __m128d a, __m128d b, int);
ADDSD __m128d _mm_add_sd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions
Overflow, Underflow, Invalid, Precision, Denormal

Other Exceptions
VEX-encoded instruction, see Exceptions Type 3.
EVEX-encoded instruction, see Exceptions Type E3.






platform: x86_64
mnem: ADDSS
description:
ADDSS-Add Scalar Single-Precision Floating-Point Values
 Opcode/                             Op /    64/32        CPUID           Description
 Instruction                         En      bit Mode     Feature
                                             Support      Flag
 F3 0F 58 /r                         RM      V/V          SSE             Add the low single-precision floating-point value from
 ADDSS xmm1, xmm2/m32                                                     xmm2/mem to xmm1 and store the result in xmm1.
 VEX.NDS.128.F3.0F.WIG 58 /r         RVM     V/V          AVX             Add the low single-precision floating-point value from
 VADDSS xmm1,xmm2,                                                        xmm3/mem to xmm2 and store the result in xmm1.
 xmm3/m32
 EVEX.NDS.LIG.F3.0F.W0 58 /r         T1S     V/V          AVX512F         Add the low single-precision floating-point value from
 VADDSS xmm1{k1}{z}, xmm2,                                                xmm3/m32 to xmm2 and store the result in xmm1with
 xmm3/m32{er}                                                             writemask k1.



                                                     Instruction Operand Encoding
       Op/En                  Operand 1                    Operand 2                      Operand 3                     Operand 4
        RM                ModRM:reg (r, w)                ModRM:r/m (r)                       NA                            NA
        RVM                ModRM:reg (w)                    VEX.vvvv                     ModRM:r/m (r)                      NA
        T1S                ModRM:reg (w)                   EVEX.vvvv                     ModRM:r/m (r)                      NA

Description
Adds the low single-precision floating-point values from the second source operand and the first source operand,
and stores the double-precision floating-point result in the destination operand.
The second source operand can be an XMM register or a 64-bit memory location. The first source and destination
operands are XMM registers.
128-bit Legacy SSE version: The first source and destination operands are the same. Bits (MAX_VL-1:32) of the
corresponding the destination register remain unchanged.
EVEX and VEX.128 encoded version: The first source operand is encoded by EVEX.vvvv/VEX.vvvv. Bits (127:32) of
the XMM register destination are copied from corresponding bits in the first source operand. Bits (MAX_VL-1:128)
of the destination register are zeroed.
EVEX version: The low doubleword element of the destination is updated according to the writemask.
Software should ensure VADDSS is encoded with VEX.L=0. Encoding VADDSS with VEX.L=1 may encounter unpre-
dictable behavior across different processor generations.

Operation
VADDSS (EVEX encoded versions)
IF (EVEX.b = 1) AND SRC2 *is a register*
    THEN
         SET_RM(EVEX.RC);
    ELSE
         SET_RM(MXCSR.RM);
FI;
IF k1[0] or *no writemask*
    THEN      DEST[31:0] <- SRC1[31:0] + SRC2[31:0]
    ELSE
         IF *merging-masking*              ; merging-masking
              THEN *DEST[31:0] remains unchanged*
              ELSE                         ; zeroing-masking
                  THEN DEST[31:0] <- 0
         FI;
FI;
DEST[127:32] <- SRC1[127:32]



DEST[MAX_VL-1:128] <- 0

VADDSS DEST, SRC1, SRC2 (VEX.128 encoded version)
DEST[31:0] <-SRC1[31:0] + SRC2[31:0]
DEST[127:32] <-SRC1[127:32]
DEST[MAX_VL-1:128] <-0

ADDSS DEST, SRC (128-bit Legacy SSE version)
DEST[31:0] <-DEST[31:0] + SRC[31:0]
DEST[MAX_VL-1:32] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VADDSS __m128 _mm_mask_add_ss (__m128 s, __mmask8 k, __m128 a, __m128 b);
VADDSS __m128 _mm_maskz_add_ss (__mmask8 k, __m128 a, __m128 b);
VADDSS __m128 _mm_add_round_ss (__m128 a, __m128 b, int);
VADDSS __m128 _mm_mask_add_round_ss (__m128 s, __mmask8 k, __m128 a, __m128 b, int);
VADDSS __m128 _mm_maskz_add_round_ss (__mmask8 k, __m128 a, __m128 b, int);
ADDSS __m128 _mm_add_ss (__m128 a, __m128 b);

SIMD Floating-Point Exceptions
Overflow, Underflow, Invalid, Precision, Denormal

Other Exceptions
VEX-encoded instruction, see Exceptions Type 3.
EVEX-encoded instruction, see Exceptions Type E3.






platform: x86_64
mnem: ADDSUBPD
description:
ADDSUBPD-Packed Double-FP Add/Subtract
Opcode/                                         Op/       64/32-bit CPUID        Description
Instruction                                     En        Mode      Feature
                                                                    Flag
66 0F D0 /r                                     RM        V/V       SSE3         Add/subtract double-precision floating-point
ADDSUBPD xmm1, xmm2/m128                                                         values from xmm2/m128 to xmm1.

VEX.NDS.128.66.0F.WIG D0 /r                     RVM V/V             AVX          Add/subtract packed double-precision
VADDSUBPD xmm1, xmm2, xmm3/m128                                                  floating-point values from xmm3/mem to
                                                                                 xmm2 and stores result in xmm1.
VEX.NDS.256.66.0F.WIG D0 /r                     RVM V/V             AVX          Add / subtract packed double-precision
VADDSUBPD ymm1, ymm2, ymm3/m256                                                  floating-point values from ymm3/mem to
                                                                                 ymm2 and stores result in ymm1.



                                          Instruction Operand Encoding
  Op/En             Operand 1               Operand 2                      Operand 3                      Operand 4
    RM           ModRM:reg (r, w)         ModRM:r/m (r)                        NA                             NA
   RVM            ModRM:reg (w)            VEX.vvvv (r)                   ModRM:r/m (r)                       NA

Description
Adds odd-numbered double-precision floating-point values of the first source operand (second operand) with the
corresponding double-precision floating-point values from the second source operand (third operand); stores the
result in the odd-numbered values of the destination operand (first operand). Subtracts the even-numbered
double-precision floating-point values from the second source operand from the corresponding double-precision
floating values in the first source operand; stores the result into the even-numbered values of the destination
operand.
In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers
(XMM8-XMM15).
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (VLMAX-1:128) of the corresponding
YMM register destination are unmodified. See Figure 3-3.
VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination
operand is an XMM register. The upper bits (VLMAX-1:128) of the corresponding YMM register destination are
zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register.





                                             ADDSUBPD xmm1, xmm2/m128


                                     [127:64]                           [63:0]              xmm2/m128




                                                                                            RESULT:
                         xmm1[127:64] + xmm2/m128[127:64]   xmm1[63:0] - xmm2/m128[63:0]
                                                                                            xmm1

                                     [127:64]                           [63:0]



                              Figure 3-3. ADDSUBPD-Packed Double-FP Add/Subtract


Operation
ADDSUBPD (128-bit Legacy SSE version)
DEST[63:0] <- DEST[63:0] - SRC[63:0]
DEST[127:64] <- DEST[127:64] + SRC[127:64]
DEST[VLMAX-1:128] (Unmodified)

VADDSUBPD (VEX.128 encoded version)
DEST[63:0] <- SRC1[63:0] - SRC2[63:0]
DEST[127:64] <- SRC1[127:64] + SRC2[127:64]
DEST[VLMAX-1:128] <- 0

VADDSUBPD (VEX.256 encoded version)
DEST[63:0] <- SRC1[63:0] - SRC2[63:0]
DEST[127:64] <- SRC1[127:64] + SRC2[127:64]
DEST[191:128] <- SRC1[191:128] - SRC2[191:128]
DEST[255:192] <- SRC1[255:192] + SRC2[255:192]

Intel C/C++ Compiler Intrinsic Equivalent
ADDSUBPD:      __m128d _mm_addsub_pd(__m128d a, __m128d b)

VADDSUBPD:     __m256d _mm256_addsub_pd (__m256d a, __m256d b)

Exceptions
When the source operand is a memory operand, it must be aligned on a 16-byte boundary or a general-protection
exception (#GP) will be generated.

SIMD Floating-Point Exceptions
Overflow, Underflow, Invalid, Precision, Denormal.

Other Exceptions
See Exceptions Type 2.






platform: x86_64
mnem: ADDSUBPS
description:
ADDSUBPS-Packed Single-FP Add/Subtract
 Opcode/                                        Op/   64/32-bit CPUID        Description
 Instruction                                    En    Mode      Feature
                                                                Flag
 F2 0F D0 /r                                    RM    V/V       SSE3         Add/subtract single-precision floating-point
 ADDSUBPS xmm1, xmm2/m128                                                    values from xmm2/m128 to xmm1.

 VEX.NDS.128.F2.0F.WIG D0 /r                    RVM V/V         AVX          Add/subtract single-precision floating-point
 VADDSUBPS xmm1, xmm2, xmm3/m128                                             values from xmm3/mem to xmm2 and stores
                                                                             result in xmm1.
 VEX.NDS.256.F2.0F.WIG D0 /r                    RVM V/V         AVX          Add / subtract single-precision floating-point
 VADDSUBPS ymm1, ymm2, ymm3/m256                                             values from ymm3/mem to ymm2 and stores
                                                                             result in ymm1.



                                          Instruction Operand Encoding
  Op/En              Operand 1               Operand 2                  Operand 3                      Operand 4
    RM            ModRM:reg (r, w)         ModRM:r/m (r)                    NA                             NA
   RVM             ModRM:reg (w)            VEX.vvvv (r)               ModRM:r/m (r)                       NA

Description
Adds odd-numbered single-precision floating-point values of the first source operand (second operand) with the
corresponding single-precision floating-point values from the second source operand (third operand); stores the
result in the odd-numbered values of the destination operand (first operand). Subtracts the even-numbered
single-precision floating-point values from the second source operand from the corresponding single-precision
floating values in the first source operand; stores the result into the even-numbered values of the destination
operand.
In 64-bit mode, using a REX prefix in the form of REX.R permits this instruction to access additional registers
(XMM8-XMM15).
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (VLMAX-1:128) of the corresponding
YMM register destination are unmodified. See Figure 3-4.
VEX.128 encoded version: the first source operand is an XMM register or 128-bit memory location. The destination
operand is an XMM register. The upper bits (VLMAX-1:128) of the corresponding YMM register destination are
zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register.





                                           ADDSUBPS xmm1, xmm2/m128

                                                                                                    xmm2/
                        [127:96]             [95:64]              [63:32]            [31:0]
                                                                                                    m128




                      xmm1[127:96] +    xmm1[95:64] - xmm2/     xmm1[63:32] +      xmm1[31:0] -     RESULT:
                    xmm2/m128[127:96]      m128[95:64]        xmm2/m128[63:32]   xmm2/m128[31:0]    xmm1

                        [127:96]             [95:64]              [63:32]            [31:0]


                                                                                                        OM15992



                               Figure 3-4. ADDSUBPS-Packed Single-FP Add/Subtract


Operation
ADDSUBPS (128-bit Legacy SSE version)
DEST[31:0] <- DEST[31:0] - SRC[31:0]
DEST[63:32] <- DEST[63:32] + SRC[63:32]
DEST[95:64] <- DEST[95:64] - SRC[95:64]
DEST[127:96] <- DEST[127:96] + SRC[127:96]
DEST[VLMAX-1:128] (Unmodified)

VADDSUBPS (VEX.128 encoded version)
DEST[31:0] <- SRC1[31:0] - SRC2[31:0]
DEST[63:32] <- SRC1[63:32] + SRC2[63:32]
DEST[95:64] <- SRC1[95:64] - SRC2[95:64]
DEST[127:96] <- SRC1[127:96] + SRC2[127:96]
DEST[VLMAX-1:128] <- 0

VADDSUBPS (VEX.256 encoded version)
DEST[31:0] <- SRC1[31:0] - SRC2[31:0]
DEST[63:32] <- SRC1[63:32] + SRC2[63:32]
DEST[95:64] <- SRC1[95:64] - SRC2[95:64]
DEST[127:96] <- SRC1[127:96] + SRC2[127:96]
DEST[159:128] <- SRC1[159:128] - SRC2[159:128]
DEST[191:160]<- SRC1[191:160] + SRC2[191:160]
DEST[223:192] <- SRC1[223:192] - SRC2[223:192]
DEST[255:224] <- SRC1[255:224] + SRC2[255:224].

Intel C/C++ Compiler Intrinsic Equivalent
ADDSUBPS:      __m128 _mm_addsub_ps(__m128 a, __m128 b)

VADDSUBPS:     __m256 _mm256_addsub_ps (__m256 a, __m256 b)

Exceptions
When the source operand is a memory operand, the operand must be aligned on a 16-byte boundary or a general-
protection exception (#GP) will be generated.





SIMD Floating-Point Exceptions
Overflow, Underflow, Invalid, Precision, Denormal.

Other Exceptions
See Exceptions Type 2.






platform: x86_64
mnem: ADOX
description:
ADOX - Unsigned Integer Addition of Two Operands with Overflow Flag
 Opcode/                           Op/     64/32bit    CPUID       Description
 Instruction                       En      Mode        Feature
                                           Support     Flag
 F3 0F 38 F6 /r                    RM      V/V         ADX         Unsigned addition of r32 with OF, r/m32 to r32, writes OF.
 ADOX r32, r/m32
 F3 REX.w 0F 38 F6 /r              RM      V/NE        ADX         Unsigned addition of r64 with OF, r/m64 to r64, writes OF.
 ADOX r64, r/m64



                                                  Instruction Operand Encoding
       Op/En               Operand 1                   Operand 2                     Operand 3                     Operand 4
        RM              ModRM:reg (r, w)              ModRM:r/m (r)                      NA                            NA

Description
Performs an unsigned addition of the destination operand (first operand), the source operand (second operand)
and the overflow-flag (OF) and stores the result in the destination operand. The destination operand is a general-
purpose register, whereas the source operand can be a general-purpose register or memory location. The state of
OF represents a carry from a previous addition. The instruction sets the OF flag with the carry generated by the
unsigned addition of the operands.
The ADOX instruction is executed in the context of multi-precision addition, where we add a series of operands with
a carry-chain. At the beginning of a chain of additions, we execute an instruction to zero the OF (e.g. XOR).
This instruction is supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in 64-bit
mode.
In 64-bit mode, the default operation size is 32 bits. Using a REX Prefix in the form of REX.R permits access to addi-
tional registers (R8-15). Using REX Prefix in the form of REX.W promotes operation to 64-bits.
ADOX executes normally either inside or outside a transaction region.
Note: ADOX defines the CF and OF flags differently than the ADD/ADC instructions as defined in Intel 64 and
IA-32 Architectures Software Developer's Manual, Volume 2A.

Operation
IF OperandSize is 64-bit
    THEN OF:DEST[63:0] <- DEST[63:0] + SRC[63:0] + OF;
    ELSE OF:DEST[31:0] <- DEST[31:0] + SRC[31:0] + OF;
FI;

Flags Affected
OF is updated based on result. CF, SF, ZF, AF and PF flags are unmodified.

Intel C/C++ Compiler Intrinsic Equivalent
unsigned char _addcarryx_u32 (unsigned char c_in, unsigned int src1, unsigned int src2, unsigned int *sum_out);
unsigned char _addcarryx_u64 (unsigned char c_in, unsigned __int64 src1, unsigned __int64 src2, unsigned __int64 *sum_out);

SIMD Floating-Point Exceptions
None





Protected Mode Exceptions
#UD                      If the LOCK prefix is used.
                         If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)                   For an illegal address in the SS segment.
#GP(0)                   For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
                         If the DS, ES, FS, or GS register is used to access memory and it contains a null segment
                         selector.
#PF(fault-code)          For a page fault.
#AC(0)                   If alignment checking is enabled and an unaligned memory reference is made while the
                         current privilege level is 3.

Real-Address Mode Exceptions
#UD                      If the LOCK prefix is used.
                         If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)                   For an illegal address in the SS segment.
#GP(0)                   If any part of the operand lies outside the effective address space from 0 to FFFFH.

Virtual-8086 Mode Exceptions
#UD                      If the LOCK prefix is used.
                         If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)                   For an illegal address in the SS segment.
#GP(0)                   If any part of the operand lies outside the effective address space from 0 to FFFFH.
#PF(fault-code)          For a page fault.
#AC(0)                   If alignment checking is enabled and an unaligned memory reference is made while the
                         current privilege level is 3.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                      If the LOCK prefix is used.
                         If CPUID.(EAX=07H, ECX=0H):EBX.ADX[bit 19] = 0.
#SS(0)                   If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)                   If the memory address is in a non-canonical form.
#PF(fault-code)          For a page fault.
#AC(0)                   If alignment checking is enabled and an unaligned memory reference is made while the
                         current privilege level is 3.






platform: x86_64
mnem: AESDEC
description:
AESDEC-Perform One Round of an AES Decryption Flow
Opcode/                                         Op/      64/32-bit CPUID        Description
Instruction                                     En       Mode      Feature
                                                                   Flag
66 0F 38 DE /r                                  RM       V/V       AES          Perform one round of an AES decryption flow,
AESDEC xmm1, xmm2/m128                                                          using the Equivalent Inverse Cipher, operating
                                                                                on a 128-bit data (state) from xmm1 with a
                                                                                128-bit round key from xmm2/m128.
VEX.NDS.128.66.0F38.WIG DE /r                   RVM V/V            Both AES     Perform one round of an AES decryption flow,
VAESDEC xmm1, xmm2, xmm3/m128                                      and          using the Equivalent Inverse Cipher, operating
                                                                   AVX flags    on a 128-bit data (state) from xmm2 with a
                                                                                128-bit round key from xmm3/m128; store
                                                                                the result in xmm1.



                                          Instruction Operand Encoding
  Op/En           Operand 1               Operand2                        Operand3                       Operand4
    RM         ModRM:reg (r, w)          ModRM:r/m (r)                        NA                             NA
   RVM         ModRM:reg (w)             VEX.vvvv (r)                    ModRM:r/m (r)                       NA

Description
This instruction performs a single round of the AES decryption flow using the Equivalent Inverse Cipher, with the
round key from the second source operand, operating on a 128-bit data (state) from the first source operand, and
store the result in the destination operand.
Use the AESDEC instruction for all but the last decryption round. For the last decryption round, use the AESDE-
CLAST instruction.
128-bit Legacy SSE version: The first source operand and the destination operand are the same and must be an
XMM register. The second source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-
1:128) of the corresponding YMM destination register remain unchanged.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-1:128) of the destination YMM
register are zeroed.

Operation
AESDEC
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- InvShiftRows( STATE );
STATE <- InvSubBytes( STATE );
STATE <- InvMixColumns( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] (Unmodified)

VAESDEC
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- InvShiftRows( STATE );
STATE <- InvSubBytes( STATE );
STATE <- InvMixColumns( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] <- 0





Intel C/C++ Compiler Intrinsic Equivalent
(V)AESDEC:      __m128i _mm_aesdec (__m128i, __m128i)

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4.






platform: x86_64
mnem: AESDECLAST
description:
AESDECLAST-Perform Last Round of an AES Decryption Flow
Opcode/                                          Op/     64/32-bit CPUID         Description
Instruction                                      En      Mode      Feature
                                                                   Flag
66 0F 38 DF /r                                   RM      V/V       AES           Perform the last round of an AES decryption
AESDECLAST xmm1, xmm2/m128                                                       flow, using the Equivalent Inverse Cipher,
                                                                                 operating on a 128-bit data (state) from
                                                                                 xmm1 with a 128-bit round key from
                                                                                 xmm2/m128.
VEX.NDS.128.66.0F38.WIG DF /r                    RVM V/V           Both AES      Perform the last round of an AES decryption
VAESDECLAST xmm1, xmm2, xmm3/m128                                  and           flow, using the Equivalent Inverse Cipher,
                                                                   AVX flags     operating on a 128-bit data (state) from
                                                                                 xmm2 with a 128-bit round key from
                                                                                 xmm3/m128; store the result in xmm1.



                                            Instruction Operand Encoding
  Op/En             Operand 1                 Operand2                     Operand3                       Operand4
    RM           ModRM:reg (r, w)           ModRM:r/m (r)                      NA                             NA
   RVM           ModRM:reg (w)              VEX.vvvv (r)                 ModRM:r/m (r)                        NA

Description
This instruction performs the last round of the AES decryption flow using the Equivalent Inverse Cipher, with the
round key from the second source operand, operating on a 128-bit data (state) from the first source operand, and
store the result in the destination operand.
128-bit Legacy SSE version: The first source operand and the destination operand are the same and must be an
XMM register. The second source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-
1:128) of the corresponding YMM destination register remain unchanged.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-1:128) of the destination YMM
register are zeroed.

Operation
AESDECLAST
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- InvShiftRows( STATE );
STATE <- InvSubBytes( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] (Unmodified)

VAESDECLAST
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- InvShiftRows( STATE );
STATE <- InvSubBytes( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] <- 0

Intel C/C++ Compiler Intrinsic Equivalent
(V)AESDECLAST:     __m128i _mm_aesdeclast (__m128i, __m128i)




SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4.






platform: x86_64
mnem: AESENC
description:
AESENC-Perform One Round of an AES Encryption Flow
Opcode/                                         Op/    64/32-bit CPUID        Description
Instruction                                     En     Mode      Feature
                                                                 Flag
66 0F 38 DC /r                                  RM     V/V       AES          Perform one round of an AES encryption flow,
AESENC xmm1, xmm2/m128                                                        operating on a 128-bit data (state) from
                                                                              xmm1 with a 128-bit round key from
                                                                              xmm2/m128.
VEX.NDS.128.66.0F38.WIG DC /r                   RVM V/V          Both AES     Perform one round of an AES encryption flow,
VAESENC xmm1, xmm2, xmm3/m128                                    and          operating on a 128-bit data (state) from
                                                                 AVX flags    xmm2 with a 128-bit round key from the
                                                                              xmm3/m128; store the result in xmm1.



                                          Instruction Operand Encoding
  Op/En           Operand 1                 Operand2                    Operand3                        Operand4
    RM         ModRM:reg (r, w)            ModRM:r/m (r)                     NA                            NA
   RVM          ModRM:reg (w)              VEX.vvvv (r)                ModRM:r/m (r)                       NA

Description
This instruction performs a single round of an AES encryption flow using a round key from the second source
operand, operating on 128-bit data (state) from the first source operand, and store the result in the destination
operand.
Use the AESENC instruction for all but the last encryption rounds. For the last encryption round, use the AESENC-
CLAST instruction.
128-bit Legacy SSE version: The first source operand and the destination operand are the same and must be an
XMM register. The second source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-
1:128) of the corresponding YMM destination register remain unchanged.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-1:128) of the destination YMM
register are zeroed.

Operation
AESENC
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- ShiftRows( STATE );
STATE <- SubBytes( STATE );
STATE <- MixColumns( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] (Unmodified)

VAESENC
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- ShiftRows( STATE );
STATE <- SubBytes( STATE );
STATE <- MixColumns( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] <- 0





Intel C/C++ Compiler Intrinsic Equivalent
(V)AESENC:      __m128i _mm_aesenc (__m128i, __m128i)

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4.






platform: x86_64
mnem: AESENCLAST
description:
AESENCLAST-Perform Last Round of an AES Encryption Flow
Opcode/                                           Op/     64/32-bit CPUID        Description
Instruction                                       En      Mode      Feature
                                                                    Flag
66 0F 38 DD /r                                    RM      V/V       AES          Perform the last round of an AES encryption
AESENCLAST xmm1, xmm2/m128                                                       flow, operating on a 128-bit data (state) from
                                                                                 xmm1 with a 128-bit round key from
                                                                                 xmm2/m128.
VEX.NDS.128.66.0F38.WIG DD /r                     RVM V/V           Both AES     Perform the last round of an AES encryption
VAESENCLAST xmm1, xmm2, xmm3/m128                                   and          flow, operating on a 128-bit data (state) from
                                                                    AVX flags    xmm2 with a 128 bit round key from
                                                                                 xmm3/m128; store the result in xmm1.



                                            Instruction Operand Encoding
  Op/En             Operand 1                  Operand2                       Operand3                     Operand4
    RM           ModRM:reg (r, w)            ModRM:r/m (r)                      NA                             NA
   RVM           ModRM:reg (w)               VEX.vvvv (r)                 ModRM:r/m (r)                        NA

Description
This instruction performs the last round of an AES encryption flow using a round key from the second source
operand, operating on 128-bit data (state) from the first source operand, and store the result in the destination
operand.
128-bit Legacy SSE version: The first source operand and the destination operand are the same and must be an
XMM register. The second source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-
1:128) of the corresponding YMM destination register remain unchanged.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand can be an XMM register or a 128-bit memory location. Bits (VLMAX-1:128) of the destination YMM
register are zeroed.

Operation
AESENCLAST
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- ShiftRows( STATE );
STATE <- SubBytes( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] (Unmodified)

VAESENCLAST
STATE <- SRC1;
RoundKey <- SRC2;
STATE <- ShiftRows( STATE );
STATE <- SubBytes( STATE );
DEST[127:0] <- STATE XOR RoundKey;
DEST[VLMAX-1:128] <- 0

Intel C/C++ Compiler Intrinsic Equivalent
(V)AESENCLAST:     __m128i _mm_aesenclast (__m128i, __m128i)





SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4.






platform: x86_64
mnem: AESIMC
description:
AESIMC-Perform the AES InvMixColumn Transformation
Opcode/                                            Op/   64/32-bit CPUID        Description
Instruction                                        En    Mode      Feature
                                                                   Flag
66 0F 38 DB /r                                     RM    V/V       AES          Perform the InvMixColumn transformation on
AESIMC xmm1, xmm2/m128                                                          a 128-bit round key from xmm2/m128 and
                                                                                store the result in xmm1.
VEX.128.66.0F38.WIG DB /r                          RM    V/V       Both AES     Perform the InvMixColumn transformation on
VAESIMC xmm1, xmm2/m128                                            and          a 128-bit round key from xmm2/m128 and
                                                                   AVX flags    store the result in xmm1.



                                              Instruction Operand Encoding
  Op/En             Operand 1                   Operand2                     Operand3                     Operand4
    RM            ModRM:reg (w)               ModRM:r/m (r)                     NA                            NA

Description
Perform the InvMixColumns transformation on the source operand and store the result in the destination operand.
The destination operand is an XMM register. The source operand can be an XMM register or a 128-bit memory loca-
tion.
Note: the AESIMC instruction should be applied to the expanded AES round keys (except for the first and last round
key) in order to prepare them for decryption using the "Equivalent Inverse Cipher" (defined in FIPS 197).
128-bit Legacy SSE version: Bits (VLMAX-1:128) of the corresponding YMM destination register remain
unchanged.
VEX.128 encoded version: Bits (VLMAX-1:128) of the destination YMM register are zeroed.
Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation
AESIMC
DEST[127:0] <- InvMixColumns( SRC );
DEST[VLMAX-1:128] (Unmodified)

VAESIMC
DEST[127:0] <- InvMixColumns( SRC );
DEST[VLMAX-1:128] <- 0;

Intel C/C++ Compiler Intrinsic Equivalent
(V)AESIMC:     __m128i _mm_aesimc (__m128i)

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4; additionally
#UD                   If VEX.vvvv != 1111B.






platform: x86_64
mnem: AESKEYGENASSIST
description:
AESKEYGENASSIST-AES Round Key Generation Assist
 Opcode/                                               Op/     64/32-bit CPUID        Description
 Instruction                                           En      Mode      Feature
                                                                         Flag
 66 0F 3A DF /r ib                                     RMI     V/V       AES          Assist in AES round key generation using an 8
 AESKEYGENASSIST xmm1, xmm2/m128, imm8                                                bits Round Constant (RCON) specified in the
                                                                                      immediate byte, operating on 128 bits of data
                                                                                      specified in xmm2/m128 and stores the
                                                                                      result in xmm1.
 VEX.128.66.0F3A.WIG DF /r ib                          RMI     V/V       Both AES     Assist in AES round key generation using 8
 VAESKEYGENASSIST xmm1, xmm2/m128, imm8                                  and          bits Round Constant (RCON) specified in the
                                                                         AVX flags    immediate byte, operating on 128 bits of data
                                                                                      specified in xmm2/m128 and stores the
                                                                                      result in xmm1.



                                                  Instruction Operand Encoding
   Op/En            Operand 1                       Operand2                    Operand3                        Operand4
    RMI           ModRM:reg (w)                   ModRM:r/m (r)                      imm8                          NA

Description
Assist in expanding the AES cipher key, by computing steps towards generating a round key for encryption, using
128-bit data specified in the source operand and an 8-bit round constant specified as an immediate, store the
result in the destination operand.
The destination operand is an XMM register. The source operand can be an XMM register or a 128-bit memory loca-
tion.
128-bit Legacy SSE version: Bits (VLMAX-1:128) of the corresponding YMM destination register remain
unchanged.
VEX.128 encoded version: Bits (VLMAX-1:128) of the destination YMM register are zeroed.
Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation
AESKEYGENASSIST
X3[31:0] <- SRC [127: 96];
X2[31:0] <- SRC [95: 64];
X1[31:0] <- SRC [63: 32];
X0[31:0] <- SRC [31: 0];
RCON[31:0] <- ZeroExtend(Imm8[7:0]);
DEST[31:0] <- SubWord(X1);
DEST[63:32 ] <- RotWord( SubWord(X1) ) XOR RCON;
DEST[95:64] <- SubWord(X3);
DEST[127:96] <- RotWord( SubWord(X3) ) XOR RCON;
DEST[VLMAX-1:128] (Unmodified)





VAESKEYGENASSIST
X3[31:0] <- SRC [127: 96];
X2[31:0] <- SRC [95: 64];
X1[31:0] <- SRC [63: 32];
X0[31:0] <- SRC [31: 0];
RCON[31:0] <- ZeroExtend(Imm8[7:0]);
DEST[31:0] <- SubWord(X1);
DEST[63:32 ] <- RotWord( SubWord(X1) ) XOR RCON;
DEST[95:64] <- SubWord(X3);
DEST[127:96] <- RotWord( SubWord(X3) ) XOR RCON;
DEST[VLMAX-1:128] <- 0;

Intel C/C++ Compiler Intrinsic Equivalent
(V)AESKEYGENASSIST:    __m128i _mm_aeskeygenassist (__m128i, const int)

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4; additionally
#UD                   If VEX.vvvv != 1111B.






platform: x86_64
mnem: AND
description:
AND-Logical AND
 Opcode                    Instruction                  Op/    64-bit       Compat/ Description
                                                        En     Mode         Leg Mode
 24 ib                     AND AL, imm8                 I      Valid        Valid        AL AND imm8.
 25 iw                     AND AX, imm16                I      Valid        Valid        AX AND imm16.
 25 id                     AND EAX, imm32               I      Valid        Valid        EAX AND imm32.
 REX.W + 25 id             AND RAX, imm32               I      Valid        N.E.         RAX AND imm32 sign-extended to 64-bits.
 80 /4 ib                  AND r/m8, imm8               MI     Valid        Valid        r/m8 AND imm8.
 REX + 80 /4 ib            AND r/m8*, imm8              MI     Valid        N.E.         r/m8 AND imm8.
 81 /4 iw                  AND r/m16, imm16             MI     Valid        Valid        r/m16 AND imm16.
 81 /4 id                  AND r/m32, imm32             MI     Valid        Valid        r/m32 AND imm32.
 REX.W + 81 /4 id          AND r/m64, imm32             MI     Valid        N.E.         r/m64 AND imm32 sign extended to 64-bits.
 83 /4 ib                  AND r/m16, imm8              MI     Valid        Valid        r/m16 AND imm8 (sign-extended).
 83 /4 ib                  AND r/m32, imm8              MI     Valid        Valid        r/m32 AND imm8 (sign-extended).
 REX.W + 83 /4 ib          AND r/m64, imm8              MI     Valid        N.E.         r/m64 AND imm8 (sign-extended).
 20 /r                     AND r/m8, r8                 MR     Valid        Valid        r/m8 AND r8.
 REX + 20 /r               AND r/m8*, r8*               MR     Valid        N.E.         r/m64 AND r8 (sign-extended).
 21 /r                     AND r/m16, r16               MR     Valid        Valid        r/m16 AND r16.
 21 /r                     AND r/m32, r32               MR     Valid        Valid        r/m32 AND r32.
 REX.W + 21 /r             AND r/m64, r64               MR     Valid        N.E.         r/m64 AND r32.
 22 /r                     AND r8, r/m8                 RM     Valid        Valid        r8 AND r/m8.
 REX + 22 /r               AND r8*, r/m8*               RM     Valid        N.E.         r/m64 AND r8 (sign-extended).
 23 /r                     AND r16, r/m16               RM     Valid        Valid        r16 AND r/m16.
 23 /r                     AND r32, r/m32               RM     Valid        Valid        r32 AND r/m32.
 REX.W + 23 /r             AND r64, r/m64               RM     Valid        N.E.         r64 AND r/m64.
 NOTES:
 *In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.



                                                  Instruction Operand Encoding
  Op/En              Operand 1                     Operand 2                        Operand 3                     Operand 4
    RM            ModRM:reg (r, w)               ModRM:r/m (r)                         NA                             NA
    MR            ModRM:r/m (r, w)               ModRM:reg (r)                         NA                             NA
    MI            ModRM:r/m (r, w)                    imm8                             NA                             NA
     I            AL/AX/EAX/RAX                       imm8                             NA                             NA

Description
Performs a bitwise AND operation on the destination (first) and source (second) operands and stores the result in
the destination operand location. The source operand can be an immediate, a register, or a memory location; the
destination operand can be a register or a memory location. (However, two memory operands cannot be used in
one instruction.) Each bit of the result is set to 1 if both corresponding bits of the first and second operands are 1;
otherwise, it is set to 0.
This instruction can be used with a LOCK prefix to allow the it to be executed atomically.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.



Operation
DEST <- DEST AND SRC;

Flags Affected
The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is
undefined.

Protected Mode Exceptions
#GP(0)                 If the destination operand points to a non-writable segment.
                       If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                       If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made while the
                     current privilege level is 3.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions
#GP                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                    If a memory operand effective address is outside the SS segment limit.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)                 If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)                 If the memory address is in a non-canonical form.
#PF(fault-code)        If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made while the
                     current privilege level is 3.
#UD                    If the LOCK prefix is used but the destination is not a memory operand.






platform: x86_64
mnem: ANDN
description:
ANDN - Logical AND NOT
 Opcode/Instruction              Op/     64/32     CPUID        Description
                                 En      -bit      Feature
                                         Mode      Flag
 VEX.NDS.LZ.0F38.W0 F2 /r        RVM     V/V       BMI1         Bitwise AND of inverted r32b with r/m32, store result in r32a.
 ANDN r32a, r32b, r/m32
 VEX.NDS.LZ. 0F38.W1 F2 /r       RVM     V/NE      BMI1         Bitwise AND of inverted r64b with r/m64, store result in r64a.
 ANDN r64a, r64b, r/m64



                                                 Instruction Operand Encoding
  Op/En             Operand 1                    Operand 2                       Operand 3                      Operand 4
   RVM           ModRM:reg (w)                   VEX.vvvv (r)                  ModRM:r/m (r)                        NA

Description
Performs a bitwise logical AND of inverted second operand (the first source operand) with the third operand (the
second source operand). The result is stored in the first operand (destination operand).
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation
DEST <- (NOT SRC1) bitwiseAND SRC2;
SF <- DEST[OperandSize -1];
ZF <- (DEST = 0);

Flags Affected
SF and ZF are updated based on result. OF and CF flags are cleared. AF and PF flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent
Auto-generated from high-level language.

