Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, A-L

FI;

CPL := 3;

(* Resume execution in Virtual-8086 mode *)

tempOldSSP = SSP;

(* Now past all faulting points; safe to free the token. The token free is done using the old SSP

* and using a supervisor override as old CPL was a supervisor privilege level *)

IF shadowStackEnabled

expected_token_value = tempOldSSP | BUSY_BIT

(* busy bit - bit position 0 - must be set *)

new_token_value = tempOldSSP

(* clear the busy bit *)

shadow_stack_lock_cmpxchg8b(tempOldSSP, new_token_value, expected_token_value)

FI;

END;

PROTECTED-MODE-RETURN: (* PE = 1 *)

IF CS(RPL) > CPL

THEN GOTO RETURN-TO-OUTER-PRIVILEGE-LEVEL;

ELSE GOTO RETURN-TO-SAME-PRIVILEGE-LEVEL; FI;

END;

RETURN-TO-OUTER-PRIVILEGE-LEVEL:

IF OperandSize = 32

THEN

tempESP := Pop();

tempSS := Pop(); (* 32-bit pop, high-order 16 bits discarded *)

ELSE IF OperandSize = 16

THEN

tempESP := Pop(); (* 16-bit pop; clear upper bits *)

tempSS := Pop(); (* 16-bit pop *)

ELSE (* OperandSize = 64 *)

tempRSP := Pop();

tempSS := Pop(); (* 64-bit pop, high-order 48 bits discarded *)

FI;

IF new mode ≠ 64-Bit Mode

THEN

IF EIP is not within CS limit

THEN #GP(0); FI;

ELSE (* new mode = 64-bit mode *)

IF RIP is non-canonical

THEN #GP(0); FI;

FI;

EFLAGS (CF, PF, AF, ZF, SF, TF, DF, OF, NT) := tempEFLAGS;

IF OperandSize = 32 or OperandSize = 64

THEN EFLAGS(RF, AC, ID) := tempEFLAGS; FI;

IF CPL ≤ IOPL

THEN EFLAGS(IF) := tempEFLAGS; FI;

IF CPL = 0

THEN

EFLAGS(IOPL) := tempEFLAGS;

IF OperandSize = 32 or OperandSize = 64

THEN EFLAGS(VIF, VIP) := tempEFLAGS; FI;

FI;

IF ShadowStackEnabled(CPL)

(* check if 8 byte aligned *)

IRET/IRETD/IRETQ—Interrupt Return

Vol. 2A

3-541

INSTRUCTION SET REFERENCE, A-L

IF SSP AND 0x7 != 0

THEN #CP(FAR-RET/IRET); FI;

IF CS(RPL) != 3

THEN

tempSsCS = shadow_stack_load 8 bytes from SSP+16;

tempSsLIP = shadow_stack_load 8 bytes from SSP+8;

tempSSP = shadow_stack_load 8 bytes from SSP;

SSP = SSP + 24;

(* Do 64 bit compare to detect bits beyond 15 being set *)

tempCS = CS; (* zero padded to 64 bit *)

IF tempCS != tempSsCS

THEN #CP(FAR-RET/IRET); FI;

(* Do 64 bit compare; pad CSBASE+RIP with 0 for 32 bit LIP *)

IF CSBASE + RIP != tempSsEIP

THEN #CP(FAR-RET/IRET); FI;

(* check if 4 byte aligned *)

IF tempSSP AND 0x3 != 0

THEN #CP(FAR-RET/IRET); FI;

FI;

tempOldCPL = CPL;

CPL := CS(RPL);

IF OperandSize = 64

THEN

RSP := tempRSP;

SS := tempSS;

ELSE

ESP := tempESP;

SS := tempSS;

FI;

IF new mode != 64-Bit Mode

THEN

IF EIP is not within CS limit

THEN #GP(0); FI;

ELSE (* new mode = 64-bit mode *)

IF RIP is non-canonical

THEN #GP(0); FI;

FI;

tempOldSSP = SSP;

IF ShadowStackEnabled(CPL)

IF CPL = 3

THEN tempSSP := IA32_PL3_SSP; FI;

IF ((IA32_EFER.LMA AND CS.L) = 0 AND tempSSP[63:32] != 0) OR

((IA32_EFER.LMA AND CS.L) = 1 AND tempSSP is not canonical relative to the current paging mode)

THEN #GP(0); FI;

SSP := tempSSP

FI;

(* Now past all faulting points; safe to free the token. The token free is done using the old SSP

* and using a supervisor override as old CPL was a supervisor privilege level *)

IF ShadowStackEnabled(tempOldCPL)

expected_token_value = tempOldSSP | BUSY_BIT (* busy bit - bit position 0 - must be set *)

new_token_value = tempOldSSP (* clear the busy bit *)

shadow_stack_lock_cmpxchg8b(tempOldSSP, new_token_value, expected_token_value)

FI;

3-542

Vol. 2A

IRET/IRETD/IRETQ—Interrupt Return

INSTRUCTION SET REFERENCE, A-L

FOR each SegReg in (ES, FS, GS, and DS)

tempDesc := descriptor cache for SegReg (* hidden part of segment register *)

IF (SegmentSelector == NULL) OR (tempDesc(DPL) < CPL AND tempDesc(Type) is (data or non-conforming code)))

THEN (* Segment register invalid *)

SegmentSelector := 0; (*Segment selector becomes null*)

FI;

OD;

END;

RETURN-TO-SAME-PRIVILEGE-LEVEL: (* PE = 1, RPL = CPL *)

IF new mode ≠ 64-Bit Mode

THEN

IF EIP is not within CS limit

THEN #GP(0); FI;

ELSE (* new mode = 64-bit mode *)

IF RIP is non-canonical

THEN #GP(0); FI;

FI;

EFLAGS (CF, PF, AF, ZF, SF, TF, DF, OF, NT) := tempEFLAGS;

IF OperandSize = 32 or OperandSize = 64

THEN EFLAGS(RF, AC, ID) := tempEFLAGS; FI;

IF CPL ≤ IOPL

THEN EFLAGS(IF) := tempEFLAGS; FI;

IF CPL = 0

THEN

EFLAGS(IOPL) := tempEFLAGS;

IF OperandSize = 32 or OperandSize = 64

THEN EFLAGS(VIF, VIP) := tempEFLAGS; FI;

FI;

IF ShadowStackEnabled(CPL)

IF SSP AND 0x7 != 0 (* check if aligned to 8 bytes *)

THEN #CP(FAR-RET/IRET); FI;

tempSsCS = shadow_stack_load 8 bytes from SSP+16;

tempSsLIP = shadow_stack_load 8 bytes from SSP+8;

tempSSP = shadow_stack_load 8 bytes from SSP;

SSP = SSP + 24;

tempCS = CS; (* zero padded to 64 bit *)

IF tempCS != tempSsCS (* 64 bit compare; CS zero padded to 64 bits *)

THEN #CP(FAR-RET/IRET); FI;

IF CSBASE + RIP != tempSsLIP (* 64 bit compare; CSBASE+RIP zero padded to 64 bit for 32 bit LIP *)

THEN #CP(FAR-RET/IRET); FI;

IF tempSSP AND 0x3 != 0 (* check if aligned to 4 bytes *)

THEN #CP(FAR-RET/IRET); FI;

IF ((IA32_EFER.LMA AND CS.L) = 0 AND tempSSP[63:32] != 0) OR

((IA32_EFER.LMA AND CS.L) = 1 AND tempSSP is not canonical relative to the current paging mode)

THEN #GP(0); FI;

FI;

IF ShadowStackEnabled(CPL)

IF IA32_EFER.LMA = 1

(* In IA-32e-mode the IRET may be switching stacks if the interrupt/exception was delivered

through an IDT with a non-zero IST *)

(* In IA-32e mode for same CPL IRET there is always a stack switch. The below check verifies if the

