Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, M-U

STAC-Set AC Flag in EFLAGS Register

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 01 CB

V/V

SMAP

Set the AC flag in the EFLAGS register.

STAC

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Sets the AC flag bit in EFLAGS register. This may enable alignment checking of user-mode data accesses. This

allows explicit supervisor-mode data accesses to user-mode pages even if the SMAP bit is set in the CR4 register.

This instruction's operation is the same in non-64-bit modes and 64-bit mode. Attempts to execute STAC when

CPL > 0 cause #UD.

Operation

EFLAGS.AC := 1;

Flags Affected

AC set. Other flags are unaffected.

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If the CPL > 0.

If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

Virtual-8086 Mode Exceptions

#UD

The STAC instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

If the LOCK prefix is used.

If the CPL > 0.

If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If the CPL > 0.

If CPUID.(EAX=07H, ECX=0H):EBX.SMAP[bit 20] = 0.

STAC-Set AC Flag in EFLAGS Register

Vol. 2B

4-659

INSTRUCTION SET REFERENCE, M-U

STI-Set Interrupt Flag

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

STI

Valid

Set interrupt flag; external, maskable

interrupts enabled at the end of the next

instruction.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

In most cases, STI sets the interrupt flag (IF) in the EFLAGS register. This allows the processor to respond to

maskable hardware interrupts.

If IF = 0, maskable hardware interrupts remain inhibited on the instruction boundary following an execution of STI.

(The delayed effect of this instruction is provided to allow interrupts to be enabled just before returning from a

procedure or subroutine. For instance, if an STI instruction is followed by an RET instruction, the RET instruction is

allowed to execute before external interrupts are recognized. No interrupts can be recognized if an execution of CLI

immediately follow such an execution of STI.) The inhibition ends after delivery of another event (e.g., exception)

or the execution of the next instruction.

The IF flag and the STI and CLI instructions do not prohibit the generation of exceptions and nonmaskable inter-

rupts (NMIs). However, NMIs (and system-management interrupts) may be inhibited on the instruction boundary

following an execution of STI that begins with IF = 0.

Operation is different in two modes defined as follows:

• PVI mode (protected-mode virtual interrupts): CR0.PE = 1, EFLAGS.VM = 0, CPL = 3, and CR4.PVI = 1;

• VME mode (virtual-8086 mode extensions): CR0.PE = 1, EFLAGS.VM = 1, and CR4.VME = 1.

If IOPL < 3, EFLAGS.VIP = 1, and either VME mode or PVI mode is active, STI sets the VIF flag in the EFLAGS

Table 4-19 indicates the action of the STI instruction depending on the processor operating mode, IOPL, CPL, and

EFLAGS.VIP.

Table 4-19. Decision Table for STI Results

Mode

IOPL

EFLAGS.VIP

STI Result

Real-address

X¹

IF = 1

≥ CPL

IF = 1

Protected, not PVI²

< CPL

#GP fault

IF = 1

Protected, PVI³

VIF = 1

0-2

#GP fault

IF = 1

Virtual-8086, not VME³

0-2

#GP fault

IF = 1

Virtual-8086, VME³

VIF = 1

0-2

#GP fault

NOTES:

1. X = This setting has no effect on instruction operation.

4-662

Vol. 2B

STI-Set Interrupt Flag

INSTRUCTION SET REFERENCE, M-U

2. For this table, “protected mode” applies whenever CR0.PE = 1 and EFLAGS.VM = 0; it includes compatibility mode and 64-bit mode.

3. PVI mode and virtual-8086 mode each imply CPL = 3.

Operation

IF CR0.PE = 0 (* Executing in real-address mode *)

THEN IF := 1; (* Set Interrupt Flag *)

ELSE

IF IOPL ≥ CPL (* CPL = 3 if EFLAGS.VM = 1 *)

THEN IF := 1; (* Set Interrupt Flag *)

ELSE

IF VME mode OR PVI mode

THEN

IF EFLAGS.VIP = 0

THEN VIF := 1; (* Set Virtual Interrupt Flag *)

ELSE #GP(0);

FI;

ELSE #GP(0);

FI;

Flags Affected

Either the IF flag or the VIF flag is set to 1. Other flags are unaffected.

Protected Mode Exceptions

#GP(0)

If CPL is greater than IOPL and PVI mode is not active.

If CPL is greater than IOPL and EFLAGS.VIP = 1.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If IOPL is less than 3 and VME mode is not active.

If IOPL is less than 3 and EFLAGS.VIP = 1.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode.

STI-Set Interrupt Flag

Vol. 2B

4-663

INSTRUCTION SET REFERENCE, M-U

STMXCSR-Store MXCSR Register State

Opcode*/

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F AE /3

V/V

SSE

Store contents of MXCSR register to m32.

STMXCSR m32

VEX.LZ.0F.WIG AE /3

V/V

AVX

Store contents of MXCSR register to m32.

VSTMXCSR m32

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the contents of the MXCSR control and status register to the destination operand. The destination operand

is a 32-bit memory location. The reserved bits in the MXCSR register are stored as 0s.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

VEX.L must be 0, otherwise instructions will #UD.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

m32 := MXCSR;

Intel C/C++ Compiler Intrinsic Equivalent

_mm_getcsr(void)

SIMD Floating-Point Exceptions

None.

Other Exceptions

See Table 2-22, “Type 5 Class Exception Conditions,” additionally:

#UD

If VEX.L= 1,

If VEX.vvvv ≠ 1111B.

4-664

Vol. 2B

STMXCSR-Store MXCSR Register State

INSTRUCTION SET REFERENCE, M-U

STOS/STOSB/STOSW/STOSD/STOSQ-Store String

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

STOS m8

Valid

For legacy mode, store AL at address ES:(E)DI; For 64-

bit mode store AL at address RDI or EDI.

STOS m16

Valid

For legacy mode, store AX at address ES:(E)DI; For 64-

bit mode store AX at address RDI or EDI.

STOS m32

Valid

For legacy mode, store EAX at address ES:(E)DI; For

64-bit mode store EAX at address RDI or EDI.

REX.W + AB

STOS m64

Valid

N.E.

Store RAX at address RDI or EDI.

STOSB

Valid

For legacy mode, store AL at address ES:(E)DI; For 64-

bit mode store AL at address RDI or EDI.

STOSW

Valid

For legacy mode, store AX at address ES:(E)DI; For 64-

bit mode store AX at address RDI or EDI.

STOSD

Valid

For legacy mode, store EAX at address ES:(E)DI; For

64-bit mode store EAX at address RDI or EDI.

REX.W + AB

STOSQ

Valid

N.E.

Store RAX at address RDI or EDI.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

In non-64-bit and default 64-bit mode; stores a byte, word, or doubleword from the AL, AX, or EAX register

(respectively) into the destination operand. The destination operand is a memory location, the address of which is

read from either the ES:EDI or ES:DI register (depending on the address-size attribute of the instruction and the

mode of operation). The ES segment cannot be overridden with a segment override prefix.

At the assembly-code level, two forms of the instruction are allowed: the “explicit-operands” form and the “no-

operands” form. The explicit-operands form (specified with the STOS mnemonic) allows the destination operand to

be specified explicitly. Here, the destination operand should be a symbol that indicates the size and location of the

destination value. The source operand is then automatically selected to match the size of the destination operand

(the AL register for byte operands, AX for word operands, EAX for doubleword operands). The explicit-operands

form is provided to allow documentation; however, note that the documentation provided by this form can be

misleading. That is, the destination operand symbol must specify the correct type (size) of the operand (byte,

word, or doubleword), but it does not have to specify the correct location. The location is always specified by the

ES:(E)DI register. These must be loaded correctly before the store string instruction is executed.

The no-operands form provides “short forms” of the byte, word, doubleword, and quadword versions of the STOS

instructions. Here also ES:(E)DI is assumed to be the destination operand and AL, AX, or EAX is assumed to be the

source operand. The size of the destination and source operands is selected by the mnemonic: STOSB (byte read

from register AL), STOSW (word from AX), STOSD (doubleword from EAX).

After the byte, word, or doubleword is transferred from the register to the memory location, the (E)DI register is

incremented or decremented according to the setting of the DF flag in the EFLAGS register. If the DF flag is 0, the

by 1 for byte operations, by 2 for word operations, by 4 for doubleword operations).

NOTE

To improve performance, more recent processors support modifications to the processor’s

operation during the string store operations initiated with STOS and STOSB. See Section 7.3.9.3 in

the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for additional

information on fast-string operation.

STOS/STOSB/STOSW/STOSD/STOSQ-Store String

Vol. 2B

4-665

INSTRUCTION SET REFERENCE, M-U

In 64-bit mode, the default address size is 64 bits, 32-bit address size is supported using the prefix 67H. Using a

REX prefix in the form of REX.W promotes operation on doubleword operand to 64 bits. The promoted no-operand

mnemonic is STOSQ. STOSQ (and its explicit operands variant) store a quadword from the RAX register into the

destination addressed by RDI or EDI. See the summary chart at the beginning of this section for encoding data and

limits.

The STOS, STOSB, STOSW, STOSD, STOSQ instructions can be preceded by the REP prefix for block stores of ECX

bytes, words, or doublewords. More often, however, these instructions are used within a LOOP construct because

data needs to be moved into the AL, AX, or EAX register before it can be stored. See “REP/REPE/REPZ

/REPNE/REPNZ-Repeat String Operation Prefix” in this chapter for a description of the REP prefix.

Operation

Non-64-bit Mode:

IF (Byte store)

THEN

DEST := AL;

THEN IF DF = 0

THEN (E)DI := (E)DI + 1;

ELSE (E)DI := (E)DI - 1;

FI;

ELSE IF (Word store)

THEN

DEST := AX;

THEN IF DF = 0

THEN (E)DI := (E)DI + 2;

ELSE (E)DI := (E)DI - 2;

FI;

ELSE IF (Doubleword store)

THEN

DEST := EAX;

THEN IF DF = 0

THEN (E)DI := (E)DI + 4;

ELSE (E)DI := (E)DI - 4;

FI;

64-bit Mode:

IF (Byte store)

THEN

DEST := AL;

THEN IF DF = 0

THEN (R|E)DI := (R|E)DI + 1;

ELSE (R|E)DI := (R|E)DI - 1;

FI;

ELSE IF (Word store)

THEN

DEST := AX;

THEN IF DF = 0

THEN (R|E)DI := (R|E)DI + 2;

ELSE (R|E)DI := (R|E)DI - 2;

FI;

ELSE IF (Doubleword store)

4-666

Vol. 2B

STOS/STOSB/STOSW/STOSD/STOSQ-Store String

INSTRUCTION SET REFERENCE, M-U

THEN

DEST := EAX;

THEN IF DF = 0

THEN (R|E)DI := (R|E)DI + 4;

ELSE (R|E)DI := (R|E)DI - 4;

FI;

ELSE IF (Quadword store using REX.W )

THEN

DEST := RAX;

THEN IF DF = 0

THEN (R|E)DI := (R|E)DI + 8;

ELSE (R|E)DI := (R|E)DI - 8;

FI;

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the limit of the ES segment.

If the ES register contains a NULL segment selector.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the ES segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the ES segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

STOS/STOSB/STOSW/STOSD/STOSQ-Store String

Vol. 2B

4-667

INSTRUCTION SET REFERENCE, M-U

STR-Store Task Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 00 /1

STR r/m16

Valid

Stores segment selector from TR in r/m16.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

N/A

Description

Stores the segment selector from the task register (TR) in the destination operand. The destination operand can be

a general-purpose register or a memory location. The segment selector stored with this instruction points to the

task state segment (TSS) for the currently running task.

When the destination operand is a 32-bit register, the 16-bit segment selector is copied into the lower 16 bits of the

segment selector is written to memory as a 16-bit quantity, regardless of operand size.

In 64-bit mode, operation is the same. The size of the memory operand is fixed at 16 bits. In register stores, the 2-

byte TR is zero extended if stored to a 64-bit register.