SIMD Floating-Point Exceptions
None

Other Exceptions
See Section 2.5.1, "Exception Conditions for VEX-Encoded GPR Instructions", Table 2-29; additionally
#UD                      If VEX.W = 1.






platform: x86_64
mnem: ANDPD
description:
ANDPD-Bitwise Logical AND of Packed Double Precision Floating-Point Values
 Opcode/                           Op /    64/32       CPUID          Description
 Instruction                       En      bit Mode    Feature
                                           Support     Flag
 66 0F 54 /r                       RM      V/V         SSE2           Return the bitwise logical AND of packed double-
 ANDPD xmm1, xmm2/m128                                                precision floating-point values in xmm1 and xmm2/mem.
 VEX.NDS.128.66.0F 54 /r           RVM     V/V         AVX            Return the bitwise logical AND of packed double-
 VANDPD xmm1, xmm2,                                                   precision floating-point values in xmm2 and xmm3/mem.
 xmm3/m128
 VEX.NDS.256.66.0F 54 /r           RVM     V/V         AVX            Return the bitwise logical AND of packed double-
 VANDPD ymm1, ymm2,                                                   precision floating-point values in ymm2 and ymm3/mem.
 ymm3/m256
 EVEX.NDS.128.66.0F.W1 54 /r       FV      V/V         AVX512VL       Return the bitwise logical AND of packed double-
 VANDPD xmm1 {k1}{z}, xmm2,                            AVX512DQ       precision floating-point values in xmm2 and
 xmm3/m128/m64bcst                                                    xmm3/m128/m64bcst subject to writemask k1.
 EVEX.NDS.256.66.0F.W1 54 /r       FV      V/V         AVX512VL       Return the bitwise logical AND of packed double-
 VANDPD ymm1 {k1}{z}, ymm2,                            AVX512DQ       precision floating-point values in ymm2 and
 ymm3/m256/m64bcst                                                    ymm3/m256/m64bcst subject to writemask k1.
 EVEX.NDS.512.66.0F.W1 54 /r       FV      V/V         AVX512DQ       Return the bitwise logical AND of packed double-
 VANDPD zmm1 {k1}{z}, zmm2,                                           precision floating-point values in zmm2 and
 zmm3/m512/m64bcst                                                    zmm3/m512/m64bcst subject to writemask k1.



                                           Instruction Operand Encoding
         Op/En             Operand 1                   Operand 2                       Operand 3                Operand 4
          RM            ModRM:reg (r, w)              ModRM:r/m (r)                        NA                       NA
         RVM             ModRM:reg (w)                  VEX.vvvv                     ModRM:r/m (r)                  NA
          FV             ModRM:reg (w)                 EVEX.vvvv                     ModRM:r/m (r)                  NA

Description
Performs a bitwise logical AND of the two, four or eight packed double-precision floating-point values from the first
source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with
writemask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAX_VL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAX_VL-1:128)
of the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAX_VL-1:128) of the corresponding
register destination are unmodified.





Operation
VANDPD (EVEX encoded versions)
(KL, VL) = (2, 128), (4, 256), (8, 512)
FOR j <- 0 TO KL-1
    i <- j * 64
    IF k1[j] OR *no writemask*
         THEN
               IF (EVEX.b == 1) AND (SRC2 *is memory*)
                    THEN
                         DEST[i+63:i] <- SRC1[i+63:i] BITWISE AND SRC2[63:0]
                    ELSE
                         DEST[i+63:i] <- SRC1[i+63:i] BITWISE AND SRC2[i+63:i]
               FI;
         ELSE
               IF *merging-masking*                 ; merging-masking
                    THEN *DEST[i+63:i] remains unchanged*
                    ELSE                            ; zeroing-masking
                         DEST[i+63:i] = 0
               FI;
    FI;
ENDFOR
DEST[MAX_VL-1:VL] <- 0

VANDPD (VEX.256 encoded version)
DEST[63:0] <- SRC1[63:0] BITWISE AND SRC2[63:0]
DEST[127:64] <- SRC1[127:64] BITWISE AND SRC2[127:64]
DEST[191:128] <- SRC1[191:128] BITWISE AND SRC2[191:128]
DEST[255:192] <- SRC1[255:192] BITWISE AND SRC2[255:192]
DEST[MAX_VL-1:256] <- 0

VANDPD (VEX.128 encoded version)
DEST[63:0] <- SRC1[63:0] BITWISE AND SRC2[63:0]
DEST[127:64] <- SRC1[127:64] BITWISE AND SRC2[127:64]
DEST[MAX_VL-1:128] <- 0

ANDPD (128-bit Legacy SSE version)
DEST[63:0] <- DEST[63:0] BITWISE AND SRC[63:0]
DEST[127:64] <- DEST[127:64] BITWISE AND SRC[127:64]
DEST[MAX_VL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VANDPD __m512d _mm512_and_pd (__m512d a, __m512d b);
VANDPD __m512d _mm512_mask_and_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);
VANDPD __m512d _mm512_maskz_and_pd (__mmask8 k, __m512d a, __m512d b);
VANDPD __m256d _mm256_mask_and_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);
VANDPD __m256d _mm256_maskz_and_pd (__mmask8 k, __m256d a, __m256d b);
VANDPD __m128d _mm_mask_and_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);
VANDPD __m128d _mm_maskz_and_pd (__mmask8 k, __m128d a, __m128d b);
VANDPD __m256d _mm256_and_pd (__m256d a, __m256d b);
ANDPD __m128d _mm_and_pd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions
None




Other Exceptions
VEX-encoded instruction, see Exceptions Type 4.
EVEX-encoded instruction, see Exceptions Type E4.






platform: x86_64
mnem: ANDPS
description:
ANDPS-Bitwise Logical AND of Packed Single Precision Floating-Point Values
 Opcode/                               Op /     64/32         CPUID           Description
 Instruction                           En       bit Mode      Feature
                                                Support       Flag
 0F 54 /r                              RM       V/V           SSE             Return the bitwise logical AND of packed single-precision
 ANDPS xmm1, xmm2/m128                                                        floating-point values in xmm1 and xmm2/mem.
 VEX.NDS.128.0F 54 /r                  RVM      V/V           AVX             Return the bitwise logical AND of packed single-precision
 VANDPS xmm1,xmm2,                                                            floating-point values in xmm2 and xmm3/mem.
 xmm3/m128
 VEX.NDS.256.0F 54 /r                  RVM      V/V           AVX             Return the bitwise logical AND of packed single-precision
 VANDPS ymm1, ymm2,                                                           floating-point values in ymm2 and ymm3/mem.
 ymm3/m256
 EVEX.NDS.128.0F.W0 54 /r              FV       V/V           AVX512VL        Return the bitwise logical AND of packed single-precision
 VANDPS xmm1 {k1}{z}, xmm2,                                   AVX512DQ        floating-point values in xmm2 and xmm3/m128/m32bcst
 xmm3/m128/m32bcst                                                            subject to writemask k1.
 EVEX.NDS.256.0F.W0 54 /r              FV       V/V           AVX512VL        Return the bitwise logical AND of packed single-precision
 VANDPS ymm1 {k1}{z}, ymm2,                                   AVX512DQ        floating-point values in ymm2 and ymm3/m256/m32bcst
 ymm3/m256/m32bcst                                                            subject to writemask k1.
 EVEX.NDS.512.0F.W0 54 /r              FV       V/V           AVX512DQ        Return the bitwise logical AND of packed single-precision
 VANDPS zmm1 {k1}{z}, zmm2,                                                   floating-point values in zmm2 and zmm3/m512/m32bcst
 zmm3/m512/m32bcst                                                            subject to writemask k1.



                                                      Instruction Operand Encoding
       Op/En                  Operand 1                         Operand 2                        Operand 3                Operand 4
         RM               ModRM:reg (r, w)                    ModRM:r/m (r)                          NA                       NA
        RVM                ModRM:reg (w)                         VEX.vvvv                      ModRM:r/m (r)                  NA
         FV                ModRM:reg (w)                        EVEX.vvvv                      ModRM:r/m (r)                  NA

Description
Performs a bitwise logical AND of the four, eight or sixteen packed single-precision floating-point values from the
first source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with
writemask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAX_VL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAX_VL-1:128)
of the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAX_VL-1:128) of the corresponding
ZMM register destination are unmodified.





Operation
VANDPS (EVEX encoded versions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j <- 0 TO KL-1
    i <- j * 32
    IF k1[j] OR *no writemask*
               IF (EVEX.b == 1) AND (SRC2 *is memory*)
                    THEN
                         DEST[i+63:i] <- SRC1[i+31:i] BITWISE AND SRC2[31:0]
                    ELSE
                         DEST[i+31:i] <- SRC1[i+31:i] BITWISE AND SRC2[i+31:i]
               FI;
         ELSE
               IF *merging-masking*                 ; merging-masking
                    THEN *DEST[i+31:i] remains unchanged*
                    ELSE                            ; zeroing-masking
                         DEST[i+31:i] <- 0
               FI;
    FI;
ENDFOR
DEST[MAX_VL-1:VL] <- 0;

VANDPS (VEX.256 encoded version)
DEST[31:0] <- SRC1[31:0] BITWISE AND SRC2[31:0]
DEST[63:32] <- SRC1[63:32] BITWISE AND SRC2[63:32]
DEST[95:64] <- SRC1[95:64] BITWISE AND SRC2[95:64]
DEST[127:96] <- SRC1[127:96] BITWISE AND SRC2[127:96]
DEST[159:128] <- SRC1[159:128] BITWISE AND SRC2[159:128]
DEST[191:160] <- SRC1[191:160] BITWISE AND SRC2[191:160]
DEST[223:192] <- SRC1[223:192] BITWISE AND SRC2[223:192]
DEST[255:224] <- SRC1[255:224] BITWISE AND SRC2[255:224].
DEST[MAX_VL-1:256] <- 0;

VANDPS (VEX.128 encoded version)
DEST[31:0] <- SRC1[31:0] BITWISE AND SRC2[31:0]
DEST[63:32] <- SRC1[63:32] BITWISE AND SRC2[63:32]
DEST[95:64] <- SRC1[95:64] BITWISE AND SRC2[95:64]
DEST[127:96] <- SRC1[127:96] BITWISE AND SRC2[127:96]
DEST[MAX_VL-1:128] <- 0;

ANDPS (128-bit Legacy SSE version)
DEST[31:0] <- DEST[31:0] BITWISE AND SRC[31:0]
DEST[63:32] <- DEST[63:32] BITWISE AND SRC[63:32]
DEST[95:64] <- DEST[95:64] BITWISE AND SRC[95:64]
DEST[127:96] <- DEST[127:96] BITWISE AND SRC[127:96]
DEST[MAX_VL-1:128] (Unmodified)





Intel C/C++ Compiler Intrinsic Equivalent
VANDPS __m512 _mm512_and_ps (__m512 a, __m512 b);
VANDPS __m512 _mm512_mask_and_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);
VANDPS __m512 _mm512_maskz_and_ps (__mmask16 k, __m512 a, __m512 b);
VANDPS __m256 _mm256_mask_and_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);
VANDPS __m256 _mm256_maskz_and_ps (__mmask8 k, __m256 a, __m256 b);
VANDPS __m128 _mm_mask_and_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);
VANDPS __m128 _mm_maskz_and_ps (__mmask8 k, __m128 a, __m128 b);
VANDPS __m256 _mm256_and_ps (__m256 a, __m256 b);
ANDPS __m128 _mm_and_ps (__m128 a, __m128 b);

SIMD Floating-Point Exceptions
None

Other Exceptions
VEX-encoded instruction, see Exceptions Type 4.
EVEX-encoded instruction, see Exceptions Type E4.






platform: x86_64
mnem: ANDNPD
description:
ANDNPD-Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
 Opcode/                           Op /    64/32        CPUID           Description
 Instruction                       En      bit Mode     Feature
                                           Support      Flag
 66 0F 55 /r                       RM      V/V          SSE2            Return the bitwise logical AND NOT of packed double-
 ANDNPD xmm1, xmm2/m128                                                 precision floating-point values in xmm1 and xmm2/mem.
 VEX.NDS.128.66.0F 55 /r           RVM     V/V          AVX             Return the bitwise logical AND NOT of packed double-
 VANDNPD xmm1, xmm2,                                                    precision floating-point values in xmm2 and xmm3/mem.
 xmm3/m128
 VEX.NDS.256.66.0F 55/r            RVM     V/V          AVX             Return the bitwise logical AND NOT of packed double-
 VANDNPD ymm1, ymm2,                                                    precision floating-point values in ymm2 and ymm3/mem.
 ymm3/m256
 EVEX.NDS.128.66.0F.W1 55 /r       FV      V/V          AVX512VL        Return the bitwise logical AND NOT of packed double-
 VANDNPD xmm1 {k1}{z}, xmm2,                            AVX512DQ        precision floating-point values in xmm2 and
 xmm3/m128/m64bcst                                                      xmm3/m128/m64bcst subject to writemask k1.
 EVEX.NDS.256.66.0F.W1 55 /r       FV      V/V          AVX512VL        Return the bitwise logical AND NOT of packed double-
 VANDNPD ymm1 {k1}{z}, ymm2,                            AVX512DQ        precision floating-point values in ymm2 and
 ymm3/m256/m64bcst                                                      ymm3/m256/m64bcst subject to writemask k1.
 EVEX.NDS.512.66.0F.W1 55 /r       FV      V/V          AVX512DQ        Return the bitwise logical AND NOT of packed double-
 VANDNPD zmm1 {k1}{z}, zmm2,                                            precision floating-point values in zmm2 and
 zmm3/m512/m64bcst                                                      zmm3/m512/m64bcst subject to writemask k1.



                                           Instruction Operand Encoding
        Op/En              Operand 1                     Operand 2                        Operand 3                Operand 4
          RM            ModRM:reg (r, w)               ModRM:r/m (r)                          NA                       NA
         RVM             ModRM:reg (w)                    VEX.vvvv                      ModRM:r/m (r)                  NA
          FV             ModRM:reg (w)                   EVEX.vvvv                      ModRM:r/m (r)                  NA

Description
Performs a bitwise logical AND NOT of the two, four or eight packed double-precision floating-point values from the
first source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
64-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with
writemask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAX_VL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAX_VL-1:128)
of the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAX_VL-1:128) of the corresponding
register destination are unmodified.





Operation
VANDNPD (EVEX encoded versions)
(KL, VL) = (2, 128), (4, 256), (8, 512)
FOR j <- 0 TO KL-1
    i <- j * 64
    IF k1[j] OR *no writemask*
               IF (EVEX.b == 1) AND (SRC2 *is memory*)
                    THEN
                         DEST[i+63:i] <- (NOT(SRC1[i+63:i])) BITWISE AND SRC2[63:0]
                    ELSE
                         DEST[i+63:i] <- (NOT(SRC1[i+63:i])) BITWISE AND SRC2[i+63:i]
               FI;
         ELSE
               IF *merging-masking*                ; merging-masking
                    THEN *DEST[i+63:i] remains unchanged*
                    ELSE                           ; zeroing-masking
                         DEST[i+63:i] = 0
               FI;
    FI;
ENDFOR
DEST[MAX_VL-1:VL] <- 0

VANDNPD (VEX.256 encoded version)
DEST[63:0] <- (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0]
DEST[127:64] <- (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64]
DEST[191:128] <- (NOT(SRC1[191:128])) BITWISE AND SRC2[191:128]
DEST[255:192] <- (NOT(SRC1[255:192])) BITWISE AND SRC2[255:192]
DEST[MAX_VL-1:256] <- 0

VANDNPD (VEX.128 encoded version)
DEST[63:0] <- (NOT(SRC1[63:0])) BITWISE AND SRC2[63:0]
DEST[127:64] <- (NOT(SRC1[127:64])) BITWISE AND SRC2[127:64]
DEST[MAX_VL-1:128] <- 0

ANDNPD (128-bit Legacy SSE version)
DEST[63:0] <- (NOT(DEST[63:0])) BITWISE AND SRC[63:0]
DEST[127:64] <- (NOT(DEST[127:64])) BITWISE AND SRC[127:64]
DEST[MAX_VL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VANDNPD __m512d _mm512_andnot_pd (__m512d a, __m512d b);
VANDNPD __m512d _mm512_mask_andnot_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);
VANDNPD __m512d _mm512_maskz_andnot_pd (__mmask8 k, __m512d a, __m512d b);
VANDNPD __m256d _mm256_mask_andnot_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);
VANDNPD __m256d _mm256_maskz_andnot_pd (__mmask8 k, __m256d a, __m256d b);
VANDNPD __m128d _mm_mask_andnot_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);
VANDNPD __m128d _mm_maskz_andnot_pd (__mmask8 k, __m128d a, __m128d b);
VANDNPD __m256d _mm256_andnot_pd (__m256d a, __m256d b);
ANDNPD __m128d _mm_andnot_pd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions
None





Other Exceptions
VEX-encoded instruction, see Exceptions Type 4.
EVEX-encoded instruction, see Exceptions Type E4.






platform: x86_64
mnem: ANDNPS
description:
ANDNPS-Bitwise Logical AND NOT of Packed Single Precision Floating-Point Values
 Opcode/                              Op /    64/32         CPUID          Description
 Instruction                          En      bit Mode      Feature
                                              Support       Flag
 0F 55 /r                             RM      V/V           SSE            Return the bitwise logical AND NOT of packed single-precision
 ANDNPS xmm1, xmm2/m128                                                    floating-point values in xmm1 and xmm2/mem.
 VEX.NDS.128.0F 55 /r                 RVM     V/V           AVX            Return the bitwise logical AND NOT of packed single-precision
 VANDNPS xmm1, xmm2,                                                       floating-point values in xmm2 and xmm3/mem.
 xmm3/m128
 VEX.NDS.256.0F 55 /r                 RVM     V/V           AVX            Return the bitwise logical AND NOT of packed single-precision
 VANDNPS ymm1, ymm2,                                                       floating-point values in ymm2 and ymm3/mem.
 ymm3/m256
 EVEX.NDS.128.0F.W0 55 /r             FV      V/V           AVX512VL       Return the bitwise logical AND of packed single-precision
 VANDNPS xmm1 {k1}{z},                                      AVX512DQ       floating-point values in xmm2 and xmm3/m128/m32bcst
 xmm2, xmm3/m128/m32bcst                                                   subject to writemask k1.
 EVEX.NDS.256.0F.W0 55 /r             FV      V/V           AVX512VL       Return the bitwise logical AND of packed single-precision
 VANDNPS ymm1 {k1}{z},                                      AVX512DQ       floating-point values in ymm2 and ymm3/m256/m32bcst
 ymm2, ymm3/m256/m32bcst                                                   subject to writemask k1.
 EVEX.NDS.512.0F.W0 55 /r             FV      V/V           AVX512DQ       Return the bitwise logical AND of packed single-precision
 VANDNPS zmm1 {k1}{z},                                                     floating-point values in zmm2 and zmm3/m512/m32bcst
 zmm2, zmm3/m512/m32bcst                                                   subject to writemask k1.



                                                     Instruction Operand Encoding
          Op/En                   Operand 1                       Operand 2                     Operand 3               Operand 4
            RM                 ModRM:reg (r, w)                 ModRM:r/m (r)                       NA                      NA
           RVM                  ModRM:reg (w)                      VEX.vvvv                   ModRM:r/m (r)                 NA
            FV                  ModRM:reg (w)                     EVEX.vvvv                   ModRM:r/m (r)                 NA

Description
Performs a bitwise logical AND NOT of the four, eight or sixteen packed single-precision floating-point values from
the first source operand and the second source operand, and stores the result in the destination operand.
EVEX encoded versions: The first source operand is a ZMM/YMM/XMM register. The second source operand can be
a ZMM/YMM/XMM register, a 512/256/128-bit memory location, or a 512/256/128-bit vector broadcasted from a
32-bit memory location. The destination operand is a ZMM/YMM/XMM register conditionally updated with
writemask k1.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand is a YMM register
or a 256-bit memory location. The destination operand is a YMM register. The upper bits (MAX_VL-1:256) of the
corresponding ZMM register destination are zeroed.
VEX.128 encoded version: The first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (MAX_VL-1:128)
of the corresponding ZMM register destination are zeroed.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (MAX_VL-1:128) of the corresponding
ZMM register destination are unmodified.





Operation
VANDNPS (EVEX encoded versions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j <- 0 TO KL-1
    i <- j * 32
    IF k1[j] OR *no writemask*
               IF (EVEX.b == 1) AND (SRC2 *is memory*)
                    THEN
                         DEST[i+31:i] <- (NOT(SRC1[i+31:i])) BITWISE AND SRC2[31:0]
                    ELSE
                         DEST[i+31:i] <- (NOT(SRC1[i+31:i])) BITWISE AND SRC2[i+31:i]
               FI;
         ELSE
               IF *merging-masking*                ; merging-masking
                    THEN *DEST[i+31:i] remains unchanged*
                    ELSE                           ; zeroing-masking
                         DEST[i+31:i] = 0
               FI;
    FI;
ENDFOR
DEST[MAX_VL-1:VL] <- 0

VANDNPS (VEX.256 encoded version)
DEST[31:0] <- (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0]
DEST[63:32] <- (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32]
DEST[95:64] <- (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64]
DEST[127:96] <- (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96]
DEST[159:128] <- (NOT(SRC1[159:128])) BITWISE AND SRC2[159:128]
DEST[191:160] <- (NOT(SRC1[191:160])) BITWISE AND SRC2[191:160]
DEST[223:192] <- (NOT(SRC1[223:192])) BITWISE AND SRC2[223:192]
DEST[255:224] <- (NOT(SRC1[255:224])) BITWISE AND SRC2[255:224].
DEST[MAX_VL-1:256] <- 0

VANDNPS (VEX.128 encoded version)
DEST[31:0] <- (NOT(SRC1[31:0])) BITWISE AND SRC2[31:0]
DEST[63:32] <- (NOT(SRC1[63:32])) BITWISE AND SRC2[63:32]
DEST[95:64] <- (NOT(SRC1[95:64])) BITWISE AND SRC2[95:64]
DEST[127:96] <- (NOT(SRC1[127:96])) BITWISE AND SRC2[127:96]
DEST[MAX_VL-1:128] <- 0

ANDNPS (128-bit Legacy SSE version)
DEST[31:0] <- (NOT(DEST[31:0])) BITWISE AND SRC[31:0]
DEST[63:32] <- (NOT(DEST[63:32])) BITWISE AND SRC[63:32]
DEST[95:64] <- (NOT(DEST[95:64])) BITWISE AND SRC[95:64]
DEST[127:96] <- (NOT(DEST[127:96])) BITWISE AND SRC[127:96]
DEST[MAX_VL-1:128] (Unmodified)





Intel C/C++ Compiler Intrinsic Equivalent
VANDNPS __m512 _mm512_andnot_ps (__m512 a, __m512 b);
VANDNPS __m512 _mm512_mask_andnot_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);
VANDNPS __m512 _mm512_maskz_andnot_ps (__mmask16 k, __m512 a, __m512 b);
VANDNPS __m256 _mm256_mask_andnot_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);
VANDNPS __m256 _mm256_maskz_andnot_ps (__mmask8 k, __m256 a, __m256 b);
VANDNPS __m128 _mm_mask_andnot_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);
VANDNPS __m128 _mm_maskz_andnot_ps (__mmask8 k, __m128 a, __m128 b);
VANDNPS __m256 _mm256_andnot_ps (__m256 a, __m256 b);
ANDNPS __m128 _mm_andnot_ps (__m128 a, __m128 b);

SIMD Floating-Point Exceptions
None

Other Exceptions
VEX-encoded instruction, see Exceptions Type 4.
EVEX-encoded instruction, see Exceptions Type E4.






platform: x86_64
mnem: ARPL
description:
ARPL-Adjust RPL Field of Segment Selector
Opcode                  Instruction              Op/     64-bit   Compat/ Description
                                                 En      Mode     Leg Mode
63 /r                   ARPL r/m16, r16          NP      N. E.    Valid       Adjust RPL of r/m16 to not less than RPL of
                                                                              r16.



                                            Instruction Operand Encoding
  Op/En            Operand 1                 Operand 2                    Operand 3                      Operand 4
    NP           ModRM:r/m (w)             ModRM:reg (r)                     NA                             NA

Description
Compares the RPL fields of two segment selectors. The first operand (the destination operand) contains one
segment selector and the second operand (source operand) contains the other. (The RPL field is located in bits 0
and 1 of each operand.) If the RPL field of the destination operand is less than the RPL field of the source operand,
the ZF flag is set and the RPL field of the destination operand is increased to match that of the source operand.
Otherwise, the ZF flag is cleared and no change is made to the destination operand. (The destination operand can
be a word register or a memory location; the source operand must be a word register.)
The ARPL instruction is provided for use by operating-system procedures (however, it can also be used by applica-
tions). It is generally used to adjust the RPL of a segment selector that has been passed to the operating system
by an application program to match the privilege level of the application program. Here the segment selector
passed to the operating system is placed in the destination operand and segment selector for the application
program's code segment is placed in the source operand. (The RPL field in the source operand represents the priv-
ilege level of the application program.) Execution of the ARPL instruction then ensures that the RPL of the segment
selector received by the operating system is no lower (does not have a higher privilege) than the privilege level of
the application program (the segment selector for the application program's code segment can be read from the
stack following a procedure call).
This instruction executes as described in compatibility mode and legacy mode. It is not encodable in 64-bit mode.
See "Checking Caller Access Privileges" in Chapter 3, "Protected-Mode Memory Management," of the Intel 64 and
IA-32 Architectures Software Developer's Manual, Volume 3A, for more information about the use of this instruc-
tion.

Operation
IF 64-BIT MODE
    THEN
        See MOVSXD;
    ELSE
        IF DEST[RPL] < SRC[RPL]
             THEN
                 ZF <- 1;
                 DEST[RPL] <- SRC[RPL];
             ELSE
                 ZF <- 0;
        FI;
FI;

Flags Affected
The ZF flag is set to 1 if the RPL field of the destination operand is less than that of the source operand; otherwise,
it is set to 0.





Protected Mode Exceptions
#GP(0)                   If the destination is located in a non-writable segment.
                         If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                         If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
                         selector.
#SS(0)                   If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)          If a page fault occurs.
#AC(0)                   If alignment checking is enabled and an unaligned memory reference is made while the
                         current privilege level is 3.
#UD                      If the LOCK prefix is used.

Real-Address Mode Exceptions
#UD                      The ARPL instruction is not recognized in real-address mode.
                         If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#UD                      The ARPL instruction is not recognized in virtual-8086 mode.
                         If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
Not applicable.






platform: x86_64
mnem: BLENDPD
description:
BLENDPD - Blend Packed Double Precision Floating-Point Values
 Opcode/                                            Op/    64/32-bit CPUID       Description
 Instruction                                        En     Mode      Feature
                                                                     Flag
 66 0F 3A 0D /r ib                                  RMI    V/V       SSE4_1      Select packed DP-FP values from xmm1 and
 BLENDPD xmm1, xmm2/m128, imm8                                                   xmm2/m128 from mask specified in imm8
                                                                                 and store the values into xmm1.
 VEX.NDS.128.66.0F3A.WIG 0D /r ib                   RVMI V/V         AVX         Select packed double-precision floating-point
 VBLENDPD xmm1, xmm2, xmm3/m128, imm8                                            Values from xmm2 and xmm3/m128 from
                                                                                 mask in imm8 and store the values in xmm1.
 VEX.NDS.256.66.0F3A.WIG 0D /r ib                   RVMI V/V         AVX         Select packed double-precision floating-point
 VBLENDPD ymm1, ymm2, ymm3/m256, imm8                                            Values from ymm2 and ymm3/m256 from
                                                                                 mask in imm8 and store the values in ymm1.



                                            Instruction Operand Encoding
  Op/En               Operand 1              Operand 2                     Operand 3                       Operand 4
   RMI           ModRM:reg (r, w)           ModRM:r/m (r)                     imm8                             NA
   RVMI              ModRM:reg (w)          VEX.vvvv (r)                ModRM:r/m (r)                       imm8[3:0]

Description
Double-precision floating-point values from the second source operand (third operand) are conditionally merged
with values from the first source operand (second operand) and written to the destination operand (first operand).
The immediate bits [3:0] determine whether the corresponding double-precision floating-point value in the desti-
nation is copied from the second source or first source. If a bit in the mask, corresponding to a word, is "1", then
the double-precision floating-point value in the second source operand is copied, else the value in the first source
operand is copied.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (VLMAX-1:128) of the corresponding
YMM register destination are unmodified.
VEX.128 encoded version: the first source operand is an XMM register. The second source operand is an XMM
register or 128-bit memory location. The destination operand is an XMM register. The upper bits (VLMAX-1:128) of
the corresponding YMM register destination are zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register.

Operation
BLENDPD (128-bit Legacy SSE version)
IF (IMM8[0] = 0)THEN DEST[63:0] <- DEST[63:0]
        ELSE DEST [63:0] <- SRC[63:0] FI
IF (IMM8[1] = 0) THEN DEST[127:64] <- DEST[127:64]
        ELSE DEST [127:64] <- SRC[127:64] FI
DEST[VLMAX-1:128] (Unmodified)

VBLENDPD (VEX.128 encoded version)
IF (IMM8[0] = 0)THEN DEST[63:0] <- SRC1[63:0]
        ELSE DEST [63:0] <- SRC2[63:0] FI
IF (IMM8[1] = 0) THEN DEST[127:64] <- SRC1[127:64]
        ELSE DEST [127:64] <- SRC2[127:64] FI
DEST[VLMAX-1:128] <- 0





VBLENDPD (VEX.256 encoded version)
IF (IMM8[0] = 0)THEN DEST[63:0] <- SRC1[63:0]
        ELSE DEST [63:0] <- SRC2[63:0] FI
IF (IMM8[1] = 0) THEN DEST[127:64] <- SRC1[127:64]
        ELSE DEST [127:64] <- SRC2[127:64] FI
IF (IMM8[2] = 0) THEN DEST[191:128] <- SRC1[191:128]
        ELSE DEST [191:128] <- SRC2[191:128] FI
IF (IMM8[3] = 0) THEN DEST[255:192] <- SRC1[255:192]
        ELSE DEST [255:192] <- SRC2[255:192] FI

Intel C/C++ Compiler Intrinsic Equivalent
BLENDPD:         __m128d _mm_blend_pd (__m128d v1, __m128d v2, const int mask);

VBLENDPD:        __m256d _mm256_blend_pd (__m256d a, __m256d b, const int mask);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4.






platform: x86_64
mnem: BEXTR
description:
BEXTR - Bit Field Extract
 Opcode/Instruction                Op/    64/32     CPUID      Description
                                   En     -bit      Feature
                                          Mode      Flag
 VEX.NDS.LZ.0F38.W0 F7 /r          RMV    V/V       BMI1       Contiguous bitwise extract from r/m32 using r32b as control; store
 BEXTR r32a, r/m32, r32b                                       result in r32a.
 VEX.NDS.LZ.0F38.W1 F7 /r          RMV    V/N.E.    BMI1       Contiguous bitwise extract from r/m64 using r64b as control; store
 BEXTR r64a, r/m64, r64b                                       result in r64a



                                                   Instruction Operand Encoding
   Op/En               Operand 1                     Operand 2                      Operand 3                        Operand 4
   RMV               ModRM:reg (w)                  ModRM:r/m (r)                  VEX.vvvv (r)                          NA

Description
Extracts contiguous bits from the first source operand (the second operand) using an index value and length value
specified in the second source operand (the third operand). Bit 7:0 of the second source operand specifies the
starting bit position of bit extraction. A START value exceeding the operand size will not extract any bits from the
second source operand. Bit 15:8 of the second source operand specifies the maximum number of bits (LENGTH)
beginning at the START position to extract. Only bit positions up to (OperandSize -1) of the first source operand are
extracted. The extracted bits are written to the destination register, starting from the least significant bit. All higher
order bits in the destination operand (starting at bit position LENGTH) are zeroed. The destination register is
cleared if no bits are extracted.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation
START <- SRC2[7:0];
LEN <- SRC2[15:8];
TEMP <- ZERO_EXTEND_TO_512 (SRC1 );
DEST <- ZERO_EXTEND(TEMP[START+LEN -1: START]);
ZF <- (DEST = 0);

Flags Affected
ZF is updated based on the result. AF, SF, and PF are undefined. All other flags are cleared.

Intel C/C++ Compiler Intrinsic Equivalent
BEXTR:         unsigned __int32 _bextr_u32(unsigned __int32 src, unsigned __int32 start. unsigned __int32 len);

BEXTR:         unsigned __int64 _bextr_u64(unsigned __int64 src, unsigned __int32 start. unsigned __int32 len);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Section 2.5.1, "Exception Conditions for VEX-Encoded GPR Instructions", Table 2-29; additionally
#UD                      If VEX.W = 1.






platform: x86_64
mnem: BLENDPS
description:
BLENDPS - Blend Packed Single Precision Floating-Point Values
 Opcode/                                                    Op/    64/32-bit CPUID       Description
 Instruction                                                En     Mode      Feature
                                                                             Flag
 66 0F 3A 0C /r ib                                          RMI    V/V       SSE4_1      Select packed single precision floating-point
 BLENDPS xmm1, xmm2/m128, imm8                                                           values from xmm1 and xmm2/m128 from
                                                                                         mask specified in imm8 and store the values
                                                                                         into xmm1.
 VEX.NDS.128.66.0F3A.WIG 0C /r ib                           RVMI V/V         AVX         Select packed single-precision floating-point
 VBLENDPS xmm1, xmm2, xmm3/m128, imm8                                                    values from xmm2 and xmm3/m128 from
                                                                                         mask in imm8 and store the values in xmm1.
 VEX.NDS.256.66.0F3A.WIG 0C /r ib                           RVMI V/V         AVX         Select packed single-precision floating-point
 VBLENDPS ymm1, ymm2, ymm3/m256, imm8                                                    values from ymm2 and ymm3/m256 from
                                                                                         mask in imm8 and store the values in ymm1.