IRET/IRETD/IRETQ—Interrupt Return

Vol. 2A

3-543

INSTRUCTION SET REFERENCE, A-L

stack switch was to self stack and if so, do not try to free the token on this shadow stack. If the

tempSSP was not to same stack then there was a stack switch so do attempt to free the token *)

IF tempSSP != SSP

THEN

expected_token_value = SSP | BUSY_BIT

(* busy bit - bit position 0 - must be set *)

new_token_value = SSP

(* clear the busy bit *)

shadow_stack_lock_cmpxchg8b(SSP, new_token_value, expected_token_value)

FI;

SSP := tempSSP

FI;

END;

IA-32e-MODE:

IF NT = 1

THEN #GP(0);

ELSE IF OperandSize = 32

THEN

EIP := Pop();

CS := Pop();

tempEFLAGS := Pop();

ELSE IF OperandSize = 16

THEN

EIP := Pop(); (* 16-bit pop; clear upper bits *)

CS := Pop(); (* 16-bit pop *)

tempEFLAGS := Pop(); (* 16-bit pop; clear upper bits *)

FI;

ELSE (* OperandSize = 64 *)

THEN

RIP := Pop();

CS := Pop(); (* 64-bit pop, high-order 48 bits discarded *)

tempRFLAGS := Pop();

FI;

IF CS.RPL > CPL

THEN GOTO RETURN-TO-OUTER-PRIVILEGE-LEVEL;

ELSE

IF instruction began in 64-Bit Mode

THEN

IF OperandSize = 32

THEN

ESP := Pop();

SS := Pop(); (* 32-bit pop, high-order 16 bits discarded *)

ELSE IF OperandSize = 16

THEN

ESP := Pop(); (* 16-bit pop; clear upper bits *)

SS := Pop(); (* 16-bit pop *)

ELSE (* OperandSize = 64 *)

RSP := Pop();

SS := Pop(); (* 64-bit pop, high-order 48 bits discarded *)

FI;

GOTO RETURN-TO-SAME-PRIVILEGE-LEVEL; FI;

END;

3-544

Vol. 2A

IRET/IRETD/IRETQ—Interrupt Return

INSTRUCTION SET REFERENCE, A-L

Flags Affected

All the flags and fields in the EFLAGS register are potentially modified, depending on the mode of operation of the

processor. If performing a return from a nested task to a previous task, the EFLAGS register will be modified

according to the EFLAGS image stored in the previous task’s TSS.

Protected Mode Exceptions

#GP(0)

If the return code or stack segment selector is NULL.

If the return instruction pointer is not within the return code segment limit.

#GP(selector)

If a segment selector index is outside its descriptor table limits.

If the return code segment selector RPL is less than the CPL.

If the DPL of a conforming-code segment is greater than the return code segment selector

RPL.

If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment

selector.

If the stack segment descriptor DPL is not equal to the RPL of the return code segment

selector.

If the stack segment is not a writable data segment.

If the stack segment selector RPL is not equal to the RPL of the return code segment selector.

If the segment descriptor for a code segment does not indicate it is a code segment.

If the segment selector for a TSS has its local/global bit set for local.

If a TSS segment descriptor specifies that the TSS is not busy.

If a TSS segment descriptor specifies that the TSS is not available.

#SS(0)

If the top bytes of stack are not within stack limits.

If the return stack segment is not present.

#NP (selector)

If the return code segment is not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If an unaligned memory reference occurs when the CPL is 3 and alignment checking is

enabled.

#UD

If the LOCK prefix is used.

#CP (Far-RET/IRET) If the previous SSP from shadow stack (when returning to CPL <3) or from IA32_PL3_SSP

(returning to CPL 3) is not 4 byte aligned.

If returning to 32-bit or compatibility mode and the previous SSP from shadow stack (when

returning to CPL <3) or from IA32_PL3_SSP (returning to CPL 3) is beyond 4GB.

If return instruction pointer from stack and shadow stack do not match.

Real-Address Mode Exceptions

#GP

If the return instruction pointer is not within the return code segment limit.

#SS

If the top bytes of stack are not within stack limits.

Virtual-8086 Mode Exceptions

#GP(0)

If the return instruction pointer is not within the return code segment limit.

IF IOPL not equal to 3.

#PF(fault-code)

If a page fault occurs.

#SS(0)

If the top bytes of stack are not within stack limits.

#AC(0)

If an unaligned memory reference occurs and alignment checking is enabled.

#UD

If the LOCK prefix is used.

IRET/IRETD/IRETQ—Interrupt Return

Vol. 2A

3-545

INSTRUCTION SET REFERENCE, A-L

Compatibility Mode Exceptions

#GP(0)

If EFLAGS.NT[bit 14] = 1.

Other exceptions same as in Protected Mode.

64-Bit Mode Exceptions

#GP(0)

If EFLAGS.NT[bit 14] = 1.

If the return code segment selector is NULL.

If the stack segment selector is NULL going back to compatibility mode.

If the stack segment selector is NULL going back to CPL3 64-bit mode.

If a NULL stack segment selector RPL is not equal to CPL going back to non-CPL3 64-bit mode.

If the return instruction pointer is not within the return code segment limit.

If the return instruction pointer is non-canonical.

#GP(Selector)

If a segment selector index is outside its descriptor table limits.

If a segment descriptor memory address is non-canonical.

If the segment descriptor for a code segment does not indicate it is a code segment.

If the proposed new code segment descriptor has both the D-bit and L-bit set.

If the DPL for a nonconforming-code segment is not equal to the RPL of the code segment

selector.

If CPL is greater than the RPL of the code segment selector.

If the DPL of a conforming-code segment is greater than the return code segment selector

RPL.

If the stack segment is not a writable data segment.

If the stack segment descriptor DPL is not equal to the RPL of the return code segment

selector.

If the stack segment selector RPL is not equal to the RPL of the return code segment selector.

#SS(0)

If an attempt to pop a value off the stack violates the SS limit.

If an attempt to pop a value off the stack causes a non-canonical address to be referenced.

If the return stack segment is not present.

#NP (selector)

If the return code segment is not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If an unaligned memory reference occurs when the CPL is 3 and alignment checking is

enabled.

#UD

If the LOCK prefix is used.

#CP (Far-RET/IRET) If the previous SSP from shadow stack (when returning to CPL <3) or from IA32_PL3_SSP

(returning to CPL 3) is not 4 byte aligned.

If returning to 32-bit or compatibility mode and the previous SSP from shadow stack (when

returning to CPL <3) or from IA32_PL3_SSP (returning to CPL 3) is beyond 4GB.

If return instruction pointer from stack and shadow stack do not match.

3-546

Vol. 2A

IRET/IRETD/IRETQ—Interrupt Return

INSTRUCTION SET REFERENCE, A-L

Jcc—Jump if Condition Is Met

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

77 cb

JA rel8

Valid

Jump short if above (CF=0 and ZF=0).

73 cb

JAE rel8

Valid

Jump short if above or equal (CF=0).

72 cb

JB rel8

Valid

Jump short if below (CF=1).

76 cb

JBE rel8

Valid

Jump short if below or equal (CF=1 or ZF=1).

72 cb

JC rel8

Valid

Jump short if carry (CF=1).

E3 cb

JCXZ rel8

N.E.

Valid

Jump short if CX register is 0.

E3 cb

JECXZ rel8

Valid

Jump short if ECX register is 0.

E3 cb

JRCXZ rel8

Valid

N.E.

Jump short if RCX register is 0.

74 cb

JE rel8

Valid

Jump short if equal (ZF=1).

7F cb

JG rel8

Valid

Jump short if greater (ZF=0 and SF=OF).

7D cb

JGE rel8

Valid

Jump short if greater or equal (SF=OF).

7C cb

JL rel8

Valid

Jump short if less (SF≠ OF).

7E cb

JLE rel8

Valid

Jump short if less or equal (ZF=1 or SF≠ OF).

76 cb

JNA rel8

Valid

Jump short if not above (CF=1 or ZF=1).