The STR instruction is useful only in operating-system software. It can only be executed in protected mode.

Operation

DEST := TR(SegmentSelector);

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If the destination is a memory operand that is located in a non-writable segment or if the

effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If CR4.UMIP = 1 and CPL > 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

The STR instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The STR instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

4-668

Vol. 2B

STR-Store Task Register

INSTRUCTION SET REFERENCE, M-U

STTILECFG-Store Tile Configuration

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.66.0F38.W0 49 !(11):000:bbb

V/N.E.

AMX-TILE

Store tile configuration in m512.

STTILECFG m512

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:r/m (w)

N/A

Description

The STTILECFG instruction takes a pointer to a 64-byte memory location (described in Table 3-10 in the “LDTI-

LECFG-Load Tile Configuration” entry) that will, after successful execution of this instruction, contain the descrip-

tion of the tiles that were configured. In order to configure tiles, the AMX-TILE bit in CPUID must be set and the

operating system has to have enabled the tiles architecture.

If the tiles are not configured, then STTILECFG stores 64B of zeros to the indicated memory location.

Any attempt to execute the STTILECFG instruction inside an Intel TSX transaction will result in a transaction abort.

Operation

STTILECFG mem

if TILES_CONFIGURED == 0:

//write 64 bytes of zeros at mem pointer

buf[0..63] := 0

write_memory(mem, 64, buf)

else:

buf.byte[0] := tilecfg.palette_id

buf.byte[1] := tilecfg.start_row

buf.byte[2..15] := 0

p := 16

for n in 0 ... palette_table[tilecfg.palette_id].max_names-1:

buf.word[p/2] := tilecfg.t[n].colsb

p := p + 2

if p < 47:

buf.byte[p..47] := 0

p := 48

for n in 0 ... palette_table[tilecfg.palette_id].max_names-1:

buf.byte[p++] := tilecfg.t[n].rows

if p < 63:

buf.byte[p..63] := 0

write_memory(mem, 64, buf)

Intel C/C++ Compiler Intrinsic Equivalent

STTILECFGvoid _tile_storeconfig(void *);

Flags Affected

None.

4-670

Vol. 2B

STTILECFG-Store Tile Configuration

INSTRUCTION SET REFERENCE, M-U

STUI-Set User Interrupt Flag

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

F3 0F 01 EF

V/I

UINTR

Set user interrupt flag.

STUI

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

STUI sets the user interrupt flag (UIF). Its effect takes place immediately; a user interrupt may be delivered on the

instruction boundary following STUI. (This is in contrast with STI, whose effect is delayed by one instruction).

An execution of STUI inside a transactional region causes a transactional abort; the abort loads EAX as it would

have had it been due to an execution of STI.

Operation

UIF := 1;

Flags Affected

None.

Protected Mode Exceptions

#UD

The STUI instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD

The STUI instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The STUI instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

The STUI instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If executed inside an enclave.

If CR4.UINTR = 0.

If CPUID.07H.0H:EDX.UINTR[bit 5] = 0.

4-672

Vol. 2B

STUI-Set User Interrupt Flag

INSTRUCTION SET REFERENCE, M-U

SUB-Subtract

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

2C ib

SUB AL, imm8

Valid

Subtract imm8 from AL.

2D iw

SUB AX, imm16

Valid

Subtract imm16 from AX.

2D id

SUB EAX, imm32

Valid

Subtract imm32 from EAX.

REX.W + 2D id

SUB RAX, imm32

Valid

N.E.

Subtract imm32 sign-extended to 64-bits

from RAX.

80 /5 ib

SUB r/m8, imm8

Valid

Subtract imm8 from r/m8.

REX + 80 /5 ib

SUB r/m8¹, imm8

Valid

N.E.

Subtract imm8 from r/m8.

81 /5 iw

SUB r/m16, imm16

Valid

Subtract imm16 from r/m16.

81 /5 id

SUB r/m32, imm32

Valid

Subtract imm32 from r/m32.

REX.W + 81 /5 id

SUB r/m64, imm32

Valid

N.E.

Subtract imm32 sign-extended to 64-bits

from r/m64.

83 /5 ib

SUB r/m16, imm8

Valid

Subtract sign-extended imm8 from r/m16.

83 /5 ib

SUB r/m32, imm8

Valid

Subtract sign-extended imm8 from r/m32.

REX.W + 83 /5 ib

SUB r/m64, imm8

Valid

N.E.

Subtract sign-extended imm8 from r/m64.

28 /r

SUB r/m8, r8

Valid

Subtract r8 from r/m8.

REX + 28 /r

SUB r/m8¹, r8¹

Valid

N.E.

Subtract r8 from r/m8.

29 /r

SUB r/m16, r16

Valid

Subtract r16 from r/m16.

29 /r

SUB r/m32, r32

Valid

Subtract r32 from r/m32.

REX.W + 29 /r

SUB r/m64, r64

Valid

N.E.

Subtract r64 from r/m64.

2A /r

SUB r8, r/m8

Valid

Subtract r/m8 from r8.

REX + 2A /r

SUB r8¹, r/m8¹

Valid

N.E.

Subtract r/m8 from r8.

2B /r

SUB r16, r/m16

Valid

Subtract r/m16 from r16.

2B /r

SUB r32, r/m32

Valid

Subtract r/m32 from r32.

REX.W + 2B /r

SUB r64, r/m64

Valid

N.E.

Subtract r/m64 from r64.

NOTES:

1. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

AL/AX/EAX/RAX

imm8/16/32

N/A

ModRM:r/m (r, w)

imm8/16/32

N/A

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

Subtracts the second operand (source operand) from the first operand (destination operand) and stores the result

in the destination operand. The destination operand can be a register or a memory location; the source operand

can be an immediate, register, or memory location. (However, two memory operands cannot be used in one

instruction.) When an immediate value is used as an operand, it is sign-extended to the length of the destination

operand format.

SUB-Subtract

Vol. 2B

4-673

INSTRUCTION SET REFERENCE, M-U

The SUB instruction performs integer subtraction. It evaluates the result for both signed and unsigned integer

operands and sets the OF and CF flags to indicate an overflow in the signed or unsigned result, respectively. The SF

flag indicates the sign of the signed result.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

Operation

DEST := (DEST - SRC);

Flags Affected

The OF, SF, ZF, AF, PF, and CF flags are set according to the result.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

4-674

Vol. 2B

SUB-Subtract

INSTRUCTION SET REFERENCE, M-U

SUBPD-Subtract Packed Double Precision Floating-Point Values

Opcode/

Op/E

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 5C /r

V/V

SSE2

Subtract packed double precision floating-point values in

SUBPD xmm1, xmm2/m128

xmm2/mem from xmm1 and store result in xmm1.

VEX.128.66.0F.WIG 5C /r

V/V

AVX

Subtract packed double precision floating-point values in

VSUBPD xmm1,xmm2, xmm3/m128

xmm3/mem from xmm2 and store result in xmm1.

VEX.256.66.0F.WIG 5C /r

V/V

AVX

Subtract packed double precision floating-point values in

VSUBPD ymm1, ymm2, ymm3/m256

ymm3/mem from ymm2 and store result in ymm1.

EVEX.128.66.0F.W1 5C /r

V/V

AVX512VL

Subtract packed double precision floating-point values

VSUBPD xmm1 {k1}{z}, xmm2,

AVX512F

from xmm3/m128/m64bcst to xmm2 and store result in

xmm3/m128/m64bcst

xmm1 with writemask k1.

EVEX.256.66.0F.W1 5C /r

V/V

AVX512VL

Subtract packed double precision floating-point values

VSUBPD ymm1 {k1}{z}, ymm2,

AVX512F

from ymm3/m256/m64bcst to ymm2 and store result in

ymm3/m256/m64bcst

ymm1 with writemask k1.

EVEX.512.66.0F.W1 5C /r

V/V

AVX512F

Subtract packed double precision floating-point values

VSUBPD zmm1 {k1}{z}, zmm2,

from zmm3/m512/m64bcst to zmm2 and store result in

zmm3/m512/m64bcst{er}

zmm1 with writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a SIMD subtract of the two, four or eight packed double precision floating-point values of the second

Source operand from the first Source operand, and stores the packed double precision floating-point results in the

destination operand.

VEX.128 and EVEX.128 encoded versions: The second source operand is an XMM register or an 128-bit memory

location. The first source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corre-

sponding destination register are zeroed.

VEX.256 and EVEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory

location. The first source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corre-

sponding destination register are zeroed.

EVEX.512 encoded version: The second source operand is a ZMM register, a 512-bit memory location or a 512-bit

vector broadcasted from a 64-bit memory location. The first source operand and destination operands are ZMM

registers. The destination operand is conditionally updated according to the writemask.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper Bits (MAXVL-1:128) of the corresponding

SUBPD-Subtract Packed Double Precision Floating-Point Values

Vol. 2B

4-675

INSTRUCTION SET REFERENCE, M-U

Operation

VSUBPD (EVEX Encoded Versions When SRC2 Operand is a Vector Register)

(KL, VL) = (2, 128), (4, 256), (8, 512)

IF (VL = 512) AND (EVEX.b = 1)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask*

THEN DEST[i+63:i] := SRC1[i+63:i] - SRC2[i+63:i]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[63:0] remains unchanged*

ELSE

; zeroing-masking

DEST[63:0] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VSUBPD (EVEX Encoded Versions When SRC2 Operand is a Memory Source)

(KL, VL) = (2, 128), (4, 256), (8, 512)

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask* THEN

IF (EVEX.b = 1)

THEN DEST[i+63:i] := SRC1[i+63:i] - SRC2[63:0];

ELSE

EST[i+63:i] := SRC1[i+63:i] - SRC2[i+63:i];

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[63:0] remains unchanged*

ELSE

; zeroing-masking

DEST[63:0] := 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VSUBPD (VEX.256 Encoded Version)

DEST[63:0] := SRC1[63:0] - SRC2[63:0]

DEST[127:64] := SRC1[127:64] - SRC2[127:64]

DEST[191:128] := SRC1[191:128] - SRC2[191:128]

DEST[255:192] := SRC1[255:192] - SRC2[255:192]

DEST[MAXVL-1:256] := 0

4-676

Vol. 2B

SUBPD-Subtract Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

VSUBPD (VEX.128 Encoded Version)

DEST[63:0] := SRC1[63:0] - SRC2[63:0]

DEST[127:64] := SRC1[127:64] - SRC2[127:64]

DEST[MAXVL-1:128] := 0

SUBPD (128-bit Legacy SSE Version)

DEST[63:0] := DEST[63:0] - SRC[63:0]

DEST[127:64] := DEST[127:64] - SRC[127:64]

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSUBPD __m512d _mm512_sub_pd (__m512d a, __m512d b);

VSUBPD __m512d _mm512_mask_sub_pd (__m512d s, __mmask8 k, __m512d a, __m512d b);

VSUBPD __m512d _mm512_maskz_sub_pd (__mmask8 k, __m512d a, __m512d b);

VSUBPD __m512d _mm512_sub_round_pd (__m512d a, __m512d b, int);

VSUBPD __m512d _mm512_mask_sub_round_pd (__m512d s, __mmask8 k, __m512d a, __m512d b, int);

VSUBPD __m512d _mm512_maskz_sub_round_pd (__mmask8 k, __m512d a, __m512d b, int);

VSUBPD __m256d _mm256_sub_pd (__m256d a, __m256d b);

VSUBPD __m256d _mm256_mask_sub_pd (__m256d s, __mmask8 k, __m256d a, __m256d b);

VSUBPD __m256d _mm256_maskz_sub_pd (__mmask8 k, __m256d a, __m256d b);

SUBPD __m128d _mm_sub_pd (__m128d a, __m128d b);

VSUBPD __m128d _mm_mask_sub_pd (__m128d s, __mmask8 k, __m128d a, __m128d b);

VSUBPD __m128d _mm_maskz_sub_pd (__mmask8 k, __m128d a, __m128d b);

SIMD Floating-Point Exceptions

Overflow, Underflow, Invalid, Precision, Denormal.