                                                     Instruction Operand Encoding
   Op/En               Operand 1                       Operand 2                    Operand 3                      Operand 4
    RMI            ModRM:reg (r, w)                  ModRM:r/m (r)                     imm8                            NA
   RVMI              ModRM:reg (w)                    VEX.vvvv (r)                 ModRM:r/m (r)                     imm8

Description
Packed single-precision floating-point values from the second source operand (third operand) are conditionally
merged with values from the first source operand (second operand) and written to the destination operand (first
operand). The immediate bits [7:0] determine whether the corresponding single precision floating-point value in
the destination is copied from the second source or first source. If a bit in the mask, corresponding to a word, is
"1", then the single-precision floating-point value in the second source operand is copied, else the value in the first
source operand is copied.
128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-
nation is not distinct from the first source XMM register and the upper bits (VLMAX-1:128) of the corresponding
YMM register destination are unmodified.
VEX.128 encoded version: The first source operand an XMM register. The second source operand is an XMM register
or 128-bit memory location. The destination operand is an XMM register. The upper bits (VLMAX-1:128) of the
corresponding YMM register destination are zeroed.
VEX.256 encoded version: The first source operand is a YMM register. The second source operand can be a YMM
register or a 256-bit memory location. The destination operand is a YMM register.

Operation
BLENDPS (128-bit Legacy SSE version)
IF (IMM8[0] = 0) THEN DEST[31:0] <-DEST[31:0]
        ELSE DEST [31:0] <- SRC[31:0] FI
IF (IMM8[1] = 0) THEN DEST[63:32] <- DEST[63:32]
        ELSE DEST [63:32] <- SRC[63:32] FI
IF (IMM8[2] = 0) THEN DEST[95:64] <- DEST[95:64]
        ELSE DEST [95:64] <- SRC[95:64] FI
IF (IMM8[3] = 0) THEN DEST[127:96] <- DEST[127:96]
        ELSE DEST [127:96] <- SRC[127:96] FI
DEST[VLMAX-1:128] (Unmodified)





VBLENDPS (VEX.128 encoded version)
IF (IMM8[0] = 0) THEN DEST[31:0] <-SRC1[31:0]
        ELSE DEST [31:0] <- SRC2[31:0] FI
IF (IMM8[1] = 0) THEN DEST[63:32] <- SRC1[63:32]
        ELSE DEST [63:32] <- SRC2[63:32] FI
IF (IMM8[2] = 0) THEN DEST[95:64] <- SRC1[95:64]
        ELSE DEST [95:64] <- SRC2[95:64] FI
IF (IMM8[3] = 0) THEN DEST[127:96] <- SRC1[127:96]
        ELSE DEST [127:96] <- SRC2[127:96] FI
DEST[VLMAX-1:128] <- 0

VBLENDPS (VEX.256 encoded version)
IF (IMM8[0] = 0) THEN DEST[31:0] <-SRC1[31:0]
        ELSE DEST [31:0] <- SRC2[31:0] FI
IF (IMM8[1] = 0) THEN DEST[63:32] <- SRC1[63:32]
        ELSE DEST [63:32] <- SRC2[63:32] FI
IF (IMM8[2] = 0) THEN DEST[95:64] <- SRC1[95:64]
        ELSE DEST [95:64] <- SRC2[95:64] FI
IF (IMM8[3] = 0) THEN DEST[127:96] <- SRC1[127:96]
        ELSE DEST [127:96] <- SRC2[127:96] FI
IF (IMM8[4] = 0) THEN DEST[159:128] <- SRC1[159:128]
        ELSE DEST [159:128] <- SRC2[159:128] FI
IF (IMM8[5] = 0) THEN DEST[191:160] <- SRC1[191:160]
        ELSE DEST [191:160] <- SRC2[191:160] FI
IF (IMM8[6] = 0) THEN DEST[223:192] <- SRC1[223:192]
        ELSE DEST [223:192] <- SRC2[223:192] FI
IF (IMM8[7] = 0) THEN DEST[255:224] <- SRC1[255:224]
        ELSE DEST [255:224] <- SRC2[255:224] FI.

Intel C/C++ Compiler Intrinsic Equivalent
BLENDPS:       __m128 _mm_blend_ps (__m128 v1, __m128 v2, const int mask);

VBLENDPS:      __m256 _mm256_blend_ps (__m256 a, __m256 b, const int mask);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4.






platform: x86_64
mnem: BLENDVPD
description:
BLENDVPD - Variable Blend Packed Double Precision Floating-Point Values
 Opcode/                                                   Op/       64/32-bit CPUID      Description
 Instruction                                               En        Mode      Feature
                                                                               Flag
 66 0F 38 15 /r                                            RM0       V/V       SSE4_1     Select packed DP FP values from xmm1 and
 BLENDVPD xmm1, xmm2/m128 , <XMM0>                                                        xmm2 from mask specified in XMM0 and
                                                                                          store the values in xmm1.
 VEX.NDS.128.66.0F3A.W0 4B /r /is4                         RVMR V/V            AVX        Conditionally copy double-precision floating-
 VBLENDVPD xmm1, xmm2, xmm3/m128, xmm4                                                    point values from xmm2 or xmm3/m128 to
                                                                                          xmm1, based on mask bits in the mask
                                                                                          operand, xmm4.
 VEX.NDS.256.66.0F3A.W0 4B /r /is4                         RVMR V/V            AVX        Conditionally copy double-precision floating-
 VBLENDVPD ymm1, ymm2, ymm3/m256, ymm4                                                    point values from ymm2 or ymm3/m256 to
                                                                                          ymm1, based on mask bits in the mask
                                                                                          operand, ymm4.



                                                     Instruction Operand Encoding
    Op/En             Operand 1                        Operand 2                     Operand 3                     Operand 4
    RM0            ModRM:reg (r, w)                  ModRM:r/m (r)                implicit XMM0                        NA
    RVMR            ModRM:reg (w)                     VEX.vvvv (r)                ModRM:r/m (r)                    imm8[7:4]

Description
Conditionally copy each quadword data element of double-precision floating-point value from the second source
operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits
are the most significant bit in each quadword element of the mask register.
Each quadword element of the destination operand is copied from:
.    the corresponding quadword element in the second source operand, if a mask bit is "1"; or
.    the corresponding quadword element in the first source operand, if a mask bit is "0"
The register assignment of the implicit mask operand for BLENDVPD is defined to be the architectural register
XMM0.
128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (VLMAX-1:128)
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined
to be the architectural register XMM0. An attempt to execute BLENDVPD with a VEX prefix will cause #UD.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. The upper bits (VLMAX-1:128) of the corresponding YMM register (destination register) are zeroed.
VEX.W must be 0, otherwise, the instruction will #UD.
VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source
operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. VEX.W must be 0, otherwise, the instruction will #UD.
VBLENDVPD permits the mask to be any XMM or YMM register. In contrast, BLENDVPD treats XMM0 implicitly as the
mask and do not support non-destructive destination operation.





Operation
BLENDVPD (128-bit Legacy SSE version)
MASK <- XMM0
IF (MASK[63] = 0) THEN DEST[63:0] <- DEST[63:0]
        ELSE DEST [63:0] <- SRC[63:0] FI
IF (MASK[127] = 0) THEN DEST[127:64] <- DEST[127:64]
        ELSE DEST [127:64] <- SRC[127:64] FI
DEST[VLMAX-1:128] (Unmodified)

VBLENDVPD (VEX.128 encoded version)
MASK <- SRC3
IF (MASK[63] = 0) THEN DEST[63:0] <- SRC1[63:0]
        ELSE DEST [63:0] <- SRC2[63:0] FI
IF (MASK[127] = 0) THEN DEST[127:64] <- SRC1[127:64]
        ELSE DEST [127:64] <- SRC2[127:64] FI
DEST[VLMAX-1:128] <- 0

VBLENDVPD (VEX.256 encoded version)
MASK <- SRC3
IF (MASK[63] = 0) THEN DEST[63:0] <- SRC1[63:0]
        ELSE DEST [63:0] <- SRC2[63:0] FI
IF (MASK[127] = 0) THEN DEST[127:64] <- SRC1[127:64]
        ELSE DEST [127:64] <- SRC2[127:64] FI
IF (MASK[191] = 0) THEN DEST[191:128] <- SRC1[191:128]
        ELSE DEST [191:128] <- SRC2[191:128] FI
IF (MASK[255] = 0) THEN DEST[255:192] <- SRC1[255:192]
        ELSE DEST [255:192] <- SRC2[255:192] FI

Intel C/C++ Compiler Intrinsic Equivalent
BLENDVPD:      __m128d _mm_blendv_pd(__m128d v1, __m128d v2, __m128d v3);

VBLENDVPD:     __m128 _mm_blendv_pd (__m128d a, __m128d b, __m128d mask);

VBLENDVPD:     __m256 _mm256_blendv_pd (__m256d a, __m256d b, __m256d mask);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Exceptions Type 4; additionally
#UD                  If VEX.W = 1.






platform: x86_64
mnem: BLENDVPS
description:
BLENDVPS - Variable Blend Packed Single Precision Floating-Point Values
 Opcode/                                                    Op/      64/32-bit CPUID      Description
 Instruction                                                En       Mode      Feature
                                                                               Flag
 66 0F 38 14 /r                                             RM0      V/V       SSE4_1     Select packed single precision floating-point
 BLENDVPS xmm1, xmm2/m128, <XMM0>                                                         values from xmm1 and xmm2/m128 from
                                                                                          mask specified in XMM0 and store the values
                                                                                          into xmm1.
 VEX.NDS.128.66.0F3A.W0 4A /r /is4                          RVMR V/V           AVX        Conditionally copy single-precision floating-
 VBLENDVPS xmm1, xmm2, xmm3/m128, xmm4                                                    point values from xmm2 or xmm3/m128 to
                                                                                          xmm1, based on mask bits in the specified
                                                                                          mask operand, xmm4.
 VEX.NDS.256.66.0F3A.W0 4A /r /is4                          RVMR V/V           AVX        Conditionally copy single-precision floating-
 VBLENDVPS ymm1, ymm2, ymm3/m256, ymm4                                                    point values from ymm2 or ymm3/m256 to
                                                                                          ymm1, based on mask bits in the specified
                                                                                          mask register, ymm4.



                                                     Instruction Operand Encoding
    Op/En             Operand 1                        Operand 2                     Operand 3                      Operand 4
    RM0            ModRM:reg (r, w)                  ModRM:r/m (r)                implicit XMM0                         NA
    RVMR            ModRM:reg (w)                     VEX.vvvv (r)                ModRM:r/m (r)                     imm8[7:4]

Description
Conditionally copy each dword data element of single-precision floating-point value from the second source
operand and the first source operand depending on mask bits defined in the mask register operand. The mask bits
are the most significant bit in each dword element of the mask register.
Each quadword element of the destination operand is copied from:
.    the corresponding dword element in the second source operand, if a mask bit is "1"; or
.    the corresponding dword element in the first source operand, if a mask bit is "0"
The register assignment of the implicit mask operand for BLENDVPS is defined to be the architectural register
XMM0.
128-bit Legacy SSE version: The first source operand and the destination operand is the same. Bits (VLMAX-1:128)
of the corresponding YMM destination register remain unchanged. The mask register operand is implicitly defined
to be the architectural register XMM0. An attempt to execute BLENDVPS with a VEX prefix will cause #UD.
VEX.128 encoded version: The first source operand and the destination operand are XMM registers. The second
source operand is an XMM register or 128-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. The upper bits (VLMAX-1:128) of the corresponding YMM register (destination register) are zeroed.
VEX.W must be 0, otherwise, the instruction will #UD.
VEX.256 encoded version: The first source operand and destination operand are YMM registers. The second source
operand can be a YMM register or a 256-bit memory location. The mask operand is the third source register, and
encoded in bits[7:4] of the immediate byte(imm8). The bits[3:0] of imm8 are ignored. In 32-bit mode, imm8[7] is
ignored. VEX.W must be 0, otherwise, the instruction will #UD.
VBLENDVPS permits the mask to be any XMM or YMM register. In contrast, BLENDVPS treats XMM0 implicitly as the
mask and do not support non-destructive destination operation.





Operation
BLENDVPS (128-bit Legacy SSE version)
MASK <- XMM0
IF (MASK[31] = 0) THEN DEST[31:0] <- DEST[31:0]
        ELSE DEST [31:0] <- SRC[31:0] FI
IF (MASK[63] = 0) THEN DEST[63:32] <- DEST[63:32]
        ELSE DEST [63:32] <- SRC[63:32] FI
IF (MASK[95] = 0) THEN DEST[95:64] <- DEST[95:64]
        ELSE DEST [95:64] <- SRC[95:64] FI
IF (MASK[127] = 0) THEN DEST[127:96] <- DEST[127:96]
        ELSE DEST [127:96] <- SRC[127:96] FI
DEST[VLMAX-1:128] (Unmodified)

VBLENDVPS (VEX.128 encoded version)
MASK <- SRC3
IF (MASK[31] = 0) THEN DEST[31:0] <- SRC1[31:0]
        ELSE DEST [31:0] <- SRC2[31:0] FI
IF (MASK[63] = 0) THEN DEST[63:32] <- SRC1[63:32]
        ELSE DEST [63:32] <- SRC2[63:32] FI
IF (MASK[95] = 0) THEN DEST[95:64] <- SRC1[95:64]
        ELSE DEST [95:64] <- SRC2[95:64] FI
IF (MASK[127] = 0) THEN DEST[127:96] <- SRC1[127:96]
        ELSE DEST [127:96] <- SRC2[127:96] FI
DEST[VLMAX-1:128] <- 0

VBLENDVPS (VEX.256 encoded version)
MASK <- SRC3
IF (MASK[31] = 0) THEN DEST[31:0] <- SRC1[31:0]
        ELSE DEST [31:0] <- SRC2[31:0] FI
IF (MASK[63] = 0) THEN DEST[63:32] <- SRC1[63:32]
        ELSE DEST [63:32] <- SRC2[63:32] FI
IF (MASK[95] = 0) THEN DEST[95:64] <- SRC1[95:64]
        ELSE DEST [95:64] <- SRC2[95:64] FI
IF (MASK[127] = 0) THEN DEST[127:96] <- SRC1[127:96]
        ELSE DEST [127:96] <- SRC2[127:96] FI
IF (MASK[159] = 0) THEN DEST[159:128] <- SRC1[159:128]
        ELSE DEST [159:128] <- SRC2[159:128] FI
IF (MASK[191] = 0) THEN DEST[191:160] <- SRC1[191:160]
        ELSE DEST [191:160] <- SRC2[191:160] FI
IF (MASK[223] = 0) THEN DEST[223:192] <- SRC1[223:192]
        ELSE DEST [223:192] <- SRC2[223:192] FI
IF (MASK[255] = 0) THEN DEST[255:224] <- SRC1[255:224]
        ELSE DEST [255:224] <- SRC2[255:224] FI

Intel C/C++ Compiler Intrinsic Equivalent
BLENDVPS:      __m128 _mm_blendv_ps(__m128 v1, __m128 v2, __m128 v3);

VBLENDVPS:     __m128 _mm_blendv_ps (__m128 a, __m128 b, __m128 mask);

VBLENDVPS:     __m256 _mm256_blendv_ps (__m256 a, __m256 b, __m256 mask);

SIMD Floating-Point Exceptions
None




Other Exceptions
See Exceptions Type 4; additionally
#UD                       If VEX.W = 1.






platform: x86_64
mnem: BLSI
description:
BLSI - Extract Lowest Set Isolated Bit
 Opcode/Instruction                 Op/   64/32     CPUID     Description
                                    En    -bit      Feature
                                          Mode      Flag
 VEX.NDD.LZ.0F38.W0 F3 /3           VM    V/V       BMI1      Extract lowest set bit from r/m32 and set that bit in r32.
 BLSI r32, r/m32
 VEX.NDD.LZ.0F38.W1 F3 /3           VM    V/N.E.    BMI1      Extract lowest set bit from r/m64, and set that bit in r64.
 BLSI r64, r/m64



                                                   Instruction Operand Encoding
   Op/En               Operand 1                     Operand 2                    Operand 3                       Operand 4
    VM               VEX.vvvv (w)                  ModRM:r/m (r)                      NA                              NA

Description
Extracts the lowest set bit from the source operand and set the corresponding bit in the destination register. All
other bits in the destination operand are zeroed. If no bits are set in the source operand, BLSI sets all the bits in
the destination to 0 and sets ZF and CF.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation
temp <- (-SRC) bitwiseAND (SRC);
SF <- temp[OperandSize -1];
ZF <- (temp = 0);
IF SRC = 0
    CF <- 0;
ELSE
    CF <- 1;
FI
DEST <- temp;

Flags Affected
ZF and SF are updated based on the result. CF is set if the source is not zero. OF flags are cleared. AF and PF
flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent
BLSI:          unsigned __int32 _blsi_u32(unsigned __int32 src);

BLSI:          unsigned __int64 _blsi_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Section 2.5.1, "Exception Conditions for VEX-Encoded GPR Instructions", Table 2-29; additionally
#UD                      If VEX.W = 1.






platform: x86_64
mnem: BLSMSK
description:
BLSMSK - Get Mask Up to Lowest Set Bit
 Opcode/Instruction                 Op/   64/32     CPUID       Description
                                    En    -bit      Feature
                                          Mode      Flag
 VEX.NDD.LZ.0F38.W0 F3 /2           VM    V/V       BMI1        Set all lower bits in r32 to "1" starting from bit 0 to lowest set bit in
 BLSMSK r32, r/m32                                              r/m32.
 VEX.NDD.LZ.0F38.W1 F3 /2           VM    V/N.E.    BMI1        Set all lower bits in r64 to "1" starting from bit 0 to lowest set bit in
 BLSMSK r64, r/m64                                              r/m64.



                                                   Instruction Operand Encoding
   Op/En              Operand 1                     Operand 2                        Operand 3                        Operand 4
    VM               VEX.vvvv (w)                  ModRM:r/m (r)                         NA                               NA

Description
Sets all the lower bits of the destination operand to "1" up to and including lowest set bit (=1) in the source
operand. If source operand is zero, BLSMSK sets all bits of the destination operand to 1 and also sets CF to 1.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation
temp <- (SRC-1) XOR (SRC) ;
SF <- temp[OperandSize -1];
ZF <- 0;
IF SRC = 0
    CF <- 1;
ELSE
    CF <- 0;
FI
DEST <- temp;

Flags Affected
SF is updated based on the result. CF is set if the source if zero. ZF and OF flags are cleared. AF and PF flag are
undefined.

Intel C/C++ Compiler Intrinsic Equivalent
BLSMSK:       unsigned __int32 _blsmsk_u32(unsigned __int32 src);

BLSMSK:       unsigned __int64 _blsmsk_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Section 2.5.1, "Exception Conditions for VEX-Encoded GPR Instructions", Table 2-29; additionally
#UD                     If VEX.W = 1.






platform: x86_64
mnem: BLSR
description:
BLSR - Reset Lowest Set Bit
 Opcode/Instruction               Op/   64/32     CPUID        Description
                                  En    -bit      Feature
                                        Mode      Flag
 VEX.NDD.LZ.0F38.W0 F3 /1         VM    V/V       BMI1         Reset lowest set bit of r/m32, keep all other bits of r/m32 and write
 BLSR r32, r/m32                                               result to r32.
 VEX.NDD.LZ.0F38.W1 F3 /1         VM    V/N.E.    BMI1         Reset lowest set bit of r/m64, keep all other bits of r/m64 and write
 BLSR r64, r/m64                                               result to r64.



                                                 Instruction Operand Encoding
   Op/En              Operand 1                    Operand 2                       Operand 3                      Operand 4
    VM              VEX.vvvv (w)                 ModRM:r/m (r)                        NA                              NA

Description
Copies all bits from the source operand to the destination operand and resets (=0) the bit position in the destina-
tion operand that corresponds to the lowest set bit of the source operand. If the source operand is zero BLSR sets
CF.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation
temp <- (SRC-1) bitwiseAND ( SRC );
SF <- temp[OperandSize -1];
ZF <- (temp = 0);
IF SRC = 0
    CF <- 1;
ELSE
    CF <- 0;
FI
DEST <- temp;

Flags Affected
ZF and SF flags are updated based on the result. CF is set if the source is zero. OF flag is cleared. AF and PF flags
are undefined.

Intel C/C++ Compiler Intrinsic Equivalent
BLSR:          unsigned __int32 _blsr_u32(unsigned __int32 src);

BLSR:          unsigned __int64 _blsr_u64(unsigned __int64 src);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Section 2.5.1, "Exception Conditions for VEX-Encoded GPR Instructions", Table 2-29; additionally
#UD                     If VEX.W = 1.






platform: x86_64
mnem: BNDCL
description:
BNDCL-Check Lower Bound
 Opcode/                       Op/En      64/32       CPUID     Description
 Instruction                              bit Mode    Feature
                                          Support     Flag
 F3 0F 1A /r                   RM         NE/V        MPX       Generate a #BR if the address in r/m32 is lower than the lower
 BNDCL bnd, r/m32                                               bound in bnd.LB.
 F3 0F 1A /r                   RM         V/NE        MPX       Generate a #BR if the address in r/m64 is lower than the lower
 BNDCL bnd, r/m64                                               bound in bnd.LB.



                                                 Instruction Operand Encoding
      Op/En                Operand 1                             Operand 2                               Operand 3
       RM                 ModRM:reg (w)                         ModRM:r/m (r)                               NA

Description
Compare the address in the second operand with the lower bound in bnd. The second operand can be either a
register or memory operand. If the address is lower than the lower bound in bnd.LB, it will set BNDSTATUS to 01H
and signal a #BR exception.
This instruction does not cause any memory access, and does not read or write any flags.

Operation
BNDCL BND, reg
IF reg < BND.LB Then
    BNDSTATUS <- 01H;
    #BR;
FI;

BNDCL BND, mem
TEMP <- LEA(mem);
IF TEMP < BND.LB Then
    BNDSTATUS <- 01H;
    #BR;
FI;

Intel C/C++ Compiler Intrinsic Equivalent
BNDCL void _bnd_chk_ptr_lbounds(const void *q)

Flags Affected
None

Protected Mode Exceptions
#BR                   If lower bound check fails.
#UD                   If the LOCK prefix is used.
                      If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                      If 67H prefix is not used and CS.D=0.
                      If 67H prefix is used and CS.D=1.





Real-Address Mode Exceptions
#BR                 If lower bound check fails.
#UD                 If the LOCK prefix is used.
                    If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                    If 16-bit addressing is used.

Virtual-8086 Mode Exceptions
#BR                 If lower bound check fails.
#UD                 If the LOCK prefix is used.
                    If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                    If 16-bit addressing is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                 If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
Same exceptions as in protected mode.






platform: x86_64
mnem: BNDCU
description:
BNDCU/BNDCN-Check Upper Bound
 Opcode/                        Op/En       64/32       CPUID     Description
 Instruction                                bit Mode    Feature
                                            Support     Flag
 F2 0F 1A /r                    RM          NE/V        MPX       Generate a #BR if the address in r/m32 is higher than the upper
 BNDCU bnd, r/m32                                                 bound in bnd.UB (bnb.UB in 1's complement form).
 F2 0F 1A /r                    RM          V/NE        MPX       Generate a #BR if the address in r/m64 is higher than the upper
 BNDCU bnd, r/m64                                                 bound in bnd.UB (bnb.UB in 1's complement form).
 F2 0F 1B /r                    RM          NE/V        MPX       Generate a #BR if the address in r/m32 is higher than the upper
 BNDCN bnd, r/m32                                                 bound in bnd.UB (bnb.UB not in 1's complement form).
 F2 0F 1B /r                    RM          V/NE        MPX       Generate a #BR if the address in r/m64 is higher than the upper
 BNDCN bnd, r/m64                                                 bound in bnd.UB (bnb.UB not in 1's complement form).



                                                   Instruction Operand Encoding
    Op/En                    Operand 1                             Operand 2                              Operand 3
      RM                    ModRM:reg (w)                         ModRM:r/m (r)                               NA

Description
Compare the address in the second operand with the upper bound in bnd. The second operand can be either a
register or a memory operand. If the address is higher than the upper bound in bnd.UB, it will set BNDSTATUS to
01H and signal a #BR exception.
BNDCU perform 1's complement operation on the upper bound of bnd first before proceeding with address compar-
ison. BNDCN perform address comparison directly using the upper bound in bnd that is already reverted out of 1's
complement form.
This instruction does not cause any memory access, and does not read or write any flags.
Effective address computation of m32/64 has identical behavior to LEA

Operation
BNDCU BND, reg
IF reg > NOT(BND.UB) Then
    BNDSTATUS <- 01H;
    #BR;
FI;

BNDCU BND, mem
TEMP <- LEA(mem);
IF TEMP > NOT(BND.UB) Then
    BNDSTATUS <- 01H;
    #BR;
FI;

BNDCN BND, reg
IF reg > BND.UB Then
    BNDSTATUS <- 01H;
    #BR;
FI;





BNDCN BND, mem
TEMP <- LEA(mem);
IF TEMP > BND.UB Then
    BNDSTATUS <- 01H;
    #BR;
FI;

Intel C/C++ Compiler Intrinsic Equivalent
BNDCU .void _bnd_chk_ptr_ubounds(const void *q)

Flags Affected
None

Protected Mode Exceptions
#BR                  If upper bound check fails.
#UD                  If the LOCK prefix is used.
                     If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                     If 67H prefix is not used and CS.D=0.
                     If 67H prefix is used and CS.D=1.

Real-Address Mode Exceptions
#BR                  If upper bound check fails.
#UD                  If the LOCK prefix is used.
                     If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                     If 16-bit addressing is used.

Virtual-8086 Mode Exceptions
#BR                  If upper bound check fails.
#UD                  If the LOCK prefix is used.
                     If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                     If 16-bit addressing is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                  If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
Same exceptions as in protected mode.






platform: x86_64
mnem: BNDLDX
description:
BNDLDX-Load Extended Bounds Using Address Translation
 Opcode/                          Op/En     64/32       CPUID     Description
 Instruction                                bit Mode    Feature
                                            Support     Flag
 0F 1A /r                         RM        V/V         MPX       Load the bounds stored in a bound table entry (BTE) into bnd with
 BNDLDX bnd, mib                                                  address translation using the base of mib and conditional on the
                                                                  index of mib matching the pointer value in the BTE.



                                                 Instruction Operand Encoding
     Op/En                    Operand 1                            Operand 2                               Operand 3
                                                         SIB.base (r): Address of pointer
      RM                    ModRM:reg (w)                                                                     NA
                                                                   SIB.index(r)

Description
BNDLDX uses the linear address constructed from the base register and displacement of the SIB-addressing form
of the memory operand (mib) to perform address translation to access a bound table entry and conditionally load
the bounds in the BTE to the destination. The destination register is updated with the bounds in the BTE, if the
content of the index register of mib matches the pointer value stored in the BTE.
If the pointer value comparison fails, the destination is updated with INIT bounds (lb = 0x0, ub = 0x0) (note: as
articulated earlier, the upper bound is represented using 1's complement, therefore, the 0x0 value of upper bound
allows for access to full memory).
This instruction does not cause memory access to the linear address of mib nor the effective address referenced by
the base, and does not read or write any flags.
Segment overrides apply to the linear address computation with the base of mib, and are used during address
translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be
linear address. There are no segmentation checks performed on the base of mib.
The base of mib will not be checked for canonical address violation as it does not access memory.
Any encoding of this instruction that does not specify base or index register will treat those registers as zero
(constant). The reg-reg form of this instruction will remain a NOP.
The scale field of the SIB byte has no effect on these instructions and is ignored.
The bound register may be partially updated on memory faults. The order in which memory operands are loaded is
implementation specific.

Operation
base <- mib.SIB.base ? mib.SIB.base + Disp: 0;
ptr_value <- mib.SIB.index ? mib.SIB.index : 0;

Outside 64-bit mode
A_BDE[31:0] <- (Zero_extend32(base[31:12] << 2) + (BNDCFG[31:12] <<12 );
A_BT[31:0] <- LoadFrom(A_BDE );
IF A_BT[0] equal 0 Then
    BNDSTATUS <- A_BDE | 02H;
    #BR;
FI;
A_BTE[31:0] <- (Zero_extend32(base[11:2] << 4) + (A_BT[31:2] << 2 );
Temp_lb[31:0] <- LoadFrom(A_BTE);
Temp_ub[31:0] <- LoadFrom(A_BTE + 4);
Temp_ptr[31:0] <- LoadFrom(A_BTE + 8);
IF Temp_ptr equal ptr_value Then
    BND.LB <- Temp_lb;
    BND.UB <- Temp_ub;



ELSE
    BND.LB <- 0;
    BND.UB <- 0;
FI;

In 64-bit mode
A_BDE[63:0] <- (Zero_extend64(base[47+MAWA:20] << 3) + (BNDCFG[63:20] <<12 );1
A_BT[63:0] <- LoadFrom(A_BDE);
IF A_BT[0] equal 0 Then
    BNDSTATUS <- A_BDE | 02H;
    #BR;
FI;
A_BTE[63:0] <- (Zero_extend64(base[19:3] << 5) + (A_BT[63:3] << 3 );
Temp_lb[63:0] <- LoadFrom(A_BTE);
Temp_ub[63:0] <- LoadFrom(A_BTE + 8);
Temp_ptr[63:0] <- LoadFrom(A_BTE + 16);
IF Temp_ptr equal ptr_value Then
    BND.LB <- Temp_lb;
    BND.UB <- Temp_ub;
ELSE
    BND.LB <- 0;
    BND.UB <- 0;
FI;

Intel C/C++ Compiler Intrinsic Equivalent
BNDLDX: Generated by compiler as needed.

Flags Affected
None

Protected Mode Exceptions
#BR                    If the bound directory entry is invalid.
#UD                    If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 67H prefix is not used and CS.D=0.
                       If 67H prefix is used and CS.D=1.
#GP(0)                 If a destination effective address of the Bound Table entry is outside the DS segment limit.
                       If DS register contains a NULL segment selector.
#PF(fault code)        If a page fault occurs.

Real-Address Mode Exceptions
#UD                    If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 16-bit addressing is used.
#GP(0)                 If a destination effective address of the Bound Table entry is outside the DS segment limit.




1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-
   ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Section 17.3.1 of Intel 64 and IA-32 Architectures Software Devel-
   oper's Manual, Volume 1.



Virtual-8086 Mode Exceptions
#UD                     If the LOCK prefix is used.
                        If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                        If 16-bit addressing is used.
#GP(0)                  If a destination effective address of the Bound Table entry is outside the DS segment limit.
#PF(fault code)         If a page fault occurs.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#BR                     If the bound directory entry is invalid.
#UD                     If ModRM is RIP relative.
                        If the LOCK prefix is used.
                        If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#GP(0)                  If the memory address (A_BDE or A_BTE) is in a non-canonical form.
#PF(fault code)         If a page fault occurs.






platform: x86_64
mnem: BNDMK
description:
BNDMK-Make Bounds
 Opcode/                        Op/En     64/32       CPUID      Description
 Instruction                              bit Mode    Feature
                                          Support     Flag
 F3 0F 1B /r                    RM        NE/V        MPX        Make lower and upper bounds from m32 and store them in bnd.
 BNDMK bnd, m32
 F3 0F 1B /r                    RM        V/NE        MPX        Make lower and upper bounds from m64 and store them in bnd.
 BNDMK bnd, m64



                                                 Instruction Operand Encoding
    Op/En                   Operand 1                            Operand 2                             Operand 3
       RM                ModRM:reg (w)                          ModRM:r/m (r)                             NA

Description
Makes bounds from the second operand and stores the lower and upper bounds in the bound register bnd. The
second operand must be a memory operand. The content of the base register from the memory operand is stored
in the lower bound bnd.LB. The 1's complement of the effective address of m32/m64 is stored in the upper bound
b.UB. Computation of m32/m64 has identical behavior to LEA.
This instruction does not cause any memory access, and does not read or write any flags.
If the instruction did not specify base register, the lower bound will be zero. The reg-reg form of this instruction
retains legacy behavior (NOP).
RIP relative instruction in 64-bit will #UD.

Operation
BND.LB <- SRCMEM.base;
IF 64-bit mode Then
    BND.UB <- NOT(LEA.64_bits(SRCMEM));
ELSE
    BND.UB <- Zero_Extend.64_bits(NOT(LEA.32_bits(SRCMEM)));
FI;

Intel C/C++ Compiler Intrinsic Equivalent
BNDMKvoid * _bnd_set_ptr_bounds(const void * q, size_t size);

Flags Affected
None

Protected Mode Exceptions
#UD                    If ModRM is RIP relative.
                       If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 67H prefix is not used and CS.D=0.
                       If 67H prefix is used and CS.D=1.

Real-Address Mode Exceptions
#UD                    If ModRM is RIP relative.
                       If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 16-bit addressing is used.




Virtual-8086 Mode Exceptions
#UD                 If ModRM is RIP relative.
                    If the LOCK prefix is used.
                    If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                    If 16-bit addressing is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                 If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#SS(0)              If the memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
Same exceptions as in protected mode.






platform: x86_64
mnem: BNDMOV
description:
BNDMOV-Move Bounds
 Opcode/                          Op/En     64/32        CPUID          Description
 Instruction                                bit Mode     Feature
                                            Support      Flag
 66 0F 1A /r                      RM        NE/V         MPX            Move lower and upper bound from bnd2/m64 to bound register
 BNDMOV bnd1, bnd2/m64                                                  bnd1.
 66 0F 1A /r                      RM        V/NE         MPX            Move lower and upper bound from bnd2/m128 to bound register
 BNDMOV bnd1, bnd2/m128                                                 bnd1.
 66 0F 1B /r                      MR        NE/V         MPX            Move lower and upper bound from bnd2 to bnd1/m64.
 BNDMOV bnd1/m64, bnd2
 66 0F 1B /r                      MR        V/NE         MPX            Move lower and upper bound from bnd2 to bound register
 BNDMOV bnd1/m128, bnd2                                                 bnd1/m128.



                                                   Instruction Operand Encoding
     Op/En                     Operand 1                                  Operand 2                                Operand 3
      RM                    ModRM:reg (w)                            ModRM:r/m (r)                                         NA
      MR                    ModRM:r/m (w)                               ModRM:reg (r)                                      NA

Description
BNDMOV moves a pair of lower and upper bound values from the source operand (the second operand) to the
destination (the first operand). Each operation is 128-bit move. The exceptions are same as the MOV instruction.
The memory format for loading/store bounds in 64-bit mode is shown in Figure 3-5.




                                                                                                BNDMOV to memory in 64-bit mode
                       Upper Bound (UB)                  Lower Bound (LB)


                    16                                                  8                                          0     Byte offset




                                                                                              BNDMOV to memory in 32-bit mode
                  Upper Bound (UB)                     Lower Bound (LB)


                  16                                                8                     4                    0       Byte offset




                                  Figure 3-5. Memory Layout of BNDMOV to/from Memory


This instruction does not change flags.