72 cb

JNAE rel8

Valid

Jump short if not above or equal (CF=1).

73 cb

JNB rel8

Valid

Jump short if not below (CF=0).

77 cb

JNBE rel8

Valid

Jump short if not below or equal (CF=0 and

ZF=0).

73 cb

JNC rel8

Valid

Jump short if not carry (CF=0).

75 cb

JNE rel8

Valid

Jump short if not equal (ZF=0).

7E cb

JNG rel8

Valid

Jump short if not greater (ZF=1 or SF≠ OF).

7C cb

JNGE rel8

Valid

Jump short if not greater or equal (SF≠ OF).

7D cb

JNL rel8

Valid

Jump short if not less (SF=OF).

7F cb

JNLE rel8

Valid

Jump short if not less or equal (ZF=0 and

SF=OF).

71 cb

JNO rel8

Valid

Jump short if not overflow (OF=0).

7B cb

JNP rel8

Valid

Jump short if not parity (PF=0).

79 cb

JNS rel8

Valid

Jump short if not sign (SF=0).

75 cb

JNZ rel8

Valid

Jump short if not zero (ZF=0).

70 cb

JO rel8

Valid

Jump short if overflow (OF=1).

7A cb

JP rel8

Valid

Jump short if parity (PF=1).

7A cb

JPE rel8

Valid

Jump short if parity even (PF=1).

7B cb

JPO rel8

Valid

Jump short if parity odd (PF=0).

78 cb

JS rel8

Valid

Jump short if sign (SF=1).

74 cb

JZ rel8

Valid

Jump short if zero (ZF = 1).

0F 87 cw

JA rel16

N.S.

Valid

Jump near if above (CF=0 and ZF=0). Not

supported in 64-bit mode.

0F 87 cd

JA rel32

Valid

Jump near if above (CF=0 and ZF=0).

0F 83 cw

JAE rel16

N.S.

Valid

Jump near if above or equal (CF=0). Not

supported in 64-bit mode.

0F 83 cd

JAE rel32

Valid

Jump near if above or equal (CF=0).

Jcc—Jump if Condition Is Met

Vol. 2A

3-547

INSTRUCTION SET REFERENCE, A-L

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 82 cw

JB rel16

N.S.

Valid

Jump near if below (CF=1). Not supported in

64-bit mode.

0F 82 cd

JB rel32

Valid

Jump near if below (CF=1).

0F 86 cw

JBE rel16

N.S.

Valid

Jump near if below or equal (CF=1 or ZF=1).

Not supported in 64-bit mode.

0F 86 cd

JBE rel32

Valid

Jump near if below or equal (CF=1 or ZF=1).

0F 82 cw

JC rel16

N.S.

Valid

Jump near if carry (CF=1). Not supported in

64-bit mode.

0F 82 cd

JC rel32

Valid

Jump near if carry (CF=1).

0F 84 cw

JE rel16

N.S.

Valid

Jump near if equal (ZF=1). Not supported in

64-bit mode.

0F 84 cd

JE rel32

Valid

Jump near if equal (ZF=1).

0F 84 cw

JZ rel16

N.S.

Valid

Jump near if 0 (ZF=1). Not supported in 64-bit

mode.

0F 84 cd

JZ rel32

Valid

Jump near if 0 (ZF=1).

0F 8F cw

JG rel16

N.S.

Valid

Jump near if greater (ZF=0 and SF=OF). Not

supported in 64-bit mode.

0F 8F cd

JG rel32

Valid

Jump near if greater (ZF=0 and SF=OF).

0F 8D cw

JGE rel16

N.S.

Valid

Jump near if greater or equal (SF=OF). Not

supported in 64-bit mode.

0F 8D cd

JGE rel32

Valid

Jump near if greater or equal (SF=OF).

0F 8C cw

JL rel16

N.S.

Valid

Jump near if less (SF≠ OF). Not supported in

64-bit mode.

0F 8C cd

JL rel32

Valid

Jump near if less (SF≠ OF).

0F 8E cw

JLE rel16

N.S.

Valid

Jump near if less or equal (ZF=1 or SF≠ OF).

Not supported in 64-bit mode.

0F 8E cd

JLE rel32

Valid

Jump near if less or equal (ZF=1 or SF≠ OF).

0F 86 cw

JNA rel16

N.S.

Valid

Jump near if not above (CF=1 or ZF=1). Not

supported in 64-bit mode.

0F 86 cd

JNA rel32

Valid

Jump near if not above (CF=1 or ZF=1).

0F 82 cw

JNAE rel16

N.S.

Valid

Jump near if not above or equal (CF=1). Not

supported in 64-bit mode.

0F 82 cd

JNAE rel32

Valid

Jump near if not above or equal (CF=1).

0F 83 cw

JNB rel16

N.S.

Valid

Jump near if not below (CF=0). Not supported

in 64-bit mode.

0F 83 cd

JNB rel32

Valid

Jump near if not below (CF=0).

0F 87 cw

JNBE rel16

N.S.

Valid

Jump near if not below or equal (CF=0 and

ZF=0). Not supported in 64-bit mode.

0F 87 cd

JNBE rel32

Valid

Jump near if not below or equal (CF=0 and

ZF=0).

0F 83 cw

JNC rel16

N.S.

Valid

Jump near if not carry (CF=0). Not supported

in 64-bit mode.

0F 83 cd

JNC rel32

Valid

Jump near if not carry (CF=0).

0F 85 cw

JNE rel16

N.S.

Valid

Jump near if not equal (ZF=0). Not supported

in 64-bit mode.

3-548

Vol. 2A

Jcc—Jump if Condition Is Met

INSTRUCTION SET REFERENCE, A-L

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 85 cd

JNE rel32

Valid

Jump near if not equal (ZF=0).

0F 8E cw

JNG rel16

N.S.

Valid

Jump near if not greater (ZF=1 or SF≠ OF).

Not supported in 64-bit mode.

0F 8E cd

JNG rel32

Valid

Jump near if not greater (ZF=1 or SF≠ OF).

0F 8C cw

JNGE rel16

N.S.

Valid

Jump near if not greater or equal (SF≠ OF).

Not supported in 64-bit mode.

0F 8C cd

JNGE rel32

Valid

Jump near if not greater or equal (SF≠ OF).

0F 8D cw

JNL rel16

N.S.

Valid

Jump near if not less (SF=OF). Not supported

in 64-bit mode.

0F 8D cd

JNL rel32

Valid

Jump near if not less (SF=OF).

0F 8F cw

JNLE rel16

N.S.

Valid

Jump near if not less or equal (ZF=0 and

SF=OF). Not supported in 64-bit mode.

0F 8F cd

JNLE rel32

Valid

Jump near if not less or equal (ZF=0 and

SF=OF).

0F 81 cw

JNO rel16

N.S.

Valid

Jump near if not overflow (OF=0). Not

supported in 64-bit mode.

0F 81 cd

JNO rel32

Valid

Jump near if not overflow (OF=0).

0F 8B cw

JNP rel16

N.S.

Valid

Jump near if not parity (PF=0). Not supported

in 64-bit mode.

0F 8B cd

JNP rel32

Valid

Jump near if not parity (PF=0).

0F 89 cw

JNS rel16

N.S.

Valid

Jump near if not sign (SF=0). Not supported in

64-bit mode.

0F 89 cd

JNS rel32

Valid

Jump near if not sign (SF=0).

0F 85 cw

JNZ rel16

N.S.

Valid

Jump near if not zero (ZF=0). Not supported in

64-bit mode.

0F 85 cd

JNZ rel32

Valid

Jump near if not zero (ZF=0).

0F 80 cw

JO rel16

N.S.

Valid

Jump near if overflow (OF=1). Not supported

in 64-bit mode.

0F 80 cd

JO rel32

Valid

Jump near if overflow (OF=1).

0F 8A cw

JP rel16

N.S.

Valid

Jump near if parity (PF=1). Not supported in

64-bit mode.

0F 8A cd

JP rel32

Valid

Jump near if parity (PF=1).