Other Exceptions

VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions.”

EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions.”

SUBPD-Subtract Packed Double Precision Floating-Point Values

Vol. 2B

4-677

INSTRUCTION SET REFERENCE, M-U

SUBPS-Subtract Packed Single Precision Floating-Point Values

Opcode/

Op/E

64/32 bit

CPUID

Description

Instruction

Mode

Feature Flag

Support

NP 0F 5C /r

V/V

SSE

Subtract packed single precision floating-point values in

SUBPS xmm1, xmm2/m128

xmm2/mem from xmm1 and store result in xmm1.

VEX.128.0F.WIG 5C /r

V/V

AVX

Subtract packed single precision floating-point values in

VSUBPS xmm1,xmm2, xmm3/m128

xmm3/mem from xmm2 and stores result in xmm1.

VEX.256.0F.WIG 5C /r

V/V

AVX

Subtract packed single precision floating-point values in

VSUBPS ymm1, ymm2, ymm3/m256

ymm3/mem from ymm2 and stores result in ymm1.

EVEX.128.0F.W0 5C /r

V/V

AVX512VL

Subtract packed single precision floating-point values

VSUBPS xmm1 {k1}{z}, xmm2,

AVX512F

from xmm3/m128/m32bcst to xmm2 and stores result

xmm3/m128/m32bcst

in xmm1 with writemask k1.

EVEX.256.0F.W0 5C /r

V/V

AVX512VL

Subtract packed single precision floating-point values

VSUBPS ymm1 {k1}{z}, ymm2,

AVX512F

from ymm3/m256/m32bcst to ymm2 and stores result

ymm3/m256/m32bcst

in ymm1 with writemask k1.

EVEX.512.0F.W0 5C /r

V/V

AVX512F

Subtract packed single precision floating-point values in

VSUBPS zmm1 {k1}{z}, zmm2,

zmm3/m512/m32bcst from zmm2 and stores result in

zmm3/m512/m32bcst{er}

zmm1 with writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a SIMD subtract of the packed single precision floating-point values in the second Source operand from

the First Source operand, and stores the packed single precision floating-point results in the destination operand.

VEX.128 and EVEX.128 encoded versions: The second source operand is an XMM register or an 128-bit memory

location. The first source operand and destination operands are XMM registers. Bits (MAXVL-1:128) of the corre-

sponding destination register are zeroed.

VEX.256 and EVEX.256 encoded versions: The second source operand is an YMM register or an 256-bit memory

location. The first source operand and destination operands are YMM registers. Bits (MAXVL-1:256) of the corre-

sponding destination register are zeroed.

EVEX.512 encoded version: The second source operand is a ZMM register, a 512-bit memory location or a 512-bit

vector broadcasted from a 32-bit memory location. The first source operand and destination operands are ZMM

registers. The destination operand is conditionally updated according to the writemask.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper Bits (MAXVL-1:128) of the corresponding

Operation

VSUBPS (EVEX Encoded Versions When SRC2 Operand is a Vector Register)

(KL, VL) = (4, 128), (8, 256), (16, 512)

IF (VL = 512) AND (EVEX.b = 1)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

4-678

Vol. 2B

SUBPS-Subtract Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

FI;

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask*

THEN DEST[i+31:i] := SRC1[i+31:i] - SRC2[i+31:i]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[31:0] remains unchanged*

ELSE

; zeroing-masking

DEST[31:0] := 0

FI;

ENDFOR;

DEST[MAXVL-1:VL] := 0

VSUBPS (EVEX Encoded Versions When SRC2 Operand is a Memory Source)

(KL, VL) = (4, 128), (8, 256),(16, 512)

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask* THEN

IF (EVEX.b = 1)

THEN DEST[i+31:i] := SRC1[i+31:i] - SRC2[31:0];

ELSE

DEST[i+31:i] := SRC1[i+31:i] - SRC2[i+31:i];

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[31:0] remains unchanged*

ELSE

; zeroing-masking

DEST[31:0] := 0

FI;

ENDFOR;

DEST[MAXVL-1:VL] := 0

VSUBPS (VEX.256 Encoded Version)

DEST[31:0] := SRC1[31:0] - SRC2[31:0]

DEST[63:32] := SRC1[63:32] - SRC2[63:32]

DEST[95:64] := SRC1[95:64] - SRC2[95:64]

DEST[127:96] := SRC1[127:96] - SRC2[127:96]

DEST[159:128] := SRC1[159:128] - SRC2[159:128]

DEST[191:160] := SRC1[191:160] - SRC2[191:160]

DEST[223:192] := SRC1[223:192] - SRC2[223:192]

DEST[255:224] := SRC1[255:224] - SRC2[255:224].

DEST[MAXVL-1:256] := 0

VSUBPS (VEX.128 Encoded Version)

DEST[31:0] := SRC1[31:0] - SRC2[31:0]

DEST[63:32] := SRC1[63:32] - SRC2[63:32]

DEST[95:64] := SRC1[95:64] - SRC2[95:64]

DEST[127:96] := SRC1[127:96] - SRC2[127:96]

DEST[MAXVL-1:128] := 0

SUBPS-Subtract Packed Single Precision Floating-Point Values

Vol. 2B

4-679

INSTRUCTION SET REFERENCE, M-U

SUBPS (128-bit Legacy SSE Version)

DEST[31:0] := SRC1[31:0] - SRC2[31:0]

DEST[63:32] := SRC1[63:32] - SRC2[63:32]

DEST[95:64] := SRC1[95:64] - SRC2[95:64]

DEST[127:96] := SRC1[127:96] - SRC2[127:96]

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSUBPS __m512 _mm512_sub_ps (__m512 a, __m512 b);

VSUBPS __m512 _mm512_mask_sub_ps (__m512 s, __mmask16 k, __m512 a, __m512 b);

VSUBPS __m512 _mm512_maskz_sub_ps (__mmask16 k, __m512 a, __m512 b);

VSUBPS __m512 _mm512_sub_round_ps (__m512 a, __m512 b, int);

VSUBPS __m512 _mm512_mask_sub_round_ps (__m512 s, __mmask16 k, __m512 a, __m512 b, int);

VSUBPS __m512 _mm512_maskz_sub_round_ps (__mmask16 k, __m512 a, __m512 b, int);

VSUBPS __m256 _mm256_sub_ps (__m256 a, __m256 b);

VSUBPS __m256 _mm256_mask_sub_ps (__m256 s, __mmask8 k, __m256 a, __m256 b);

VSUBPS __m256 _mm256_maskz_sub_ps (__mmask16 k, __m256 a, __m256 b);

SUBPS __m128 _mm_sub_ps (__m128 a, __m128 b);

VSUBPS __m128 _mm_mask_sub_ps (__m128 s, __mmask8 k, __m128 a, __m128 b);

VSUBPS __m128 _mm_maskz_sub_ps (__mmask16 k, __m128 a, __m128 b);

SIMD Floating-Point Exceptions

Overflow, Underflow, Invalid, Precision, Denormal.

Other Exceptions

VEX-encoded instructions, see Table 2-19, “Type 2 Class Exception Conditions.”

EVEX-encoded instructions, see Table 2-46, “Type E2 Class Exception Conditions.”

4-680

Vol. 2B

SUBPS-Subtract Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, M-U

SUBSD-Subtract Scalar Double Precision Floating-Point Value

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F2 0F 5C /r

V/V

SSE2

Subtract the low double precision floating-point value in

SUBSD xmm1, xmm2/m64

xmm2/m64 from xmm1 and store the result in xmm1.

VEX.LIG.F2.0F.WIG 5C /r

V/V

AVX

Subtract the low double precision floating-point value in

VSUBSD xmm1,xmm2, xmm3/m64

xmm3/m64 from xmm2 and store the result in xmm1.

EVEX.LLIG.F2.0F.W1 5C /r

V/V

AVX512F

Subtract the low double precision floating-point value in

VSUBSD xmm1 {k1}{z}, xmm2,

xmm3/m64 from xmm2 and store the result in xmm1

xmm3/m64{er}

under writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Tuple1 Scalar

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Subtract the low double precision floating-point value in the second source operand from the first source operand

and stores the double precision floating-point result in the low quadword of the destination operand.

The second source operand can be an XMM register or a 64-bit memory location. The first source and destination

operands are XMM registers.

128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL-1:64) of the

corresponding destination register remain unchanged.

VEX.128 and EVEX encoded versions: Bits (127:64) of the XMM register destination are copied from corresponding

bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed.

EVEX encoded version: The low quadword element of the destination operand is updated according to the write-

mask.

Software should ensure VSUBSD is encoded with VEX.L=0. Encoding VSUBSD with VEX.L=1 may encounter unpre-

dictable behavior across different processor generations.

Operation

VSUBSD (EVEX Encoded Version)

IF (SRC2 *is register*) AND (EVEX.b = 1)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

IF k1[0] or *no writemask*

THEN

DEST[63:0] := SRC1[63:0] - SRC2[63:0]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[63:0] remains unchanged*

ELSE

; zeroing-masking

THEN DEST[63:0] := 0

FI;

SUBSD-Subtract Scalar Double Precision Floating-Point Value

Vol. 2B

4-681

INSTRUCTION SET REFERENCE, M-U

DEST[127:64] := SRC1[127:64]

DEST[MAXVL-1:128] := 0

VSUBSD (VEX.128 Encoded Version)

DEST[63:0] := SRC1[63:0] - SRC2[63:0]

DEST[127:64] := SRC1[127:64]

DEST[MAXVL-1:128] := 0

SUBSD (128-bit Legacy SSE Version)

DEST[63:0] := DEST[63:0] - SRC[63:0]

DEST[MAXVL-1:64] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSUBSD __m128d _mm_mask_sub_sd (__m128d s, __mmask8 k, __m128d a, __m128d b);

VSUBSD __m128d _mm_maskz_sub_sd (__mmask8 k, __m128d a, __m128d b);

VSUBSD __m128d _mm_sub_round_sd (__m128d a, __m128d b, int);

VSUBSD __m128d _mm_mask_sub_round_sd (__m128d s, __mmask8 k, __m128d a, __m128d b, int);

VSUBSD __m128d _mm_maskz_sub_round_sd (__mmask8 k, __m128d a, __m128d b, int);

SUBSD __m128d _mm_sub_sd (__m128d a, __m128d b);

SIMD Floating-Point Exceptions

Overflow, Underflow, Invalid, Precision, Denormal.

Other Exceptions

VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions.”

EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions.”

4-682

Vol. 2B

SUBSD-Subtract Scalar Double Precision Floating-Point Value

INSTRUCTION SET REFERENCE, M-U

SUBSS-Subtract Scalar Single Precision Floating-Point Value

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

F3 0F 5C /r

V/V

SSE

Subtract the low single precision floating-point value in

SUBSS xmm1, xmm2/m32

xmm2/m32 from xmm1 and store the result in xmm1.

VEX.LIG.F3.0F.WIG 5C /r

V/V

AVX

Subtract the low single precision floating-point value in

VSUBSS xmm1,xmm2, xmm3/m32

xmm3/m32 from xmm2 and store the result in xmm1.

EVEX.LLIG.F3.0F.W0 5C /r

V/V

AVX512F

Subtract the low single precision floating-point value in

VSUBSS xmm1 {k1}{z}, xmm2,

xmm3/m32 from xmm2 and store the result in xmm1

xmm3/m32{er}

under writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Tuple1 Scalar

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Subtract the low single precision floating-point value from the second source operand and the first source operand

and store the double precision floating-point result in the low doubleword of the destination operand.

The second source operand can be an XMM register or a 32-bit memory location. The first source and destination

operands are XMM registers.