Operation
BNDMOV register to register
DEST.LB <- SRC.LB;
DEST.UB <- SRC.UB;





BNDMOV from memory
IF 64-bit mode THEN
         DEST.LB <- LOAD_QWORD(SRC);
         DEST.UB <- LOAD_QWORD(SRC+8);
    ELSE
         DEST.LB <- LOAD_DWORD_ZERO_EXT(SRC);
         DEST.UB <- LOAD_DWORD_ZERO_EXT(SRC+4);
FI;

BNDMOV to memory
IF 64-bit mode THEN
         DEST[63:0] <- SRC.LB;
         DEST[127:64] <- SRC.UB;
    ELSE
         DEST[31:0] <- SRC.LB;
         DEST[63:32] <- SRC.UB;
FI;

Intel C/C++ Compiler Intrinsic Equivalent
BNDMOV         void * _bnd_copy_ptr_bounds(const void *q, const void *r)

Flags Affected
None

Protected Mode Exceptions
#UD                   If the LOCK prefix is used but the destination is not a memory operand.
                      If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                      If 67H prefix is not used and CS.D=0.
                      If 67H prefix is used and CS.D=1.
#SS(0)                If the memory operand effective address is outside the SS segment limit.
#GP(0)                If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                      If the destination operand points to a non-writable segment
                      If the DS, ES, FS, or GS segment register contains a NULL segment selector.
#AC(0)                If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.
#PF(fault code)       If a page fault occurs.

Real-Address Mode Exceptions
#UD                   If the LOCK prefix is used but the destination is not a memory operand.
                      If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                      If 16-bit addressing is used.
#GP(0)                If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                   If the memory operand effective address is outside the SS segment limit.





Virtual-8086 Mode Exceptions
#UD                 If the LOCK prefix is used but the destination is not a memory operand.
                    If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                    If 16-bit addressing is used.
#GP(0)              If the memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)              If the memory operand effective address is outside the SS segment limit.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.
#PF(fault code)     If a page fault occurs.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                 If the LOCK prefix is used but the destination is not a memory operand.
                    If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#SS(0)              If the memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while CPL is 3.
#PF(fault code)     If a page fault occurs.






platform: x86_64
mnem: BNDSTX
description:
BNDSTX-Store Extended Bounds Using Address Translation
 Opcode/                          Op/En     64/32        CPUID     Description
 Instruction                                bit Mode     Feature
                                            Support      Flag
 0F 1B /r                         MR        V/V          MPX       Store the bounds in bnd and the pointer value in the index regis-
 BNDSTX mib, bnd                                                   ter of mib to a bound table entry (BTE) with address translation
                                                                   using the base of mib.



                                                   Instruction Operand Encoding
     Op/En                     Operand 1                             Operand 2                               Operand 3
                     SIB.base (r): Address of pointer
      MR                                                           ModRM:reg (r)                                 NA
                               SIB.index(r)

Description
BNDSTX uses the linear address constructed from the displacement and base register of the SIB-addressing form
of the memory operand (mib) to perform address translation to store to a bound table entry. The bounds in the
source operand bnd are written to the lower and upper bounds in the BTE. The content of the index register of mib
is written to the pointer value field in the BTE.
This instruction does not cause memory access to the linear address of mib nor the effective address referenced by
the base, and does not read or write any flags.
Segment overrides apply to the linear address computation with the base of mib, and are used during address
translation to generate the address of the bound table entry. By default, the address of the BTE is assumed to be
linear address. There are no segmentation checks performed on the base of mib.
The base of mib will not be checked for canonical address violation as it does not access memory.
Any encoding of this instruction that does not specify base or index register will treat those registers as zero
(constant). The reg-reg form of this instruction will remain a NOP.
The scale field of the SIB byte has no effect on these instructions and is ignored.
The bound register may be partially updated on memory faults. The order in which memory operands are loaded is
implementation specific.

Operation
base <- mib.SIB.base ? mib.SIB.base + Disp: 0;
ptr_value <- mib.SIB.index ? mib.SIB.index : 0;

Outside 64-bit mode
A_BDE[31:0] <- (Zero_extend32(base[31:12] << 2) + (BNDCFG[31:12] <<12 );
A_BT[31:0] <- LoadFrom(A_BDE);
IF A_BT[0] equal 0 Then
    BNDSTATUS <- A_BDE | 02H;
    #BR;
FI;
A_DEST[31:0] <- (Zero_extend32(base[11:2] << 4) + (A_BT[31:2] << 2 ); // address of Bound table entry
A_DEST[8][31:0] <- ptr_value;
A_DEST[0][31:0] <- BND.LB;
A_DEST[4][31:0] <- BND.UB;





In 64-bit mode
A_BDE[63:0] <- (Zero_extend64(base[47+MAWA:20] << 3) + (BNDCFG[63:20] <<12 );1
A_BT[63:0] <- LoadFrom(A_BDE);
IF A_BT[0] equal 0 Then
    BNDSTATUS <- A_BDE | 02H;
    #BR;
FI;
A_DEST[63:0] <- (Zero_extend64(base[19:3] << 5) + (A_BT[63:3] << 3 ); // address of Bound table entry
A_DEST[16][63:0] <- ptr_value;
A_DEST[0][63:0] <- BND.LB;
A_DEST[8][63:0] <- BND.UB;

Intel C/C++ Compiler Intrinsic Equivalent
BNDSTX: _bnd_store_ptr_bounds(const void **ptr_addr, const void *ptr_val);

Flags Affected
None

Protected Mode Exceptions
#BR                    If the bound directory entry is invalid.
#UD                    If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 67H prefix is not used and CS.D=0.
                       If 67H prefix is used and CS.D=1.
#GP(0)                 If a destination effective address of the Bound Table entry is outside the DS segment limit.
                       If DS register contains a NULL segment selector.
                       If the destination operand points to a non-writable segment
#PF(fault code)        If a page fault occurs.

Real-Address Mode Exceptions
#UD                    If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 16-bit addressing is used.
#GP(0)                 If a destination effective address of the Bound Table entry is outside the DS segment limit.

Virtual-8086 Mode Exceptions
#UD                    If the LOCK prefix is used.
                       If ModRM.r/m encodes BND4-BND7 when Intel MPX is enabled.
                       If 16-bit addressing is used.
#GP(0)                 If a destination effective address of the Bound Table entry is outside the DS segment limit.
#PF(fault code)        If a page fault occurs.

Compatibility Mode Exceptions
Same exceptions as in protected mode.




1. If CPL < 3, the supervisor MAWA (MAWAS) is used; this value is 0. If CPL = 3, the user MAWA (MAWAU) is used; this value is enumer-
   ated in CPUID.(EAX=07H,ECX=0H):ECX.MAWAU[bits 21:17]. See Section 17.3.1 of Intel 64 and IA-32 Architectures Software Devel-
   oper's Manual, Volume 1.



64-Bit Mode Exceptions
#BR                     If the bound directory entry is invalid.
#UD                     If ModRM is RIP relative.
                        If the LOCK prefix is used.
                        If ModRM.r/m and REX encodes BND4-BND15 when Intel MPX is enabled.
#GP(0)                  If the memory address (A_BDE or A_BTE) is in a non-canonical form.
                        If the destination operand points to a non-writable segment
#PF(fault code)         If a page fault occurs.






platform: x86_64
mnem: BOUND
description:
BOUND-Check Array Index Against Bounds
Opcode                  Instruction                  Op/   64-bit    Compat/ Description
                                                     En    Mode      Leg Mode
62 /r                   BOUND r16, m16&16            RM    Invalid   Valid     Check if r16 (array index) is within bounds
                                                                               specified by m16&16.
62 /r                   BOUND r32, m32&32            RM    Invalid   Valid     Check if r32 (array index) is within bounds
                                                                               specified by m32&32.



                                              Instruction Operand Encoding
  Op/En             Operand 1                      Operand 2                 Operand 3                    Operand 4
    RM             ModRM:reg (r)                  ModRM:r/m (r)                 NA                            NA

Description
BOUND determines if the first operand (array index) is within the bounds of an array specified the second operand
(bounds operand). The array index is a signed integer located in a register. The bounds operand is a memory loca-
tion that contains a pair of signed doubleword-integers (when the operand-size attribute is 32) or a pair of signed
word-integers (when the operand-size attribute is 16). The first doubleword (or word) is the lower bound of the
array and the second doubleword (or word) is the upper bound of the array. The array index must be greater than
or equal to the lower bound and less than or equal to the upper bound plus the operand size in bytes. If the index
is not within bounds, a BOUND range exceeded exception (#BR) is signaled. When this exception is generated, the
saved return instruction pointer points to the BOUND instruction.
The bounds limit data structure (two words or doublewords containing the lower and upper limits of the array) is
usually placed just before the array itself, making the limits addressable via a constant offset from the beginning of
the array. Because the address of the array already will be present in a register, this practice avoids extra bus cycles
to obtain the effective address of the array bounds.
This instruction executes as described in compatibility mode and legacy mode. It is not valid in 64-bit mode.

Operation
IF 64bit Mode
    THEN
         #UD;
    ELSE
         IF (ArrayIndex < LowerBound OR ArrayIndex > UpperBound)
         (* Below lower bound or above upper bound *)
              THEN #BR; FI;
FI;

Flags Affected
None.

Protected Mode Exceptions
#BR                   If the bounds test fails.
#UD                   If second operand is not a memory location.
                      If the LOCK prefix is used.
#GP(0)                If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                      If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)                If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)       If a page fault occurs.
#AC(0)                If alignment checking is enabled and an unaligned memory reference is made while the
                      current privilege level is 3.



Real-Address Mode Exceptions
#BR                    If the bounds test fails.
#UD                    If second operand is not a memory location.
                       If the LOCK prefix is used.
#GP                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                    If a memory operand effective address is outside the SS segment limit.

Virtual-8086 Mode Exceptions
#BR                    If the bounds test fails.
#UD                    If second operand is not a memory location.
                       If the LOCK prefix is used.
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                    If in 64-bit mode.






platform: x86_64
mnem: BSF
description:
BSF-Bit Scan Forward
 Opcode                   Instruction                 Op/   64-bit   Compat/ Description
                                                      En    Mode     Leg Mode
 0F BC /r                 BSF r16, r/m16              RM    Valid    Valid       Bit scan forward on r/m16.
 0F BC /r                 BSF r32, r/m32              RM    Valid    Valid       Bit scan forward on r/m32.
 REX.W + 0F BC /r         BSF r64, r/m64              RM    Valid    N.E.        Bit scan forward on r/m64.



                                              Instruction Operand Encoding
  Op/En              Operand 1                     Operand 2                 Operand 3                    Operand 4
    RM              ModRM:reg (w)                 ModRM:r/m (r)                 NA                              NA

Description
Searches the source operand (second operand) for the least significant set bit (1 bit). If a least significant 1 bit is
found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a
memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source
operand. If the content of the source operand is 0, the content of the destination operand is undefined.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
IF SRC = 0
    THEN
        ZF <- 1;
        DEST is undefined;
    ELSE
        ZF <- 0;
        temp <- 0;
        WHILE Bit(SRC, temp) = 0
        DO
            temp <- temp + 1;
        OD;
        DEST <- temp;
FI;

Flags Affected
The ZF flag is set to 1 if all the source operand is 0; otherwise, the ZF flag is cleared. The CF, OF, SF, AF, and PF, flags
are undefined.

Protected Mode Exceptions
#GP(0)                  If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                        If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)                  If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)         If a page fault occurs.
#AC(0)                  If alignment checking is enabled and an unaligned memory reference is made while the
                        current privilege level is 3.
#UD                     If the LOCK prefix is used.





Real-Address Mode Exceptions
#GP                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                    If a memory operand effective address is outside the SS segment limit.
#UD                    If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made.
#UD                    If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)                 If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)                 If the memory address is in a non-canonical form.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made while the
                       current privilege level is 3.
#UD                    If the LOCK prefix is used.






platform: x86_64
mnem: BSR
description:
BSR-Bit Scan Reverse
Opcode                   Instruction                  Op/     64-bit   Compat/ Description
                                                      En      Mode     Leg Mode
0F BD /r                 BSR r16, r/m16               RM      Valid    Valid      Bit scan reverse on r/m16.
0F BD /r                 BSR r32, r/m32               RM      Valid    Valid      Bit scan reverse on r/m32.
REX.W + 0F BD /r         BSR r64, r/m64               RM      Valid    N.E.       Bit scan reverse on r/m64.



                                              Instruction Operand Encoding
  Op/En             Operand 1                     Operand 2                    Operand 3                   Operand 4
   RM              ModRM:reg (w)                 ModRM:r/m (r)                    NA                              NA

Description
Searches the source operand (second operand) for the most significant set bit (1 bit). If a most significant 1 bit is
found, its bit index is stored in the destination operand (first operand). The source operand can be a register or a
memory location; the destination operand is a register. The bit index is an unsigned offset from bit 0 of the source
operand. If the content source operand is 0, the content of the destination operand is undefined.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
IF SRC = 0
    THEN
        ZF <- 1;
        DEST is undefined;
    ELSE
        ZF <- 0;
        temp <- OperandSize - 1;
        WHILE Bit(SRC, temp) = 0
        DO
            temp <- temp - 1;
        OD;
        DEST <- temp;
FI;

Flags Affected
The ZF flag is set to 1 if all the source operand is 0; otherwise, the ZF flag is cleared. The CF, OF, SF, AF, and PF, flags
are undefined.

Protected Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                       If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made while the
                       current privilege level is 3.
#UD                    If the LOCK prefix is used.





Real-Address Mode Exceptions
#GP                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                    If a memory operand effective address is outside the SS segment limit.
#UD                    If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made.
#UD                    If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)                 If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)                 If the memory address is in a non-canonical form.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made while the
                       current privilege level is 3.
#UD                    If the LOCK prefix is used.






platform: x86_64
mnem: BSWAP
description:
BSWAP-Byte Swap
Opcode                    Instruction                   Op/   64-bit   Compat/ Description
                                                        En    Mode     Leg Mode
0F C8+rd                  BSWAP r32                     O     Valid*   Valid       Reverses the byte order of a 32-bit register.
REX.W + 0F C8+rd          BSWAP r64                     O     Valid    N.E.        Reverses the byte order of a 64-bit register.
NOTES:
* See IA-32 Architecture Compatibility section below.



                                                Instruction Operand Encoding
  Op/En             Operand 1                     Operand 2                    Operand 3                    Operand 4
    O            opcode + rd (r, w)                     NA                        NA                            NA

Description
Reverses the byte order of a 32-bit or 64-bit (destination) register. This instruction is provided for converting little-
endian values to big-endian format and vice versa. To swap bytes in a word value (16-bit register), use the XCHG
instruction. When the BSWAP instruction references a 16-bit register, the result is undefined.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

IA-32 Architecture Legacy Compatibility
The BSWAP instruction is not supported on IA-32 processors earlier than the Intel486 processor family. For
compatibility with this instruction, software should include functionally equivalent code for execution on Intel
processors earlier than the Intel486 processor family.

Operation
TEMP <- DEST
IF 64-bit mode AND OperandSize = 64
    THEN
         DEST[7:0] <- TEMP[63:56];
         DEST[15:8] <- TEMP[55:48];
         DEST[23:16] <- TEMP[47:40];
         DEST[31:24] <- TEMP[39:32];
         DEST[39:32] <- TEMP[31:24];
         DEST[47:40] <- TEMP[23:16];
         DEST[55:48] <- TEMP[15:8];
         DEST[63:56] <- TEMP[7:0];
    ELSE
         DEST[7:0] <- TEMP[31:24];
         DEST[15:8] <- TEMP[23:16];
         DEST[23:16] <- TEMP[15:8];
         DEST[31:24] <- TEMP[7:0];
FI;

Flags Affected
None.

Exceptions (All Operating Modes)
#UD                    If the LOCK prefix is used.





platform: x86_64
mnem: BT
description:
BT-Bit Test
 Opcode                    Instruction                  Op/      64-bit   Compat/ Description
                                                        En       Mode     Leg Mode
 0F A3 /r                  BT r/m16, r16                MR       Valid    Valid       Store selected bit in CF flag.
 0F A3 /r                  BT r/m32, r32                MR       Valid    Valid       Store selected bit in CF flag.
 REX.W + 0F A3 /r          BT r/m64, r64                MR       Valid    N.E.        Store selected bit in CF flag.
 0F BA /4 ib               BT r/m16, imm8               MI       Valid    Valid       Store selected bit in CF flag.
 0F BA /4 ib               BT r/m32, imm8               MI       Valid    Valid       Store selected bit in CF flag.
 REX.W + 0F BA /4 ib       BT r/m64, imm8               MI       Valid    N.E.        Store selected bit in CF flag.



                                                   Instruction Operand Encoding
    Op/En              Operand 1                     Operand 2                    Operand 3                      Operand 4
     MR             ModRM:r/m (r)                  ModRM:reg (r)                     NA                                NA
     MI             ModRM:r/m (r)                      imm8                          NA                                NA

Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset (specified by the second operand) and stores the value of the bit in the CF flag. The bit base operand
can be a register or a memory location; the bit offset operand can be a register or an immediate value:
.    If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
     operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
     mode).
.    If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
     that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
     referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. In this case, the low-order 3 or 5 bits (3 for 16-bit oper-
ands, 5 for 32-bit operands) of the immediate bit offset are stored in the immediate bit offset field, and the high-
order bits are shifted and combined with the byte displacement in the addressing mode by the assembler. The
processor will ignore the high order bits if they are not zero.
When accessing a bit in memory, the processor may access 4 bytes starting from the memory address for a 32-bit
operand size, using by the following relationship:

    Effective Address + (4 * (BitOffset DIV 32))
Or, it may access 2 bytes starting from the memory address for a 16-bit operand, using this relationship:

    Effective Address + (2 * (BitOffset DIV 16))
It may do so even when only a single byte needs to be accessed to reach the given bit. When using this bit
addressing mechanism, software should avoid referencing areas of memory close to address space holes. In partic-
ular, it should avoid references to memory-mapped I/O registers. Instead, software should use the MOV instruc-
tions to load from or store to these addresses, and use the register form of these instructions to manipulate the
data.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bit oper-
ands. See the summary chart at the beginning of this section for encoding data and limits.

Operation
CF <- Bit(BitBase, BitOffset);



Flags Affected
The CF flag contains the value of the selected bit. The ZF flag is unaffected. The OF, SF, AF, and PF flags are
undefined.

Protected Mode Exceptions
#GP(0)               If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                     If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)               If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)      If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made while the
                     current privilege level is 3.
#UD                  If the LOCK prefix is used.

Real-Address Mode Exceptions
#GP                  If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                  If a memory operand effective address is outside the SS segment limit.
#UD                  If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)               If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)               If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)      If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made.
#UD                  If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)               If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)               If the memory address is in a non-canonical form.
#PF(fault-code)      If a page fault occurs.
#AC(0)               If alignment checking is enabled and an unaligned memory reference is made while the
                     current privilege level is 3.
#UD                  If the LOCK prefix is used.






platform: x86_64
mnem: BTC
description:
BTC-Bit Test and Complement
 Opcode                    Instruction                    Op/   64-bit   Compat/ Description
                                                          En    Mode     Leg Mode
 0F BB /r                  BTC r/m16, r16                 MR    Valid    Valid        Store selected bit in CF flag and complement.
 0F BB /r                  BTC r/m32, r32                 MR    Valid    Valid        Store selected bit in CF flag and complement.
 REX.W + 0F BB /r          BTC r/m64, r64                 MR    Valid    N.E.         Store selected bit in CF flag and complement.
 0F BA /7 ib               BTC r/m16, imm8                MI    Valid    Valid        Store selected bit in CF flag and complement.
 0F BA /7 ib               BTC r/m32, imm8                MI    Valid    Valid        Store selected bit in CF flag and complement.
 REX.W + 0F BA /7 ib       BTC r/m64, imm8                MI    Valid    N.E.         Store selected bit in CF flag and complement.



                                                  Instruction Operand Encoding
    Op/En              Operand 1                    Operand 2                    Operand 3                     Operand 4
     MR           ModRM:r/m (r, w)                ModRM:reg (r)                     NA                             NA
     MI           ModRM:r/m (r, w)                       imm8                       NA                             NA

Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset operand (second operand), stores the value of the bit in the CF flag, and complements the selected
bit in the bit string. The bit base operand can be a register or a memory location; the bit offset operand can be a
register or an immediate value:
.    If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
     operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
     mode). This allows any bit position to be selected.
.    If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
     that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
     referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. See "BT-Bit Test" in this chapter for more information on
this addressing mechanism.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
CF <- Bit(BitBase, BitOffset);
Bit(BitBase, BitOffset) <- NOT Bit(BitBase, BitOffset);

Flags Affected
The CF flag contains the value of the selected bit before it is complemented. The ZF flag is unaffected. The OF, SF,
AF, and PF flags are undefined.





Protected Mode Exceptions
#GP(0)              If the destination operand points to a non-writable segment.
                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                    If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions
#GP                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                 If a memory operand effective address is outside the SS segment limit.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions
#GP(0)              If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.






platform: x86_64
mnem: BTR
description:
BTR-Bit Test and Reset
 Opcode                      Instruction            Op/   64-bit     Compat/ Description
                                                    En    Mode       Leg Mode
 0F B3 /r                    BTR r/m16, r16         MR    Valid      Valid      Store selected bit in CF flag and clear.
 0F B3 /r                    BTR r/m32, r32         MR    Valid      Valid      Store selected bit in CF flag and clear.
 REX.W + 0F B3 /r            BTR r/m64, r64         MR    Valid      N.E.       Store selected bit in CF flag and clear.
 0F BA /6 ib                 BTR r/m16, imm8        MI    Valid      Valid      Store selected bit in CF flag and clear.
 0F BA /6 ib                 BTR r/m32, imm8        MI    Valid      Valid      Store selected bit in CF flag and clear.
 REX.W + 0F BA /6 ib         BTR r/m64, imm8        MI    Valid      N.E.       Store selected bit in CF flag and clear.



                                               Instruction Operand Encoding
    Op/En                Operand 1               Operand 2                   Operand 3                     Operand 4
     MR             ModRM:r/m (r, w)            ModRM:reg (r)                   NA                             NA
     MI             ModRM:r/m (r, w)               imm8                         NA                             NA

Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset operand (second operand), stores the value of the bit in the CF flag, and clears the selected bit in the
bit string to 0. The bit base operand can be a register or a memory location; the bit offset operand can be a register
or an immediate value:
.    If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
     operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
     mode). This allows any bit position to be selected.
.    If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
     that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
     referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. See "BT-Bit Test" in this chapter for more information on
this addressing mechanism.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
CF <- Bit(BitBase, BitOffset);
Bit(BitBase, BitOffset) <- 0;

Flags Affected
The CF flag contains the value of the selected bit before it is cleared. The ZF flag is unaffected. The OF, SF, AF, and
PF flags are undefined.





Protected Mode Exceptions
#GP(0)              If the destination operand points to a non-writable segment.
                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                    If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions
#GP                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                 If a memory operand effective address is outside the SS segment limit.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions
#GP(0)              If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.






platform: x86_64
mnem: BTS
description:
BTS-Bit Test and Set
 Opcode                    Instruction             Op/     64-bit    Compat/ Description
                                                   En      Mode      Leg Mode
 0F AB /r                  BTS r/m16, r16          MR      Valid     Valid       Store selected bit in CF flag and set.
 0F AB /r                  BTS r/m32, r32          MR      Valid     Valid       Store selected bit in CF flag and set.
 REX.W + 0F AB /r          BTS r/m64, r64          MR      Valid     N.E.        Store selected bit in CF flag and set.
 0F BA /5 ib               BTS r/m16, imm8         MI      Valid     Valid       Store selected bit in CF flag and set.
 0F BA /5 ib               BTS r/m32, imm8         MI      Valid     Valid       Store selected bit in CF flag and set.
 REX.W + 0F BA /5 ib       BTS r/m64, imm8         MI      Valid     N.E.        Store selected bit in CF flag and set.



                                              Instruction Operand Encoding
    Op/En              Operand 1               Operand 2                     Operand 3                      Operand 4
     MR           ModRM:r/m (r, w)            ModRM:reg (r)                     NA                              NA
     MI           ModRM:r/m (r, w)               imm8                           NA                              NA

Description
Selects the bit in a bit string (specified with the first operand, called the bit base) at the bit-position designated by
the bit offset operand (second operand), stores the value of the bit in the CF flag, and sets the selected bit in the
bit string to 1. The bit base operand can be a register or a memory location; the bit offset operand can be a register
or an immediate value:
.    If the bit base operand specifies a register, the instruction takes the modulo 16, 32, or 64 of the bit offset
     operand (modulo size depends on the mode and register size; 64-bit operands are available only in 64-bit
     mode). This allows any bit position to be selected.
.    If the bit base operand specifies a memory location, the operand represents the address of the byte in memory
     that contains the bit base (bit 0 of the specified byte) of the bit string. The range of the bit position that can be
     referenced by the offset operand depends on the operand size.
See also: Bit(BitBase, BitOffset) on page 3-11.
Some assemblers support immediate bit offsets larger than 31 by using the immediate bit offset field in combina-
tion with the displacement field of the memory operand. See "BT-Bit Test" in this chapter for more information on
this addressing mechanism.
This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.
In 64-bit mode, the instruction's default operation size is 32 bits. Using a REX prefix in the form of REX.R permits
access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See
the summary chart at the beginning of this section for encoding data and limits.

Operation
CF <- Bit(BitBase, BitOffset);
Bit(BitBase, BitOffset) <- 1;

Flags Affected
The CF flag contains the value of the selected bit before it is set. The ZF flag is unaffected. The OF, SF, AF, and PF
flags are undefined.





Protected Mode Exceptions
#GP(0)              If the destination operand points to a non-writable segment.
                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                    If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions
#GP                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                 If a memory operand effective address is outside the SS segment limit.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions
#GP                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used but the destination is not a memory operand.






platform: x86_64
mnem: BZHI
description:
BZHI - Zero High Bits Starting with Specified Bit Position
  Opcode/Instruction                  Op/      64/32         CPUID       Description
                                      En       -bit          Feature
                                               Mode          Flag
  VEX.NDS.LZ.0F38.W0 F5 /r            RMV      V/V           BMI2        Zero bits in r/m32 starting with the position in r32b, write result to
  BZHI r32a, r/m32, r32b                                                 r32a.
  VEX.NDS.LZ.0F38.W1 F5 /r            RMV      V/N.E.        BMI2        Zero bits in r/m64 starting with the position in r64b, write result to
  BZHI r64a, r/m64, r64b                                                 r64a.



                                                        Instruction Operand Encoding
   Op/En                Operand 1                            Operand 2                      Operand 3                       Operand 4
    RMV              ModRM:reg (w)                      ModRM:r/m (r)                      VEX.vvvv (r)                         NA

Description
BZHI copies the bits of the first source operand (the second operand) into the destination operand (the first
operand) and clears the higher bits in the destination according to the INDEX value specified by the second source
operand (the third operand). The INDEX is specified by bits 7:0 of the second source operand. The INDEX value is
saturated at the value of OperandSize -1. CF is set, if the number contained in the 8 low bits of the third operand
is greater than OperandSize -1.
This instruction is not supported in real mode and virtual-8086 mode. The operand size is always 32 bits if not in
64-bit mode. In 64-bit mode operand size 64 requires VEX.W1. VEX.W1 is ignored in non-64-bit modes. An
attempt to execute this instruction with VEX.L not equal to 0 will cause #UD.

Operation
N <- SRC2[7:0]
DEST <- SRC1
IF (N < OperandSize)
    DEST[OperandSize-1:N] <- 0
FI
IF (N > OperandSize - 1)
    CF <- 1
ELSE
    CF <- 0
FI

Flags Affected
ZF, CF and SF flags are updated based on the result. OF flag is cleared. AF and PF flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent
BZHI:           unsigned __int32 _bzhi_u32(unsigned __int32 src, unsigned __int32 index);

BZHI:           unsigned __int64 _bzhi_u64(unsigned __int64 src, unsigned __int32 index);

SIMD Floating-Point Exceptions
None

Other Exceptions
See Section 2.5.1, "Exception Conditions for VEX-Encoded GPR Instructions", Table 2-29; additionally
#UD                        If VEX.W = 1.






platform: x86_64
mnem: CALL
description:
CALL-Call Procedure
    Opcode             Instruction          Op/    64-bit    Compat/ Description
                                            En     Mode      Leg Mode
    E8 cw              CALL rel16           M      N.S.      Valid       Call near, relative, displacement relative to next
                                                                         instruction.
    E8 cd              CALL rel32           M      Valid     Valid       Call near, relative, displacement relative to next
                                                                         instruction. 32-bit displacement sign extended to
                                                                         64-bits in 64-bit mode.
    FF /2              CALL r/m16           M      N.E.      Valid       Call near, absolute indirect, address given in r/m16.
    FF /2              CALL r/m32           M      N.E.      Valid       Call near, absolute indirect, address given in r/m32.
    FF /2              CALL r/m64           M      Valid     N.E.        Call near, absolute indirect, address given in r/m64.
    9A cd              CALL ptr16:16        D      Invalid   Valid       Call far, absolute, address given in operand.
    9A cp              CALL ptr16:32        D      Invalid   Valid       Call far, absolute, address given in operand.
    FF /3              CALL m16:16          M      Valid     Valid       Call far, absolute indirect address given in m16:16.
                                                                         In 32-bit mode: if selector points to a gate, then RIP
                                                                         = 32-bit zero extended displacement taken from
                                                                         gate; else RIP = zero extended 16-bit offset from
                                                                         far pointer referenced in the instruction.
    FF /3              CALL m16:32          M      Valid     Valid       In 64-bit mode: If selector points to a gate, then RIP
                                                                         = 64-bit displacement taken from gate; else RIP =
                                                                         zero extended 32-bit offset from far pointer
                                                                         referenced in the instruction.
    REX.W + FF /3      CALL m16:64          M      Valid     N.E.        In 64-bit mode: If selector points to a gate, then RIP
                                                                         = 64-bit displacement taken from gate; else RIP =
                                                                         64-bit offset from far pointer referenced in the
                                                                         instruction.



                                             Instruction Operand Encoding
     Op/En           Operand 1                  Operand 2                  Operand 3                       Operand 4
       D               Offset                      NA                         NA                               NA
       M            ModRM:r/m (r)                  NA                         NA                               NA

Description
Saves procedure linking information on the stack and branches to the called procedure specified using the target
operand. The target operand specifies the address of the first instruction in the called procedure. The operand can
be an immediate value, a general-purpose register, or a memory location.
This instruction can be used to execute four types of calls:
.     Near Call - A call to a procedure in the current code segment (the segment currently pointed to by the CS
      register), sometimes referred to as an intra-segment call.
.     Far Call - A call to a procedure located in a different segment than the current code segment, sometimes
      referred to as an inter-segment call.
.     Inter-privilege-level far call - A far call to a procedure in a segment at a different privilege level than that
      of the currently executing program or procedure.
.     Task switch - A call to a procedure located in a different task.
The latter two call types (inter-privilege-level call and task switch) can only be executed in protected mode. See
"Calling Procedures Using Call and RET" in Chapter 6 of the Intel 64 and IA-32 Architectures Software Devel-
oper's Manual, Volume 1, for additional information on near, far, and inter-privilege-level calls. See Chapter 7,
"Task Management," in the Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A, for infor-
mation on performing task switches with the CALL instruction.



Near Call. When executing a near call, the processor pushes the value of the EIP register (which contains the offset
of the instruction following the CALL instruction) on the stack (for use later as a return-instruction pointer). The
processor then branches to the address in the current code segment specified by the target operand. The target
operand specifies either an absolute offset in the code segment (an offset from the base of the code segment) or a
relative offset (a signed displacement relative to the current value of the instruction pointer in the EIP register; this
value points to the instruction following the CALL instruction). The CS register is not changed on near calls.
For a near call absolute, an absolute offset is specified indirectly in a general-purpose register or a memory location
(r/m16, r/m32, or r/m64). The operand-size attribute determines the size of the target operand (16, 32 or 64
bits). When in 64-bit mode, the operand size for near call (and all near branches) is forced to 64-bits. Absolute
offsets are loaded directly into the EIP(RIP) register. If the operand size attribute is 16, the upper two bytes of the
EIP register are cleared, resulting in a maximum instruction pointer size of 16 bits. When accessing an absolute
offset indirectly using the stack pointer [ESP] as the base register, the base value used is the value of the ESP
before the instruction executes.
A relative offset (rel16 or rel32) is generally specified as a label in assembly code. But at the machine code level, it
is encoded as a signed, 16- or 32-bit immediate value. This value is added to the value in the EIP(RIP) register. In
64-bit mode the relative offset is always a 32-bit immediate value which is sign extended to 64-bits before it is
added to the value in the RIP register for the target calculation. As with absolute offsets, the operand-size attribute
determines the size of the target operand (16, 32, or 64 bits). In 64-bit mode the target operand will always be 64-
bits because the operand size is forced to 64-bits for near branches.
Far Calls in Real-Address or Virtual-8086 Mode. When executing a far call in real- address or virtual-8086 mode, the
processor pushes the current value of both the CS and EIP registers on the stack for use as a return-instruction
pointer. The processor then performs a "far branch" to the code segment and offset specified with the target
operand for the called procedure. The target operand specifies an absolute far address either directly with a pointer
(ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). With the pointer method, the
segment and offset of the called procedure is encoded in the instruction using a 4-byte (16-bit operand size) or 6-
byte (32-bit operand size) far address immediate. With the indirect method, the target operand specifies a memory
location that contains a 4-byte (16-bit operand size) or 6-byte (32-bit operand size) far address. The operand-size
attribute determines the size of the offset (16 or 32 bits) in the far address. The far address is loaded directly into
the CS and EIP registers. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared.
Far Calls in Protected Mode. When the processor is operating in protected mode, the CALL instruction can be used to
perform the following types of far calls:
.   Far call to the same privilege level
.   Far call to a different privilege level (inter-privilege level call)
.   Task switch (far call to another task)
In protected mode, the processor always uses the segment selector part of the far address to access the corre-
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate, task gate, or TSS) and access
rights determine the type of call operation to be performed.
If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,
a general-protection exception is generated.) A far call to the same privilege level in protected mode is very similar
to one carried out in real-address or virtual-8086 mode. The target operand specifies an absolute far address either
directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). The
operand- size attribute determines the size of the offset (16 or 32 bits) in the far address. The new code segment
selector and its descriptor are loaded into CS register; the offset from the instruction is loaded into the EIP register.
A call gate (described in the next paragraph) can also be used to perform a far call to a code segment at the same
privilege level. Using this mechanism provides an extra level of indirection and is the preferred method of making
calls between 16-bit and 32-bit code segments.
When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed
through a call gate. The segment selector specified by the target operand identifies the call gate. The target
operand can specify the call gate segment selector either directly with a pointer (ptr16:16 or ptr16:32) or indirectly
with a memory location (m16:16 or m16:32). The processor obtains the segment selector for the new code
segment and the new instruction pointer (offset) from the call gate descriptor. (The offset from the target operand
is ignored when a call gate is used.)