0F 8A cw

JPE rel16

N.S.

Valid

Jump near if parity even (PF=1). Not

supported in 64-bit mode.

0F 8A cd

JPE rel32

Valid

Jump near if parity even (PF=1).

0F 8B cw

JPO rel16

N.S.

Valid

Jump near if parity odd (PF=0). Not supported

in 64-bit mode.

0F 8B cd

JPO rel32

Valid

Jump near if parity odd (PF=0).

0F 88 cw

JS rel16

N.S.

Valid

Jump near if sign (SF=1). Not supported in 64-

bit mode.

0F 88 cd

JS rel32

Valid

Jump near if sign (SF=1).

0F 84 cw

JZ rel16

N.S.

Valid

Jump near if 0 (ZF=1). Not supported in 64-bit

mode.

0F 84 cd

JZ rel32

Valid

Jump near if 0 (ZF=1).

Jcc—Jump if Condition Is Met

Vol. 2A

3-549

INSTRUCTION SET REFERENCE, A-L

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

Offset

N/A

Description

Checks the state of one or more of the status flags in the EFLAGS register (CF, OF, PF, SF, and ZF) and, if the flags

are in the specified state (condition), performs a jump to the target instruction specified by the destination

operand. A condition code (cc) is associated with each instruction to indicate the condition being tested for. If the

condition is not satisfied, the jump is not performed and execution continues with the instruction following the Jcc

instruction.

The target instruction is specified with a relative offset (a signed offset relative to the current value of the instruc-

tion pointer in the EIP register). A relative offset (rel8, rel16, or rel32) is generally specified as a label in assembly

code, but at the machine code level, it is encoded as a signed, 8-bit or 32-bit immediate value, which is added to

the instruction pointer. Instruction coding is most efficient for offsets of -128 to +127. If the operand-size attribute

is 16, the upper two bytes of the EIP register are cleared, resulting in a maximum instruction pointer size of 16 bits.

The conditions for each Jcc mnemonic are given in the “Description” column of the table on the preceding page. The

terms “less” and “greater” are used for comparisons of signed integers and the terms “above” and “below” are used

for unsigned integers.

Because a particular state of the status flags can sometimes be interpreted in two ways, two mnemonics are

defined for some opcodes. For example, the JA (jump if above) instruction and the JNBE (jump if not below or

equal) instruction are alternate mnemonics for the opcode 77H.

The Jcc instruction does not support far jumps (jumps to other code segments). When the target for the conditional

jump is in a different segment, use the opposite condition from the condition being tested for the Jcc instruction,

and then access the target with an unconditional far jump (JMP instruction) to the other segment. For example, the

following conditional far jump is illegal:

JZ FARLABEL;

To accomplish this far jump, use the following two instructions:

JNZ BEYOND;

JMP FARLABEL;

BEYOND:

The JRCXZ, JECXZ, and JCXZ instructions differ from other Jcc instructions because they do not check status flags.

Instead, they check RCX, ECX or CX for 0. The register checked is determined by the address-size attribute. These

instructions are useful when used at the beginning of a loop that terminates with a conditional loop instruction

(such as LOOPNE). They can be used to prevent an instruction sequence from entering a loop when RCX, ECX or CX

is 0. This would cause the loop to execute 2⁶⁴, 2³² or 64K times (not zero times).

All conditional jumps are converted to code fetches of one or two cache lines, regardless of jump address or cache-

ability.

In 64-bit mode, operand size is fixed at 64 bits. JMP Short is RIP = RIP + 8-bit offset sign extended to 64 bits. JMP

Near is RIP = RIP + 32-bit offset sign extended to 64 bits.

3-550

Vol. 2A

Jcc—Jump if Condition Is Met

INSTRUCTION SET REFERENCE, A-L

JMP—Jump

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

EB cb

JMP rel8

Valid

Jump short, RIP = RIP + 8-bit displacement sign

extended to 64-bits.

E9 cw

JMP rel16

N.S.

Valid

Jump near, relative, displacement relative to

next instruction. Not supported in 64-bit

mode.

E9 cd

JMP rel32

Valid

Jump near, relative, RIP = RIP + 32-bit

displacement sign extended to 64-bits.

FF /4

JMP r/m16

N.S.

Valid

Jump near, absolute indirect, address = zero-

extended r/m16. Not supported in 64-bit

mode.

FF /4

JMP r/m32

N.S.

Valid

Jump near, absolute indirect, address given in

r/m32. Not supported in 64-bit mode.

FF /4

JMP r/m64

Valid

N.E.

Jump near, absolute indirect, RIP = 64-Bit

offset from register or memory.

EA cd

JMP ptr16:16

Inv.

Valid

Jump far, absolute, address given in operand.

EA cp

JMP ptr16:32

Inv.

Valid

Jump far, absolute, address given in operand.

FF /5

JMP m16:16

Valid

Jump far, absolute indirect, address given in

m16:16.

FF /5

JMP m16:32

Valid

Jump far, absolute indirect, address given in

m16:32.

REX.W FF /5

JMP m16:64

Valid

N.E.

Jump far, absolute indirect, address given in

m16:64.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

Segment + Absolute Address

N/A

Offset

N/A

ModRM:r/m (r)

N/A

Description

Transfers program control to a different point in the instruction stream without recording return information. The

destination (target) operand specifies the address of the instruction being jumped to. This operand can be an

immediate value, a general-purpose register, or a memory location.

This instruction can be used to execute four different types of jumps:

• Near jump—A jump to an instruction within the current code segment (the segment currently pointed to by the

CS register), sometimes referred to as an intrasegment jump.

• Short jump—A near jump where the jump range is limited to -128 to +127 from the current EIP value.

• Far jump—A jump to an instruction located in a different segment than the current code segment but at the

same privilege level, sometimes referred to as an intersegment jump.

• Task switch—A jump to an instruction located in a different task.

A task switch can only be executed in protected mode (see Chapter 8, in the Intel® 64 and IA-32 Architectures

Software Developer’s Manual, Volume 3A, for information on performing task switches with the JMP instruction).

Near and Short Jumps. When executing a near jump, the processor jumps to the address (within the current code

segment) that is specified with the target operand. The target operand specifies either an absolute offset (that is

an offset from the base of the code segment) or a relative offset (a signed displacement relative to the current

3-552

Vol. 2A

JMP—Jump

INSTRUCTION SET REFERENCE, A-L

value of the instruction pointer in the EIP register). A near jump to a relative offset of 8-bits (rel8) is referred to as

a short jump. The CS register is not changed on near and short jumps.

An absolute offset is specified indirectly in a general-purpose register or a memory location (r/m16 or r/m32). The

operand-size attribute determines the size of the target operand (16 or 32 bits). Absolute offsets are loaded

directly into the EIP register. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared,

resulting in a maximum instruction pointer size of 16 bits.

A relative offset (rel8, rel16, or rel32) is generally specified as a label in assembly code, but at the machine code

level, it is encoded as a signed 8-, 16-, or 32-bit immediate value. This value is added to the value in the EIP

relative offsets, the opcode (for short vs. near jumps) and the operand-size attribute (for near relative jumps)

determines the size of the target operand (8, 16, or 32 bits).

Far Jumps in Real-Address or Virtual-8086 Mode. When executing a far jump in real-address or virtual-8086 mode,

the processor jumps to the code segment and offset specified with the target operand. Here the target operand

specifies an absolute far address either directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory

location (m16:16 or m16:32). With the pointer method, the segment and address of the called procedure is

encoded in the instruction, using a 4-byte (16-bit operand size) or 6-byte (32-bit operand size) far address imme-

diate. With the indirect method, the target operand specifies a memory location that contains a 4-byte (16-bit

operand size) or 6-byte (32-bit operand size) far address. The far address is loaded directly into the CS and EIP

registers. If the operand-size attribute is 16, the upper two bytes of the EIP register are cleared.