128-bit Legacy SSE version: The destination and first source operand are the same. Bits (MAXVL-1:32) of the

corresponding destination register remain unchanged.

VEX.128 and EVEX encoded versions: Bits (127:32) of the XMM register destination are copied from corresponding

bits in the first source operand. Bits (MAXVL-1:128) of the destination register are zeroed.

EVEX encoded version: The low doubleword element of the destination operand is updated according to the write-

mask.

Software should ensure VSUBSS is encoded with VEX.L=0. Encoding VSUBSD with VEX.L=1 may encounter unpre-

dictable behavior across different processor generations.

Operation

VSUBSS (EVEX Encoded Version)

IF (SRC2 *is register*) AND (EVEX.b = 1)

THEN

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(EVEX.RC);

ELSE

SET_ROUNDING_MODE_FOR_THIS_INSTRUCTION(MXCSR.RC);

FI;

IF k1[0] or *no writemask*

THEN

DEST[31:0] := SRC1[31:0] - SRC2[31:0]

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[31:0] remains unchanged*

ELSE

; zeroing-masking

THEN DEST[31:0] := 0

FI;

SUBSS-Subtract Scalar Single Precision Floating-Point Value

Vol. 2B

4-683

INSTRUCTION SET REFERENCE, M-U

DEST[127:32] := SRC1[127:32]

DEST[MAXVL-1:128] := 0

VSUBSS (VEX.128 Encoded Version)

DEST[31:0] := SRC1[31:0] - SRC2[31:0]

DEST[127:32] := SRC1[127:32]

DEST[MAXVL-1:128] := 0

SUBSS (128-bit Legacy SSE Version)

DEST[31:0] := DEST[31:0] - SRC[31:0]

DEST[MAXVL-1:32] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VSUBSS __m128 _mm_mask_sub_ss (__m128 s, __mmask8 k, __m128 a, __m128 b);

VSUBSS __m128 _mm_maskz_sub_ss (__mmask8 k, __m128 a, __m128 b);

VSUBSS __m128 _mm_sub_round_ss (__m128 a, __m128 b, int);

VSUBSS __m128 _mm_mask_sub_round_ss (__m128 s, __mmask8 k, __m128 a, __m128 b, int);

VSUBSS __m128 _mm_maskz_sub_round_ss (__mmask8 k, __m128 a, __m128 b, int);

SUBSS __m128 _mm_sub_ss (__m128 a, __m128 b);

SIMD Floating-Point Exceptions

Overflow, Underflow, Invalid, Precision, Denormal.

Other Exceptions

VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions.”

EVEX-encoded instructions, see Table 2-47, “Type E3 Class Exception Conditions.”

4-684

Vol. 2B

SUBSS-Subtract Scalar Single Precision Floating-Point Value

INSTRUCTION SET REFERENCE, M-U

SWAPGS-Swap GS Base Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 01 F8

SWAPGS

Valid

Invalid

Exchanges the current GS base register value with

the value contained in MSR address C0000102H.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

SWAPGS exchanges the current GS base register value with the value contained in MSR address C0000102H

(IA32_KERNEL_GS_BASE). The SWAPGS instruction is a privileged instruction intended for use by system soft-

ware.

When using SYSCALL to implement system calls, there is no kernel stack at the OS entry point. Neither is there a

straightforward method to obtain a pointer to kernel structures from which the kernel stack pointer could be read.

Thus, the kernel cannot save general purpose registers or reference memory.

By design, SWAPGS does not require any general purpose registers or memory operands. No registers need to be

saved before using the instruction. SWAPGS exchanges the CPL 0 data pointer from the IA32_KERNEL_GS_BASE

MSR with the GS base register. The kernel can then use the GS prefix on normal memory references to access

kernel data structures. Similarly, when the OS kernel is entered using an interrupt or exception (where the kernel

stack is already set up), SWAPGS can be used to quickly get a pointer to the kernel data structures.

The IA32_KERNEL_GS_BASE MSR itself is only accessible using RDMSR/WRMSR instructions. Those instructions

are only accessible at privilege level 0. The WRMSR instruction ensures that the IA32_KERNEL_GS_BASE MSR

contains a canonical address.

Operation

IF CS.L ≠ 1 (* Not in 64-Bit Mode *)

THEN

#UD; FI;

IF CPL ≠ 0

THEN #GP(0); FI;

tmp := GS.base;

GS.base := IA32_KERNEL_GS_BASE;

IA32_KERNEL_GS_BASE := tmp;

Flags Affected

None.

Protected Mode Exceptions

#UD

If Mode ≠ 64-Bit.

Real-Address Mode Exceptions

#UD

If Mode ≠ 64-Bit.

Virtual-8086 Mode Exceptions

#UD

If Mode ≠ 64-Bit.

SWAPGS-Swap GS Base Register

Vol. 2B

4-685

INSTRUCTION SET REFERENCE, M-U

SYSCALL-Fast System Call

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 05

SYSCALL

Valid

Invalid

Fast call to privilege level 0 system procedures.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

SYSCALL invokes an OS system-call handler at privilege level 0. It does so by loading RIP from the IA32_LSTAR

MSR (after saving the address of the instruction following SYSCALL into RCX). (The WRMSR instruction ensures

that the IA32_LSTAR MSR always contain a canonical address.)

SYSCALL also saves RFLAGS into R11 and then masks RFLAGS using the IA32_FMASK MSR (MSR address

C0000084H); specifically, the processor clears in RFLAGS every bit corresponding to a bit that is set in the

IA32_FMASK MSR.

SYSCALL loads the CS and SS selectors with values derived from bits 47:32 of the IA32_STAR MSR. However, the

CS and SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors.

Instead, the descriptor caches are loaded with fixed values. See the Operation section for details. It is the respon-

sibility of OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values corre-

spond to the fixed values loaded into the descriptor caches; the SYSCALL instruction does not ensure this

correspondence.

The SYSCALL instruction does not save the stack pointer (RSP). If the OS system-call handler will change the stack

pointer, it is the responsibility of software to save the previous value of the stack pointer. This might be done prior

to executing SYSCALL, with software restoring the stack pointer with the instruction following SYSCALL (which will

be executed after SYSRET). Alternatively, the OS system-call handler may save the stack pointer and restore it

before executing SYSRET.

When shadow stacks are enabled at a privilege level where the SYSCALL instruction is invoked, the SSP is saved to

the IA32_PL3_SSP MSR. If shadow stacks are enabled at privilege level 0, the SSP is loaded with 0. Refer to

Chapter 6, “Procedure Calls, Interrupts, and Exceptions‚” and Chapter 17, “Control-flow Enforcement Technology

(CET)‚” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for additional CET details.

Instruction ordering. Instructions following a SYSCALL may be fetched from memory before earlier instructions

complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSCALL have

completed execution (the later instructions may execute before data stored by the earlier instructions have

become globally visible).

Operation

IF (CS.L ≠ 1 ) or (IA32_EFER.LMA ≠ 1) or (IA32_EFER.SCE ≠ 1)

(* Not in 64-Bit Mode or SYSCALL/SYSRET not enabled in IA32_EFER *)

THEN #UD;

FI;

RCX := RIP;

(* Will contain address of next instruction *)

RIP := IA32_LSTAR;

R11 := RFLAGS;

RFLAGS := RFLAGS AND NOT(IA32_FMASK);

CS.Selector := IA32_STAR[47:32] AND FFFCH (* Operating system provides CS; RPL forced to 0 *)

(* Set rest of CS to a fixed value *)

CS.Base := 0;

(* Flat segment *)

CS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

CS.Type := 11;

(* Execute/read code, accessed *)

SYSCALL-Fast System Call

Vol. 2B

4-687

INSTRUCTION SET REFERENCE, M-U

CS.S := 1;

CS.DPL := 0;

CS.P := 1;

CS.L := 1;

(* Entry is to 64-bit mode *)

CS.D := 0;

(* Required if CS.L = 1 *)

CS.G := 1;

(* 4-KByte granularity *)

IF ShadowStackEnabled(CPL)

THEN (* adjust so bits 63:N get the value of bit N-1, where N is the CPU’s maximum linear-address width *)

IA32_PL3_SSP := LA_adjust(SSP);

(* With shadow stacks enabled the system call is supported from Ring 3 to Ring 0 *)

(* OS supporting Ring 0 to Ring 0 system calls or Ring 1/2 to ring 0 system call *)

(* Must preserve the contents of IA32_PL3_SSP to avoid losing ring 3 state *)

FI;

CPL := 0;

IF ShadowStackEnabled(CPL)

SSP := 0;

FI;

IF EndbranchEnabled(CPL)

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_S_CET.SUPPRESS = 0

FI;

SS.Selector := IA32_STAR[47:32] + 8;

(* SS just above CS *)

(* Set rest of SS to a fixed value *)

SS.Base := 0;

(* Flat segment *)

SS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

SS.Type := 3;

(* Read/write data, accessed *)

SS.S := 1;

SS.DPL := 0;

SS.P := 1;

SS.B := 1;

(* 32-bit stack segment *)

SS.G := 1;

(* 4-KByte granularity *)

Flags Affected

All.

Protected Mode Exceptions

#UD

The SYSCALL instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD

The SYSCALL instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The SYSCALL instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

The SYSCALL instruction is not recognized in compatibility mode.

4-688

Vol. 2B

SYSCALL-Fast System Call

INSTRUCTION SET REFERENCE, M-U

SYSENTER-Fast System Call

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 34

SYSENTER

Valid

Fast call to privilege level 0 system procedures.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Executes a fast call to a level 0 system procedure or routine. SYSENTER is a companion instruction to SYSEXIT. The

instruction is optimized to provide the maximum performance for system calls from user code running at privilege

level 3 to operating system or executive procedures running at privilege level 0.

When executed in IA-32e mode, the SYSENTER instruction transitions the logical processor to 64-bit mode; other-

wise, the logical processor remains in protected mode.

Prior to executing the SYSENTER instruction, software must specify the privilege level 0 code segment and code

entry point, and the privilege level 0 stack segment and stack pointer by writing values to the following MSRs:

• IA32_SYSENTER_CS (MSR address 174H) - The lower 16 bits of this MSR are the segment selector for the

privilege level 0 code segment. This value is also used to determine the segment selector of the privilege level

0 stack segment (see the Operation section). This value cannot indicate a null selector.

• IA32_SYSENTER_EIP (MSR address 176H) - The value of this MSR is loaded into RIP (thus, this value

references the first instruction of the selected operating procedure or routine). In protected mode, only

bits 31:0 are loaded.

• IA32_SYSENTER_ESP (MSR address 175H) - The value of this MSR is loaded into RSP (thus, this value

contains the stack pointer for the privilege level 0 stack). This value cannot represent a non-canonical address.

In protected mode, only bits 31:0 are loaded.

These MSRs can be read from and written to using RDMSR/WRMSR. The WRMSR instruction ensures that the

IA32_SYSENTER_EIP and IA32_SYSENTER_ESP MSRs always contain canonical addresses.

While SYSENTER loads the CS and SS selectors with values derived from the IA32_SYSENTER_CS MSR, the CS and

SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors. Instead,

the descriptor caches are loaded with fixed values. See the Operation section for details. It is the responsibility of

OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values correspond to the

fixed values loaded into the descriptor caches; the SYSENTER instruction does not ensure this correspondence.

The SYSENTER instruction can be invoked from all operating modes except real-address mode.

The SYSENTER and SYSEXIT instructions are companion instructions, but they do not constitute a call/return pair.

When executing a SYSENTER instruction, the processor does not save state information for the user code (e.g., the

instruction pointer), and neither the SYSENTER nor the SYSEXIT instruction supports passing parameters on the

stack.

To use the SYSENTER and SYSEXIT instructions as companion instructions for transitions between privilege level 3

code and privilege level 0 operating system procedures, the following conventions must be followed:

• The segment descriptors for the privilege level 0 code and stack segments and for the privilege level 3 code and

stack segments must be contiguous in a descriptor table. This convention allows the processor to compute the

segment selectors from the value entered in the SYSENTER_CS_MSR MSR.