On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The
segment selector for the new stack segment is specified in the TSS for the currently running task. The branch to
the new code segment occurs after the stack switch. (Note that when using a call gate to perform a far call to a
segment at the same privilege level, no stack switch occurs.) On the new stack, the processor pushes the segment
selector and stack pointer for the calling procedure's stack, an optional set of parameters from the calling proce-
dures stack, and the segment selector and instruction pointer for the calling procedure's code segment. (A value in
the call gate descriptor determines how many parameters to copy to the new stack.) Finally, the processor
branches to the address of the procedure being called within the new code segment.
Executing a task switch with the CALL instruction is similar to executing a call through a call gate. The target
operand specifies the segment selector of the task gate for the new task activated by the switch (the offset in the
target operand is ignored). The task gate in turn points to the TSS for the new task, which contains the segment
selectors for the task's code and stack segments. Note that the TSS also contains the EIP value for the next instruc-
tion that was to be executed before the calling task was suspended. This instruction pointer value is loaded into the
EIP register to re-start the calling task.
The CALL instruction can also specify the segment selector of the TSS directly, which eliminates the indirection of
the task gate. See Chapter 7, "Task Management," in the Intel 64 and IA-32 Architectures Software Developer's
Manual, Volume 3A, for information on the mechanics of a task switch.
When you execute at task switch with a CALL instruction, the nested task flag (NT) is set in the EFLAGS register and
the new TSS's previous task link field is loaded with the old task's TSS selector. Code is expected to suspend this
nested task by executing an IRET instruction which, because the NT flag is set, automatically uses the previous
task link to return to the calling task. (See "Task Linking" in Chapter 7 of the Intel 64 and IA-32 Architectures
Software Developer's Manual, Volume 3A, for information on nested tasks.) Switching tasks with the CALL instruc-
tion differs in this regard from JMP instruction. JMP does not set the NT flag and therefore does not expect an IRET
instruction to suspend the task.
Mixing 16-Bit and 32-Bit Calls. When making far calls between 16-bit and 32-bit code segments, use a call gate. If
the far call is from a 32-bit code segment to a 16-bit code segment, the call should be made from the first 64
KBytes of the 32-bit code segment. This is because the operand-size attribute of the instruction is set to 16, so only
a 16-bit return address offset can be saved. Also, the call should be made using a 16-bit call gate so that 16-bit
values can be pushed on the stack. See Chapter 21, "Mixing 16-Bit and 32-Bit Code," in the Intel 64 and IA-32
Architectures Software Developer's Manual, Volume 3B, for more information.
Far Calls in Compatibility Mode. When the processor is operating in compatibility mode, the CALL instruction can be
used to perform the following types of far calls:
.   Far call to the same privilege level, remaining in compatibility mode
.   Far call to the same privilege level, transitioning to 64-bit mode
.   Far call to a different privilege level (inter-privilege level call), transitioning to 64-bit mode
Note that a CALL instruction can not be used to cause a task switch in compatibility mode since task switches are
not supported in IA-32e mode.
In compatibility mode, the processor always uses the segment selector part of the far address to access the corre-
sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate) and access rights determine
the type of call operation to be performed.
If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,
a general-protection exception is generated.) A far call to the same privilege level in compatibility mode is very
similar to one carried out in protected mode. The target operand specifies an absolute far address either directly
with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32). The operand-size
attribute determines the size of the offset (16 or 32 bits) in the far address. The new code segment selector and its
descriptor are loaded into CS register and the offset from the instruction is loaded into the EIP register. The differ-
ence is that 64-bit mode may be entered. This specified by the L bit in the new code segment descriptor.
Note that a 64-bit call gate (described in the next paragraph) can also be used to perform a far call to a code
segment at the same privilege level. However, using this mechanism requires that the target code segment
descriptor have the L bit set, causing an entry to 64-bit mode.
When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed
through a 64-bit call gate. The segment selector specified by the target operand identifies the call gate. The target



operand can specify the call gate segment selector either directly with a pointer (ptr16:16 or ptr16:32) or indirectly
with a memory location (m16:16 or m16:32). The processor obtains the segment selector for the new code
segment and the new instruction pointer (offset) from the 16-byte call gate descriptor. (The offset from the target
operand is ignored when a call gate is used.)
On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The
segment selector for the new stack segment is set to NULL. The new stack pointer is specified in the TSS for the
currently running task. The branch to the new code segment occurs after the stack switch. (Note that when using
a call gate to perform a far call to a segment at the same privilege level, an implicit stack switch occurs as a result
of entering 64-bit mode. The SS selector is unchanged, but stack segment accesses use a segment base of 0x0,
the limit is ignored, and the default stack size is 64-bits. The full value of RSP is used for the offset, of which the
upper 32-bits are undefined.) On the new stack, the processor pushes the segment selector and stack pointer for
the calling procedure's stack and the segment selector and instruction pointer for the calling procedure's code
segment. (Parameter copy is not supported in IA-32e mode.) Finally, the processor branches to the address of the
procedure being called within the new code segment.
Near/(Far) Calls in 64-bit Mode. When the processor is operating in 64-bit mode, the CALL instruction can be used to
perform the following types of far calls:
.   Far call to the same privilege level, transitioning to compatibility mode
.   Far call to the same privilege level, remaining in 64-bit mode
.   Far call to a different privilege level (inter-privilege level call), remaining in 64-bit mode
Note that in this mode the CALL instruction can not be used to cause a task switch in 64-bit mode since task
switches are not supported in IA-32e mode.
In 64-bit mode, the processor always uses the segment selector part of the far address to access the corresponding
descriptor in the GDT or LDT. The descriptor type (code segment, call gate) and access rights determine the type
of call operation to be performed.
If the selected descriptor is for a code segment, a far call to a code segment at the same privilege level is
performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,
a general-protection exception is generated.) A far call to the same privilege level in 64-bit mode is very similar to
one carried out in compatibility mode. The target operand specifies an absolute far address indirectly with a
memory location (m16:16, m16:32 or m16:64). The form of CALL with a direct specification of absolute far
address is not defined in 64-bit mode. The operand-size attribute determines the size of the offset (16, 32, or 64
bits) in the far address. The new code segment selector and its descriptor are loaded into the CS register; the offset
from the instruction is loaded into the EIP register. The new code segment may specify entry either into compati-
bility or 64-bit mode, based on the L bit value.
A 64-bit call gate (described in the next paragraph) can also be used to perform a far call to a code segment at the
same privilege level. However, using this mechanism requires that the target code segment descriptor have the L
bit set.
When executing an inter-privilege-level far call, the code segment for the procedure being called must be accessed
through a 64-bit call gate. The segment selector specified by the target operand identifies the call gate. The target
operand can only specify the call gate segment selector indirectly with a memory location (m16:16, m16:32 or
m16:64). The processor obtains the segment selector for the new code segment and the new instruction pointer
(offset) from the 16-byte call gate descriptor. (The offset from the target operand is ignored when a call gate is
used.)
On inter-privilege-level calls, the processor switches to the stack for the privilege level of the called procedure. The
segment selector for the new stack segment is set to NULL. The new stack pointer is specified in the TSS for the
currently running task. The branch to the new code segment occurs after the stack switch.
Note that when using a call gate to perform a far call to a segment at the same privilege level, an implicit stack
switch occurs as a result of entering 64-bit mode. The SS selector is unchanged, but stack segment accesses use
a segment base of 0x0, the limit is ignored, and the default stack size is 64-bits. (The full value of RSP is used for
the offset.) On the new stack, the processor pushes the segment selector and stack pointer for the calling proce-
dure's stack and the segment selector and instruction pointer for the calling procedure's code segment. (Parameter
copy is not supported in IA-32e mode.) Finally, the processor branches to the address of the procedure being called
within the new code segment.





Operation
IF near call
    THEN IF near relative call
         THEN
             IF OperandSize = 64
                  THEN
                       tempDEST <- SignExtend(DEST); (* DEST is rel32 *)
                       tempRIP <- RIP + tempDEST;
                       IF stack not large enough for a 8-byte return address
                            THEN #SS(0); FI;
                       Push(RIP);
                       RIP <- tempRIP;
             FI;
             IF OperandSize = 32
                  THEN
                       tempEIP <- EIP + DEST; (* DEST is rel32 *)
                       IF tempEIP is not within code segment limit THEN #GP(0); FI;
                       IF stack not large enough for a 4-byte return address
                            THEN #SS(0); FI;
                       Push(EIP);
                       EIP <- tempEIP;
             FI;
             IF OperandSize = 16
                  THEN
                       tempEIP <- (EIP + DEST) AND 0000FFFFH; (* DEST is rel16 *)
                       IF tempEIP is not within code segment limit THEN #GP(0); FI;
                       IF stack not large enough for a 2-byte return address
                            THEN #SS(0); FI;
                       Push(IP);
                       EIP <- tempEIP;
             FI;
         ELSE (* Near absolute call *)
             IF OperandSize = 64
                  THEN
                       tempRIP <- DEST; (* DEST is r/m64 *)
                       IF stack not large enough for a 8-byte return address
                            THEN #SS(0); FI;
                       Push(RIP);
                       RIP <- tempRIP;
             FI;
             IF OperandSize = 32
                  THEN
                       tempEIP <- DEST; (* DEST is r/m32 *)
                       IF tempEIP is not within code segment limit THEN #GP(0); FI;
                       IF stack not large enough for a 4-byte return address
                            THEN #SS(0); FI;
                       Push(EIP);
                       EIP <- tempEIP;
             FI;
             IF OperandSize = 16
                  THEN
                       tempEIP <- DEST AND 0000FFFFH; (* DEST is r/m16 *)
                       IF tempEIP is not within code segment limit THEN #GP(0); FI;



                        IF stack not large enough for a 2-byte return address
                             THEN #SS(0); FI;
                        Push(IP);
                        EIP <- tempEIP;
                  FI;
     FI;rel/abs
FI; near

IF far call and (PE = 0 or (PE = 1 and VM = 1)) (* Real-address or virtual-8086 mode *)
    THEN
         IF OperandSize = 32
               THEN
                    IF stack not large enough for a 6-byte return address
                         THEN #SS(0); FI;
                    IF DEST[31:16] is not zero THEN #GP(0); FI;
                    Push(CS); (* Padded with 16 high-order bits *)
                    Push(EIP);
                    CS <- DEST[47:32]; (* DEST is ptr16:32 or [m16:32] *)
                    EIP <- DEST[31:0]; (* DEST is ptr16:32 or [m16:32] *)
               ELSE (* OperandSize = 16 *)
                    IF stack not large enough for a 4-byte return address
                         THEN #SS(0); FI;
                    Push(CS);
                    Push(IP);
                    CS <- DEST[31:16]; (* DEST is ptr16:16 or [m16:16] *)
                    EIP <- DEST[15:0]; (* DEST is ptr16:16 or [m16:16]; clear upper 16 bits *)
         FI;
FI;

IF far call and (PE = 1 and VM = 0) (* Protected mode or IA-32e Mode, not virtual-8086 mode*)
    THEN
         IF segment selector in target operand NULL
               THEN #GP(0); FI;
         IF segment selector index not within descriptor table limits
               THEN #GP(new code segment selector); FI;
         Read type and access rights of selected segment descriptor;
         IF IA32_EFER.LMA = 0
               THEN
                    IF segment type is not a conforming or nonconforming code segment, call
                    gate, task gate, or TSS
                         THEN #GP(segment selector); FI;
               ELSE
                    IF segment type is not a conforming or nonconforming code segment or
                    64-bit call gate,
                         THEN #GP(segment selector); FI;
         FI;
         Depending on type and access rights:
               GO TO CONFORMING-CODE-SEGMENT;
               GO TO NONCONFORMING-CODE-SEGMENT;
               GO TO CALL-GATE;
               GO TO TASK-GATE;
               GO TO TASK-STATE-SEGMENT;
FI;




CONFORMING-CODE-SEGMENT:
   IF L bit = 1 and D bit = 1 and IA32_EFER.LMA = 1
        THEN GP(new code segment selector); FI;
   IF DPL > CPL
        THEN #GP(new code segment selector); FI;
   IF segment not present
        THEN #NP(new code segment selector); FI;
   IF stack not large enough for return address
        THEN #SS(0); FI;
   tempEIP <- DEST(Offset);
   IF OperandSize = 16
        THEN
              tempEIP <- tempEIP AND 0000FFFFH; FI; (* Clear upper 16 bits *)
   IF (EFER.LMA = 0 or target mode = Compatibility mode) and (tempEIP outside new code
   segment limit)
        THEN #GP(0); FI;
   IF tempEIP is non-canonical
        THEN #GP(0); FI;
   IF OperandSize = 32
        THEN
              Push(CS); (* Padded with 16 high-order bits *)
              Push(EIP);
              CS <- DEST(CodeSegmentSelector);
              (* Segment descriptor information also loaded *)
              CS(RPL) <- CPL;
              EIP <- tempEIP;
        ELSE
              IF OperandSize = 16
                   THEN
                       Push(CS);
                       Push(IP);
                       CS <- DEST(CodeSegmentSelector);
                       (* Segment descriptor information also loaded *)
                       CS(RPL) <- CPL;
                       EIP <- tempEIP;
                   ELSE (* OperandSize = 64 *)
                       Push(CS); (* Padded with 48 high-order bits *)
                       Push(RIP);
                       CS <- DEST(CodeSegmentSelector);
                       (* Segment descriptor information also loaded *)
                       CS(RPL) <- CPL;
                       RIP <- tempEIP;
              FI;
   FI;
END;

NONCONFORMING-CODE-SEGMENT:
  IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1
       THEN GP(new code segment selector); FI;
  IF (RPL > CPL) or (DPL != CPL)
       THEN #GP(new code segment selector); FI;
  IF segment not present
       THEN #NP(new code segment selector); FI;
  IF stack not large enough for return address



        THEN #SS(0); FI;
   tempEIP <- DEST(Offset);
   IF OperandSize = 16
        THEN tempEIP <- tempEIP AND 0000FFFFH; FI; (* Clear upper 16 bits *)
   IF (EFER.LMA = 0 or target mode = Compatibility mode) and (tempEIP outside new code
   segment limit)
        THEN #GP(0); FI;
   IF tempEIP is non-canonical
        THEN #GP(0); FI;
   IF OperandSize = 32
        THEN
             Push(CS); (* Padded with 16 high-order bits *)
             Push(EIP);
             CS <- DEST(CodeSegmentSelector);
             (* Segment descriptor information also loaded *)
             CS(RPL) <- CPL;
             EIP <- tempEIP;
        ELSE
             IF OperandSize = 16
                  THEN
                      Push(CS);
                      Push(IP);
                      CS <- DEST(CodeSegmentSelector);
                      (* Segment descriptor information also loaded *)
                      CS(RPL) <- CPL;
                      EIP <- tempEIP;
                  ELSE (* OperandSize = 64 *)
                      Push(CS); (* Padded with 48 high-order bits *)
                      Push(RIP);
                      CS <- DEST(CodeSegmentSelector);
                      (* Segment descriptor information also loaded *)
                      CS(RPL) <- CPL;
                      RIP <- tempEIP;
             FI;
   FI;
END;

CALL-GATE:
   IF call gate (DPL < CPL) or (RPL > DPL)
        THEN #GP(call-gate selector); FI;
   IF call gate not present
        THEN #NP(call-gate selector); FI;
   IF call-gate code-segment selector is NULL
        THEN #GP(0); FI;
   IF call-gate code-segment selector index is outside descriptor table limits
        THEN #GP(call-gate code-segment selector); FI;
   Read call-gate code-segment descriptor;
   IF call-gate code-segment descriptor does not indicate a code segment
   or call-gate code-segment descriptor DPL > CPL
        THEN #GP(call-gate code-segment selector); FI;
   IF IA32_EFER.LMA = 1 AND (call-gate code-segment descriptor is
   not a 64-bit code segment or call-gate code-segment descriptor has both L-bit and D-bit set)
        THEN #GP(call-gate code-segment selector); FI;
   IF call-gate code segment not present



        THEN #NP(call-gate code-segment selector); FI;
   IF call-gate code segment is non-conforming and DPL < CPL
        THEN go to MORE-PRIVILEGE;
        ELSE go to SAME-PRIVILEGE;
   FI;
END;

MORE-PRIVILEGE:
  IF current TSS is 32-bit
       THEN
            TSSstackAddress <- (new code-segment DPL * 8) + 4;
            IF (TSSstackAddress + 5) > current TSS limit
                 THEN #TS(current TSS selector); FI;
            NewSS <- 2 bytes loaded from (TSS base + TSSstackAddress + 4);
            NewESP <- 4 bytes loaded from (TSS base + TSSstackAddress);
       ELSE
            IF current TSS is 16-bit
                 THEN
                      TSSstackAddress <- (new code-segment DPL * 4) + 2
                      IF (TSSstackAddress + 3) > current TSS limit
                           THEN #TS(current TSS selector); FI;
                      NewSS <- 2 bytes loaded from (TSS base + TSSstackAddress + 2);
                      NewESP <- 2 bytes loaded from (TSS base + TSSstackAddress);
                 ELSE (* current TSS is 64-bit *)
                      TSSstackAddress <- (new code-segment DPL * 8) + 4;
                      IF (TSSstackAddress + 7) > current TSS limit
                           THEN #TS(current TSS selector); FI;
                      NewSS <- new code-segment DPL; (* NULL selector with RPL = new CPL *)
                      NewRSP <- 8 bytes loaded from (current TSS base + TSSstackAddress);
            FI;
  FI;
  IF IA32_EFER.LMA = 0 and NewSS is NULL
       THEN #TS(NewSS); FI;
  Read new code-segment descriptor and new stack-segment descriptor;
  IF IA32_EFER.LMA = 0 and (NewSS RPL != new code-segment DPL
  or new stack-segment DPL != new code-segment DPL or new stack segment is not a
  writable data segment)
       THEN #TS(NewSS); FI
  IF IA32_EFER.LMA = 0 and new stack segment not present
       THEN #SS(NewSS); FI;
  IF CallGateSize = 32
       THEN
            IF new stack does not have room for parameters plus 16 bytes
                 THEN #SS(NewSS); FI;
            IF CallGate(InstructionPointer) not within new code-segment limit
                 THEN #GP(0); FI;
            SS <- newSS; (* Segment descriptor information also loaded *)
            ESP <- newESP;
            CS:EIP <- CallGate(CS:InstructionPointer);
            (* Segment descriptor information also loaded *)
            Push(oldSS:oldESP); (* From calling procedure *)
            temp <- parameter count from call gate, masked to 5 bits;
            Push(parameters from calling procedure's stack, temp)
            Push(oldCS:oldEIP); (* Return address to calling procedure *)



        ELSE
            IF CallGateSize = 16
                 THEN
                      IF new stack does not have room for parameters plus 8 bytes
                           THEN #SS(NewSS); FI;
                      IF (CallGate(InstructionPointer) AND FFFFH) not in new code-segment limit
                           THEN #GP(0); FI;
                      SS <- newSS; (* Segment descriptor information also loaded *)
                      ESP <- newESP;
                      CS:IP <- CallGate(CS:InstructionPointer);
                      (* Segment descriptor information also loaded *)
                      Push(oldSS:oldESP); (* From calling procedure *)
                      temp <- parameter count from call gate, masked to 5 bits;
                      Push(parameters from calling procedure's stack, temp)
                      Push(oldCS:oldEIP); (* Return address to calling procedure *)
                 ELSE (* CallGateSize = 64 *)
                      IF pushing 32 bytes on the stack would use a non-canonical address
                           THEN #SS(NewSS); FI;
                      IF (CallGate(InstructionPointer) is non-canonical)
                           THEN #GP(0); FI;
                      SS <- NewSS; (* NewSS is NULL)
                      RSP <- NewESP;
                      CS:IP <- CallGate(CS:InstructionPointer);
                      (* Segment descriptor information also loaded *)
                      Push(oldSS:oldESP); (* From calling procedure *)
                      Push(oldCS:oldEIP); (* Return address to calling procedure *)
            FI;
   FI;
   CPL <- CodeSegment(DPL)
   CS(RPL) <- CPL
END;

SAME-PRIVILEGE:
  IF CallGateSize = 32
       THEN
            IF stack does not have room for 8 bytes
                  THEN #SS(0); FI;
            IF CallGate(InstructionPointer) not within code segment limit
                  THEN #GP(0); FI;
            CS:EIP <- CallGate(CS:EIP) (* Segment descriptor information also loaded *)
            Push(oldCS:oldEIP); (* Return address to calling procedure *)
       ELSE
            If CallGateSize = 16
                  THEN
                      IF stack does not have room for 4 bytes
                           THEN #SS(0); FI;
                      IF CallGate(InstructionPointer) not within code segment limit
                           THEN #GP(0); FI;
                      CS:IP <- CallGate(CS:instruction pointer);
                      (* Segment descriptor information also loaded *)
                      Push(oldCS:oldIP); (* Return address to calling procedure *)
                  ELSE (* CallGateSize = 64)
                      IF pushing 16 bytes on the stack touches non-canonical addresses
                           THEN #SS(0); FI;



                      IF RIP non-canonical
                           THEN #GP(0); FI;
                      CS:IP <- CallGate(CS:instruction pointer);
                      (* Segment descriptor information also loaded *)
                      Push(oldCS:oldIP); (* Return address to calling procedure *)
           FI;
   FI;
   CS(RPL) <- CPL
END;

TASK-GATE:
   IF task gate DPL < CPL or RPL
        THEN #GP(task gate selector); FI;
   IF task gate not present
        THEN #NP(task gate selector); FI;
   Read the TSS segment selector in the task-gate descriptor;
   IF TSS segment selector local/global bit is set to local
   or index not within GDT limits
        THEN #GP(TSS selector); FI;
   Access TSS descriptor in GDT;
   IF TSS descriptor specifies that the TSS is busy (low-order 5 bits set to 00001)
        THEN #GP(TSS selector); FI;
   IF TSS not present
        THEN #NP(TSS selector); FI;
   SWITCH-TASKS (with nesting) to TSS;
   IF EIP not within code segment limit
        THEN #GP(0); FI;
END;

TASK-STATE-SEGMENT:
   IF TSS DPL < CPL or RPL
   or TSS descriptor indicates TSS not available
        THEN #GP(TSS selector); FI;
   IF TSS is not present
        THEN #NP(TSS selector); FI;
   SWITCH-TASKS (with nesting) to TSS;
   IF EIP not within code segment limit
        THEN #GP(0); FI;
END;


Flags Affected
All flags are affected if a task switch occurs; no flags are affected if a task switch does not occur.





Protected Mode Exceptions
#GP(0)                If the target offset in destination operand is beyond the new code segment limit.
                      If the segment selector in the destination operand is NULL.
                      If the code segment selector in the gate is NULL.
                      If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                      If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment
                      selector.
#GP(selector)         If a code segment or gate or TSS selector index is outside descriptor table limits.
                      If the segment descriptor pointed to by the segment selector in the destination operand is not
                      for a conforming-code segment, nonconforming-code segment, call gate, task gate, or task
                      state segment.
                      If the DPL for a nonconforming-code segment is not equal to the CPL or the RPL for the
                      segment's segment selector is greater than the CPL.
                      If the DPL for a conforming-code segment is greater than the CPL.
                      If the DPL from a call-gate, task-gate, or TSS segment descriptor is less than the CPL or than
                      the RPL of the call-gate, task-gate, or TSS's segment selector.
                      If the segment descriptor for a segment selector from a call gate does not indicate it is a code
                      segment.
                      If the segment selector from a call gate is beyond the descriptor table limits.
                      If the DPL for a code-segment obtained from a call gate is greater than the CPL.
                      If the segment selector for a TSS has its local/global bit set for local.
                      If a TSS segment descriptor specifies that the TSS is busy or not available.
#SS(0)                If pushing the return address, parameters, or stack segment pointer onto the stack exceeds
                      the bounds of the stack segment, when no stack switch occurs.
                      If a memory operand effective address is outside the SS segment limit.
#SS(selector)         If pushing the return address, parameters, or stack segment pointer onto the stack exceeds
                      the bounds of the stack segment, when a stack switch occurs.
                      If the SS register is being loaded as part of a stack switch and the segment pointed to is
                      marked not present.
                      If stack segment does not have room for the return address, parameters, or stack segment
                      pointer, when stack switch occurs.
#NP(selector)         If a code segment, data segment, stack segment, call gate, task gate, or TSS is not present.
#TS(selector)         If the new stack segment selector and ESP are beyond the end of the TSS.
                      If the new stack segment selector is NULL.
                      If the RPL of the new stack segment selector in the TSS is not equal to the DPL of the code
                      segment being accessed.
                      If DPL of the stack segment descriptor for the new stack segment is not equal to the DPL of the
                      code segment descriptor.
                      If the new stack segment is not a writable data segment.
                      If segment-selector index for stack segment is outside descriptor table limits.
#PF(fault-code)       If a page fault occurs.
#AC(0)                If alignment checking is enabled and an unaligned memory reference is made while the
                      current privilege level is 3.
#UD                   If the LOCK prefix is used.

Real-Address Mode Exceptions
#GP                   If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                      If the target offset is beyond the code segment limit.
#UD                   If the LOCK prefix is used.




Virtual-8086 Mode Exceptions
#GP(0)              If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                    If the target offset is beyond the code segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made.
#UD                 If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.
#GP(selector)       If a memory address accessed by the selector is in non-canonical space.
#GP(0)              If the target offset in the destination operand is non-canonical.

64-Bit Mode Exceptions
#GP(0)              If a memory address is non-canonical.
                    If target offset in destination operand is non-canonical.
                    If the segment selector in the destination operand is NULL.
                    If the code segment selector in the 64-bit gate is NULL.
#GP(selector)       If code segment or 64-bit call gate is outside descriptor table limits.
                    If code segment or 64-bit call gate overlaps non-canonical space.
                    If the segment descriptor pointed to by the segment selector in the destination operand is not
                    for a conforming-code segment, nonconforming-code segment, or 64-bit call gate.
                    If the segment descriptor pointed to by the segment selector in the destination operand is a
                    code segment and has both the D-bit and the L- bit set.
                    If the DPL for a nonconforming-code segment is not equal to the CPL, or the RPL for the
                    segment's segment selector is greater than the CPL.
                    If the DPL for a conforming-code segment is greater than the CPL.
                    If the DPL from a 64-bit call-gate is less than the CPL or than the RPL of the 64-bit call-gate.
                    If the upper type field of a 64-bit call gate is not 0x0.
                    If the segment selector from a 64-bit call gate is beyond the descriptor table limits.
                    If the DPL for a code-segment obtained from a 64-bit call gate is greater than the CPL.
                    If the code segment descriptor pointed to by the selector in the 64-bit gate doesn't have the L-
                    bit set and the D-bit clear.
                    If the segment descriptor for a segment selector from the 64-bit call gate does not indicate it
                    is a code segment.
#SS(0)              If pushing the return offset or CS selector onto the stack exceeds the bounds of the stack
                    segment when no stack switch occurs.
                    If a memory operand effective address is outside the SS segment limit.
                    If the stack address is in a non-canonical form.
#SS(selector)       If pushing the old values of SS selector, stack pointer, EFLAGS, CS selector, offset, or error
                    code onto the stack violates the canonical boundary when a stack switch occurs.
#NP(selector)       If a code segment or 64-bit call gate is not present.
#TS(selector)       If the load of the new RSP exceeds the limit of the TSS.
#UD                 (64-bit mode only) If a far call is direct to an absolute address in memory.
                    If the LOCK prefix is used.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.






platform: x86_64
mnem: CBW
description:
CBW/CWDE/CDQE-Convert Byte to Word/Convert Word to Doubleword/Convert Doubleword to Quadword
Opcode                    Instruction                 Op/     64-bit     Compat/ Description
                                                      En      Mode       Leg Mode
98                        CBW                         NP      Valid      Valid       AX <- sign-extend of AL.
98                        CWDE                        NP      Valid      Valid       EAX <- sign-extend of AX.
REX.W + 98                CDQE                        NP      Valid      N.E.        RAX <- sign-extend of EAX.



                                                Instruction Operand Encoding
  Op/En             Operand 1                     Operand 2                      Operand 3                     Operand 4
     NP                 NA                           NA                             NA                            NA

Description
Double the size of the source operand by means of sign extension. The CBW (convert byte to word) instruction
copies the sign (bit 7) in the source operand into every bit in the AH register. The CWDE (convert word to double-
word) instruction copies the sign (bit 15) of the word in the AX register into the high 16 bits of the EAX register.
CBW and CWDE reference the same opcode. The CBW instruction is intended for use when the operand-size attri-
bute is 16; CWDE is intended for use when the operand-size attribute is 32. Some assemblers may force the
operand size. Others may treat these two mnemonics as synonyms (CBW/CWDE) and use the setting of the
operand-size attribute to determine the size of values to be converted.
In 64-bit mode, the default operation size is the size of the destination register. Use of the REX.W prefix promotes
this instruction (CDQE when promoted) to operate on 64-bit operands. In which case, CDQE copies the sign (bit
31) of the doubleword in the EAX register into the high 32 bits of RAX.

Operation
IF OperandSize = 16 (* Instruction = CBW *)
    THEN
        AX <- SignExtend(AL);
    ELSE IF (OperandSize = 32, Instruction = CWDE)
        EAX <- SignExtend(AX); FI;
    ELSE (* 64-Bit Mode, OperandSize = 64, Instruction = CDQE*)
        RAX <- SignExtend(EAX);
FI;

Flags Affected
None.

Exceptions (All Operating Modes)
#UD                    If the LOCK prefix is used.






platform: x86_64
mnem: CLAC
description:
CLAC-Clear AC Flag in EFLAGS Register
Opcode/                                   Op /    64/32 bit   CPUID     Description
Instruction                               En      Mode        Feature
                                                  Support     Flag
0F 01 CA                                  NP      V/V         SMAP      Clear the AC flag in the EFLAGS register.
CLAC



                                          Instruction Operand Encoding
  Op/En           Operand 1                Operand 2                    Operand 3                      Operand 4
    NP               NA                          NA                        NA                              NA

Description
Clears the AC flag bit in EFLAGS register. This disables any alignment checking of user-mode data accesses. If the
SMAP bit is set in the CR4 register, this disallows explicit supervisor-mode data accesses to user-mode pages.
This instruction's operation is the same in non-64-bit modes and 64-bit mode. Attempts to execute CLAC when
CPL > 0 cause #UD.

Operation
EFLAGS.AC <- 0;

Flags Affected
AC cleared. Other flags are unaffected.

Protected Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If the CPL > 0.
                    If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

Real-Address Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

Virtual-8086 Mode Exceptions
#UD                 The CLAC instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If the CPL > 0.
                    If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

64-Bit Mode Exceptions
#UD                 If the LOCK prefix is used.
                    If the CPL > 0.
                    If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.






platform: x86_64
mnem: CLC
description:
CLC-Clear Carry Flag
 Opcode                    Instruction                 Op/   64-bit   Compat/ Description
                                                       En    Mode     Leg Mode
 F8                        CLC                         NP    Valid    Valid      Clear CF flag.



                                               Instruction Operand Encoding
   Op/En               Operand 1                 Operand 2                    Operand 3                   Operand 4
      NP                  NA                           NA                        NA                          NA

Description
Clears the CF flag in the EFLAGS register. Operation is the same in all modes.

Operation
CF <- 0;

Flags Affected
The CF flag is set to 0. The OF, ZF, SF, AF, and PF flags are unaffected.

Exceptions (All Operating Modes)
#UD                      If the LOCK prefix is used.






platform: x86_64
mnem: CLD
description:
CLD-Clear Direction Flag
Opcode                 Instruction                 Op/   64-bit   Compat/ Description
                                                   En    Mode     Leg Mode
FC                     CLD                         NP    Valid    Valid         Clear DF flag.



                                            Instruction Operand Encoding
  Op/En            Operand 1                 Operand 2                    Operand 3               Operand 4
     NP               NA                           NA                        NA                       NA

Description
Clears the DF flag in the EFLAGS register. When the DF flag is set to 0, string operations increment the index regis-
ters (ESI and/or EDI). Operation is the same in all modes.

Operation
DF <- 0;

Flags Affected
The DF flag is set to 0. The CF, OF, ZF, SF, AF, and PF flags are unaffected.

Exceptions (All Operating Modes)
#UD                  If the LOCK prefix is used.






platform: x86_64
mnem: CLFLUSH
description:
CLFLUSH-Flush Cache Line
 Opcode                    Instruction                 Op/    64-bit      Compat/ Description
                                                       En     Mode        Leg Mode
 0F AE /7                  CLFLUSH m8                  M      Valid       Valid       Flushes cache line containing m8.



                                                 Instruction Operand Encoding
  Op/En             Operand 1                     Operand 2                       Operand 3                    Operand 4
    M             ModRM:r/m (w)                       NA                             NA                            NA

Description
Invalidates from every level of the cache hierarchy in the cache coherence domain the cache line that contains the
linear address specified with the memory operand. If that cache line contains modified data at any level of the
cache hierarchy, that data is written back to memory. The source operand is a byte memory location.
The availability of CLFLUSH is indicated by the presence of the CPUID feature flag CLFSH
(CPUID.01H:EDX[bit 19]). The aligned cache line size affected is also indicated with the CPUID instruction (bits 8
through 15 of the EBX register when the initial value in the EAX register is 1).
The memory attribute of the page containing the affected line has no effect on the behavior of this instruction. It
should be noted that processors are free to speculatively fetch and cache data from system memory regions
assigned a memory-type allowing for speculative reads (such as, the WB, WC, and WT memory types). PREFETCHh
instructions can be used to provide the processor with hints for this speculative behavior. Because this speculative
fetching can occur at any time and is not tied to instruction execution, the CLFLUSH instruction is not ordered with
respect to PREFETCHh instructions or any of the speculative fetching mechanisms (that is, data can be specula-
tively loaded into a cache line just before, during, or after the execution of a CLFLUSH instruction that references
the cache line).
Executions of the CLFLUSH instruction are ordered with respect to each other and with respect to writes, locked
read-modify-write instructions, fence instructions, and executions of CLFLUSHOPT to the same cache line.1 They
are not ordered with respect to executions of CLFLUSHOPT to different cache lines.
The CLFLUSH instruction can be used at all privilege levels and is subject to all permission checking and faults asso-
ciated with a byte load (and in addition, a CLFLUSH instruction is allowed to flush a linear address in an execute-
only segment). Like a load, the CLFLUSH instruction sets the A bit but not the D bit in the page tables.
In some implementations, the CLFLUSH instruction may always cause transactional abort with Transactional
Synchronization Extensions (TSX). The CLFLUSH instruction is not expected to be commonly used inside typical
transactional regions. However, programmers must not rely on CLFLUSH instruction to force a transactional abort,
since whether they cause transactional abort is implementation dependent.
The CLFLUSH instruction was introduced with the SSE2 extensions; however, because it has its own CPUID feature
flag, it can be implemented in IA-32 processors that do not include the SSE2 extensions. Also, detecting the pres-
ence of the SSE2 extensions with the CPUID instruction does not guarantee that the CLFLUSH instruction is imple-
mented in the processor.
CLFLUSH operation is the same in non-64-bit modes and 64-bit mode.

Operation
Flush_Cache_Line(SRC);

Intel C/C++ Compiler Intrinsic Equivalents
CLFLUSH:    void _mm_clflush(void const *p)




1. Earlier versions of this manual specified that executions of the CLFLUSH instruction were ordered only by the MFENCE instruction.
   All processors implementing the CLFLUSH instruction also order it relative to the other operations enumerated above.