Far Jumps in Protected Mode. When the processor is operating in protected mode, the JMP instruction can be used

to perform the following three types of far jumps:

• A far jump to a conforming or non-conforming code segment.

• A far jump through a call gate.

• A task switch.

(The JMP instruction cannot be used to perform inter-privilege-level far jumps.)

In protected mode, the processor always uses the segment selector part of the far address to access the corre-

sponding descriptor in the GDT or LDT. The descriptor type (code segment, call gate, task gate, or TSS) and access

rights determine the type of jump to be performed.

If the selected descriptor is for a code segment, a far jump to a code segment at the same privilege level is

performed. (If the selected code segment is at a different privilege level and the code segment is non-conforming,

a general-protection exception is generated.) A far jump to the same privilege level in protected mode is very

similar to one carried out in real-address or virtual-8086 mode. The target operand specifies an absolute far

address either directly with a pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or

m16:32). The operand-size attribute determines the size of the offset (16 or 32 bits) in the far address. The new

code segment selector and its descriptor are loaded into CS register, and the offset from the instruction is loaded

into the EIP register. Note that a call gate (described in the next paragraph) can also be used to perform far call to

a code segment at the same privilege level. Using this mechanism provides an extra level of indirection and is the

preferred method of making jumps between 16-bit and 32-bit code segments.

When executing a far jump through a call gate, the segment selector specified by the target operand identifies the

call gate. (The offset part of the target operand is ignored.) The processor then jumps to the code segment speci-

fied in the call gate descriptor and begins executing the instruction at the offset specified in the call gate. No stack

switch occurs. Here again, the target operand can specify the far address of the call gate either directly with a

pointer (ptr16:16 or ptr16:32) or indirectly with a memory location (m16:16 or m16:32).

Executing a task switch with the JMP instruction is somewhat similar to executing a jump through a call gate. Here

the target operand specifies the segment selector of the task gate for the task being switched to (and the offset

part of the target operand is ignored). The task gate in turn points to the TSS for the task, which contains the

segment selectors for the task’s code and stack segments. The TSS also contains the EIP value for the next instruc-

tion that was to be executed before the task was suspended. This instruction pointer value is loaded into the EIP

The JMP instruction can also specify the segment selector of the TSS directly, which eliminates the indirection of the

task gate. See Chapter 8 in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for

detailed information on the mechanics of a task switch.

JMP—Jump

Vol. 2A

3-553

INSTRUCTION SET REFERENCE, A-L

Note that when you execute at task switch with a JMP instruction, the nested task flag (NT) is not set in the EFLAGS

previous task can thus not be carried out by executing the IRET instruction. Switching tasks with the JMP instruc-

tion differs in this regard from the CALL instruction which does set the NT flag and save the previous task link infor-

mation, allowing a return to the calling task with an IRET instruction.

Refer to Chapter 6, “Procedure Calls, Interrupts, and Exceptions” and Chapter 17, “Control-Flow Enforcement Tech-

nology (CET)” in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1 for CET details.

In 64-Bit Mode. The instruction’s operation size is fixed at 64 bits. If a selector points to a gate, then RIP equals the

64-bit displacement taken from gate; else RIP equals the zero-extended offset from the far pointer referenced in

the instruction.

See the summary chart at the beginning of this section for encoding data and limits.

Instruction ordering. Instructions following a far jump may be fetched from memory before earlier instructions

complete execution, but they will not execute (even speculatively) until all instructions prior to the far jump have

completed execution (the later instructions may execute before data stored by the earlier instructions have become

globally visible).

Instructions sequentially following a near indirect JMP instruction (i.e., those not at the target) may be executed

speculatively. If software needs to prevent this (e.g., in order to prevent a speculative execution side channel),

then an INT3 or LFENCE instruction opcode can be placed after the near indirect JMP in order to block speculative

execution.

Operation

IF near jump

IF 64-bit Mode

THEN

IF near relative jump

THEN

tempRIP := RIP + DEST; (* RIP is instruction following JMP instruction*)

ELSE (* Near absolute jump *)

tempRIP := DEST;

FI;

ELSE

IF near relative jump

THEN

tempEIP := EIP + DEST; (* EIP is instruction following JMP instruction*)

ELSE (* Near absolute jump *)

tempEIP := DEST;

FI;

IF (IA32_EFER.LMA = 0 or target mode = Compatibility mode)

and tempEIP outside code segment limit

THEN #GP(0); FI

IF 64-bit mode and tempRIP is not canonical

THEN #GP(0);

FI;

IF OperandSize = 32

THEN

EIP := tempEIP;

ELSE

IF OperandSize = 16

THEN (* OperandSize = 16 *)

EIP := tempEIP AND 0000FFFFH;

ELSE (* OperandSize = 64)

RIP := tempRIP;

3-554

Vol. 2A

JMP—Jump

INSTRUCTION SET REFERENCE, A-L

FI;

IF (JMP near indirect, absolute indirect)

IF EndbranchEnabledAndNotSuppressed(CPL)

IF CPL = 3

THEN

IF ( no 3EH prefix OR IA32_U_CET.NO_TRACK_EN == 0 )

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH

FI;

ELSE

IF ( no 3EH prefix OR IA32_S_CET.NO_TRACK_EN == 0 )

THEN

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

FI;

IF far jump and (PE = 0 or (PE = 1 AND VM = 1)) (* Real-address or virtual-8086 mode *)

THEN

tempEIP := DEST(Offset); (* DEST is ptr16:32 or [m16:32] *)

IF tempEIP is beyond code segment limit

THEN #GP(0); FI;

CS := DEST(segment selector); (* DEST is ptr16:32 or [m16:32] *)

IF OperandSize = 32

THEN

EIP := tempEIP; (* DEST is ptr16:32 or [m16:32] *)

ELSE (* OperandSize = 16 *)

EIP := tempEIP AND 0000FFFFH; (* Clear upper 16 bits *)

FI;

IF far jump and (PE = 1 and VM = 0)

(* IA-32e mode or protected mode, not virtual-8086 mode *)

THEN

IF effective address in the CS, DS, ES, FS, GS, or SS segment is illegal

or segment selector in target operand NULL

THEN #GP(0); FI;

IF segment selector index not within descriptor table limits

THEN #GP(new selector); FI;

Read type and access rights of segment descriptor;

IF (IA32_EFER.LMA = 0)

THEN

IF segment type is not a conforming or nonconforming code

segment, call gate, task gate, or TSS

THEN #GP(segment selector); FI;

ELSE

IF segment type is not a conforming or nonconforming code segment

call gate

THEN #GP(segment selector); FI;

FI;

Depending on type and access rights:

GO TO CONFORMING-CODE-SEGMENT;

GO TO NONCONFORMING-CODE-SEGMENT;

JMP—Jump

Vol. 2A

3-555

INSTRUCTION SET REFERENCE, A-L

GO TO CALL-GATE;

GO TO TASK-GATE;

GO TO TASK-STATE-SEGMENT;

ELSE

#GP(segment selector);

FI;

CONFORMING-CODE-SEGMENT:

IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1

THEN GP(new code segment selector); FI;

IF DPL > CPL

THEN #GP(segment selector); FI;

IF segment not present

THEN #NP(segment selector); FI;

tempEIP := DEST(Offset);

IF OperandSize = 16

THEN tempEIP := tempEIP AND 0000FFFFH;

FI;

IF (IA32_EFER.LMA = 0 or target mode = Compatibility mode) and

tempEIP outside code segment limit

THEN #GP(0); FI

IF tempEIP is non-canonical

THEN #GP(0); FI;

IF ShadowStackEnabled(CPL)

IF (IA32_EFER.LMA and DEST(segment selector).L) = 0

(* If target is legacy or compatibility mode then the SSP must be in low 4GB *)

IF (SSP & 0xFFFFFFFF00000000 != 0)

THEN #GP(0); FI;

FI;

CS := DEST[segment selector]; (* Segment descriptor information also loaded *)

CS(RPL) := CPL

EIP := tempEIP;