• The fast system call “stub” routines executed by user code (typically in shared libraries or DLLs) must save the

required return IP and processor state information if a return to the calling procedure is required. Likewise, the

operating system or executive procedures called with SYSENTER instructions must have access to and use this

saved return and state information when returning to the user code.

The SYSENTER and SYSEXIT instructions were introduced into the IA-32 architecture in the Pentium II processor.

The availability of these instructions on a processor is indicated with the SYSENTER/SYSEXIT present (SEP) feature

4-690

Vol. 2B

SYSENTER-Fast System Call

INSTRUCTION SET REFERENCE, M-U

flag returned to the EDX register by the CPUID instruction. An operating system that qualifies the SEP flag must

also qualify the processor family and model to ensure that the SYSENTER/SYSEXIT instructions are actually

present. For example:

IF CPUID SEP bit is set

THEN IF (Family = 6) and (Model < 3) and (Stepping < 3)

THEN

SYSENTER/SYSEXIT_Not_Supported; FI;

ELSE

SYSENTER/SYSEXIT_Supported; FI;

FI;

When the CPUID instruction is executed on the Pentium Pro processor (model 1), the processor returns a the SEP

flag as set, but does not support the SYSENTER/SYSEXIT instructions.

When shadow stacks are enabled at privilege level where SYSENTER instruction is invoked, the SSP is saved to the

IA32_PL3_SSP MSR. If shadow stacks are enabled at privilege level 0, the SSP is loaded with 0. Refer to Chapter

6, “Procedure Calls, Interrupts, and Exceptions‚” and Chapter 17, “Control-flow Enforcement Technology (CET)‚” in

the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for additional CET details.

Instruction ordering. Instructions following a SYSENTER may be fetched from memory before earlier instructions

complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSENTER have

completed execution (the later instructions may execute before data stored by the earlier instructions have

become globally visible).

Operation

IF CR0.PE = 0 OR IA32_SYSENTER_CS[15:2] = 0 THEN #GP(0); FI;

RFLAGS.VM := 0;

(* Ensures protected mode execution *)

RFLAGS.IF := 0;

(* Mask interrupts *)

IF in IA-32e mode

THEN

RSP := IA32_SYSENTER_ESP;

RIP := IA32_SYSENTER_EIP;

ELSE

ESP := IA32_SYSENTER_ESP[31:0];

EIP := IA32_SYSENTER_EIP[31:0];

FI;

CS.Selector := IA32_SYSENTER_CS[15:0] AND FFFCH;

(* Operating system provides CS; RPL forced to 0 *)

(* Set rest of CS to a fixed value *)

CS.Base := 0;

(* Flat segment *)

CS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

CS.Type := 11;

(* Execute/read code, accessed *)

CS.S := 1;

CS.DPL := 0;

CS.P := 1;

IF in IA-32e mode

THEN

CS.L := 1;

(* Entry is to 64-bit mode *)

CS.D := 0;

(* Required if CS.L = 1 *)

ELSE

CS.L := 0;

CS.D := 1;

(* 32-bit code segment*)

FI;

CS.G := 1;

(* 4-KByte granularity *)

SYSENTER-Fast System Call

Vol. 2B

4-691

INSTRUCTION SET REFERENCE, M-U

IF ShadowStackEnabled(CPL)

THEN

IF IA32_EFER.LMA = 0

THEN IA32_PL3_SSP := SSP;

ELSE (* adjust so bits 63:N get the value of bit N-1, where N is the CPU’s maximum linear-address width *)

IA32_PL3_SSP := LA_adjust(SSP);

FI;

CPL := 0;

IF ShadowStackEnabled(CPL)

SSP := 0;

FI;

IF EndbranchEnabled(CPL)

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_S_CET.SUPPRESS = 0

FI;

SS.Selector := CS.Selector + 8;

(* SS just above CS *)

(* Set rest of SS to a fixed value *)

SS.Base := 0;

(* Flat segment *)

SS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

SS.Type := 3;

(* Read/write data, accessed *)

SS.S := 1;

SS.DPL := 0;

SS.P := 1;

SS.B := 1;

(* 32-bit stack segment*)

SS.G := 1;

(* 4-KByte granularity *)

Flags Affected

VM, IF (see Operation above).

Protected Mode Exceptions

#GP(0)

If IA32_SYSENTER_CS[15:2] = 0.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

The SYSENTER instruction is not recognized in real-address mode.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

Same exceptions as in protected mode.

4-692

Vol. 2B

SYSENTER-Fast System Call

INSTRUCTION SET REFERENCE, M-U

SYSEXIT-Fast Return from Fast System Call

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 35

SYSEXIT

Valid

Fast return to privilege level 3 user code.

REX.W + 0F 35

SYSEXIT

Valid

Fast return to 64-bit mode privilege level 3 user code.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Executes a fast return to privilege level 3 user code. SYSEXIT is a companion instruction to the SYSENTER instruc-

tion. The instruction is optimized to provide the maximum performance for returns from system procedures

executing at protections levels 0 to user procedures executing at protection level 3. It must be executed from code

executing at privilege level 0.

With a 64-bit operand size, SYSEXIT remains in 64-bit mode; otherwise, it either enters compatibility mode (if the

logical processor is in IA-32e mode) or remains in protected mode (if it is not).

Prior to executing SYSEXIT, software must specify the privilege level 3 code segment and code entry point, and the

privilege level 3 stack segment and stack pointer by writing values into the following MSR and general-purpose

registers:

• IA32_SYSENTER_CS (MSR address 174H) - Contains a 32-bit value that is used to determine the segment

selectors for the privilege level 3 code and stack segments (see the Operation section)

• RDX - The canonical address in this register is loaded into RIP (thus, this value references the first instruction

to be executed in the user code). If the return is not to 64-bit mode, only bits 31:0 are loaded.

• ECX - The canonical address in this register is loaded into RSP (thus, this value contains the stack pointer for

the privilege level 3 stack). If the return is not to 64-bit mode, only bits 31:0 are loaded.

The IA32_SYSENTER_CS MSR can be read from and written to using RDMSR and WRMSR.

While SYSEXIT loads the CS and SS selectors with values derived from the IA32_SYSENTER_CS MSR, the CS and

SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors. Instead,

the descriptor caches are loaded with fixed values. See the Operation section for details. It is the responsibility of

OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values correspond to the

fixed values loaded into the descriptor caches; the SYSEXIT instruction does not ensure this correspondence.

The SYSEXIT instruction can be invoked from all operating modes except real-address mode and virtual-8086

mode.

The SYSENTER and SYSEXIT instructions were introduced into the IA-32 architecture in the Pentium II processor.

The availability of these instructions on a processor is indicated with the SYSENTER/SYSEXIT present (SEP) feature

flag returned to the EDX register by the CPUID instruction. An operating system that qualifies the SEP flag must

also qualify the processor family and model to ensure that the SYSENTER/SYSEXIT instructions are actually

present. For example:

IF CPUID SEP bit is set

THEN IF (Family = 6) and (Model < 3) and (Stepping < 3)

THEN

SYSENTER/SYSEXIT_Not_Supported; FI;

ELSE

SYSENTER/SYSEXIT_Supported; FI;

FI;

When the CPUID instruction is executed on the Pentium Pro processor (model 1), the processor returns a the SEP

flag as set, but does not support the SYSENTER/SYSEXIT instructions.

SYSEXIT-Fast Return from Fast System Call

Vol. 2B

4-693

INSTRUCTION SET REFERENCE, M-U

When shadow stacks are enabled at privilege level 3 the instruction loads SSP with value from IA32_PL3_SSP MSR.

Refer to Chapter 6, “Interrupt and Exception Handling‚” and Chapter 17, “Control-flow Enforcement Technology

(CET)‚” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for additional CET details.

Instruction ordering. Instructions following a SYSEXIT may be fetched from memory before earlier instructions

complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSEXIT have

completed execution (the later instructions may execute before data stored by the earlier instructions have become

globally visible).

Operation

IF IA32_SYSENTER_CS[15:2] = 0 OR CR0.PE = 0 OR CPL ≠ 0 THEN #GP(0); FI;

IF operand size is 64-bit

THEN

(* Return to 64-bit mode *)

RSP := RCX;

RIP := RDX;

ELSE

(* Return to protected mode or compatibility mode *)

RSP := ECX;

RIP := EDX;

FI;

IF operand size is 64-bit

(* Operating system provides CS; RPL forced to 3 *)

THEN CS.Selector := IA32_SYSENTER_CS[15:0] + 32;

ELSE CS.Selector := IA32_SYSENTER_CS[15:0] + 16;

FI;

CS.Selector := CS.Selector OR 3;

(* RPL forced to 3 *)

(* Set rest of CS to a fixed value *)

CS.Base := 0;

(* Flat segment *)

CS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

CS.Type := 11;

(* Execute/read code, accessed *)

CS.S := 1;

CS.DPL := 3;

CS.P := 1;

IF operand size is 64-bit

THEN

(* return to 64-bit mode *)

CS.L := 1;

(* 64-bit code segment *)

CS.D := 0;

(* Required if CS.L = 1 *)

ELSE

(* return to protected mode or compatibility mode *)

CS.L := 0;

CS.D := 1;

(* 32-bit code segment*)

FI;

CS.G := 1;

(* 4-KByte granularity *)

CPL := 3;

IF ShadowStackEnabled(CPL)

THEN SSP := IA32_PL3_SSP;

FI;

SS.Selector := CS.Selector + 8;

(* SS just above CS *)

(* Set rest of SS to a fixed value *)

SS.Base := 0;

(* Flat segment *)

SS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

SS.Type := 3;

(* Read/write data, accessed *)

SS.S := 1;

SS.DPL := 3;

SS.P := 1;

SS.B := 1;

(* 32-bit stack segment*)

4-694

Vol. 2B

SYSEXIT-Fast Return from Fast System Call

INSTRUCTION SET REFERENCE, M-U

SYSRET-Return From Fast System Call

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 07

SYSRET

Valid

Invalid

Return to compatibility mode from fast

system call.

REX.W + 0F 07

SYSRET

Valid

Invalid

Return to 64-bit mode from fast system call.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

SYSRET is a companion instruction to the SYSCALL instruction. It returns from an OS system-call handler to user

code at privilege level 3. It does so by loading RIP from RCX and loading RFLAGS from R11.¹ With a 64-bit operand

size, SYSRET remains in 64-bit mode; otherwise, it enters compatibility mode and only the low 32 bits of the regis-

ters are loaded.

SYSRET loads the CS and SS selectors with values derived from bits 63:48 of the IA32_STAR MSR. However, the CS

and SS descriptor caches are not loaded from the descriptors (in GDT or LDT) referenced by those selectors.

Instead, the descriptor caches are loaded with fixed values. See the Operation section for details. It is the respon-

sibility of OS software to ensure that the descriptors (in GDT or LDT) referenced by those selector values corre-

spond to the fixed values loaded into the descriptor caches; the SYSRET instruction does not ensure this

correspondence.

The SYSRET instruction does not modify the stack pointer (ESP or RSP). For that reason, it is necessary for software

to switch to the user stack. The OS may load the user stack pointer (if it was saved after SYSCALL) before executing

SYSRET; alternatively, user code may load the stack pointer (if it was saved before SYSCALL) after receiving control

from SYSRET.

If the OS loads the stack pointer before executing SYSRET, it must ensure that the handler of any interrupt or

exception delivered between restoring the stack pointer and successful execution of SYSRET is not invoked with the

user stack. It can do so using approaches such as the following:

• External interrupts. The OS can prevent an external interrupt from being delivered by clearing EFLAGS.IF

before loading the user stack pointer.