Protected Mode Exceptions
#GP(0)              For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
#SS(0)              For an illegal address in the SS segment.
#PF(fault-code)     For a page fault.
#UD                 If CPUID.01H:EDX.CLFSH[bit 19] = 0.
                    If the LOCK prefix is used.
                    If an instruction prefix F2H or F3H is used.

Real-Address Mode Exceptions
#GP                 If any part of the operand lies outside the effective address space from 0 to FFFFH.
#UD                 If CPUID.01H:EDX.CLFSH[bit 19] = 0.
                    If the LOCK prefix is used.
                    If an instruction prefix F2H or F3H is used.

Virtual-8086 Mode Exceptions
Same exceptions as in real address mode.
#PF(fault-code)     For a page fault.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     For a page fault.
#UD                 If CPUID.01H:EDX.CLFSH[bit 19] = 0.
                    If the LOCK prefix is used.
                    If an instruction prefix F2H or F3H is used.






platform: x86_64
mnem: CLFLUSHOPT
description:
CLFLUSHOPT-Flush Cache Line Optimized
 Opcode                   Instruction                Op/     64-bit   Compat/ Description
                                                     En      Mode     Leg Mode
 66 0F AE /7              CLFLUSHOPT m8              M       Valid    Valid       Flushes cache line containing m8.



                                                Instruction Operand Encoding
  Op/En             Operand 1                    Operand 2                    Operand 3                    Operand 4
    M             ModRM:r/m (w)                     NA                           NA                           NA

Description
Invalidates from every level of the cache hierarchy in the cache coherence domain the cache line that contains the
linear address specified with the memory operand. If that cache line contains modified data at any level of the
cache hierarchy, that data is written back to memory. The source operand is a byte memory location.
The availability of CLFLUSHOPT is indicated by the presence of the CPUID feature flag CLFLUSHOPT
(CPUID.(EAX=7,ECX=0):EBX[bit 23]). The aligned cache line size affected is also indicated with the CPUID instruc-
tion (bits 8 through 15 of the EBX register when the initial value in the EAX register is 1).
The memory attribute of the page containing the affected line has no effect on the behavior of this instruction. It
should be noted that processors are free to speculatively fetch and cache data from system memory regions
assigned a memory-type allowing for speculative reads (such as, the WB, WC, and WT memory types). PREFETCHh
instructions can be used to provide the processor with hints for this speculative behavior. Because this speculative
fetching can occur at any time and is not tied to instruction execution, the CLFLUSH instruction is not ordered with
respect to PREFETCHh instructions or any of the speculative fetching mechanisms (that is, data can be specula-
tively loaded into a cache line just before, during, or after the execution of a CLFLUSH instruction that references
the cache line).
Executions of the CLFLUSHOPT instruction are ordered with respect to fence instructions and to locked read-
modify-write instructions; they are also ordered with respect to the following accesses to the cache line being
invalidated: writes, executions of CLFLUSH, and executions of CLFLUSHOPT. They are not ordered with respect to
writes, executions of CLFLUSH, or executions of CLFLUSHOPT that access other cache lines; to enforce ordering
with such an operation, software can insert an SFENCE instruction between CFLUSHOPT and that operation.
The CLFLUSHOPT instruction can be used at all privilege levels and is subject to all permission checking and faults
associated with a byte load (and in addition, a CLFLUSHOPT instruction is allowed to flush a linear address in an
execute-only segment). Like a load, the CLFLUSHOPT instruction sets the A bit but not the D bit in the page tables.
In some implementations, the CLFLUSHOPT instruction may always cause transactional abort with Transactional
Synchronization Extensions (TSX). The CLFLUSHOPT instruction is not expected to be commonly used inside
typical transactional regions. However, programmers must not rely on CLFLUSHOPT instruction to force a transac-
tional abort, since whether they cause transactional abort is implementation dependent.
CLFLUSHOPT operation is the same in non-64-bit modes and 64-bit mode.

Operation
Flush_Cache_Line_Optimized(SRC);

Intel C/C++ Compiler Intrinsic Equivalents
CLFLUSHOPT:void _mm_clflushopt(void const *p)





Protected Mode Exceptions
#GP(0)              For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
#SS(0)              For an illegal address in the SS segment.
#PF(fault-code)     For a page fault.
#UD                 If CPUID.(EAX=7,ECX=0):EBX.CLFLUSHOPT[bit 23] = 0.
                    If the LOCK prefix is used.
                    If an instruction prefix F2H or F3H is used.

Real-Address Mode Exceptions
#GP                 If any part of the operand lies outside the effective address space from 0 to FFFFH.
#UD                 If CPUID.(EAX=7,ECX=0):EBX.CLFLUSHOPT[bit 23] = 0.
                    If the LOCK prefix is used.
                    If an instruction prefix F2H or F3H is used.

Virtual-8086 Mode Exceptions
Same exceptions as in real address mode.
#PF(fault-code)     For a page fault.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     For a page fault.
#UD                 If CPUID.(EAX=7,ECX=0):EBX.CLFLUSHOPT[bit 23] = 0.
                    If the LOCK prefix is used.
                    If an instruction prefix F2H or F3H is used.






platform: x86_64
mnem: CLI
description:
CLI - Clear Interrupt Flag
 Opcode                       Instruction                  Op/    64-bit        Compat/ Description
                                                           En     Mode          Leg Mode
 FA                           CLI                          NP     Valid         Valid         Clear interrupt flag; interrupts disabled when
                                                                                              interrupt flag cleared.



                                                    Instruction Operand Encoding
  Op/En                 Operand 1                     Operand 2                          Operand 3                        Operand 4
      NP                     NA                            NA                                 NA                              NA

Description
If protected-mode virtual interrupts are not enabled, CLI clears the IF flag in the EFLAGS register. No other flags
are affected. Clearing the IF flag causes the processor to ignore maskable external interrupts. The IF flag and the
CLI and STI instruction have no affect on the generation of exceptions and NMI interrupts.
When protected-mode virtual interrupts are enabled, CPL is 3, and IOPL is less than 3; CLI clears the VIF flag in the
EFLAGS register, leaving IF unaffected. Table 3-7 indicates the action of the CLI instruction depending on the
processor operating mode and the CPL/IOPL of the running program or procedure.
Operation is the same in all modes.


                                             Table 3-7. Decision Table for CLI Results
       PE               VM           IOPL            CPL            PVI                 VIP          VME                   CLI Result
           0             X             X              X              X                  X             X         IF = 0
           1             0           >= CPL            X              X                  X             X         IF = 0
           1             0           < CPL            3              1                  X             X         VIF = 0
           1             0           < CPL           <3              X                  X             X         GP Fault
           1             0           < CPL            X              0                  X             X         GP Fault
           1             1             3              X              X                  X             X         IF = 0
           1             1            <3              X              X                  X             1         VIF = 0
           1             1            <3              X              X                  X             0         GP Fault
 NOTES:
 * X = This setting has no impact.

Operation
IF PE = 0
    THEN
         IF <- 0; (* Reset Interrupt Flag *)
    ELSE
         IF VM = 0;
             THEN
                   IF IOPL >= CPL
                        THEN
                              IF <- 0; (* Reset Interrupt Flag *)
                   ELSE
                        IF ((IOPL < CPL) and (CPL = 3) and (PVI = 1))
                              THEN
                                  VIF <- 0; (* Reset Virtual Interrupt Flag *)
                              ELSE
                                  #GP(0);


                       FI;
                  FI;
              ELSE (* VM = 1 *)
                  IF IOPL = 3
                       THEN
                            IF <- 0; (* Reset Interrupt Flag *)
                       ELSE
                            IF (IOPL < 3) AND (VME = 1)
                                  THEN
                                      VIF <- 0; (* Reset Virtual Interrupt Flag *)
                                  ELSE
                                      #GP(0);
                            FI;
                  FI;
        FI;
FI;

Flags Affected
If protected-mode virtual interrupts are not enabled, IF is set to 0 if the CPL is equal to or less than the IOPL; other-
wise, it is not affected. Other flags are unaffected.
When protected-mode virtual interrupts are enabled, CPL is 3, and IOPL is less than 3; CLI clears the VIF flag in the
EFLAGS register, leaving IF unaffected. Other flags are unaffected.

Protected Mode Exceptions
#GP(0)                   If the CPL is greater (has less privilege) than the IOPL of the current program or procedure.
#UD                      If the LOCK prefix is used.

Real-Address Mode Exceptions
#UD                      If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)                   If the CPL is greater (has less privilege) than the IOPL of the current program or procedure.
#UD                      If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#GP(0)                   If the CPL is greater (has less privilege) than the IOPL of the current program or procedure.
#UD                      If the LOCK prefix is used.






platform: x86_64
mnem: CLTS
description:
CLTS-Clear Task-Switched Flag in CR0
 Opcode                     Instruction                Op/    64-bit   Compat/ Description
                                                       En     Mode     Leg Mode
 0F 06                      CLTS                       NP     Valid    Valid       Clears TS flag in CR0.



                                                Instruction Operand Encoding
   Op/En              Operand 1                   Operand 2                    Operand 3                    Operand 4
    NP                    NA                           NA                         NA                           NA

Description
Clears the task-switched (TS) flag in the CR0 register. This instruction is intended for use in operating-system
procedures. It is a privileged instruction that can only be executed at a CPL of 0. It is allowed to be executed in real-
address mode to allow initialization for protected mode.
The processor sets the TS flag every time a task switch occurs. The flag is used to synchronize the saving of FPU
context in multitasking applications. See the description of the TS flag in the section titled "Control Registers" in
Chapter 2 of the Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A, for more information
about this flag.
CLTS operation is the same in non-64-bit modes and 64-bit mode.
See Chapter 25, "VMX Non-Root Operation," of the Intel 64 and IA-32 Architectures Software Developer's
Manual, Volume 3C, for more information about the behavior of this instruction in VMX non-root operation.

Operation
CR0.TS[bit 3] <- 0;

Flags Affected
The TS flag in CR0 register is cleared.

Protected Mode Exceptions
#GP(0)                   If the current privilege level is not 0.
#UD                      If the LOCK prefix is used.

Real-Address Mode Exceptions
#UD                      If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)                   CLTS is not recognized in virtual-8086 mode.
#UD                      If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#GP(0)                   If the CPL is greater than 0.
#UD                      If the LOCK prefix is used.






platform: x86_64
mnem: CLWB
description:
CLWB-Cache Line Write Back
 Opcode/                     Op/      64/32 bit   CPUID          Description
 Instruction                 En       Mode        Feature Flag
                                      Support
 66 0F AE /6                 M        V/V         CLWB           Writes back modified cache line containing m8, and may
 CLWB m8                                                         retain the line in cache hierarchy in non-modified state.


                                             Instruction Operand Encoding1
     Op/En              Operand 1                  Operand 2                   Operand 3                     Operand 4
        M             ModRM:r/m (w)                   NA                          NA                            NA

Description
Writes back to memory the cache line (if modified) that contains the linear address specified with the memory
operand from any level of the cache hierarchy in the cache coherence domain. The line may be retained in the
cache hierarchy in non-modified state. Retaining the line in the cache hierarchy is a performance optimization
(treated as a hint by hardware) to reduce the possibility of cache miss on a subsequent access. Hardware may
choose to retain the line at any of the levels in the cache hierarchy, and in some cases, may invalidate the line from
the cache hierarchy. The source operand is a byte memory location.
The availability of CLWB instruction is indicated by the presence of the CPUID feature flag CLWB (bit 24 of the EBX
register, see "CPUID - CPU Identification" in this chapter). The aligned cache line size affected is also indicated
with the CPUID instruction (bits 8 through 15 of the EBX register when the initial value in the EAX register is 1).
The memory attribute of the page containing the affected line has no effect on the behavior of this instruction. It
should be noted that processors are free to speculatively fetch and cache data from system memory regions that
are assigned a memory-type allowing for speculative reads (such as, the WB, WC, and WT memory types).
PREFETCHh instructions can be used to provide the processor with hints for this speculative behavior. Because this
speculative fetching can occur at any time and is not tied to instruction execution, the CLWB instruction is not
ordered with respect to PREFETCHh instructions or any of the speculative fetching mechanisms (that is, data can
be speculatively loaded into a cache line just before, during, or after the execution of a CLWB instruction that refer-
ences the cache line).
CLWB instruction is ordered only by store-fencing operations. For example, software can use an SFENCE, MFENCE,
XCHG, or LOCK-prefixed instructions to ensure that previous stores are included in the write-back. CLWB instruc-
tion need not be ordered by another CLWB or CLFLUSHOPT instruction. CLWB is implicitly ordered with older stores
executed by the logical processor to the same address.
For usages that require only writing back modified data from cache lines to memory (do not require the line to be
invalidated), and expect to subsequently access the data, software is recommended to use CLWB (with appropriate
fencing) instead of CLFLUSH or CLFLUSHOPT for improved performance.
The CLWB instruction can be used at all privilege levels and is subject to all permission checking and faults associ-
ated with a byte load. Like a load, the CLWB instruction sets the accessed flag but not the dirty flag in the page
tables.
In some implementations, the CLWB instruction may always cause transactional abort with Transactional Synchro-
nization Extensions (TSX). CLWB instruction is not expected to be commonly used inside typical transactional
regions. However, programmers must not rely on CLWB instruction to force a transactional abort, since whether
they cause transactional abort is implementation dependent.

Operation
Cache_Line_Write_Back(m8);

Flags Affected
None.


1. ModRM.MOD != 011B



C/C++ Compiler Intrinsic Equivalent
CLWB void _mm_clwb(void const *p);

Protected Mode Exceptions
#UD                     If the LOCK prefix is used.
                        If CPUID.(EAX=07H, ECX=0H):EBX.CLWB[bit 24] = 0.
#GP(0)                  For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.
#SS(0)                  For an illegal address in the SS segment.
#PF(fault-code)         For a page fault.

Real-Address Mode Exceptions
#UD                     If the LOCK prefix is used.
                        If CPUID.(EAX=07H, ECX=0H):EBX.CLWB[bit 24] = 0.
#GP                     If any part of the operand lies outside the effective address space from 0 to FFFFH.

Virtual-8086 Mode Exceptions
Same exceptions as in real address mode.
#PF(fault-code)         For a page fault.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#UD                     If the LOCK prefix is used.
                        If CPUID.(EAX=07H, ECX=0H):EBX.CLWB[bit 24] = 0.
#SS(0)                  If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)                  If the memory address is in a non-canonical form.
#PF(fault-code)         For a page fault.






platform: x86_64
mnem: CMC
description:
CMC-Complement Carry Flag
Opcode                  Instruction                 Op/   64-bit   Compat/ Description
                                                    En    Mode     Leg Mode
F5                      CMC                         NP    Valid    Valid        Complement CF flag.



                                            Instruction Operand Encoding
  Op/En            Operand 1                 Operand 2                     Operand 3                     Operand 4
     NP               NA                        NA                            NA                             NA

Description
Complements the CF flag in the EFLAGS register. CMC operation is the same in non-64-bit modes and 64-bit mode.

Operation
EFLAGS.CF[bit 0]<- NOT EFLAGS.CF[bit 0];

Flags Affected
The CF flag contains the complement of its original value. The OF, ZF, SF, AF, and PF flags are unaffected.

Exceptions (All Operating Modes)
#UD                   If the LOCK prefix is used.






platform: x86_64
mnem: CMOVcc
description:
CMOVcc-Conditional Move
 Opcode                   Instruction          Op/   64-Bit   Compat/ Description
                                               En    Mode     Leg Mode
 0F 47 /r                 CMOVA r16, r/m16     RM    Valid    Valid    Move if above (CF=0 and ZF=0).
 0F 47 /r                 CMOVA r32, r/m32     RM    Valid    Valid    Move if above (CF=0 and ZF=0).
 REX.W + 0F 47 /r         CMOVA r64, r/m64     RM    Valid    N.E.     Move if above (CF=0 and ZF=0).
 0F 43 /r                 CMOVAE r16, r/m16    RM    Valid    Valid    Move if above or equal (CF=0).
 0F 43 /r                 CMOVAE r32, r/m32    RM    Valid    Valid    Move if above or equal (CF=0).
 REX.W + 0F 43 /r         CMOVAE r64, r/m64    RM    Valid    N.E.     Move if above or equal (CF=0).
 0F 42 /r                 CMOVB r16, r/m16     RM    Valid    Valid    Move if below (CF=1).
 0F 42 /r                 CMOVB r32, r/m32     RM    Valid    Valid    Move if below (CF=1).
 REX.W + 0F 42 /r         CMOVB r64, r/m64     RM    Valid    N.E.     Move if below (CF=1).
 0F 46 /r                 CMOVBE r16, r/m16    RM    Valid    Valid    Move if below or equal (CF=1 or ZF=1).
 0F 46 /r                 CMOVBE r32, r/m32    RM    Valid    Valid    Move if below or equal (CF=1 or ZF=1).
 REX.W + 0F 46 /r         CMOVBE r64, r/m64    RM    Valid    N.E.     Move if below or equal (CF=1 or ZF=1).
 0F 42 /r                 CMOVC r16, r/m16     RM    Valid    Valid    Move if carry (CF=1).
 0F 42 /r                 CMOVC r32, r/m32     RM    Valid    Valid    Move if carry (CF=1).
 REX.W + 0F 42 /r         CMOVC r64, r/m64     RM    Valid    N.E.     Move if carry (CF=1).
 0F 44 /r                 CMOVE r16, r/m16     RM    Valid    Valid    Move if equal (ZF=1).
 0F 44 /r                 CMOVE r32, r/m32     RM    Valid    Valid    Move if equal (ZF=1).
 REX.W + 0F 44 /r         CMOVE r64, r/m64     RM    Valid    N.E.     Move if equal (ZF=1).
 0F 4F /r                 CMOVG r16, r/m16     RM    Valid    Valid    Move if greater (ZF=0 and SF=OF).
 0F 4F /r                 CMOVG r32, r/m32     RM    Valid    Valid    Move if greater (ZF=0 and SF=OF).
 REX.W + 0F 4F /r         CMOVG r64, r/m64     RM    V/N.E.   NA       Move if greater (ZF=0 and SF=OF).
 0F 4D /r                 CMOVGE r16, r/m16    RM    Valid    Valid    Move if greater or equal (SF=OF).
 0F 4D /r                 CMOVGE r32, r/m32    RM    Valid    Valid    Move if greater or equal (SF=OF).
 REX.W + 0F 4D /r         CMOVGE r64, r/m64    RM    Valid    N.E.     Move if greater or equal (SF=OF).
 0F 4C /r                 CMOVL r16, r/m16     RM    Valid    Valid    Move if less (SF!= OF).
 0F 4C /r                 CMOVL r32, r/m32     RM    Valid    Valid    Move if less (SF!= OF).
 REX.W + 0F 4C /r         CMOVL r64, r/m64     RM    Valid    N.E.     Move if less (SF!= OF).
 0F 4E /r                 CMOVLE r16, r/m16    RM    Valid    Valid    Move if less or equal (ZF=1 or SF!= OF).
 0F 4E /r                 CMOVLE r32, r/m32    RM    Valid    Valid    Move if less or equal (ZF=1 or SF!= OF).
 REX.W + 0F 4E /r         CMOVLE r64, r/m64    RM    Valid    N.E.     Move if less or equal (ZF=1 or SF!= OF).
 0F 46 /r                 CMOVNA r16, r/m16    RM    Valid    Valid    Move if not above (CF=1 or ZF=1).
 0F 46 /r                 CMOVNA r32, r/m32    RM    Valid    Valid    Move if not above (CF=1 or ZF=1).
 REX.W + 0F 46 /r         CMOVNA r64, r/m64    RM    Valid    N.E.     Move if not above (CF=1 or ZF=1).
 0F 42 /r                 CMOVNAE r16, r/m16   RM    Valid    Valid    Move if not above or equal (CF=1).
 0F 42 /r                 CMOVNAE r32, r/m32   RM    Valid    Valid    Move if not above or equal (CF=1).
 REX.W + 0F 42 /r         CMOVNAE r64, r/m64   RM    Valid    N.E.     Move if not above or equal (CF=1).
 0F 43 /r                 CMOVNB r16, r/m16    RM    Valid    Valid    Move if not below (CF=0).
 0F 43 /r                 CMOVNB r32, r/m32    RM    Valid    Valid    Move if not below (CF=0).
 REX.W + 0F 43 /r         CMOVNB r64, r/m64    RM    Valid    N.E.     Move if not below (CF=0).
 0F 47 /r                 CMOVNBE r16, r/m16   RM    Valid    Valid    Move if not below or equal (CF=0 and ZF=0).



 Opcode               Instruction          Op/   64-Bit   Compat/ Description
                                           En    Mode     Leg Mode
 0F 47 /r             CMOVNBE r32, r/m32   RM    Valid    Valid    Move if not below or equal (CF=0 and ZF=0).
 REX.W + 0F 47 /r     CMOVNBE r64, r/m64   RM    Valid    N.E.     Move if not below or equal (CF=0 and ZF=0).
 0F 43 /r             CMOVNC r16, r/m16    RM    Valid    Valid    Move if not carry (CF=0).
 0F 43 /r             CMOVNC r32, r/m32    RM    Valid    Valid    Move if not carry (CF=0).
 REX.W + 0F 43 /r     CMOVNC r64, r/m64    RM    Valid    N.E.     Move if not carry (CF=0).
 0F 45 /r             CMOVNE r16, r/m16    RM    Valid    Valid    Move if not equal (ZF=0).
 0F 45 /r             CMOVNE r32, r/m32    RM    Valid    Valid    Move if not equal (ZF=0).
 REX.W + 0F 45 /r     CMOVNE r64, r/m64    RM    Valid    N.E.     Move if not equal (ZF=0).
 0F 4E /r             CMOVNG r16, r/m16    RM    Valid    Valid    Move if not greater (ZF=1 or SF!= OF).
 0F 4E /r             CMOVNG r32, r/m32    RM    Valid    Valid    Move if not greater (ZF=1 or SF!= OF).
 REX.W + 0F 4E /r     CMOVNG r64, r/m64    RM    Valid    N.E.     Move if not greater (ZF=1 or SF!= OF).
 0F 4C /r             CMOVNGE r16, r/m16   RM    Valid    Valid    Move if not greater or equal (SF!= OF).
 0F 4C /r             CMOVNGE r32, r/m32   RM    Valid    Valid    Move if not greater or equal (SF!= OF).
 REX.W + 0F 4C /r     CMOVNGE r64, r/m64   RM    Valid    N.E.     Move if not greater or equal (SF!= OF).
 0F 4D /r             CMOVNL r16, r/m16    RM    Valid    Valid    Move if not less (SF=OF).
 0F 4D /r             CMOVNL r32, r/m32    RM    Valid    Valid    Move if not less (SF=OF).
 REX.W + 0F 4D /r     CMOVNL r64, r/m64    RM    Valid    N.E.     Move if not less (SF=OF).
 0F 4F /r             CMOVNLE r16, r/m16   RM    Valid    Valid    Move if not less or equal (ZF=0 and SF=OF).
 0F 4F /r             CMOVNLE r32, r/m32   RM    Valid    Valid    Move if not less or equal (ZF=0 and SF=OF).
 REX.W + 0F 4F /r     CMOVNLE r64, r/m64   RM    Valid    N.E.     Move if not less or equal (ZF=0 and SF=OF).
 0F 41 /r             CMOVNO r16, r/m16    RM    Valid    Valid    Move if not overflow (OF=0).
 0F 41 /r             CMOVNO r32, r/m32    RM    Valid    Valid    Move if not overflow (OF=0).
 REX.W + 0F 41 /r     CMOVNO r64, r/m64    RM    Valid    N.E.     Move if not overflow (OF=0).
 0F 4B /r             CMOVNP r16, r/m16    RM    Valid    Valid    Move if not parity (PF=0).
 0F 4B /r             CMOVNP r32, r/m32    RM    Valid    Valid    Move if not parity (PF=0).
 REX.W + 0F 4B /r     CMOVNP r64, r/m64    RM    Valid    N.E.     Move if not parity (PF=0).
 0F 49 /r             CMOVNS r16, r/m16    RM    Valid    Valid    Move if not sign (SF=0).
 0F 49 /r             CMOVNS r32, r/m32    RM    Valid    Valid    Move if not sign (SF=0).
 REX.W + 0F 49 /r     CMOVNS r64, r/m64    RM    Valid    N.E.     Move if not sign (SF=0).
 0F 45 /r             CMOVNZ r16, r/m16    RM    Valid    Valid    Move if not zero (ZF=0).
 0F 45 /r             CMOVNZ r32, r/m32    RM    Valid    Valid    Move if not zero (ZF=0).
 REX.W + 0F 45 /r     CMOVNZ r64, r/m64    RM    Valid    N.E.     Move if not zero (ZF=0).
 0F 40 /r             CMOVO r16, r/m16     RM    Valid    Valid    Move if overflow (OF=1).
 0F 40 /r             CMOVO r32, r/m32     RM    Valid    Valid    Move if overflow (OF=1).
 REX.W + 0F 40 /r     CMOVO r64, r/m64     RM    Valid    N.E.     Move if overflow (OF=1).
 0F 4A /r             CMOVP r16, r/m16     RM    Valid    Valid    Move if parity (PF=1).
 0F 4A /r             CMOVP r32, r/m32     RM    Valid    Valid    Move if parity (PF=1).
 REX.W + 0F 4A /r     CMOVP r64, r/m64     RM    Valid    N.E.     Move if parity (PF=1).
 0F 4A /r             CMOVPE r16, r/m16    RM    Valid    Valid    Move if parity even (PF=1).
 0F 4A /r             CMOVPE r32, r/m32    RM    Valid    Valid    Move if parity even (PF=1).
 REX.W + 0F 4A /r     CMOVPE r64, r/m64    RM    Valid    N.E.     Move if parity even (PF=1).



 Opcode                   Instruction                    Op/    64-Bit   Compat/ Description
                                                         En     Mode     Leg Mode
 0F 4B /r                 CMOVPO r16, r/m16              RM     Valid    Valid       Move if parity odd (PF=0).
 0F 4B /r                 CMOVPO r32, r/m32              RM     Valid    Valid       Move if parity odd (PF=0).
 REX.W + 0F 4B /r         CMOVPO r64, r/m64              RM     Valid    N.E.        Move if parity odd (PF=0).
 0F 48 /r                 CMOVS r16, r/m16               RM     Valid    Valid       Move if sign (SF=1).
 0F 48 /r                 CMOVS r32, r/m32               RM     Valid    Valid       Move if sign (SF=1).
 REX.W + 0F 48 /r         CMOVS r64, r/m64               RM     Valid    N.E.        Move if sign (SF=1).
 0F 44 /r                 CMOVZ r16, r/m16               RM     Valid    Valid       Move if zero (ZF=1).
 0F 44 /r                 CMOVZ r32, r/m32               RM     Valid    Valid       Move if zero (ZF=1).
 REX.W + 0F 44 /r         CMOVZ r64, r/m64               RM     Valid    N.E.        Move if zero (ZF=1).



                                                   Instruction Operand Encoding
  Op/En             Operand 1                       Operand 2                    Operand 3                    Operand 4
    RM           ModRM:reg (r, w)                  ModRM:r/m (r)                    NA                            NA

Description
The CMOVcc instructions check the state of one or more of the status flags in the EFLAGS register (CF, OF, PF, SF,
and ZF) and perform a move operation if the flags are in a specified state (or condition). A condition code (cc) is
associated with each instruction to indicate the condition being tested for. If the condition is not satisfied, a move
is not performed and execution continues with the instruction following the CMOVcc instruction.
These instructions can move 16-bit, 32-bit or 64-bit values from memory to a general-purpose register or from one
general-purpose register to another. Conditional moves of 8-bit register operands are not supported.
The condition for each CMOVcc mnemonic is given in the description column of the above table. The terms "less"
and "greater" are used for comparisons of signed integers and the terms "above" and "below" are used for
unsigned integers.
Because a particular state of the status flags can sometimes be interpreted in two ways, two mnemonics are
defined for some opcodes. For example, the CMOVA (conditional move if above) instruction and the CMOVNBE
(conditional move if not below or equal) instruction are alternate mnemonics for the opcode 0F 47H.
The CMOVcc instructions were introduced in P6 family processors; however, these instructions may not be
supported by all IA-32 processors. Software can determine if the CMOVcc instructions are supported by checking
the processor's feature information with the CPUID instruction (see "CPUID-CPU Identification" in this chapter).
In 64-bit mode, the instruction's default operation size is 32 bits. Use of the REX.R prefix permits access to addi-
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the
beginning of this section for encoding data and limits.

Operation
temp <- SRC

IF condition TRUE
    THEN
         DEST <- temp;
    FI;
ELSE
    IF (OperandSize = 32 and IA-32e mode active)
         THEN
              DEST[63:32] <- 0;
    FI;
FI;



Flags Affected
None.

Protected Mode Exceptions
#GP(0)              If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                    If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used.

Real-Address Mode Exceptions
#GP                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                 If a memory operand effective address is outside the SS segment limit.
#UD                 If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)              If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made.
#UD                 If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used.






platform: x86_64
mnem: CMP
description:
CMP-Compare Two Operands
Opcode                     Instruction                 Op/     64-Bit      Compat/ Description
                                                       En      Mode        Leg Mode
3C ib                      CMP AL, imm8                I       Valid       Valid       Compare imm8 with AL.
3D iw                      CMP AX, imm16               I       Valid       Valid       Compare imm16 with AX.
3D id                      CMP EAX, imm32              I       Valid       Valid       Compare imm32 with EAX.
REX.W + 3D id              CMP RAX, imm32              I       Valid       N.E.        Compare imm32 sign-extended to 64-bits
                                                                                       with RAX.
80 /7 ib                   CMP r/m8, imm8              MI      Valid       Valid       Compare imm8 with r/m8.
REX + 80 /7 ib             CMP r/m8*, imm8             MI      Valid       N.E.        Compare imm8 with r/m8.
81 /7 iw                   CMP r/m16, imm16            MI      Valid       Valid       Compare imm16 with r/m16.
81 /7 id                   CMP r/m32, imm32            MI      Valid       Valid       Compare imm32 with r/m32.
REX.W + 81 /7 id           CMP r/m64, imm32            MI      Valid       N.E.        Compare imm32 sign-extended to 64-bits
                                                                                       with r/m64.
83 /7 ib                   CMP r/m16, imm8             MI      Valid       Valid       Compare imm8 with r/m16.
83 /7 ib                   CMP r/m32, imm8             MI      Valid       Valid       Compare imm8 with r/m32.
REX.W + 83 /7 ib           CMP r/m64, imm8             MI      Valid       N.E.        Compare imm8 with r/m64.
38 /r                      CMP r/m8, r8                MR      Valid       Valid       Compare r8 with r/m8.
                                       *   *
REX + 38 /r                CMP r/m8 , r8               MR      Valid       N.E.        Compare r8 with r/m8.
39 /r                      CMP r/m16, r16              MR      Valid       Valid       Compare r16 with r/m16.
39 /r                      CMP r/m32, r32              MR      Valid       Valid       Compare r32 with r/m32.
REX.W + 39 /r              CMP r/m64,r64               MR      Valid       N.E.        Compare r64 with r/m64.
3A /r                      CMP r8, r/m8                RM      Valid       Valid       Compare r/m8 with r8.
                                   *       *
REX + 3A /r                CMP r8 , r/m8               RM      Valid       N.E.        Compare r/m8 with r8.
3B /r                      CMP r16, r/m16              RM      Valid       Valid       Compare r/m16 with r16.
3B /r                      CMP r32, r/m32              RM      Valid       Valid       Compare r/m32 with r32.
REX.W + 3B /r              CMP r64, r/m64              RM      Valid       N.E.        Compare r/m64 with r64.
NOTES:
* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.



                                                 Instruction Operand Encoding
  Op/En             Operand 1                      Operand 2                       Operand 3                     Operand 4
    RM             ModRM:reg (r)                 ModRM:r/m (r)                        NA                             NA
    MR             ModRM:r/m (r)                 ModRM:reg (r)                        NA                             NA
    MI             ModRM:r/m (r)                     imm8                             NA                             NA
     I           AL/AX/EAX/RAX (r)                   imm8                             NA                             NA

Description
Compares the first source operand with the second source operand and sets the status flags in the EFLAGS register
according to the results. The comparison is performed by subtracting the second operand from the first operand
and then setting the status flags in the same manner as the SUB instruction. When an immediate value is used as
an operand, it is sign-extended to the length of the first operand.
The condition codes used by the Jcc, CMOVcc, and SETcc instructions are based on the results of a CMP instruction.
Appendix B, "EFLAGS Condition Codes," in the Intel 64 and IA-32 Architectures Software Developer's Manual,
Volume 1, shows the relationship of the status flags and the condition codes.



In 64-bit mode, the instruction's default operation size is 32 bits. Use of the REX.R prefix permits access to addi-
tional registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the
beginning of this section for encoding data and limits.

Operation
temp <- SRC1 - SignExtend(SRC2);
ModifyStatusFlags; (* Modify status flags in the same manner as the SUB instruction*)

Flags Affected
The CF, OF, SF, ZF, AF, and PF flags are set according to the result.

Protected Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                       If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made while the
                       current privilege level is 3.
#UD                    If the LOCK prefix is used.

Real-Address Mode Exceptions
#GP                    If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                    If a memory operand effective address is outside the SS segment limit.

Virtual-8086 Mode Exceptions
#GP(0)                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)                 If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made.
#UD                    If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)                 If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)                 If the memory address is in a non-canonical form.
#PF(fault-code)        If a page fault occurs.
#AC(0)                 If alignment checking is enabled and an unaligned memory reference is made while the
                       current privilege level is 3.
#UD                    If the LOCK prefix is used.






platform: x86_64
mnem: CMPPD
description:
CMPPD-Compare Packed Double-Precision Floating-Point Values
 Opcode/                                    Op /     64/32        CPUID      Description
 Instruction                                En       bit Mode     Feature
                                                     Support      Flag
 66 0F C2 /r ib                             RMI      V/V          SSE2       Compare packed double-precision floating-point values
 CMPPD xmm1, xmm2/m128, imm8                                                 in xmm2/m128 and xmm1 using bits 2:0 of imm8 as a
                                                                             comparison predicate.
 VEX.NDS.128.66.0F.WIG C2 /r ib             RVMI     V/V          AVX        Compare packed double-precision floating-point values
 VCMPPD xmm1, xmm2, xmm3/m128,                                               in xmm3/m128 and xmm2 using bits 4:0 of imm8 as a
 imm8                                                                        comparison predicate.
 VEX.NDS.256.66.0F.WIG C2 /r ib             RVMI     V/V          AVX        Compare packed double-precision floating-point values
 VCMPPD ymm1, ymm2, ymm3/m256,                                               in ymm3/m256 and ymm2 using bits 4:0 of imm8 as a
 imm8                                                                        comparison predicate.
 EVEX.NDS.128.66.0F.W1 C2 /r ib             FV       V/V          AVX512VL   Compare packed double-precision floating-point values
 VCMPPD k1 {k2}, xmm2,                                            AVX512F    in xmm3/m128/m64bcst and xmm2 using bits 4:0 of
 xmm3/m128/m64bcst, imm8                                                     imm8 as a comparison predicate with writemask k2
                                                                             and leave the result in mask register k1.
 EVEX.NDS.256.66.0F.W1 C2 /r ib             FV       V/V          AVX512VL   Compare packed double-precision floating-point values
 VCMPPD k1 {k2}, ymm2,                                            AVX512F    in ymm3/m256/m64bcst and ymm2 using bits 4:0 of
 ymm3/m256/m64bcst, imm8                                                     imm8 as a comparison predicate with writemask k2
                                                                             and leave the result in mask register k1.
 EVEX.NDS.512.66.0F.W1 C2 /r ib             FV       V/V          AVX512F    Compare packed double-precision floating-point values
 VCMPPD k1 {k2}, zmm2,                                                       in zmm3/m512/m64bcst and zmm2 using bits 4:0 of
 zmm3/m512/m64bcst{sae}, imm8                                                imm8 as a comparison predicate with writemask k2
                                                                             and leave the result in mask register k1.