IF EndbranchEnabled(CPL)

IF CPL = 3

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_U_CET.SUPPRESS = 0

ELSE

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_S_CET.SUPPRESS = 0

FI;

END;

NONCONFORMING-CODE-SEGMENT:

IF L-Bit = 1 and D-BIT = 1 and IA32_EFER.LMA = 1

THEN GP(new code segment selector); FI;

IF (RPL > CPL) OR (DPL ≠ CPL)

THEN #GP(code segment selector); FI;

IF segment not present

THEN #NP(segment selector); FI;

tempEIP := DEST(Offset);

IF OperandSize = 16

THEN tempEIP := tempEIP AND 0000FFFFH; FI;

IF (IA32_EFER.LMA = 0 OR target mode = Compatibility mode)

3-556

Vol. 2A

JMP—Jump

INSTRUCTION SET REFERENCE, A-L

and tempEIP outside code segment limit

THEN #GP(0); FI

IF tempEIP is non-canonical THEN #GP(0); FI;

IF ShadowStackEnabled(CPL)

IF (IA32_EFER.LMA and DEST(segment selector).L) = 0

(* If target is legacy or compatibility mode then the SSP must be in low 4GB *)

IF (SSP & 0xFFFFFFFF00000000 != 0)

THEN #GP(0); FI;

FI;

CS := DEST[segment selector]; (* Segment descriptor information also loaded *)

CS(RPL) := CPL;

EIP := tempEIP;

IF EndbranchEnabled(CPL)

IF CPL = 3

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_U_CET.SUPPRESS = 0

ELSE

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH

IA32_S_CET.SUPPRESS = 0

FI;

END;

CALL-GATE:

IF call gate DPL < CPL

or call gate DPL < call gate segment-selector RPL

THEN #GP(call gate selector); FI;

IF call gate not present

THEN #NP(call gate selector); FI;

IF call gate code-segment selector is NULL

THEN #GP(0); FI;

IF call gate code-segment selector index outside descriptor table limits

THEN #GP(code segment selector); FI;

Read code segment descriptor;

IF code-segment segment descriptor does not indicate a code segment

or code-segment segment descriptor is conforming and DPL > CPL

or code-segment segment descriptor is non-conforming and DPL ≠ CPL

THEN #GP(code segment selector); FI;

IF IA32_EFER.LMA = 1 and (code-segment descriptor is not a 64-bit code segment

or code-segment segment descriptor has both L-Bit and D-bit set)

THEN #GP(code segment selector); FI;

IF code segment is not present

THEN #NP(code-segment selector); FI;

tempEIP := DEST(Offset);

IF GateSize = 16

THEN tempEIP := tempEIP AND 0000FFFFH; FI;

IF (IA32_EFER.LMA = 0 OR target mode = Compatibility mode) AND tempEIP

outside code segment limit

THEN #GP(0); FI

CS := DEST[SegmentSelector]; (* Segment descriptor information also loaded *)

CS(RPL) := CPL;

EIP := tempEIP;

JMP—Jump

Vol. 2A

3-557

INSTRUCTION SET REFERENCE, A-L

IF EndbranchEnabled(CPL)

IF CPL = 3

THEN

IA32_U_CET.TRACKER = WAIT_FOR_ENDBRANCH;

IA32_U_CET.SUPPRESS = 0

ELSE

IA32_S_CET.TRACKER = WAIT_FOR_ENDBRANCH;

IA32_S_CET.SUPPRESS = 0

FI;

END;

TASK-GATE:

IF task gate DPL < CPL

or task gate DPL < task gate segment-selector RPL

THEN #GP(task gate selector); FI;

IF task gate not present

THEN #NP(gate selector); FI;

Read the TSS segment selector in the task-gate descriptor;

IF TSS segment selector local/global bit is set to local

or index not within GDT limits

or descriptor is not a TSS segment

or TSS descriptor specifies that the TSS is busy

THEN #GP(TSS selector); FI;

IF TSS not present

THEN #NP(TSS selector); FI;

SWITCH-TASKS to TSS;

IF EIP not within code segment limit

THEN #GP(0); FI;

END;

TASK-STATE-SEGMENT:

IF TSS DPL < CPL

or TSS DPL < TSS segment-selector RPL

or TSS descriptor indicates TSS not available

THEN #GP(TSS selector); FI;

IF TSS is not present

THEN #NP(TSS selector); FI;

SWITCH-TASKS to TSS;

IF EIP not within code segment limit

THEN #GP(0); FI;

END;

Flags Affected

All flags are affected if a task switch occurs; no flags are affected if a task switch does not occur.

Protected Mode Exceptions

#GP(0)

If offset in target operand, call gate, or TSS is beyond the code segment limits.

If the segment selector in the destination operand, call gate, task gate, or TSS is NULL.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If target mode is compatibility mode and SSP is not in low 4GB.

#GP(selector)

If the segment selector index is outside descriptor table limits.

3-558

Vol. 2A

JMP—Jump

INSTRUCTION SET REFERENCE, A-L

If the segment descriptor pointed to by the segment selector in the destination operand is not

for a conforming-code segment, nonconforming-code segment, call gate, task gate, or task

state segment.

If the DPL for a nonconforming-code segment is not equal to the CPL

(When not using a call gate.) If the RPL for the segment’s segment selector is greater than the

CPL.

If the DPL for a conforming-code segment is greater than the CPL.

If the DPL from a call-gate, task-gate, or TSS segment descriptor is less than the CPL or than

the RPL of the call-gate, task-gate, or TSS’s segment selector.

If the segment descriptor for selector in a call gate does not indicate it is a code segment.

If the segment descriptor for the segment selector in a task gate does not indicate an available

TSS.

If the segment selector for a TSS has its local/global bit set for local.

If a TSS segment descriptor specifies that the TSS is busy or not available.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#NP (selector)

If the code segment being accessed is not present.

If call gate, task gate, or TSS not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3. (Only occurs when fetching target from memory.)

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If the target operand is beyond the code segment limits.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made. (Only occurs

when fetching target from memory.)

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same as 64-bit mode exceptions.

64-Bit Mode Exceptions

#GP(0)

If a memory address is non-canonical.

If target offset in destination operand is non-canonical.

If target offset in destination operand is beyond the new code segment limit.

If the segment selector in the destination operand is NULL.

If the code segment selector in the 64-bit gate is NULL.

If transitioning to compatibility mode and the SSP is beyond 4GB.

#GP(selector)

If the code segment or 64-bit call gate is outside descriptor table limits.

If the code segment or 64-bit call gate overlaps non-canonical space.

JMP—Jump

Vol. 2A

3-559

INSTRUCTION SET REFERENCE, A-L

If the segment descriptor from a 64-bit call gate is in non-canonical space.

If the segment descriptor pointed to by the segment selector in the destination operand is not

for a conforming-code segment, nonconforming-code segment, 64-bit call gate.

If the segment descriptor pointed to by the segment selector in the destination operand is a

code segment, and has both the D-bit and the L-bit set.

If the DPL for a nonconforming-code segment is not equal to the CPL, or the RPL for the

segment’s segment selector is greater than the CPL.

If the DPL for a conforming-code segment is greater than the CPL.

If the DPL from a 64-bit call-gate is less than the CPL or than the RPL of the 64-bit call-gate.

If the upper type field of a 64-bit call gate is not 0x0.

If the segment selector from a 64-bit call gate is beyond the descriptor table limits.

If the code segment descriptor pointed to by the selector in the 64-bit gate doesn't have the L-

bit set and the D-bit clear.

If the segment descriptor for a segment selector from the 64-bit call gate does not indicate it

is a code segment.

If the code segment is non-conforming and CPL ≠ DPL.

If the code segment is confirming and CPL < DPL.

#NP(selector)

If a code segment or 64-bit call gate is not present.

#UD

(64-bit mode only) If a far jump is direct to an absolute address in memory.