• Nonmaskable interrupts (NMIs). The OS can ensure that the NMI handler is invoked with the correct stack by

using the interrupt stack table (IST) mechanism for gate 2 (NMI) in the IDT (see Section 6.14.5, “Interrupt

Stack Table,” in Intel^®64 and IA-32 Architectures Software Developer’s Manual, Volume 3A).

• General-protection exceptions (#GP). The SYSRET instruction generates #GP(0) if the value of RCX is not

canonical. The OS can address this possibility using one or more of the following approaches:

- Confirming that the value of RCX is canonical before executing SYSRET.

- Using paging to ensure that the SYSCALL instruction will never save a non-canonical value into RCX.

- Using the IST mechanism for gate 13 (#GP) in the IDT.

When shadow stacks are enabled at privilege level 3 the instruction loads SSP with value from IA32_PL3_SSP MSR.

Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions‚” and Chapter 17, “Control-flow Enforcement

Technology (CET)‚” in the Intel^® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1, for additional

CET details.

1. Regardless of the value of R11, the RF and VM flags are always 0 in RFLAGS after execution of SYSRET. In addition, all reserved bits

in RFLAGS retain the fixed values.

4-696

Vol. 2B

SYSRET-Return From Fast System Call

INSTRUCTION SET REFERENCE, M-U

Instruction ordering. Instructions following a SYSRET may be fetched from memory before earlier instructions

complete execution, but they will not execute (even speculatively) until all instructions prior to the SYSRET have

completed execution (the later instructions may execute before data stored by the earlier instructions have

become globally visible).

Operation

IF (CS.L ≠ 1 ) or (IA32_EFER.LMA ≠ 1) or (IA32_EFER.SCE ≠ 1)

(* Not in 64-Bit Mode or SYSCALL/SYSRET not enabled in IA32_EFER *)

THEN #UD; FI;

IF (CPL ≠ 0) THEN #GP(0); FI;

IF (operand size is 64-bit)

THEN (* Return to 64-Bit Mode *)

IF (RCX is not canonical) THEN #GP(0);

RIP := RCX;

ELSE (* Return to Compatibility Mode *)

RIP := ECX;

FI;

RFLAGS := (R11 & 3C7FD7H) | 2;

(* Clear RF, VM, reserved bits; set bit 1 *)

IF (operand size is 64-bit)

THEN CS.Selector := IA32_STAR[63:48]+16;

ELSE CS.Selector := IA32_STAR[63:48];

FI;

CS.Selector := CS.Selector OR 3;

(* RPL forced to 3 *)

(* Set rest of CS to a fixed value *)

CS.Base := 0;

(* Flat segment *)

CS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

CS.Type := 11;

(* Execute/read code, accessed *)

CS.S := 1;

CS.DPL := 3;

CS.P := 1;

IF (operand size is 64-bit)

THEN (* Return to 64-Bit Mode *)

CS.L := 1;

(* 64-bit code segment *)

CS.D := 0;

(* Required if CS.L = 1 *)

ELSE (* Return to Compatibility Mode *)

CS.L := 0;

(* Compatibility mode *)

CS.D := 1;

(* 32-bit code segment *)

FI;

CS.G := 1;

(* 4-KByte granularity *)

CPL := 3;

IF ShadowStackEnabled(CPL)

SSP := IA32_PL3_SSP;

FI;

SS.Selector := (IA32_STAR[63:48]+8) OR 3;

(* RPL forced to 3 *)

(* Set rest of SS to a fixed value *)

SS.Base := 0;

(* Flat segment *)

SS.Limit := FFFFFH;

(* With 4-KByte granularity, implies a 4-GByte limit *)

SS.Type := 3;

(* Read/write data, accessed *)

SS.S := 1;

SS.DPL := 3;

SS.P := 1;

SS.B := 1;

(* 32-bit stack segment*)

SS.G := 1;

(* 4-KByte granularity *)

SYSRET-Return From Fast System Call

Vol. 2B

4-697

INSTRUCTION SET REFERENCE, M-U

TDPBF16PS-Dot Product of BF16 Tiles Accumulated into Packed Single Precision Tile

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.F3.0F38.W0 5C 11:rrr:bbb

V/N.E.

AMX-BF16

Matrix multiply BF16 elements from tmm2 and

TDPBF16PS tmm1, tmm2, tmm3

tmm3, and accumulate the packed single

precision elements in tmm1.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

VEX.vvvv (r)

N/A

Description

This instruction performs a set of SIMD dot-products of two BF16 elements and accumulates the results into a

packed single precision tile. Each dword element in input tiles tmm2 and tmm3 is interpreted as a BF16 pair. For

each possible combination of (row of tmm2, column of tmm3), the instruction performs a set of SIMD dot-products

on all corresponding BF16 pairs (one pair from tmm2 and one pair from tmm3), adds the results of those dot-prod-

ucts, and then accumulates the result into the corresponding row and column of tmm1.

“Round to nearest even” rounding mode is used when doing each accumulation of the FMA. Output denormals are

always flushed to zero and input denormals are always treated as zero. MXCSR is not consulted nor updated.

Any attempt to execute the TDPBF16PS instruction inside a TSX transaction will result in a transaction abort.

Operation

define make_fp32(x):

// The x parameter is bfloat16. Pack it in to upper 16b of a dword.

// The bit pattern is a legal fp32 value. Return that bit pattern.

dword: = 0

dword[31:16] := x

return dword

TDPBF16PS tsrcdest, tsrc1, tsrc2

// C = m x n (tsrcdest), A = m x k (tsrc1), B = k x n (tsrc2)

# src1 and src2 elements are pairs of bfloat16

elements_src1 := tsrc1.colsb / 4

elements_src2 := tsrc2.colsb / 4

elements_dest := tsrcdest.colsb / 4

elements_temp := tsrcdest.colsb / 2

// Count is in bfloat16 prior to horizontal

for m in 0 ... tsrcdest.rows-1:

temp1[ 0 ... elements_temp-1 ] := 0

for k in 0 ... elements_src1-1:

for n in 0 ... elements_dest-1:

// FP32 FMA with DAZ=FTZ=1, RNE rounding.

// MXCSR is neither consulted nor updated.

// No exceptions raised or denoted.

temp1.fp32[2*n+0] += make_fp32(tsrc1.row[m].bfloat16[2*k+0]) * make_fp32(tsrc2.row[k].bfloat16[2*n+0])

temp1.fp32[2*n+1] += make_fp32(tsrc1.row[m].bfloat16[2*k+1]) * make_fp32(tsrc2.row[k].bfloat16[2*n+1])

TDPBF16PS-Dot Product of BF16 Tiles Accumulated into Packed Single Precision Tile

Vol. 2B

4-699

INSTRUCTION SET REFERENCE, M-U

TDPBSSD/TDPBSUD/TDPBUSD/TDPBUUD-Dot Product of Signed/Unsigned Bytes with Dword

Accumulation

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.F2.0F38.W0 5E 11:rrr:bbb

V/N.E.

AMX-INT8

Matrix multiply signed byte elements from tmm2

TDPBSSD tmm1, tmm2, tmm3

by signed byte elements from tmm3 and

accumulate the dword elements in tmm1.

VEX.128.F3.0F38.W0 5E 11:rrr:bbb

V/N.E.

AMX-INT8

Matrix multiply signed byte elements from tmm2

TDPBSUD tmm1, tmm2, tmm3

by unsigned byte elements from tmm3 and

accumulate the dword elements in tmm1.

VEX.128.66.0F38.W0 5E 11:rrr:bbb

V/N.E.

AMX-INT8

Matrix multiply unsigned byte elements from

TDPBUSD tmm1, tmm2, tmm3

tmm2 by signed byte elements from tmm3 and

accumulate the dword elements in tmm1.

VEX.128.NP.0F38.W0 5E 11:rrr:bbb

V/N.E.

AMX-INT8

Matrix multiply unsigned byte elements from

TDPBUUD tmm1, tmm2, tmm3

tmm2 by unsigned byte elements from tmm3

and accumulate the dword elements in tmm1.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

VEX.vvvv (r)

N/A

Description

For each possible combination of (row of tmm2, column of tmm3), the instruction performs a set of SIMD dot-prod-

ucts on all corresponding four byte elements, one from tmm2 and one from tmm3, adds the results of those dot-

products, and then accumulates the result into the corresponding row and column of tmm1. Each dword in input

tiles tmm2 and tmm3 is interpreted as four byte elements. These may be signed or unsigned. Each letter in the

two-letter pattern SU, US, SS, UU indicates the signed/unsigned nature of the values in tmm2 and tmm3, respec-

tively.

Any attempt to execute the TDPBSSD/TDPBSUD/TDPBUSD/TDPBUUD instructions inside an Intel TSX transaction

will result in a transaction abort.

Operation

define DPBD(c,x,y):// arguments are dwords

if *x operand is signed*:

extend_src1 := SIGN_EXTEND

else:

extend_src1 := ZERO_EXTEND

if *y operand is signed*:

extend_src2 := SIGN_EXTEND

else:

extend_src2 := ZERO_EXTEND

p0dword := extend_src1(x.byte[0]) * extend_src2(y.byte[0])

p1dword := extend_src1(x.byte[1]) * extend_src2(y.byte[1])

p2dword := extend_src1(x.byte[2]) * extend_src2(y.byte[2])

p3dword := extend_src1(x.byte[3]) * extend_src2(y.byte[3])

c := c + p0dword + p1dword + p2dword + p3dword

TDPBSSD/TDPBSUD/TDPBUSD/TDPBUUD-Dot Product of Signed/Unsigned Bytes with Dword Accumulation

Vol. 2B

4-701

INSTRUCTION SET REFERENCE, M-U

TDPBSSD, TDPBSUD, TDPBUSD, TDPBUUD tsrcdest, tsrc1, tsrc2 (Register Only Version)

// C = m x n (tsrcdest), A = m x k (tsrc1), B = k x n (tsrc2)

tsrc1_elements_per_row := tsrc1.colsb / 4

tsrc2_elements_per_row := tsrc2.colsb / 4

tsrcdest_elements_per_row := tsrcdest.colsb / 4

for m in 0 ... tsrcdest.rows-1:

tmp := tsrcdest.row[m]

for k in 0 ... tsrc1_elements_per_row-1:

for n in 0 ... tsrcdest_elements_per_row-1:

DPBD( tmp.dword[n], tsrc1.row[m].dword[k], tsrc2.row[k].dword[n] )

write_row_and_zero(tsrcdest, m, tmp, tsrcdest.colsb)

zero_upper_rows(tsrcdest, tsrcdest.rows)

zero_tilecfg_start()

Intel C/C++ Compiler Intrinsic Equivalent

TDPBSSD void _tile_dpbssd(__tile dst, __tile src1, __tile src2);

TDPBSUD void _tile_dpbsud(__tile dst, __tile src1, __tile src2);

TDPBUSD void _tile_dpbusd(__tile dst, __tile src1, __tile src2);

TDPBUUD void _tile_dpbuud(__tile dst, __tile src1, __tile src2);

Flags Affected

None.

Exceptions

AMX-E4; see Section 2.10, “Intel® AMX Instruction Exception Classes,” for details.

4-702

Vol. 2B

TDPBSSD/TDPBSUD/TDPBUSD/TDPBUUD-Dot Product of Signed/Unsigned Bytes with Dword Accumulation

INSTRUCTION SET REFERENCE, M-U

TEST-Logical Compare

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

A8 ib

TEST AL, imm8

Valid

AND imm8 with AL; set SF, ZF, PF according to result.

A9 iw

TEST AX, imm16

Valid

AND imm16 with AX; set SF, ZF, PF according to result.

A9 id

TEST EAX, imm32

Valid

AND imm32 with EAX; set SF, ZF, PF according to

result.

REX.W + A9 id

TEST RAX, imm32

Valid

N.E.

AND imm32 sign-extended to 64-bits with RAX; set SF,

ZF, PF according to result.

F6 /0 ib

TEST r/m8, imm8

Valid

AND imm8 with r/m8; set SF, ZF, PF according to result.