                                                   Instruction Operand Encoding
      Op/En                Operand 1                       Operand 2              Operand 3                    Operand 4
       RMI              ModRM:reg (r, w)               ModRM:r/m (r)                Imm8                          NA
      RVMI               ModRM:reg (w)                     VEX.vvvv             ModRM:r/m (r)                    Imm8
       FV                ModRM:reg (w)                   EVEX.vvvv              ModRM:r/m (r)                    Imm8

Description
Performs a SIMD compare of the packed double-precision floating-point values in the second source operand and
the first source operand and returns the results of the comparison to the destination operand. The comparison
predicate operand (immediate byte) specifies the type of comparison performed on each pair of packed values in
the two source operands.
EVEX encoded versions: The first source operand (second operand) is a ZMM/YMM/XMM register. The second
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector
broadcasted from a 64-bit memory location. The destination operand (first operand) is an opmask register.
Comparison results are written to the destination operand under the writemask k2. Each comparison result is a
single mask bit of 1 (comparison true) or 0 (comparison false).
VEX.256 encoded version: The first source operand (second operand) is a YMM register. The second source
operand (third operand) can be a YMM register or a 256-bit memory location. The destination operand (first
operand) is a YMM register. Four comparisons are performed with results written to the destination operand. The
result of each comparison is a quadword mask of all 1s (comparison true) or all 0s (comparison false).
128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The
second source operand (second operand) can be an XMM register or 128-bit memory location. Bits (MAX_VL-
1:128) of the corresponding ZMM destination register remain unchanged. Two comparisons are performed with
results written to bits 127:0 of the destination operand. The result of each comparison is a quadword mask of all
1s (comparison true) or all 0s (comparison false).





VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source
operand (third operand) can be an XMM register or a 128-bit memory location. Bits (MAX_VL-1:128) of the desti-
nation ZMM register are zeroed. Two comparisons are performed with results written to bits 127:0 of the destina-
tion operand.
The comparison predicate operand is an 8-bit immediate:
.   For instructions encoded using the VEX or EVEX prefix, bits 4:0 define the type of comparison to be performed
    (see Table 3-1). Bits 5 through 7 of the immediate are reserved.
.   For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see the
    first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved.


                         Table 3-1. Comparison Predicate for CMPPD and CMPPS Instructions
Predicate          imm8     Description                                     Result: A Is 1st Operand, B Is 2nd Operand Signals
                   Value                                                                                               #IA on
                                                                            A >B        A<B      A=B        Unordered1 QNAN

EQ_OQ (EQ)         0H       Equal (ordered, non-signaling)                  False       False     True       False          No
LT_OS (LT)         1H       Less-than (ordered, signaling)                  False       True      False      False          Yes
LE_OS (LE)         2H       Less-than-or-equal (ordered, signaling)         False       True      True       False          Yes
UNORD_Q (UNORD) 3H          Unordered (non-signaling)                       False       False     False      True           No
NEQ_UQ (NEQ)       4H       Not-equal (unordered, non-signaling)            True        True      False      True           No
NLT_US (NLT)       5H       Not-less-than (unordered, signaling)            True        False     True       True           Yes
NLE_US (NLE)       6H       Not-less-than-or-equal (unordered, signaling)   True        False     False      True           Yes
ORD_Q (ORD)        7H       Ordered (non-signaling)                         True        True      True       False          No
EQ_UQ              8H       Equal (unordered, non-signaling)                False       False     True       True           No
NGE_US (NGE)       9H       Not-greater-than-or-equal (unordered,           False       True      False      True           Yes
                            signaling)
NGT_US (NGT)       AH       Not-greater-than (unordered, signaling)         False       True      True       True           Yes
FALSE_OQ(FALSE)    BH       False (ordered, non-signaling)                  False       False     False      False          No
NEQ_OQ             CH       Not-equal (ordered, non-signaling)              True        True      False      False          No
GE_OS (GE)         DH       Greater-than-or-equal (ordered, signaling)      True        False     True        False         Yes
GT_OS (GT)         EH       Greater-than (ordered, signaling)               True        False     False      False          Yes
TRUE_UQ(TRUE)      FH       True (unordered, non-signaling)                 True        True      True       True           No
EQ_OS              10H      Equal (ordered, signaling)                      False       False     True       False          Yes
LT_OQ              11H      Less-than (ordered, nonsignaling)               False       True      False      False          No
LE_OQ              12H      Less-than-or-equal (ordered, nonsignaling)      False       True      True       False          No
UNORD_S            13H      Unordered (signaling)                           False       False     False      True           Yes
NEQ_US             14H      Not-equal (unordered, signaling)                True        True      False      True           Yes
NLT_UQ             15H      Not-less-than (unordered, nonsignaling)         True        False     True       True           No
NLE_UQ             16H      Not-less-than-or-equal (unordered, nonsig-      True        False     False      True           No
                            naling)
ORD_S              17H      Ordered (signaling)                             True        True      True       False          Yes


EQ_US              18H      Equal (unordered, signaling)                    False       False     True       True           Yes
NGE_UQ             19H      Not-greater-than-or-equal (unordered, non-      False       True      False      True           No
                            signaling)




                      Table 3-1. Comparison Predicate for CMPPD and CMPPS Instructions (Contd.)
    Predicate          imm8    Description                                  Result: A Is 1st Operand, B Is 2nd Operand Signals
                       Value                                                                                           #IA on
                                                                            A >B        A<B      A=B        Unordered1 QNAN

    NGT_UQ             1AH     Not-greater-than (unordered, nonsignaling)   False     True     True      True          No
    FALSE_OS           1BH     False (ordered, signaling)                   False     False    False     False         Yes
    NEQ_OS             1CH     Not-equal (ordered, signaling)               True      True     False     False         Yes
    GE_OQ              1DH     Greater-than-or-equal (ordered, nonsignal-   True      False    True      False         No
                               ing)
    GT_OQ              1EH     Greater-than (ordered, nonsignaling)         True      False    False     False         No
    TRUE_US            1FH     True (unordered, signaling)                  True      True     True      True          Yes


NOTES:
1. If either operand A or B is a NAN.

The unordered relationship is true when at least one of the two source operands being compared is a NaN; the
ordered relationship is true when neither source operand is a NaN.
A subsequent computational instruction that uses the mask result in the destination operand as an input operand
will not generate an exception, because a mask of all 0s corresponds to a floating-point value of +0.0 and a mask
of all 1s corresponds to a QNaN.
Note that processors with "CPUID.1H:ECX.AVX =0" do not implement the "greater-than", "greater-than-or-equal",
"not-greater than", and "not-greater-than-or-equal relations" predicates. These comparisons can be made either
by using the inverse relationship (that is, use the "not-less-than-or-equal" to make a "greater-than" comparison)
or by using software emulation. When using software emulation, the program must swap the operands (copying
registers when necessary to protect the data that will now be in the destination), and then perform the compare
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7
(Intel 64 and IA-32 Architectures Software Developer's Manual Volume 2A) under the heading Emulation.
Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand
CMPPD instruction, for processors with "CPUID.1H:ECX.AVX =0". See Table 3-2. Compiler should treat reserved
Imm8 values as illegal syntax.
                                       Table 3-2. Pseudo-Op and CMPPD Implementation
:




    Pseudo-Op                                                         CMPPD Implementation
    CMPEQPD xmm1, xmm2                                                CMPPD xmm1, xmm2, 0
    CMPLTPD xmm1, xmm2                                                CMPPD xmm1, xmm2, 1
    CMPLEPD xmm1, xmm2                                                CMPPD xmm1, xmm2, 2
    CMPUNORDPD xmm1, xmm2                                             CMPPD xmm1, xmm2, 3
    CMPNEQPD xmm1, xmm2                                               CMPPD xmm1, xmm2, 4
    CMPNLTPD xmm1, xmm2                                               CMPPD xmm1, xmm2, 5
    CMPNLEPD xmm1, xmm2                                               CMPPD xmm1, xmm2, 6
    CMPORDPD xmm1, xmm2                                               CMPPD xmm1, xmm2, 7

The greater-than relations that the processor does not implement require more than one instruction to emulate in
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to
the correct destination register and that the source operand is left intact.)
Processors with "CPUID.1H:ECX.AVX =1" implement the full complement of 32 predicates shown in Table 3-3, soft-
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand
pseudo-ops in addition to the four-operand VCMPPD instruction. See Table 3-3, where the notations of reg1 reg2,
and reg3 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal



syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter-
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPPD instructions
in a similar fashion by extending the syntax listed in Table 3-3.
                                     Table 3-3. Pseudo-Op and VCMPPD Implementation
:




    Pseudo-Op                                                CMPPD Implementation
    VCMPEQPD reg1, reg2, reg3                                VCMPPD reg1, reg2, reg3, 0
    VCMPLTPD reg1, reg2, reg3                                VCMPPD reg1, reg2, reg3, 1
    VCMPLEPD reg1, reg2, reg3                                VCMPPD reg1, reg2, reg3, 2
    VCMPUNORDPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 3
    VCMPNEQPD reg1, reg2, reg3                               VCMPPD reg1, reg2, reg3, 4
    VCMPNLTPD reg1, reg2, reg3                               VCMPPD reg1, reg2, reg3, 5
    VCMPNLEPD reg1, reg2, reg3                               VCMPPD reg1, reg2, reg3, 6
    VCMPORDPD reg1, reg2, reg3                               VCMPPD reg1, reg2, reg3, 7
    VCMPEQ_UQPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 8
    VCMPNGEPD reg1, reg2, reg3                               VCMPPD reg1, reg2, reg3, 9
    VCMPNGTPD reg1, reg2, reg3                               VCMPPD reg1, reg2, reg3, 0AH
    VCMPFALSEPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 0BH
    VCMPNEQ_OQPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 0CH
    VCMPGEPD reg1, reg2, reg3                                VCMPPD reg1, reg2, reg3, 0DH
    VCMPGTPD reg1, reg2, reg3                                VCMPPD reg1, reg2, reg3, 0EH
    VCMPTRUEPD reg1, reg2, reg3                              VCMPPD reg1, reg2, reg3, 0FH
    VCMPEQ_OSPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 10H
    VCMPLT_OQPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 11H
    VCMPLE_OQPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 12H
    VCMPUNORD_SPD reg1, reg2, reg3                           VCMPPD reg1, reg2, reg3, 13H
    VCMPNEQ_USPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 14H
    VCMPNLT_UQPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 15H
    VCMPNLE_UQPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 16H
    VCMPORD_SPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 17H
    VCMPEQ_USPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 18H
    VCMPNGE_UQPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 19H
    VCMPNGT_UQPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 1AH
    VCMPFALSE_OSPD reg1, reg2, reg3                          VCMPPD reg1, reg2, reg3, 1BH
    VCMPNEQ_OSPD reg1, reg2, reg3                            VCMPPD reg1, reg2, reg3, 1CH
    VCMPGE_OQPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 1DH
    VCMPGT_OQPD reg1, reg2, reg3                             VCMPPD reg1, reg2, reg3, 1EH
    VCMPTRUE_USPD reg1, reg2, reg3                           VCMPPD reg1, reg2, reg3, 1FH





Operation
CASE (COMPARISON PREDICATE) OF
0: OP3 <- EQ_OQ; OP5 <- EQ_OQ;
    1: OP3 <- LT_OS; OP5 <- LT_OS;
    2: OP3 <- LE_OS; OP5 <- LE_OS;
    3: OP3 <- UNORD_Q; OP5 <- UNORD_Q;
    4: OP3 <- NEQ_UQ; OP5 <- NEQ_UQ;
    5: OP3 <- NLT_US; OP5 <- NLT_US;
    6: OP3 <- NLE_US; OP5 <- NLE_US;
    7: OP3 <- ORD_Q; OP5 <- ORD_Q;
    8: OP5 <- EQ_UQ;
    9: OP5 <- NGE_US;
    10: OP5 <- NGT_US;
    11: OP5 <- FALSE_OQ;
    12: OP5 <- NEQ_OQ;
    13: OP5 <- GE_OS;
    14: OP5 <- GT_OS;
    15: OP5 <- TRUE_UQ;
    16: OP5 <- EQ_OS;
    17: OP5 <- LT_OQ;
    18: OP5 <- LE_OQ;
    19: OP5 <- UNORD_S;
    20: OP5 <- NEQ_US;
    21: OP5 <- NLT_UQ;
    22: OP5 <- NLE_UQ;
    23: OP5 <- ORD_S;
    24: OP5 <- EQ_US;
    25: OP5 <- NGE_UQ;
    26: OP5 <- NGT_UQ;
    27: OP5 <- FALSE_OS;
    28: OP5 <- NEQ_OS;
    29: OP5 <- GE_OQ;
    30: OP5 <- GT_OQ;
    31: OP5 <- TRUE_US;
    DEFAULT: Reserved;
ESAC;





VCMPPD (EVEX encoded versions)
(KL, VL) = (2, 128), (4, 256), (8, 512)
FOR j <- 0 TO KL-1
    i <- j * 64
    IF k2[j] OR *no writemask*
         THEN
               IF (EVEX.b = 1) AND (SRC2 *is memory*)
                    THEN
                         CMP <- SRC1[i+63:i] OP5 SRC2[63:0]
                    ELSE
                         CMP <- SRC1[i+63:i] OP5 SRC2[i+63:i]
               FI;
               IF CMP = TRUE
                    THEN DEST[j] <- 1;
                    ELSE DEST[j] <- 0; FI;
         ELSE       DEST[j] <- 0            ; zeroing-masking only
    FI;
ENDFOR
DEST[MAX_KL-1:KL] <- 0

VCMPPD (VEX.256 encoded version)
CMP0 <- SRC1[63:0] OP5 SRC2[63:0];
CMP1 <- SRC1[127:64] OP5 SRC2[127:64];
CMP2 <- SRC1[191:128] OP5 SRC2[191:128];
CMP3 <- SRC1[255:192] OP5 SRC2[255:192];
IF CMP0 = TRUE
    THEN DEST[63:0] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[63:0] <- 0000000000000000H; FI;
IF CMP1 = TRUE
    THEN DEST[127:64] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[127:64] <- 0000000000000000H; FI;
IF CMP2 = TRUE
    THEN DEST[191:128] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[191:128] <- 0000000000000000H; FI;
IF CMP3 = TRUE
    THEN DEST[255:192] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[255:192] <- 0000000000000000H; FI;
DEST[MAX_VL-1:256] <- 0

VCMPPD (VEX.128 encoded version)
CMP0 <- SRC1[63:0] OP5 SRC2[63:0];
CMP1 <- SRC1[127:64] OP5 SRC2[127:64];
IF CMP0 = TRUE
    THEN DEST[63:0] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[63:0] <- 0000000000000000H; FI;
IF CMP1 = TRUE
    THEN DEST[127:64] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[127:64] <- 0000000000000000H; FI;
DEST[MAX_VL-1:128] <- 0





CMPPD (128-bit Legacy SSE version)
CMP0 <- SRC1[63:0] OP3 SRC2[63:0];
CMP1 <- SRC1[127:64] OP3 SRC2[127:64];
IF CMP0 = TRUE
    THEN DEST[63:0] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[63:0] <- 0000000000000000H; FI;
IF CMP1 = TRUE
    THEN DEST[127:64] <- FFFFFFFFFFFFFFFFH;
    ELSE DEST[127:64] <- 0000000000000000H; FI;
DEST[MAX_VL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VCMPPD __mmask8 _mm512_cmp_pd_mask( __m512d a, __m512d b, int imm);
VCMPPD __mmask8 _mm512_cmp_round_pd_mask( __m512d a, __m512d b, int imm, int sae);
VCMPPD __mmask8 _mm512_mask_cmp_pd_mask( __mmask8 k1, __m512d a, __m512d b, int imm);
VCMPPD __mmask8 _mm512_mask_cmp_round_pd_mask( __mmask8 k1, __m512d a, __m512d b, int imm, int sae);
VCMPPD __mmask8 _mm256_cmp_pd_mask( __m256d a, __m256d b, int imm);
VCMPPD __mmask8 _mm256_mask_cmp_pd_mask( __mmask8 k1, __m256d a, __m256d b, int imm);
VCMPPD __mmask8 _mm_cmp_pd_mask( __m128d a, __m128d b, int imm);
VCMPPD __mmask8 _mm_mask_cmp_pd_mask( __mmask8 k1, __m128d a, __m128d b, int imm);
VCMPPD __m256 _mm256_cmp_pd(__m256d a, __m256d b, int imm)
(V)CMPPD __m128 _mm_cmp_pd(__m128d a, __m128d b, int imm)

SIMD Floating-Point Exceptions
Invalid if SNaN operand and invalid if QNaN and predicate as listed in Table 3-1.
Denormal

Other Exceptions
VEX-encoded instructions, see Exceptions Type 2.
EVEX-encoded instructions, see Exceptions Type E2.






platform: x86_64
mnem: CMPPS
description:
CMPPS-Compare Packed Single-Precision Floating-Point Values
 Opcode/                             Op /   64/32      CPUID      Description
 Instruction                         En     bit Mode   Feature
                                            Support    Flag
 0F C2 /r ib                         RMI    V/V        SSE        Compare packed single-precision floating-point values in
 CMPPS xmm1, xmm2/m128,                                           xmm2/m128 and xmm1 using bits 2:0 of imm8 as a
 imm8                                                             comparison predicate.
 VEX.NDS.128.0F.WIG C2 /r ib         RVMI   V/V        AVX        Compare packed single-precision floating-point values in
 VCMPPS xmm1, xmm2,                                               xmm3/m128 and xmm2 using bits 4:0 of imm8 as a
 xmm3/m128, imm8                                                  comparison predicate.
 VEX.NDS.256.0F.WIG C2 /r ib         RVMI   V/V        AVX        Compare packed single-precision floating-point values in
 VCMPPS ymm1, ymm2,                                               ymm3/m256 and ymm2 using bits 4:0 of imm8 as a
 ymm3/m256, imm8                                                  comparison predicate.
 EVEX.NDS.128.0F.W0 C2 /r ib         FV     V/V        AVX512VL   Compare packed single-precision floating-point values in
 VCMPPS k1 {k2}, xmm2,                                 AVX512F    xmm3/m128/m32bcst and xmm2 using bits 4:0 of imm8 as
 xmm3/m128/m32bcst, imm8                                          a comparison predicate with writemask k2 and leave the
                                                                  result in mask register k1.
 EVEX.NDS.256.0F.W0 C2 /r ib         FV     V/V        AVX512VL   Compare packed single-precision floating-point values in
 VCMPPS k1 {k2}, ymm2,                                 AVX512F    ymm3/m256/m32bcst and ymm2 using bits 4:0 of imm8 as
 ymm3/m256/m32bcst, imm8                                          a comparison predicate with writemask k2 and leave the
                                                                  result in mask register k1.
 EVEX.NDS.512.0F.W0 C2 /r ib         FV     V/V        AVX512F    Compare packed single-precision floating-point values in
 VCMPPS k1 {k2}, zmm2,                                            zmm3/m512/m32bcst and zmm2 using bits 4:0 of imm8 as
 zmm3/m512/m32bcst{sae}, imm8                                     a comparison predicate with writemask k2 and leave the
                                                                  result in mask register k1.



                                              Instruction Operand Encoding
     Op/En             Operand 1                   Operand 2                 Operand 3                    Operand 4
      RMI           ModRM:reg (r, w)              ModRM:r/m (r)                 Imm8                          NA
     RVMI            ModRM:reg (w)                  VEX.vvvv              ModRM:r/m (r)                     Imm8
       FV            ModRM:reg (w)                 EVEX.vvvv              ModRM:r/m (r)                     Imm8

Description
Performs a SIMD compare of the packed single-precision floating-point values in the second source operand and
the first source operand and returns the results of the comparison to the destination operand. The comparison
predicate operand (immediate byte) specifies the type of comparison performed on each of the pairs of packed
values.
EVEX encoded versions: The first source operand (second operand) is a ZMM/YMM/XMM register. The second
source operand can be a ZMM/YMM/XMM register, a 512/256/128-bit memory location or a 512/256/128-bit vector
broadcasted from a 32-bit memory location. The destination operand (first operand) is an opmask register.
Comparison results are written to the destination operand under the writemask k2. Each comparison result is a
single mask bit of 1 (comparison true) or 0 (comparison false).
VEX.256 encoded version: The first source operand (second operand) is a YMM register. The second source operand
(third operand) can be a YMM register or a 256-bit memory location. The destination operand (first operand) is a
YMM register. Eight comparisons are performed with results written to the destination operand. The result of each
comparison is a doubleword mask of all 1s (comparison true) or all 0s (comparison false).
128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The
second source operand (second operand) can be an XMM register or 128-bit memory location. Bits (MAX_VL-
1:128) of the corresponding ZMM destination register remain unchanged. Four comparisons are performed with
results written to bits 127:0 of the destination operand. The result of each comparison is a doubleword mask of all
1s (comparison true) or all 0s (comparison false).





VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source
operand (third operand) can be an XMM register or a 128-bit memory location. Bits (MAX_VL-1:128) of the desti-
nation ZMM register are zeroed. Four comparisons are performed with results written to bits 127:0 of the destina-
tion operand.
The comparison predicate operand is an 8-bit immediate:
.     For instructions encoded using the VEX prefix and EVEX prefix, bits 4:0 define the type of comparison to be
      performed (see Table 3-1). Bits 5 through 7 of the immediate are reserved.
.     For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see
      the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved.
The unordered relationship is true when at least one of the two source operands being compared is a NaN; the
ordered relationship is true when neither source operand is a NaN.
A subsequent computational instruction that uses the mask result in the destination operand as an input operand
will not generate an exception, because a mask of all 0s corresponds to a floating-point value of +0.0 and a mask
of all 1s corresponds to a QNaN.
Note that processors with "CPUID.1H:ECX.AVX =0" do not implement the "greater-than", "greater-than-or-equal",
"not-greater than", and "not-greater-than-or-equal relations" predicates. These comparisons can be made either
by using the inverse relationship (that is, use the "not-less-than-or-equal" to make a "greater-than" comparison)
or by using software emulation. When using software emulation, the program must swap the operands (copying
registers when necessary to protect the data that will now be in the destination), and then perform the compare
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7
(Intel 64 and IA-32 Architectures Software Developer's Manual Volume 2A) under the heading Emulation.
Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand
CMPPS instruction, for processors with "CPUID.1H:ECX.AVX =0". See Table 3-4. Compiler should treat reserved
Imm8 values as illegal syntax.
                                       Table 3-4. Pseudo-Op and CMPPS Implementation
:




    Pseudo-Op                                                  CMPPS Implementation
    CMPEQPS xmm1, xmm2                                         CMPPS xmm1, xmm2, 0
    CMPLTPS xmm1, xmm2                                         CMPPS xmm1, xmm2, 1
    CMPLEPS xmm1, xmm2                                         CMPPS xmm1, xmm2, 2
    CMPUNORDPS xmm1, xmm2                                      CMPPS xmm1, xmm2, 3
    CMPNEQPS xmm1, xmm2                                        CMPPS xmm1, xmm2, 4
    CMPNLTPS xmm1, xmm2                                        CMPPS xmm1, xmm2, 5
    CMPNLEPS xmm1, xmm2                                        CMPPS xmm1, xmm2, 6
    CMPORDPS xmm1, xmm2                                        CMPPS xmm1, xmm2, 7

The greater-than relations that the processor does not implement require more than one instruction to emulate in
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to
the correct destination register and that the source operand is left intact.)
Processors with "CPUID.1H:ECX.AVX =1" implement the full complement of 32 predicates shown in Table 3-5, soft-
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand
pseudo-ops in addition to the four-operand VCMPPS instruction. See Table 3-5, where the notation of reg1 and
reg2 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal
syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter-
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPPS instructions
in a similar fashion by extending the syntax listed in Table 3-5.
:





                                   Table 3-5. Pseudo-Op and VCMPPS Implementation
 Pseudo-Op                                                  CMPPS Implementation
 VCMPEQPS reg1, reg2, reg3                                  VCMPPS reg1, reg2, reg3, 0
 VCMPLTPS reg1, reg2, reg3                                  VCMPPS reg1, reg2, reg3, 1
 VCMPLEPS reg1, reg2, reg3                                  VCMPPS reg1, reg2, reg3, 2
 VCMPUNORDPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 3
 VCMPNEQPS reg1, reg2, reg3                                 VCMPPS reg1, reg2, reg3, 4
 VCMPNLTPS reg1, reg2, reg3                                 VCMPPS reg1, reg2, reg3, 5
 VCMPNLEPS reg1, reg2, reg3                                 VCMPPS reg1, reg2, reg3, 6
 VCMPORDPS reg1, reg2, reg3                                 VCMPPS reg1, reg2, reg3, 7
 VCMPEQ_UQPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 8
 VCMPNGEPS reg1, reg2, reg3                                 VCMPPS reg1, reg2, reg3, 9
 VCMPNGTPS reg1, reg2, reg3                                 VCMPPS reg1, reg2, reg3, 0AH
 VCMPFALSEPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 0BH
 VCMPNEQ_OQPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 0CH
 VCMPGEPS reg1, reg2, reg3                                  VCMPPS reg1, reg2, reg3, 0DH
 VCMPGTPS reg1, reg2, reg3                                  VCMPPS reg1, reg2, reg3, 0EH
 VCMPTRUEPS reg1, reg2, reg3                                VCMPPS reg1, reg2, reg3, 0FH
 VCMPEQ_OSPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 10H
 VCMPLT_OQPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 11H
 VCMPLE_OQPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 12H
 VCMPUNORD_SPS reg1, reg2, reg3                             VCMPPS reg1, reg2, reg3, 13H
 VCMPNEQ_USPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 14H
 VCMPNLT_UQPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 15H
 VCMPNLE_UQPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 16H
 VCMPORD_SPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 17H
 VCMPEQ_USPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 18H
 VCMPNGE_UQPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 19H
 VCMPNGT_UQPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 1AH
 VCMPFALSE_OSPS reg1, reg2, reg3                            VCMPPS reg1, reg2, reg3, 1BH
 VCMPNEQ_OSPS reg1, reg2, reg3                              VCMPPS reg1, reg2, reg3, 1CH
 VCMPGE_OQPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 1DH
 VCMPGT_OQPS reg1, reg2, reg3                               VCMPPS reg1, reg2, reg3, 1EH
 VCMPTRUE_USPS reg1, reg2, reg3                             VCMPPS reg1, reg2, reg3, 1FH





Operation
CASE (COMPARISON PREDICATE) OF
   0: OP3 <- EQ_OQ; OP5 <- EQ_OQ;
   1: OP3 <- LT_OS; OP5 <- LT_OS;
   2: OP3 <- LE_OS; OP5 <- LE_OS;
   3: OP3 <- UNORD_Q; OP5 <- UNORD_Q;
   4: OP3 <- NEQ_UQ; OP5 <- NEQ_UQ;
   5: OP3 <- NLT_US; OP5 <- NLT_US;
   6: OP3 <- NLE_US; OP5 <- NLE_US;
   7: OP3 <- ORD_Q; OP5 <- ORD_Q;
   8: OP5 <- EQ_UQ;
   9: OP5 <- NGE_US;
   10: OP5 <- NGT_US;
   11: OP5 <- FALSE_OQ;
   12: OP5 <- NEQ_OQ;
   13: OP5 <- GE_OS;
   14: OP5 <- GT_OS;
   15: OP5 <- TRUE_UQ;
   16: OP5 <- EQ_OS;
   17: OP5 <- LT_OQ;
   18: OP5 <- LE_OQ;
   19: OP5 <- UNORD_S;
   20: OP5 <- NEQ_US;
   21: OP5 <- NLT_UQ;
   22: OP5 <- NLE_UQ;
   23: OP5 <- ORD_S;
   24: OP5 <- EQ_US;
   25: OP5 <- NGE_UQ;
   26: OP5 <- NGT_UQ;
   27: OP5 <- FALSE_OS;
   28: OP5 <- NEQ_OS;
   29: OP5 <- GE_OQ;
   30: OP5 <- GT_OQ;
   31: OP5 <- TRUE_US;
   DEFAULT: Reserved
ESAC;





VCMPPS (EVEX encoded versions)
(KL, VL) = (4, 128), (8, 256), (16, 512)
FOR j <- 0 TO KL-1
    i <- j * 32
    IF k2[j] OR *no writemask*
         THEN
               IF (EVEX.b = 1) AND (SRC2 *is memory*)
                    THEN
                         CMP <- SRC1[i+31:i] OP5 SRC2[31:0]
                    ELSE
                         CMP <- SRC1[i+31:i] OP5 SRC2[i+31:i]
               FI;
               IF CMP = TRUE
                    THEN DEST[j] <- 1;
                    ELSE DEST[j] <- 0; FI;
         ELSE       DEST[j] <- 0                ; zeroing-masking onlyFI;
    FI;
ENDFOR
DEST[MAX_KL-1:KL] <- 0

VCMPPS (VEX.256 encoded version)
CMP0 <- SRC1[31:0] OP5 SRC2[31:0];
CMP1 <- SRC1[63:32] OP5 SRC2[63:32];
CMP2 <- SRC1[95:64] OP5 SRC2[95:64];
CMP3 <- SRC1[127:96] OP5 SRC2[127:96];
CMP4 <- SRC1[159:128] OP5 SRC2[159:128];
CMP5 <- SRC1[191:160] OP5 SRC2[191:160];
CMP6 <- SRC1[223:192] OP5 SRC2[223:192];
CMP7 <- SRC1[255:224] OP5 SRC2[255:224];
IF CMP0 = TRUE
    THEN DEST[31:0] <-FFFFFFFFH;
    ELSE DEST[31:0] <- 000000000H; FI;
IF CMP1 = TRUE
    THEN DEST[63:32] <- FFFFFFFFH;
    ELSE DEST[63:32] <-000000000H; FI;
IF CMP2 = TRUE
    THEN DEST[95:64] <- FFFFFFFFH;
    ELSE DEST[95:64] <- 000000000H; FI;
IF CMP3 = TRUE
    THEN DEST[127:96] <- FFFFFFFFH;
    ELSE DEST[127:96] <- 000000000H; FI;
IF CMP4 = TRUE
    THEN DEST[159:128] <- FFFFFFFFH;
    ELSE DEST[159:128] <- 000000000H; FI;
IF CMP5 = TRUE
    THEN DEST[191:160] <- FFFFFFFFH;
    ELSE DEST[191:160] <- 000000000H; FI;
IF CMP6 = TRUE
    THEN DEST[223:192] <- FFFFFFFFH;
    ELSE DEST[223:192] <-000000000H; FI;
IF CMP7 = TRUE
    THEN DEST[255:224] <- FFFFFFFFH;
    ELSE DEST[255:224] <- 000000000H; FI;
DEST[MAX_VL-1:256] <- 0



VCMPPS (VEX.128 encoded version)
CMP0 <- SRC1[31:0] OP5 SRC2[31:0];
CMP1 <- SRC1[63:32] OP5 SRC2[63:32];
CMP2 <- SRC1[95:64] OP5 SRC2[95:64];
CMP3 <- SRC1[127:96] OP5 SRC2[127:96];
IF CMP0 = TRUE
    THEN DEST[31:0] <-FFFFFFFFH;
    ELSE DEST[31:0] <- 000000000H; FI;
IF CMP1 = TRUE
    THEN DEST[63:32] <- FFFFFFFFH;
    ELSE DEST[63:32] <- 000000000H; FI;
IF CMP2 = TRUE
    THEN DEST[95:64] <- FFFFFFFFH;
    ELSE DEST[95:64] <- 000000000H; FI;
IF CMP3 = TRUE
    THEN DEST[127:96] <- FFFFFFFFH;
    ELSE DEST[127:96] <-000000000H; FI;
DEST[MAX_VL-1:128] <- 0

CMPPS (128-bit Legacy SSE version)
CMP0 <- SRC1[31:0] OP3 SRC2[31:0];
CMP1 <- SRC1[63:32] OP3 SRC2[63:32];
CMP2 <- SRC1[95:64] OP3 SRC2[95:64];
CMP3 <- SRC1[127:96] OP3 SRC2[127:96];
IF CMP0 = TRUE
    THEN DEST[31:0] <-FFFFFFFFH;
    ELSE DEST[31:0] <- 000000000H; FI;
IF CMP1 = TRUE
    THEN DEST[63:32] <- FFFFFFFFH;
    ELSE DEST[63:32] <- 000000000H; FI;
IF CMP2 = TRUE
    THEN DEST[95:64] <- FFFFFFFFH;
    ELSE DEST[95:64] <- 000000000H; FI;
IF CMP3 = TRUE
    THEN DEST[127:96] <- FFFFFFFFH;
    ELSE DEST[127:96] <-000000000H; FI;
DEST[MAX_VL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent
VCMPPS __mmask16 _mm512_cmp_ps_mask( __m512 a, __m512 b, int imm);
VCMPPS __mmask16 _mm512_cmp_round_ps_mask( __m512 a, __m512 b, int imm, int sae);
VCMPPS __mmask16 _mm512_mask_cmp_ps_mask( __mmask16 k1, __m512 a, __m512 b, int imm);
VCMPPS __mmask16 _mm512_mask_cmp_round_ps_mask( __mmask16 k1, __m512 a, __m512 b, int imm, int sae);
VCMPPD __mmask8 _mm256_cmp_ps_mask( __m256 a, __m256 b, int imm);
VCMPPS __mmask8 _mm256_mask_cmp_ps_mask( __mmask8 k1, __m256 a, __m256 b, int imm);
VCMPPS __mmask8 _mm_cmp_ps_mask( __m128 a, __m128 b, int imm);
VCMPPS __mmask8 _mm_mask_cmp_ps_mask( __mmask8 k1, __m128 a, __m128 b, int imm);
VCMPPS __m256 _mm256_cmp_ps(__m256 a, __m256 b, int imm)
CMPPS __m128 _mm_cmp_ps(__m128 a, __m128 b, int imm)

SIMD Floating-Point Exceptions
Invalid if SNaN operand and invalid if QNaN and predicate as listed in Table 3-1.
Denormal




Other Exceptions
VEX-encoded instructions, see Exceptions Type 2.
EVEX-encoded instructions, see Exceptions Type E2.






platform: x86_64
mnem: CMPS
description:
CMPS/CMPSB/CMPSW/CMPSD/CMPSQ-Compare String Operands
 Opcode             Instruction           Op/    64-Bit      Compat/ Description
                                          En     Mode        Leg Mode
 A6                 CMPS m8, m8           NP     Valid       Valid    For legacy mode, compare byte at address DS:(E)SI with
                                                                      byte at address ES:(E)DI; For 64-bit mode compare byte
                                                                      at address (R|E)SI to byte at address (R|E)DI. The status
                                                                      flags are set accordingly.
 A7                 CMPS m16, m16         NP     Valid       Valid    For legacy mode, compare word at address DS:(E)SI
                                                                      with word at address ES:(E)DI; For 64-bit mode
                                                                      compare word at address (R|E)SI with word at address
                                                                      (R|E)DI. The status flags are set accordingly.
 A7                 CMPS m32, m32         NP     Valid       Valid    For legacy mode, compare dword at address DS:(E)SI at
                                                                      dword at address ES:(E)DI; For 64-bit mode compare
                                                                      dword at address (R|E)SI at dword at address (R|E)DI.
                                                                      The status flags are set accordingly.
 REX.W + A7         CMPS m64, m64         NP     Valid       N.E.     Compares quadword at address (R|E)SI with quadword
                                                                      at address (R|E)DI and sets the status flags accordingly.
 A6                 CMPSB                 NP     Valid       Valid    For legacy mode, compare byte at address DS:(E)SI with
                                                                      byte at address ES:(E)DI; For 64-bit mode compare byte
                                                                      at address (R|E)SI with byte at address (R|E)DI. The
                                                                      status flags are set accordingly.
 A7                 CMPSW                 NP     Valid       Valid    For legacy mode, compare word at address DS:(E)SI
                                                                      with word at address ES:(E)DI; For 64-bit mode
                                                                      compare word at address (R|E)SI with word at address
                                                                      (R|E)DI. The status flags are set accordingly.
 A7                 CMPSD                 NP     Valid       Valid    For legacy mode, compare dword at address DS:(E)SI
                                                                      with dword at address ES:(E)DI; For 64-bit mode
                                                                      compare dword at address (R|E)SI with dword at
                                                                      address (R|E)DI. The status flags are set accordingly.
 REX.W + A7         CMPSQ                 NP     Valid       N.E.     Compares quadword at address (R|E)SI with quadword
                                                                      at address (R|E)DI and sets the status flags accordingly.