If the LOCK prefix is used.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

3-560

Vol. 2A

JMP—Jump

INSTRUCTION SET REFERENCE, A-L

KADDW/KADDB/KADDQ/KADDD—ADD Two Masks

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.0F.W0 4A /r

RVR

V/V

AVX512DQ

Add 16 bits masks in k2 and k3 and place result in k1.

KADDW k1, k2, k3

VEX.L1.66.0F.W0 4A /r

RVR

V/V

AVX512DQ

Add 8 bits masks in k2 and k3 and place result in k1.

KADDB k1, k2, k3

VEX.L1.0F.W1 4A /r

RVR

V/V

AVX512BW

Add 64 bits masks in k2 and k3 and place result in k1.

KADDQ k1, k2, k3

VEX.L1.66.0F.W1 4A /r

RVR

V/V

AVX512BW

Add 32 bits masks in k2 and k3 and place result in k1.

KADDD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Adds the vector mask k2 and the vector mask k3, and writes the result into vector mask k1.

Operation

KADDW

DEST[15:0] := SRC1[15:0] + SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KADDB

DEST[7:0] := SRC1[7:0] + SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KADDQ

DEST[63:0] := SRC1[63:0] + SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KADDD

DEST[31:0] := SRC1[31:0] + SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KADDW __mmask16 _kadd_mask16 (__mmask16 a, __mmask16 b);

KADDB __mmask8 _kadd_mask8 (__mmask8 a, __mmask8 b);

KADDQ __mmask64 _kadd_mask64 (__mmask64 a, __mmask64 b);

KADDD __mmask32 _kadd_mask32 (__mmask32 a, __mmask32 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

KADDW/KADDB/KADDQ/KADDD—ADD Two Masks

Vol. 2A

3-561

INSTRUCTION SET REFERENCE, A-L

KANDW/KANDB/KANDQ/KANDD—Bitwise Logical AND Masks

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.0F.W0 41 /r

RVR

V/V

AVX512F

Bitwise AND 16 bits masks k2 and k3 and place result in k1.

KANDW k1, k2, k3

VEX.L1.66.0F.W0 41 /r

RVR

V/V

AVX512DQ

Bitwise AND 8 bits masks k2 and k3 and place result in k1.

KANDB k1, k2, k3

VEX.L1.0F.W1 41 /r

RVR

V/V

AVX512BW

Bitwise AND 64 bits masks k2 and k3 and place result in k1.

KANDQ k1, k2, k3

VEX.L1.66.0F.W1 41 /r

RVR

V/V

AVX512BW

Bitwise AND 32 bits masks k2 and k3 and place result in k1.

KANDD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise AND between the vector mask k2 and the vector mask k3, and writes the result into vector mask

k1.

Operation

KANDW

DEST[15:0] := SRC1[15:0] BITWISE AND SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KANDB

DEST[7:0] := SRC1[7:0] BITWISE AND SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KANDQ

DEST[63:0] := SRC1[63:0] BITWISE AND SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KANDD

DEST[31:0] := SRC1[31:0] BITWISE AND SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KANDW __mmask16 _mm512_kand(__mmask16 a, __mmask16 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

KANDW/KANDB/KANDQ/KANDD—Bitwise Logical AND Masks

Vol. 2A

3-563

INSTRUCTION SET REFERENCE, A-L

KANDNW/KANDNB/KANDNQ/KANDND—Bitwise Logical AND NOT Masks

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.0F.W0 42 /r

RVR

V/V

AVX512F

Bitwise AND NOT 16 bits masks k2 and k3 and place result in

KANDNW k1, k2, k3

k1.

VEX.L1.66.0F.W0 42 /r

RVR

V/V

AVX512DQ

Bitwise AND NOT 8 bits masks k1 and k2 and place result in k1.

KANDNB k1, k2, k3

VEX.L1.0F.W1 42 /r

RVR

V/V

AVX512BW

Bitwise AND NOT 64 bits masks k2 and k3 and place result in

KANDNQ k1, k2, k3

k1.

VEX.L1.66.0F.W1 42 /r

RVR

V/V

AVX512BW

Bitwise AND NOT 32 bits masks k2 and k3 and place result in

KANDND k1, k2, k3

k1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise AND NOT between the vector mask k2 and the vector mask k3, and writes the result into vector

mask k1.

Operation

KANDNW

DEST[15:0] := (BITWISE NOT SRC1[15:0]) BITWISE AND SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KANDNB

DEST[7:0] := (BITWISE NOT SRC1[7:0]) BITWISE AND SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KANDNQ

DEST[63:0] := (BITWISE NOT SRC1[63:0]) BITWISE AND SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KANDND

DEST[31:0] := (BITWISE NOT SRC1[31:0]) BITWISE AND SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KANDNW __mmask16 _mm512_kandn(__mmask16 a, __mmask16 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

3-564

Vol. 2A

KANDNW/KANDNB/KANDNQ/KANDND—Bitwise Logical AND NOT Masks

INSTRUCTION SET REFERENCE, A-L

KMOVW/KMOVB/KMOVQ/KMOVD—Move From and to Mask Registers

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L0.0F.W0 90 /r

V/V

AVX512F

Move 16 bits mask from k2/m16 and store the result in k1.

KMOVW k1, k2/m16

VEX.L0.66.0F.W0 90 /r

V/V

AVX512DQ

Move 8 bits mask from k2/m8 and store the result in k1.

KMOVB k1, k2/m8

VEX.L0.0F.W1 90 /r

V/V

AVX512BW

Move 64 bits mask from k2/m64 and store the result in k1.

KMOVQ k1, k2/m64

VEX.L0.66.0F.W1 90 /r

V/V

AVX512BW

Move 32 bits mask from k2/m32 and store the result in k1.

KMOVD k1, k2/m32

VEX.L0.0F.W0 91 /r

V/V

AVX512F

Move 16 bits mask from k1 and store the result in m16.

KMOVW m16, k1

VEX.L0.66.0F.W0 91 /r

V/V

AVX512DQ

Move 8 bits mask from k1 and store the result in m8.

KMOVB m8, k1

VEX.L0.0F.W1 91 /r

V/V

AVX512BW

Move 64 bits mask from k1 and store the result in m64.

KMOVQ m64, k1

VEX.L0.66.0F.W1 91 /r

V/V

AVX512BW

Move 32 bits mask from k1 and store the result in m32.

KMOVD m32, k1

VEX.L0.0F.W0 92 /r

V/V

AVX512F

Move 16 bits mask from r32 to k1.

KMOVW k1, r32

VEX.L0.66.0F.W0 92 /r

V/V

AVX512DQ

Move 8 bits mask from r32 to k1.

KMOVB k1, r32

VEX.L0.F2.0F.W1 92 /r

V/I

AVX512BW

Move 64 bits mask from r64 to k1.

KMOVQ k1, r64

VEX.L0.F2.0F.W0 92 /r

V/V

AVX512BW

Move 32 bits mask from r32 to k1.

KMOVD k1, r32

VEX.L0.0F.W0 93 /r

V/V

AVX512F

Move 16 bits mask from k1 to r32.

KMOVW r32, k1

VEX.L0.66.0F.W0 93 /r

V/V

AVX512DQ

Move 8 bits mask from k1 to r32.

KMOVB r32, k1

VEX.L0.F2.0F.W1 93 /r

V/I

AVX512BW

Move 64 bits mask from k1 to r64.

KMOVQ r64, k1

VEX.L0.F2.0F.W0 93 /r

V/V

AVX512BW

Move 32 bits mask from k1 to r32.

KMOVD r32, k1

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (w)

ModRM:r/m (r)

ModRM:r/m (w, ModRM:[7:6] must not be 11b)

ModRM:reg (r)

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Copies values from the source operand (second operand) to the destination operand (first operand). The source

and destination operands can be mask registers, memory location or general purpose. The instruction cannot be

used to transfer data between general purpose registers and or memory locations.