REX + F6 /0 ib

TEST r/m8¹, imm8

Valid

N.E.

AND imm8 with r/m8; set SF, ZF, PF according to result.

F7 /0 iw

TEST r/m16, imm16

Valid

AND imm16 with r/m16; set SF, ZF, PF according to

result.

F7 /0 id

TEST r/m32, imm32

Valid

AND imm32 with r/m32; set SF, ZF, PF according to

result.

REX.W + F7 /0 id

TEST r/m64, imm32

Valid

N.E.

AND imm32 sign-extended to 64-bits with r/m64; set

SF, ZF, PF according to result.

84 /r

TEST r/m8, r8

Valid

AND r8 with r/m8; set SF, ZF, PF according to result.

REX + 84 /r

TEST r/m8¹, r8¹

Valid

N.E.

AND r8 with r/m8; set SF, ZF, PF according to result.

85 /r

TEST r/m16, r16

Valid

AND r16 with r/m16; set SF, ZF, PF according to result.

85 /r

TEST r/m32, r32

Valid

AND r32 with r/m32; set SF, ZF, PF according to result.

REX.W + 85 /r

TEST r/m64, r64

Valid

N.E.

AND r64 with r/m64; set SF, ZF, PF according to result.

NOTES:

1. In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

AL/AX/EAX/RAX

imm8/16/32

N/A

ModRM:r/m (r)

imm8/16/32

N/A

ModRM:r/m (r)

ModRM:reg (r)

N/A

Description

Computes the bit-wise logical AND of first operand (source 1 operand) and the second operand (source 2 operand)

and sets the SF, ZF, and PF status flags according to the result. The result is then discarded.

In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). Using a

REX prefix in the form of REX.W promotes operation to 64 bits. See the summary chart at the beginning of this

section for encoding data and limits.

Operation

TEMP := SRC1 AND SRC2;

SF := MSB(TEMP);

IF TEMP = 0

THEN ZF := 1;

ELSE ZF := 0;

FI:

PF := BitwiseXNOR(TEMP[0:7]);

TEST-Logical Compare

Vol. 2B

4-703

INSTRUCTION SET REFERENCE, M-U

CF := 0;

OF := 0;

(* AF is undefined *)

Flags Affected

The OF and CF flags are set to 0. The SF, ZF, and PF flags are set according to the result (see the “Operation” section

above). The state of the AF flag is undefined.

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used.

4-704

Vol. 2B

TEST-Logical Compare

INSTRUCTION SET REFERENCE, M-U

TESTUI-Determine User Interrupt Flag

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

F3 0F 01 ED

V/I

UINTR

Copies the current value of UIF into EFLAGS.CF.

TESTUI

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

TESTUI copies the current value of the user interrupt flag (UIF) into EFLAGS.CF. This instruction can be executed

regardless of CPL.

TESTUI may be executed normally inside a transactional region.

Operation

CF := UIF;

ZF := AF := OF := PF := SF := 0;

Flags Affected

The ZF, OF, AF, PF, SF flags are cleared and the CF flags to the value of the user interrupt flag.

Protected Mode Exceptions

#UD

The TESTUI instruction is not recognized in protected mode.

Real-Address Mode Exceptions

#UD

The TESTUI instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The TESTUI instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

The TESTUI instruction is not recognized in compatibility mode.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If executed inside an enclave.

If CR4.UINTR = 0.

If CPUID.07H.0H:EDX.UINTR[bit 5] = 0.

TESTUI-Determine User Interrupt Flag

Vol. 2B

4-705

INSTRUCTION SET REFERENCE, M-U

TILELOADD/TILELOADDT1-Load Tile

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.F2.0F38.W0 4B !(11):rrr:100

V/N.E.

AMX-TILE

Load data into tmm1 as specified by information

TILELOADD tmm1, sibmem

in sibmem.

VEX.128.66.0F38.W0 4B !(11):rrr:100

V/N.E.

AMX-TILE

Load data into tmm1 as specified by information

TILELOADDT1 tmm1, sibmem

in sibmem with hint to optimize data caching.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

This instruction is required to use SIB addressing. The index register serves as a stride indicator. If the SIB

encoding omits an index register, the value zero is assumed for the content of the index register.

This instruction loads a tile destination with rows and columns as specified by the tile configuration. The “T1”

version provides a hint to the implementation that the data would be reused but does not need to be resident in the

nearest cache levels.

The TILECFG.start_row in the TILECFG data should be initialized to '0' in order to load the entire tile and is set to

zero on successful completion of the TILELOADD instruction. TILELOADD is a restartable instruction and the

TILECFG.start_row will be non-zero when restartable events occur during the instruction execution.

Only memory operands are supported and they can only be accessed using a SIB addressing mode, similar to the

V[P]GATHER*/V[P]SCATTER* instructions.

Any attempt to execute the TILELOADD/TILELOADDT1 instructions inside an Intel TSX transaction will result in a

transaction abort.

Operation

TILELOADD[,T1] tdest, tsib

start := tilecfg.start_row

zero_upper_rows(tdest,start)

membegin := tsib.base + displacement

// if no index register in the SIB encoding, the value zero is used.

stride := tsib.index << tsib.scale

nbytes := tdest.colsb

while start < tdest.rows:

memptr := membegin + start * stride

write_row_and_zero(tdest, start, read_memory(memptr, nbytes), nbytes)

start := start + 1

zero_tilecfg_start()

// In the case of a memory fault in the middle of an instruction, the tilecfg.start_row := start

Intel C/C++ Compiler Intrinsic Equivalent

TILELOADD void _tile_loadd(__tile dst, const void *base, int stride);

TILELOADDT1 void _tile_stream_loadd(__tile dst, const void *base, int stride);

4-706

Vol. 2B

TILELOADD/TILELOADDT1-Load Tile

INSTRUCTION SET REFERENCE, M-U

TILERELEASE-Release Tile

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.NP.0F38.W0 49 C0

V/N.E.

AMX-TILE

Initialize TILECFG and TILEDATA.

TILERELEASE

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

This instruction returns TILECFG and TILEDATA to the INIT state.

Any attempt to execute the TILERELEASE instruction inside an Intel TSX transaction will result in a transaction

abort.

Operation

zero_all_tile_data()

tilecfg := 0// equivalent to 64B of zeros

TILES_CONFIGURED := 0

Intel C/C++ Compiler Intrinsic Equivalent

TILERELEASE void _tile_release(void);

Flags Affected

None.

Exceptions

AMX-E6; see Section 2.10, “Intel® AMX Instruction Exception Classes,” for details.

4-708

Vol. 2B

TILERELEASE-Release Tile

INSTRUCTION SET REFERENCE, M-U

TILESTORED-Store Tile

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.F3.0F38.W0 4B !(11):rrr:100

V/N.E.

AMX-TILE

Store a tile in sibmem as specified in tmm1.

TILESTORED sibmem, tmm1

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

This instruction is required to use SIB addressing. The index register serves as a stride indicator. If the SIB

encoding omits an index register, the value zero is assumed for the content of the index register.

This instruction stores a tile source of rows and columns as specified by the tile configuration.

The TILECFG.start_row in the TILECFG data should be initialized to '0' in order to store the entire tile and are set to

zero on successful completion of the TILESTORED instruction. TILESTORED is a restartable instruction and the

TILECFG.start_row will be non-zero when restartable events occur during the instruction execution.

Only memory operands are supported and they can only be accessed using a SIB addressing mode, similar to the

V[P]GATHER*/V[P]SCATTER* instructions.

Any attempt to execute the TILESTORED instruction inside an Intel TSX transaction will result in a transaction

abort.

Operation

TILESTORED tsib, tsrc

start := tilecfg.start_row

membegin := tsib.base + displacement

// if no index register in the SIB encoding, the value zero is used.

stride := tsib.index << tsib.scale

while start < tdest.rows:

memptr := membegin + start * stride

write_memory(memptr, tsrc.colsb, tsrc.row[start])

start := start + 1

zero_tilecfg_start()

// In the case of a memory fault in the middle of an instruction, the tilecfg.start_row := start

Intel C/C++ Compiler Intrinsic Equivalent

TILESTORED void _tile_stored(__tile src, void *base, int stride);

Flags Affected

None.

Exceptions

AMX-E3; see Section 2.10, “Intel® AMX Instruction Exception Classes,” for details.

TILESTORED-Store Tile

Vol. 2B

4-709

INSTRUCTION SET REFERENCE, M-U

TILEZERO-Zero Tile

Opcode/

Op/

64/32 bit

CPUID Feature

Description

Instruction

Mode

Flag

Support

VEX.128.F2.0F38.W0 49 11:rrr:000

V/N.E.

AMX-TILE

Zero the destination tile.

TILEZERO tmm1

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (w)

N/A

Description

This instruction zeroes the destination tile.

Any attempt to execute the TILEZERO instruction inside an Intel TSX transaction will result in a transaction abort.

Operation

TILEZERO tdest

nbytes := palette_table[palette_id].bytes_per_row

for i in 0 ... palette_table[palette_id].max_rows-1:

for j in 0 ... nbytes-1:

tdest.row[i].byte[j] := 0

zero_tilecfg_start()

Intel C/C++ Compiler Intrinsic Equivalent

TILEZERO void _tile_zero(__tile dst);

Flags Affected

None.

Exceptions

AMX-E5; see Section 2.10, “Intel® AMX Instruction Exception Classes,” for details.

4-710

Vol. 2B

TILEZERO-Zero Tile

INSTRUCTION SET REFERENCE, M-U

TPAUSE-Timed PAUSE

Opcode /

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F AE /6

V/V

WAITPKG

Directs the processor to enter an implementation-dependent

optimized state until the TSC reaches the value in EDX:EAX.

TPAUSE r32, <edx>, <eax>

Instruction Operand Encoding¹

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:r/m (r)

N/A

Description

TPAUSE instructs the processor to enter an implementation-dependent optimized state. There are two such opti-

mized states to choose from: light-weight power/performance optimized state, and improved power/performance

optimized state. The selection between the two is governed by the explicit input register bit[0] source operand.

TPAUSE is available when CPUID.7.0:ECX.WAITPKG[bit 5] is enumerated as 1. TPAUSE may be executed at any

privilege level. This instruction’s operation is the same in non-64-bit modes and in 64-bit mode.

Unlike PAUSE, the TPAUSE instruction will not cause an abort when used inside a transactional region, described in

the chapter Chapter 16, “Programming with Intel® Transactional Synchronization Extensions,” of the Intel^® 64 and

IA-32 Architectures Software Developer’s Manual, Volume 1.

The input register contains information such as the preferred optimized state the processor should enter as

described in the following table. Bits other than bit 0 are reserved and will result in #GP if non-zero.

Table 4-20. TPAUSE Input Register Bit Definitions

Bit Value

State Name

Wakeup Time

Power Savings

Other Benefits

bit[0] = 0

C0.2

Slower

Larger

Improves performance of the other SMT thread(s)

on the same core.

bit[0] = 1

C0.1

Faster

Smaller

N/A

bits[31:1]

N/A

Reserved

The instruction execution wakes up when the time-stamp counter reaches or exceeds the implicit EDX:EAX 64-bit

input value.

Prior to executing the TPAUSE instruction, an operating system may specify the maximum delay it allows the

processor to suspend its operation. It can do so by writing TSC-quanta value to the following 32-bit MSR

(IA32_UMWAIT_CONTROL at MSR index E1H):

• IA32_UMWAIT_CONTROL[31:2] - Determines the maximum time in TSC-quanta that the processor can reside

in either C0.1 or C0.2. A zero value indicates no maximum time. The maximum time value is a 32-bit value

where the upper 30 bits come from this field and the lower two bits are zero.

• IA32_UMWAIT_CONTROL[1] - Reserved.

• IA32_UMWAIT_CONTROL[0] - C0.2 is not allowed by the OS. Value of “1” means all C0.2 requests revert to

C0.1.