                                               Instruction Operand Encoding
   Op/En           Operand 1                     Operand 2                 Operand 3                      Operand 4
      NP               NA                           NA                         NA                             NA

Description
Compares the byte, word, doubleword, or quadword specified with the first source operand with the byte, word,
doubleword, or quadword specified with the second source operand and sets the status flags in the EFLAGS register
according to the results.
Both source operands are located in memory. The address of the first source operand is read from DS:SI, DS:ESI
or RSI (depending on the address-size attribute of the instruction is 16, 32, or 64, respectively). The address of the
second source operand is read from ES:DI, ES:EDI or RDI (again depending on the address-size attribute of the
instruction is 16, 32, or 64). The DS segment may be overridden with a segment override prefix, but the ES
segment cannot be overridden.
At the assembly-code level, two forms of this instruction are allowed: the "explicit-operands" form and the "no-
operands" form. The explicit-operands form (specified with the CMPS mnemonic) allows the two source operands
to be specified explicitly. Here, the source operands should be symbols that indicate the size and location of the
source values. This explicit-operand form is provided to allow documentation. However, note that the documenta-
tion provided by this form can be misleading. That is, the source operand symbols must specify the correct type
(size) of the operands (bytes, words, or doublewords, quadwords), but they do not have to specify the correct loca-




tion. Locations of the source operands are always specified by the DS:(E)SI (or RSI) and ES:(E)DI (or RDI) regis-
ters, which must be loaded correctly before the compare string instruction is executed.
The no-operands form provides "short forms" of the byte, word, and doubleword versions of the CMPS instructions.
Here also the DS:(E)SI (or RSI) and ES:(E)DI (or RDI) registers are assumed by the processor to specify the loca-
tion of the source operands. The size of the source operands is selected with the mnemonic: CMPSB (byte compar-
ison), CMPSW (word comparison), CMPSD (doubleword comparison), or CMPSQ (quadword comparison using
REX.W).
After the comparison, the (E/R)SI and (E/R)DI registers increment or decrement automatically according to the
setting of the DF flag in the EFLAGS register. (If the DF flag is 0, the (E/R)SI and (E/R)DI register increment; if the
DF flag is 1, the registers decrement.) The registers increment or decrement by 1 for byte operations, by 2 for word
operations, 4 for doubleword operations. If operand size is 64, RSI and RDI registers increment by 8 for quadword
operations.
The CMPS, CMPSB, CMPSW, CMPSD, and CMPSQ instructions can be preceded by the REP prefix for block compar-
isons. More often, however, these instructions will be used in a LOOP construct that takes some action based on the
setting of the status flags before the next comparison is made. See "REP/REPE/REPZ /REPNE/REPNZ-Repeat
String Operation Prefix" in Chapter 4 of the Intel 64 and IA-32 Architectures Software Developer's Manual,
Volume 2B, for a description of the REP prefix.
In 64-bit mode, the instruction's default address size is 64 bits, 32 bit address size is supported using the prefix
67H. Use of the REX.W prefix promotes doubleword operation to 64 bits (see CMPSQ). See the summary chart at
the beginning of this section for encoding data and limits.

Operation
temp <- SRC1 - SRC2;
SetStatusFlags(temp);

IF (64-Bit Mode)
    THEN
         IF (Byte comparison)
         THEN IF DF = 0
              THEN
                   (R|E)SI <- (R|E)SI + 1;
                   (R|E)DI <- (R|E)DI + 1;
              ELSE
                   (R|E)SI <- (R|E)SI - 1;
                   (R|E)DI <- (R|E)DI - 1;
              FI;
         ELSE IF (Word comparison)
              THEN IF DF = 0
                   THEN
                        (R|E)SI <- (R|E)SI + 2;
                        (R|E)DI <- (R|E)DI + 2;
                   ELSE
                        (R|E)SI <- (R|E)SI - 2;
                        (R|E)DI <- (R|E)DI - 2;
                   FI;
         ELSE IF (Doubleword comparison)
              THEN IF DF = 0
                   THEN
                        (R|E)SI <- (R|E)SI + 4;
                        (R|E)DI <- (R|E)DI + 4;
                   ELSE
                        (R|E)SI <- (R|E)SI - 4;
                        (R|E)DI <- (R|E)DI - 4;
                   FI;



          ELSE (* Quadword comparison *)
               THEN IF DF = 0
                    (R|E)SI <- (R|E)SI + 8;
                    (R|E)DI <- (R|E)DI + 8;
               ELSE
                    (R|E)SI <- (R|E)SI - 8;
                    (R|E)DI <- (R|E)DI - 8;
               FI;
          FI;
      ELSE (* Non-64-bit Mode *)
          IF (byte comparison)
          THEN IF DF = 0
               THEN
                    (E)SI <- (E)SI + 1;
                    (E)DI <- (E)DI + 1;
               ELSE
                    (E)SI <- (E)SI - 1;
                    (E)DI <- (E)DI - 1;
               FI;
          ELSE IF (Word comparison)
               THEN IF DF = 0
                    (E)SI <- (E)SI + 2;
                    (E)DI <- (E)DI + 2;
               ELSE
                    (E)SI <- (E)SI - 2;
                    (E)DI <- (E)DI - 2;
               FI;
          ELSE (* Doubleword comparison *)
               THEN IF DF = 0
                    (E)SI <- (E)SI + 4;
                    (E)DI <- (E)DI + 4;
               ELSE
                    (E)SI <- (E)SI - 4;
                    (E)DI <- (E)DI - 4;
               FI;
          FI;
FI;

Flags Affected
The CF, OF, SF, ZF, AF, and PF flags are set according to the temporary result of the comparison.

Protected Mode Exceptions
#GP(0)                   If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
                         If the DS, ES, FS, or GS register contains a NULL segment selector.
#SS(0)                   If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)          If a page fault occurs.
#AC(0)                   If alignment checking is enabled and an unaligned memory reference is made while the
                         current privilege level is 3.
#UD                      If the LOCK prefix is used.





Real-Address Mode Exceptions
#GP                 If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS                 If a memory operand effective address is outside the SS segment limit.
#UD                 If the LOCK prefix is used.

Virtual-8086 Mode Exceptions
#GP(0)              If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
#SS(0)              If a memory operand effective address is outside the SS segment limit.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made.
#UD                 If the LOCK prefix is used.

Compatibility Mode Exceptions
Same exceptions as in protected mode.

64-Bit Mode Exceptions
#SS(0)              If a memory address referencing the SS segment is in a non-canonical form.
#GP(0)              If the memory address is in a non-canonical form.
#PF(fault-code)     If a page fault occurs.
#AC(0)              If alignment checking is enabled and an unaligned memory reference is made while the
                    current privilege level is 3.
#UD                 If the LOCK prefix is used.






platform: x86_64
mnem: CMPSD
description:
CMPSD-Compare Scalar Double-Precision Floating-Point Value
    Opcode/                             Op /     64/32       CPUID     Description
    Instruction                         En       bit Mode    Feature
                                                 Support     Flag
    F2 0F C2 /r ib                      RMI      V/V         SSE2      Compare low double-precision floating-point value in
    CMPSD xmm1, xmm2/m64, imm8                                         xmm2/m64 and xmm1 using bits 2:0 of imm8 as comparison
                                                                       predicate.
    VEX.NDS.128.F2.0F.WIG C2 /r ib      RVMI     V/V         AVX       Compare low double-precision floating-point value in
    VCMPSD xmm1, xmm2,                                                 xmm3/m64 and xmm2 using bits 4:0 of imm8 as comparison
    xmm3/m64, imm8                                                     predicate.
    EVEX.NDS.LIG.F2.0F.W1 C2 /r ib      T1S      V/V         AVX512F   Compare low double-precision floating-point value in
    VCMPSD k1 {k2}, xmm2,                                              xmm3/m64 and xmm2 using bits 4:0 of imm8 as comparison
    xmm3/m64{sae}, imm8                                                predicate with writemask k2 and leave the result in mask
                                                                       register k1.



                                                    Instruction Operand Encoding
      Op/En             Operand 1                      Operand 2                Operand 3                    Operand 4
       RMI           ModRM:reg (r, w)                ModRM:r/m (r)                   Imm8                       NA
       RVMI           ModRM:reg (w)                    VEX.vvvv               ModRM:r/m (r)                    Imm8
       T1S            ModRM:reg (w)                    EVEX.vvvv              ModRM:r/m (r)                    Imm8

Description
Compares the low double-precision floating-point values in the second source operand and the first source operand
and returns the results in of the comparison to the destination operand. The comparison predicate operand (imme-
diate operand) specifies the type of comparison performed.
128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The
second source operand (second operand) can be an XMM register or 64-bit memory location. Bits (MAX_VL-1:64)
of the corresponding YMM destination register remain unchanged. The comparison result is a quadword mask of all
1s (comparison true) or all 0s (comparison false).
VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source
operand (third operand) can be an XMM register or a 64-bit memory location. The result is stored in the low quad-
word of the destination operand; the high quadword is filled with the contents of the high quadword of the first
source operand. Bits (MAX_VL-1:128) of the destination ZMM register are zeroed. The comparison result is a quad-
word mask of all 1s (comparison true) or all 0s (comparison false).
EVEX encoded version: The first source operand (second operand) is an XMM register. The second source operand
can be a XMM register or a 64-bit memory location. The destination operand (first operand) is an opmask register.
The comparison result is a single mask bit of 1 (comparison true) or 0 (comparison false), written to the destination
starting from the LSB according to the writemask k2. Bits (MAX_KL-1:128) of the destination register are cleared.
The comparison predicate operand is an 8-bit immediate:
.     For instructions encoded using the VEX prefix, bits 4:0 define the type of comparison to be performed (see
      Table 3-1). Bits 5 through 7 of the immediate are reserved.
.     For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see
      the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved.
The unordered relationship is true when at least one of the two source operands being compared is a NaN; the
ordered relationship is true when neither source operand is a NaN.
A subsequent computational instruction that uses the mask result in the destination operand as an input operand
will not generate an exception, because a mask of all 0s corresponds to a floating-point value of +0.0 and a mask
of all 1s corresponds to a QNaN.
Note that processors with "CPUID.1H:ECX.AVX =0" do not implement the "greater-than", "greater-than-or-equal",
"not-greater than", and "not-greater-than-or-equal relations" predicates. These comparisons can be made either
by using the inverse relationship (that is, use the "not-less-than-or-equal" to make a "greater-than" comparison)



or by using software emulation. When using software emulation, the program must swap the operands (copying
registers when necessary to protect the data that will now be in the destination), and then perform the compare
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7
(Intel 64 and IA-32 Architectures Software Developer's Manual Volume 2A) under the heading Emulation.
Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand
CMPSD instruction, for processors with "CPUID.1H:ECX.AVX =0". See Table 3-6. Compiler should treat reserved
Imm8 values as illegal syntax.
                                    Table 3-6. Pseudo-Op and CMPSD Implementation
:




    Pseudo-Op                                                CMPSD Implementation
    CMPEQSD xmm1, xmm2                                       CMPSD xmm1, xmm2, 0
    CMPLTSD xmm1, xmm2                                       CMPSD xmm1, xmm2, 1
    CMPLESD xmm1, xmm2                                       CMPSD xmm1, xmm2, 2
    CMPUNORDSD xmm1, xmm2                                    CMPSD xmm1, xmm2, 3
    CMPNEQSD xmm1, xmm2                                      CMPSD xmm1, xmm2, 4
    CMPNLTSD xmm1, xmm2                                      CMPSD xmm1, xmm2, 5
    CMPNLESD xmm1, xmm2                                      CMPSD xmm1, xmm2, 6
    CMPORDSD xmm1, xmm2                                      CMPSD xmm1, xmm2, 7

The greater-than relations that the processor does not implement require more than one instruction to emulate in
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to
the correct destination register and that the source operand is left intact.)
Processors with "CPUID.1H:ECX.AVX =1" implement the full complement of 32 predicates shown in Table 3-7, soft-
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand
pseudo-ops in addition to the four-operand VCMPSD instruction. See Table 3-7, where the notations of reg1 reg2,
and reg3 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal
syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter-
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPSD instructions
in a similar fashion by extending the syntax listed in Table 3-7.
                                    Table 3-7. Pseudo-Op and VCMPSD Implementation
:




    Pseudo-Op                                                CMPSD Implementation
    VCMPEQSD reg1, reg2, reg3                                VCMPSD reg1, reg2, reg3, 0
    VCMPLTSD reg1, reg2, reg3                                VCMPSD reg1, reg2, reg3, 1
    VCMPLESD reg1, reg2, reg3                                VCMPSD reg1, reg2, reg3, 2
    VCMPUNORDSD reg1, reg2, reg3                             VCMPSD reg1, reg2, reg3, 3
    VCMPNEQSD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 4
    VCMPNLTSD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 5
    VCMPNLESD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 6
    VCMPORDSD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 7
    VCMPEQ_UQSD reg1, reg2, reg3                             VCMPSD reg1, reg2, reg3, 8
    VCMPNGESD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 9
    VCMPNGTSD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 0AH
    VCMPFALSESD reg1, reg2, reg3                             VCMPSD reg1, reg2, reg3, 0BH
    VCMPNEQ_OQSD reg1, reg2, reg3                            VCMPSD reg1, reg2, reg3, 0CH
    VCMPGESD reg1, reg2, reg3                                VCMPSD reg1, reg2, reg3, 0DH




                                       Table 3-7. Pseudo-Op and VCMPSD Implementation
 Pseudo-Op                                                      CMPSD Implementation
 VCMPGTSD reg1, reg2, reg3                                     VCMPSD reg1, reg2, reg3, 0EH
 VCMPTRUESD reg1, reg2, reg3                                   VCMPSD reg1, reg2, reg3, 0FH
 VCMPEQ_OSSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 10H
 VCMPLT_OQSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 11H
 VCMPLE_OQSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 12H
 VCMPUNORD_SSD reg1, reg2, reg3                                VCMPSD reg1, reg2, reg3, 13H
 VCMPNEQ_USSD reg1, reg2, reg3                                 VCMPSD reg1, reg2, reg3, 14H
 VCMPNLT_UQSD reg1, reg2, reg3                                 VCMPSD reg1, reg2, reg3, 15H
 VCMPNLE_UQSD reg1, reg2, reg3                                 VCMPSD reg1, reg2, reg3, 16H
 VCMPORD_SSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 17H
 VCMPEQ_USSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 18H
 VCMPNGE_UQSD reg1, reg2, reg3                                 VCMPSD reg1, reg2, reg3, 19H
 VCMPNGT_UQSD reg1, reg2, reg3                                 VCMPSD reg1, reg2, reg3, 1AH
 VCMPFALSE_OSSD reg1, reg2, reg3                               VCMPSD reg1, reg2, reg3, 1BH
 VCMPNEQ_OSSD reg1, reg2, reg3                                 VCMPSD reg1, reg2, reg3, 1CH
 VCMPGE_OQSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 1DH
 VCMPGT_OQSD reg1, reg2, reg3                                  VCMPSD reg1, reg2, reg3, 1EH
 VCMPTRUE_USSD reg1, reg2, reg3                                VCMPSD reg1, reg2, reg3, 1FH

Software should ensure VCMPSD is encoded with VEX.L=0. Encoding VCMPSD with VEX.L=1 may encounter unpre-
dictable behavior across different processor generations.

Operation
CASE (COMPARISON PREDICATE) OF
   0: OP3 <-EQ_OQ; OP5 <-EQ_OQ;
   1: OP3 <-LT_OS; OP5 <-LT_OS;
   2: OP3 <-LE_OS; OP5 <-LE_OS;
   3: OP3 <-UNORD_Q; OP5 <-UNORD_Q;
   4: OP3 <-NEQ_UQ; OP5 <-NEQ_UQ;
   5: OP3 <-NLT_US; OP5 <-NLT_US;
   6: OP3 <-NLE_US; OP5 <-NLE_US;
   7: OP3 <-ORD_Q; OP5 <-ORD_Q;
   8: OP5 <-EQ_UQ;
   9: OP5 <-NGE_US;
   10: OP5 <-NGT_US;
   11: OP5 <-FALSE_OQ;
   12: OP5 <-NEQ_OQ;
   13: OP5 <-GE_OS;
   14: OP5 <-GT_OS;
   15: OP5 <-TRUE_UQ;
   16: OP5 <-EQ_OS;
   17: OP5 <-LT_OQ;
   18: OP5 <-LE_OQ;
   19: OP5 <-UNORD_S;
   20: OP5 <-NEQ_US;
   21: OP5 <-NLT_UQ;



   22: OP5 <-NLE_UQ;
   23: OP5 <-ORD_S;
   24: OP5 <-EQ_US;
   25: OP5 <-NGE_UQ;
   26: OP5 <-NGT_UQ;
   27: OP5 <-FALSE_OS;
   28: OP5 <-NEQ_OS;
   29: OP5 <-GE_OQ;
   30: OP5 <-GT_OQ;
   31: OP5 <-TRUE_US;
   DEFAULT: Reserved
ESAC;

VCMPSD (EVEX encoded version)
CMP0 <- SRC1[63:0] OP5 SRC2[63:0];

IF k2[0] or *no writemask*
    THEN      IF CMP0 = TRUE
                   THEN DEST[0] <- 1;
                   ELSE DEST[0] <- 0; FI;
    ELSE      DEST[0] <- 0                ; zeroing-masking only
FI;
DEST[MAX_KL-1:1] <- 0

CMPSD (128-bit Legacy SSE version)
CMP0 <-DEST[63:0] OP3 SRC[63:0];
IF CMP0 = TRUE
THEN DEST[63:0] <-FFFFFFFFFFFFFFFFH;
ELSE DEST[63:0] <-0000000000000000H; FI;
DEST[MAX_VL-1:64] (Unmodified)

VCMPSD (VEX.128 encoded version)
CMP0 <-SRC1[63:0] OP5 SRC2[63:0];
IF CMP0 = TRUE
THEN DEST[63:0] <-FFFFFFFFFFFFFFFFH;
ELSE DEST[63:0] <-0000000000000000H; FI;
DEST[127:64] <-SRC1[127:64]
DEST[MAX_VL-1:128] <-0

Intel C/C++ Compiler Intrinsic Equivalent
VCMPSD __mmask8 _mm_cmp_sd_mask( __m128d a, __m128d b, int imm);
VCMPSD __mmask8 _mm_cmp_round_sd_mask( __m128d a, __m128d b, int imm, int sae);
VCMPSD __mmask8 _mm_mask_cmp_sd_mask( __mmask8 k1, __m128d a, __m128d b, int imm);
VCMPSD __mmask8 _mm_mask_cmp_round_sd_mask( __mmask8 k1, __m128d a, __m128d b, int imm, int sae);
(V)CMPSD __m128d _mm_cmp_sd(__m128d a, __m128d b, const int imm)

SIMD Floating-Point Exceptions
Invalid if SNaN operand, Invalid if QNaN and predicate as listed in Table 3-1 Denormal.

Other Exceptions
VEX-encoded instructions, see Exceptions Type 3.
EVEX-encoded instructions, see Exceptions Type E3.






platform: x86_64
mnem: CMPSS
description:
CMPSS-Compare Scalar Single-Precision Floating-Point Value
    Opcode/                                  Op /      64/32         CPUID     Description
    Instruction                              En        bit Mode      Feature
                                                       Support       Flag
    F3 0F C2 /r ib                           RMI       V/V           SSE       Compare low single-precision floating-point value in
    CMPSS xmm1, xmm2/m32, imm8                                                 xmm2/m32 and xmm1 using bits 2:0 of imm8 as
                                                                               comparison predicate.
    VEX.NDS.128.F3.0F.WIG C2 /r ib           RVMI      V/V           AVX       Compare low single-precision floating-point value in
    VCMPSS xmm1, xmm2, xmm3/m32,                                               xmm3/m32 and xmm2 using bits 4:0 of imm8 as
    imm8                                                                       comparison predicate.
    EVEX.NDS.LIG.F3.0F.W0 C2 /r ib           T1S       V/V           AVX512F   Compare low single-precision floating-point value in
    VCMPSS k1 {k2}, xmm2,                                                      xmm3/m32 and xmm2 using bits 4:0 of imm8 as
    xmm3/m32{sae}, imm8                                                        comparison predicate with writemask k2 and leave the
                                                                               result in mask register k1.



                                                     Instruction Operand Encoding
       Op/En              Operand 1                          Operand 2               Operand 3                   Operand 4
        RMI            ModRM:reg (r, w)                 ModRM:r/m (r)                  Imm8                          NA
       RVMI             ModRM:reg (w)                        VEX.vvvv              ModRM:r/m (r)                   Imm8
        T1S             ModRM:reg (w)                        EVEX.vvvv             ModRM:r/m (r)                   Imm8

Description
Compares the low single-precision floating-point values in the second source operand and the first source operand
and returns the results of the comparison to the destination operand. The comparison predicate operand (imme-
diate operand) specifies the type of comparison performed.
128-bit Legacy SSE version: The first source and destination operand (first operand) is an XMM register. The
second source operand (second operand) can be an XMM register or 32-bit memory location. Bits (MAX_VL-1:32)
of the corresponding YMM destination register remain unchanged. The comparison result is a doubleword mask of
all 1s (comparison true) or all 0s (comparison false).
VEX.128 encoded version: The first source operand (second operand) is an XMM register. The second source
operand (third operand) can be an XMM register or a 32-bit memory location. The result is stored in the low 32 bits
of the destination operand; bits 128:32 of the destination operand are copied from the first source operand. Bits
(MAX_VL-1:128) of the destination ZMM register are zeroed. The comparison result is a doubleword mask of all 1s
(comparison true) or all 0s (comparison false).
EVEX encoded version: The first source operand (second operand) is an XMM register. The second source operand
can be a XMM register or a 32-bit memory location. The destination operand (first operand) is an opmask register.
The comparison result is a single mask bit of 1 (comparison true) or 0 (comparison false), written to the destination
starting from the LSB according to the writemask k2. Bits (MAX_KL-1:128) of the destination register are cleared.
The comparison predicate operand is an 8-bit immediate:
.     For instructions encoded using the VEX prefix, bits 4:0 define the type of comparison to be performed (see
      Table 3-1). Bits 5 through 7 of the immediate are reserved.
.     For instruction encodings that do not use VEX prefix, bits 2:0 define the type of comparison to be made (see
      the first 8 rows of Table 3-1). Bits 3 through 7 of the immediate are reserved.


The unordered relationship is true when at least one of the two source operands being compared is a NaN; the
ordered relationship is true when neither source operand is a NaN.
A subsequent computational instruction that uses the mask result in the destination operand as an input operand
will not generate an exception, because a mask of all 0s corresponds to a floating-point value of +0.0 and a mask
of all 1s corresponds to a QNaN.
Note that processors with "CPUID.1H:ECX.AVX =0" do not implement the "greater-than", "greater-than-or-equal",
"not-greater than", and "not-greater-than-or-equal relations" predicates. These comparisons can be made either



by using the inverse relationship (that is, use the "not-less-than-or-equal" to make a "greater-than" comparison)
or by using software emulation. When using software emulation, the program must swap the operands (copying
registers when necessary to protect the data that will now be in the destination), and then perform the compare
using a different predicate. The predicate to be used for these emulations is listed in the first 8 rows of Table 3-7
(Intel 64 and IA-32 Architectures Software Developer's Manual Volume 2A) under the heading Emulation.
Compilers and assemblers may implement the following two-operand pseudo-ops in addition to the three-operand
CMPSS instruction, for processors with "CPUID.1H:ECX.AVX =0". See Table 3-8. Compiler should treat reserved
Imm8 values as illegal syntax.
                                    Table 3-8. Pseudo-Op and CMPSS Implementation
:




    Pseudo-Op                                                CMPSS Implementation
    CMPEQSS xmm1, xmm2                                       CMPSS xmm1, xmm2, 0
    CMPLTSS xmm1, xmm2                                       CMPSS xmm1, xmm2, 1
    CMPLESS xmm1, xmm2                                       CMPSS xmm1, xmm2, 2
    CMPUNORDSS xmm1, xmm2                                    CMPSS xmm1, xmm2, 3
    CMPNEQSS xmm1, xmm2                                      CMPSS xmm1, xmm2, 4
    CMPNLTSS xmm1, xmm2                                      CMPSS xmm1, xmm2, 5
    CMPNLESS xmm1, xmm2                                      CMPSS xmm1, xmm2, 6
    CMPORDSS xmm1, xmm2                                      CMPSS xmm1, xmm2, 7

The greater-than relations that the processor does not implement require more than one instruction to emulate in
software and therefore should not be implemented as pseudo-ops. (For these, the programmer should reverse the
operands of the corresponding less than relations and use move instructions to ensure that the mask is moved to
the correct destination register and that the source operand is left intact.)
Processors with "CPUID.1H:ECX.AVX =1" implement the full complement of 32 predicates shown in Table 3-7, soft-
ware emulation is no longer needed. Compilers and assemblers may implement the following three-operand
pseudo-ops in addition to the four-operand VCMPSS instruction. See Table 3-9, where the notations of reg1 reg2,
and reg3 represent either XMM registers or YMM registers. Compiler should treat reserved Imm8 values as illegal
syntax. Alternately, intrinsics can map the pseudo-ops to pre-defined constants to support a simpler intrinsic inter-
face. Compilers and assemblers may implement three-operand pseudo-ops for EVEX encoded VCMPSS instructions
in a similar fashion by extending the syntax listed in Table 3-9.
                                    Table 3-9. Pseudo-Op and VCMPSS Implementation
:




    Pseudo-Op                                                CMPSS Implementation
    VCMPEQSS reg1, reg2, reg3                                VCMPSS reg1, reg2, reg3, 0
    VCMPLTSS reg1, reg2, reg3                                VCMPSS reg1, reg2, reg3, 1
    VCMPLESS reg1, reg2, reg3                                VCMPSS reg1, reg2, reg3, 2
    VCMPUNORDSS reg1, reg2, reg3                             VCMPSS reg1, reg2, reg3, 3
    VCMPNEQSS reg1, reg2, reg3                               VCMPSS reg1, reg2, reg3, 4
    VCMPNLTSS reg1, reg2, reg3                               VCMPSS reg1, reg2, reg3, 5
    VCMPNLESS reg1, reg2, reg3                               VCMPSS reg1, reg2, reg3, 6
    VCMPORDSS reg1, reg2, reg3                               VCMPSS reg1, reg2, reg3, 7
    VCMPEQ_UQSS reg1, reg2, reg3                             VCMPSS reg1, reg2, reg3, 8
    VCMPNGESS reg1, reg2, reg3                               VCMPSS reg1, reg2, reg3, 9
    VCMPNGTSS reg1, reg2, reg3                               VCMPSS reg1, reg2, reg3, 0AH
    VCMPFALSESS reg1, reg2, reg3                             VCMPSS reg1, reg2, reg3, 0BH
    VCMPNEQ_OQSS reg1, reg2, reg3                            VCMPSS reg1, reg2, reg3, 0CH
    VCMPGESS reg1, reg2, reg3                                VCMPSS reg1, reg2, reg3, 0DH



                                        Table 3-9. Pseudo-Op and VCMPSS Implementation
 Pseudo-Op                                                      CMPSS Implementation
 VCMPGTSS reg1, reg2, reg3                                      VCMPSS reg1, reg2, reg3, 0EH
 VCMPTRUESS reg1, reg2, reg3                                    VCMPSS reg1, reg2, reg3, 0FH
 VCMPEQ_OSSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 10H
 VCMPLT_OQSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 11H
 VCMPLE_OQSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 12H
 VCMPUNORD_SSS reg1, reg2, reg3                                 VCMPSS reg1, reg2, reg3, 13H
 VCMPNEQ_USSS reg1, reg2, reg3                                  VCMPSS reg1, reg2, reg3, 14H
 VCMPNLT_UQSS reg1, reg2, reg3                                  VCMPSS reg1, reg2, reg3, 15H
 VCMPNLE_UQSS reg1, reg2, reg3                                  VCMPSS reg1, reg2, reg3, 16H
 VCMPORD_SSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 17H
 VCMPEQ_USSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 18H
 VCMPNGE_UQSS reg1, reg2, reg3                                  VCMPSS reg1, reg2, reg3, 19H
 VCMPNGT_UQSS reg1, reg2, reg3                                  VCMPSS reg1, reg2, reg3, 1AH
 VCMPFALSE_OSSS reg1, reg2, reg3                                VCMPSS reg1, reg2, reg3, 1BH
 VCMPNEQ_OSSS reg1, reg2, reg3                                  VCMPSS reg1, reg2, reg3, 1CH
 VCMPGE_OQSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 1DH
 VCMPGT_OQSS reg1, reg2, reg3                                   VCMPSS reg1, reg2, reg3, 1EH
 VCMPTRUE_USSS reg1, reg2, reg3                                 VCMPSS reg1, reg2, reg3, 1FH

Software should ensure VCMPSS is encoded with VEX.L=0. Encoding VCMPSS with VEX.L=1 may encounter unpre-
dictable behavior across different processor generations.

Operation
CASE (COMPARISON PREDICATE) OF
   0: OP3 <-EQ_OQ; OP5 <-EQ_OQ;
   1: OP3 <-LT_OS; OP5 <-LT_OS;
   2: OP3 <-LE_OS; OP5 <-LE_OS;
   3: OP3 <-UNORD_Q; OP5 <-UNORD_Q;
   4: OP3 <-NEQ_UQ; OP5 <-NEQ_UQ;
   5: OP3 <-NLT_US; OP5 <-NLT_US;
   6: OP3 <-NLE_US; OP5 <-NLE_US;
   7: OP3 <-ORD_Q; OP5 <-ORD_Q;
   8: OP5 <-EQ_UQ;
   9: OP5 <-NGE_US;
   10: OP5 <-NGT_US;
   11: OP5 <-FALSE_OQ;
   12: OP5 <-NEQ_OQ;
   13: OP5 <-GE_OS;
   14: OP5 <-GT_OS;
   15: OP5 <-TRUE_UQ;
   16: OP5 <-EQ_OS;
   17: OP5 <-LT_OQ;
   18: OP5 <-LE_OQ;
   19: OP5 <-UNORD_S;
   20: OP5 <-NEQ_US;
   21: OP5 <-NLT_UQ;



   22: OP5 <-NLE_UQ;
   23: OP5 <-ORD_S;
   24: OP5 <-EQ_US;
   25: OP5 <-NGE_UQ;
   26: OP5 <-NGT_UQ;
   27: OP5 <-FALSE_OS;
   28: OP5 <-NEQ_OS;
   29: OP5 <-GE_OQ;
   30: OP5 <-GT_OQ;
   31: OP5 <-TRUE_US;
   DEFAULT: Reserved
ESAC;

VCMPSS (EVEX encoded version)
CMP0 <- SRC1[31:0] OP5 SRC2[31:0];

IF k2[0] or *no writemask*
    THEN      IF CMP0 = TRUE
                   THEN DEST[0] <- 1;
                   ELSE DEST[0] <- 0; FI;
    ELSE      DEST[0] <- 0                ; zeroing-masking only
FI;
DEST[MAX_KL-1:1] <- 0

CMPSS (128-bit Legacy SSE version)
CMP0 <-DEST[31:0] OP3 SRC[31:0];
IF CMP0 = TRUE
THEN DEST[31:0] <-FFFFFFFFH;
ELSE DEST[31:0] <-00000000H; FI;
DEST[MAX_VL-1:32] (Unmodified)

VCMPSS (VEX.128 encoded version)
CMP0 <-SRC1[31:0] OP5 SRC2[31:0];
IF CMP0 = TRUE
THEN DEST[31:0] <-FFFFFFFFH;
ELSE DEST[31:0] <-00000000H; FI;
DEST[127:32] <-SRC1[127:32]
DEST[MAX_VL-1:128] <-0

Intel C/C++ Compiler Intrinsic Equivalent
VCMPSS __mmask8 _mm_cmp_ss_mask( __m128 a, __m128 b, int imm);
VCMPSS __mmask8 _mm_cmp_round_ss_mask( __m128 a, __m128 b, int imm, int sae);
VCMPSS __mmask8 _mm_mask_cmp_ss_mask( __mmask8 k1, __m128 a, __m128 b, int imm);
VCMPSS __mmask8 _mm_mask_cmp_round_ss_mask( __mmask8 k1, __m128 a, __m128 b, int imm, int sae);
(V)CMPSS __m128 _mm_cmp_ss(__m128 a, __m128 b, const int imm)

SIMD Floating-Point Exceptions
Invalid if SNaN operand, Invalid if QNaN and predicate as listed in Table 3-1, Denormal.

Other Exceptions
VEX-encoded instructions, see Exceptions Type 3.
EVEX-encoded instructions, see Exceptions Type E3.