If the processor that executed a TPAUSE instruction wakes due to the expiration of the operating system time-limit,

the instructions sets RFLAGS.CF; otherwise, that flag is cleared.

The following additional events cause the processor to exit the implementation-dependent optimized state: a store

to the read-set range within the transactional region, an NMI or SMI, a debug exception, a machine check excep-

tion, the BINIT# signal, the INIT# signal, and the RESET# signal.

1. The Mod field of the ModR/M byte must have value 11B.

TPAUSE-Timed PAUSE

Vol. 2B

4-711

INSTRUCTION SET REFERENCE, M-U

Other implementation-dependent events may cause the processor to exit the implementation-dependent opti-

mized state proceeding to the instruction following TPAUSE. In addition, an external interrupt causes the processor

to exit the implementation-dependent optimized state regardless of whether maskable-interrupts are inhibited

(EFLAGS.IF =0). It should be noted that if maskable-interrupts are inhibited execution will proceed to the instruc-

tion following TPAUSE.

Operation

os_deadline := TSC+(IA32_UMWAIT_CONTROL[31:2]<<2)

instr_deadline := UINT64(EDX:EAX)

IF os_deadline < instr_deadline:

deadline := os_deadline

using_os_deadline := 1

ELSE:

deadline := instr_deadline

using_os_deadline := 0

WHILE TSC < deadline:

implementation_dependent_optimized_state(Source register, deadline, IA32_UMWAIT_CONTROL[0])

IF using_os_deadline AND TSC ≥ deadline:

RFLAGS.CF := 1

ELSE:

RFLAGS.CF := 0

RFLAGS.AF,PF,SF,ZF,OF := 0

Intel C/C++ Compiler Intrinsic Equivalent

TPAUSE uint8_t _tpause(uint32_t control, uint64_t counter);

Numeric Exceptions

None.

Exceptions (All Operating Modes)

#GP(0)

If src[31:1] != 0.

If CR4.TSD = 1 and CPL != 0.

#UD

If CPUID.7.0:ECX.WAITPKG[bit 5]=0.

4-712

Vol. 2B

TPAUSE-Timed PAUSE

INSTRUCTION SET REFERENCE, M-U

TZCNT-Count the Number of Trailing Zero Bits

Opcode/

Op/

64/32-

CPUID

Description

Instruction

bit

Feature

Mode

Flag

F3 0F BC /r

V/V

BMI1

Count the number of trailing zero bits in r/m16, return result in r16.

TZCNT r16, r/m16

F3 0F BC /r

V/V

BMI1

Count the number of trailing zero bits in r/m32, return result in r32.

TZCNT r32, r/m32

F3 REX.W 0F BC /r

V/N.E.

BMI1

Count the number of trailing zero bits in r/m64, return result in r64.

TZCNT r64, r/m64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

TZCNT counts the number of trailing least significant zero bits in source operand (second operand) and returns the

result in destination operand (first operand). TZCNT is an extension of the BSF instruction. The key difference

between TZCNT and BSF instruction is that TZCNT provides operand size as output when source operand is zero

while in the case of BSF instruction, if source operand is zero, the content of destination operand are undefined. On

processors that do not support TZCNT, the instruction byte encoding is executed as BSF.

Operation

temp := 0

DEST := 0

DO WHILE ( (temp < OperandSize) and (SRC[ temp] = 0) )

temp := temp +1

DEST := DEST+ 1

IF DEST = OperandSize

CF := 1

ELSE

CF := 0

IF DEST = 0

ZF := 1

ELSE

ZF := 0

Flags Affected

ZF is set to 1 in case of zero output (least significant bit of the source is set), and to 0 otherwise, CF is set to 1 if

the input was zero and cleared otherwise. OF, SF, PF, and AF flags are undefined.

Intel C/C++ Compiler Intrinsic Equivalent

TZCNT unsigned __int32 _tzcnt_u32(unsigned __int32 src);

TZCNT unsigned __int64 _tzcnt_u64(unsigned __int64 src);

TZCNT-Count the Number of Trailing Zero Bits

Vol. 2B

4-713

INSTRUCTION SET REFERENCE, M-U

Protected Mode Exceptions

#GP(0)

For an illegal memory operand effective address in the CS, DS, ES, FS or GS segments.

If the DS, ES, FS, or GS register is used to access memory and it contains a null segment

selector.

#SS(0)

For an illegal address in the SS segment.

#PF (fault-code)

For a page fault.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If LOCK prefix is used.

Real-Address Mode Exceptions

#GP(0)

If any part of the operand lies outside of the effective address space from 0 to 0FFFFH.

#SS(0)

For an illegal address in the SS segment.

#UD

If LOCK prefix is used.

Virtual 8086 Mode Exceptions

#GP(0)

If any part of the operand lies outside of the effective address space from 0 to 0FFFFH.

#SS(0)

For an illegal address in the SS segment.

#PF (fault-code)

For a page fault.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in Protected Mode.

64-Bit Mode Exceptions

#GP(0)

If the memory address is in a non-canonical form.

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#PF (fault-code)

For a page fault.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If LOCK prefix is used.

4-714

Vol. 2B

TZCNT-Count the Number of Trailing Zero Bits

INSTRUCTION SET REFERENCE, M-U

UCOMISD-Unordered Compare Scalar Double Precision Floating-Point Values and Set EFLAGS

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

66 0F 2E /r

V/V

SSE2

Compare low double precision floating-point values in xmm1

UCOMISD xmm1, xmm2/m64

and xmm2/mem64 and set the EFLAGS flags accordingly.

VEX.LIG.66.0F.WIG 2E /r

V/V

AVX

Compare low double precision floating-point values in xmm1

VUCOMISD xmm1, xmm2/m64

and xmm2/mem64 and set the EFLAGS flags accordingly.

EVEX.LLIG.66.0F.W1 2E /r

V/V

AVX512F

Compare low double precision floating-point values in xmm1

VUCOMISD xmm1, xmm2/m64{sae}

and xmm2/m64 and set the EFLAGS flags accordingly.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r)

ModRM:r/m (r)

N/A

Tuple1 Scalar

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Performs an unordered compare of the double precision floating-point values in the low quadwords of operand 1

(first operand) and operand 2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according

to the result (unordered, greater than, less than, or equal). The OF, SF, and AF flags in the EFLAGS register are set

to 0. The unordered result is returned if either source operand is a NaN (QNaN or SNaN).

Operand 1 is an XMM register; operand 2 can be an XMM register or a 64 bit memory

location.

The UCOMISD instruction differs from the COMISD instruction in that it signals a SIMD floating-point invalid oper-

ation exception (#I) only when a source operand is an SNaN. The COMISD instruction signals an invalid operation

exception only if a source operand is either an SNaN or a QNaN.

The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated.

Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD.

Software should ensure VCOMISD is encoded with VEX.L=0. Encoding VCOMISD with VEX.L=1 may encounter

unpredictable behavior across different processor generations.

Operation

(V)UCOMISD (All Versions)

RESULT := UnorderedCompare(DEST[63:0] <> SRC[63:0]) {

(* Set EFLAGS *) CASE (RESULT) OF

UNORDERED: ZF,PF,CF := 111;

GREATER_THAN: ZF,PF,CF := 000;

LESS_THAN: ZF,PF,CF := 001;

EQUAL: ZF,PF,CF := 100;

ESAC;

OF, AF, SF := 0; }

UCOMISD-Unordered Compare Scalar Double Precision Floating-Point Values and Set EFLAGS

Vol. 2B

4-715

INSTRUCTION SET REFERENCE, M-U

Intel C/C++ Compiler Intrinsic Equivalent

VUCOMISD int _mm_comi_round_sd(__m128d a, __m128d b, int imm, int sae);

UCOMISD int _mm_ucomieq_sd(__m128d a, __m128d b)

UCOMISD int _mm_ucomilt_sd(__m128d a, __m128d b)

UCOMISD int _mm_ucomile_sd(__m128d a, __m128d b)

UCOMISD int _mm_ucomigt_sd(__m128d a, __m128d b)

UCOMISD int _mm_ucomige_sd(__m128d a, __m128d b)

UCOMISD int _mm_ucomineq_sd(__m128d a, __m128d b)

SIMD Floating-Point Exceptions

Invalid (if SNaN operands), Denormal.

Other Exceptions

VEX-encoded instructions, see Table 2-20, “Type 3 Class Exception Conditions,” additionally:

#UD

If VEX.vvvv != 1111B.

EVEX-encoded instructions, see Table 2-48, “Type E3NF Class Exception Conditions.”

4-716

Vol. 2B

UCOMISD-Unordered Compare Scalar Double Precision Floating-Point Values and Set EFLAGS

INSTRUCTION SET REFERENCE, M-U

UCOMISS-Unordered Compare Scalar Single Precision Floating-Point Values and Set EFLAGS

Opcode/

Op /

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 2E /r

V/V

SSE

Compare low single precision floating-point values in xmm1

UCOMISS xmm1, xmm2/m32

and xmm2/mem32 and set the EFLAGS flags accordingly.

VEX.LIG.0F.WIG 2E /r

V/V

AVX

Compare low single precision floating-point values in xmm1

VUCOMISS xmm1, xmm2/m32

and xmm2/mem32 and set the EFLAGS flags accordingly.

EVEX.LLIG.0F.W0 2E /r

V/V

AVX512F

Compare low single precision floating-point values in xmm1

VUCOMISS xmm1, xmm2/m32{sae}

and xmm2/mem32 and set the EFLAGS flags accordingly.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r)

ModRM:r/m (r)

N/A

Tuple1 Scalar

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Compares the single precision floating-point values in the low doublewords of operand 1 (first operand) and

operand 2 (second operand), and sets the ZF, PF, and CF flags in the EFLAGS register according to the result (unor-

dered, greater than, less than, or equal). The OF, SF, and AF flags in the EFLAGS register are set to 0. The unor-

dered result is returned if either source operand is a NaN (QNaN or SNaN).

Operand 1 is an XMM register; operand 2 can be an XMM register or a 32 bit memory location.

The UCOMISS instruction differs from the COMISS instruction in that it signals a SIMD floating-point invalid opera-

tion exception (#I) only if a source operand is an SNaN. The COMISS instruction signals an invalid operation excep-

tion when a source operand is either a QNaN or SNaN.

The EFLAGS register is not updated if an unmasked SIMD floating-point exception is generated.

Note: VEX.vvvv and EVEX.vvvv are reserved and must be 1111b, otherwise instructions will #UD.

Software should ensure VCOMISS is encoded with VEX.L=0. Encoding VCOMISS with VEX.L=1 may encounter

unpredictable behavior across different processor generations.

Operation

(V)UCOMISS (All Versions)

RESULT := UnorderedCompare(DEST[31:0] <> SRC[31:0]) {

(* Set EFLAGS *) CASE (RESULT) OF

UNORDERED: ZF,PF,CF := 111;

GREATER_THAN: ZF,PF,CF := 000;

LESS_THAN: ZF,PF,CF := 001;

EQUAL: ZF,PF,CF := 100;

ESAC;

OF, AF, SF := 0; }

Intel C/C++ Compiler Intrinsic Equivalent

VUCOMISS int _mm_comi_round_ss(__m128 a, __m128 b, int imm, int sae);

UCOMISS

int _mm_ucomieq_ss(__m128 a, __m128 b);

UCOMISS

int _mm_ucomilt_ss(__m128 a, __m128 b);

UCOMISS

int _mm_ucomile_ss(__m128 a, __m128 b);

UCOMISS

int _mm_ucomigt_ss(__m128 a, __m128 b);

UCOMISS

int _mm_ucomige_ss(__m128 a, __m128 b);

UCOMISS

int _mm_ucomineq_ss(__m128 a, __m128 b);

UCOMISS-Unordered Compare Scalar Single Precision Floating-Point Values and Set EFLAGS

Vol. 2B

4-717

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 39