When moving to a mask register, the result is zero extended to MAX_KL size (i.e., 64 bits currently). When moving

to a general-purpose register (GPR), the result is zero-extended to the size of the destination. In 32-bit mode, the

default GPR destination’s size is 32 bits. In 64-bit mode, the default GPR destination’s size is 64 bits. Note that

VEX.W can only be used to modify the size of the GPR operand in 64b mode.

KMOVW/KMOVB/KMOVQ/KMOVD—Move From and to Mask Registers

Vol. 2A

3-565

INSTRUCTION SET REFERENCE, A-L

Operation

KMOVW

IF *destination is a memory location*

DEST[15:0] := SRC[15:0]

IF *destination is a mask register or a GPR *

DEST := ZeroExtension(SRC[15:0])

KMOVB

IF *destination is a memory location*

DEST[7:0] := SRC[7:0]

IF *destination is a mask register or a GPR *

DEST := ZeroExtension(SRC[7:0])

KMOVQ

IF *destination is a memory location or a GPR*

DEST[63:0] := SRC[63:0]

IF *destination is a mask register*

DEST := ZeroExtension(SRC[63:0])

KMOVD

IF *destination is a memory location*

DEST[31:0] := SRC[31:0]

IF *destination is a mask register or a GPR *

DEST := ZeroExtension(SRC[31:0])

Intel C/C++ Compiler Intrinsic Equivalent

KMOVW __mmask16 _mm512_kmov(__mmask16 a);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

Instructions with RR operand encoding, see Table

2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask

Instructions w/o Memory Arg)”.

Instructions with RM or MR operand encoding, see Table 2-64, “TYPE K21 Exception Definition (VEX-Encoded

OpMask Instructions Addressing Memory)”.

3-566

Vol. 2A

KMOVW/KMOVB/KMOVQ/KMOVD—Move From and to Mask Registers

INSTRUCTION SET REFERENCE, A-L

KNOTW/KNOTB/KNOTQ/KNOTD—NOT Mask Register

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature Flag

Support

VEX.L0.0F.W0 44 /r

V/V

AVX512F

Bitwise NOT of 16 bits mask k2.

KNOTW k1, k2

VEX.L0.66.0F.W0 44 /r

V/V

AVX512DQ

Bitwise NOT of 8 bits mask k2.

KNOTB k1, k2

VEX.L0.0F.W1 44 /r

V/V

AVX512BW

Bitwise NOT of 64 bits mask k2.

KNOTQ k1, k2

VEX.L0.66.0F.W1 44 /r

V/V

AVX512BW

Bitwise NOT of 32 bits mask k2.

KNOTD k1, k2

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise NOT of vector mask k2 and writes the result into vector mask k1.

Operation

KNOTW

DEST[15:0] := BITWISE NOT SRC[15:0]

DEST[MAX_KL-1:16] := 0

KNOTB

DEST[7:0] := BITWISE NOT SRC[7:0]

DEST[MAX_KL-1:8] := 0

KNOTQ

DEST[63:0] := BITWISE NOT SRC[63:0]

DEST[MAX_KL-1:64] := 0

KNOTD

DEST[31:0] := BITWISE NOT SRC[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KNOTW __mmask16 _mm512_knot(__mmask16 a);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

KNOTW/KNOTB/KNOTQ/KNOTD—NOT Mask Register

Vol. 2A

3-567

INSTRUCTION SET REFERENCE, A-L

KORW/KORB/KORQ/KORD—Bitwise Logical OR Masks

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.0F.W0 45 /r

RVR

V/V

AVX512F

Bitwise OR 16 bits masks k2 and k3 and place result in k1.

KORW k1, k2, k3

VEX.L1.66.0F.W0 45 /r

RVR

V/V

AVX512DQ

Bitwise OR 8 bits masks k2 and k3 and place result in k1.

KORB k1, k2, k3

VEX.L1.0F.W1 45 /r

RVR

V/V

AVX512BW

Bitwise OR 64 bits masks k2 and k3 and place result in k1.

KORQ k1, k2, k3

VEX.L1.66.0F.W1 45 /r

RVR

V/V

AVX512BW

Bitwise OR 32 bits masks k2 and k3 and place result in k1.

KORD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise OR between the vector mask k2 and the vector mask k3, and writes the result into vector mask

k1 (three-operand form).

Operation

KORW

DEST[15:0] := SRC1[15:0] BITWISE OR SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KORB

DEST[7:0] := SRC1[7:0] BITWISE OR SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KORQ

DEST[63:0] := SRC1[63:0] BITWISE OR SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KORD

DEST[31:0] := SRC1[31:0] BITWISE OR SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KORW __mmask16 _mm512_kor(__mmask16 a, __mmask16 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

3-568

Vol. 2A

KORW/KORB/KORQ/KORD—Bitwise Logical OR Masks

INSTRUCTION SET REFERENCE, A-L

KORTESTW/KORTESTB/KORTESTQ/KORTESTD—OR Masks and Set Flags

Opcode/

Op/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L0.0F.W0 98 /r

V/V

AVX512F

Bitwise OR 16 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTW k1, k2

VEX.L0.66.0F.W0 98 /r

V/V

AVX512DQ

Bitwise OR 8 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTB k1, k2

VEX.L0.0F.W1 98 /r

V/V

AVX512BW

Bitwise OR 64 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTQ k1, k2

VEX.L0.66.0F.W1 98 /r

V/V

AVX512BW

Bitwise OR 32 bits masks k1 and k2 and update ZF and CF accordingly.

KORTESTD k1, k2

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise OR between the vector mask register k2, and the vector mask register k1, and sets CF and ZF

based on the operation result.

ZF flag is set if both sources are 0x0. CF is set if, after the OR operation is done, the operation result is all 1’s.

Operation

KORTESTW

TMP[15:0] := DEST[15:0] BITWISE OR SRC[15:0]

IF(TMP[15:0]=0)

THEN ZF := 1

ELSE ZF := 0

FI;

IF(TMP[15:0]=FFFFh)

THEN CF := 1

ELSE CF := 0

FI;

KORTESTB

TMP[7:0] := DEST[7:0] BITWISE OR SRC[7:0]

IF(TMP[7:0]=0)

THEN ZF := 1

ELSE ZF := 0

FI;

IF(TMP[7:0]==FFh)

THEN CF := 1

ELSE CF := 0

FI;

KORTESTW/KORTESTB/KORTESTQ/KORTESTD—OR Masks and Set Flags

Vol. 2A

3-569

INSTRUCTION SET REFERENCE, A-L

KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD—Shift Left Mask Registers

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L0.66.0F3A.W1 32 /r

RRI

V/V

AVX512F

Shift left 16 bits in k2 by immediate and write result in k1.

KSHIFTLW k1, k2, imm8

VEX.L0.66.0F3A.W0 32 /r

RRI

V/V

AVX512DQ

Shift left 8 bits in k2 by immediate and write result in k1.

KSHIFTLB k1, k2, imm8

VEX.L0.66.0F3A.W1 33 /r

RRI

V/V

AVX512BW

Shift left 64 bits in k2 by immediate and write result in k1.

KSHIFTLQ k1, k2, imm8

VEX.L0.66.0F3A.W0 33 /r

RRI

V/V

AVX512BW

Shift left 32 bits in k2 by immediate and write result in k1.

KSHIFTLD k1, k2, imm8

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RRI

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

imm8

Description

Shifts 8/16/32/64 bits in the second operand (source operand) left by the count specified in immediate byte and

place the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destina-

tion are zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for

word shift), 31 (for doubleword shift) or 63 (for quadword shift).

Operation

KSHIFTLW

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=15

THEN DEST[15:0] := SRC1[15:0] << COUNT;

FI;

KSHIFTLB

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=7

THEN DEST[7:0] := SRC1[7:0] << COUNT;

FI;

KSHIFTLQ

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=63

THEN DEST[63:0] := SRC1[63:0] << COUNT;

FI;

KSHIFTLW/KSHIFTLB/KSHIFTLQ/KSHIFTLD—Shift Left Mask Registers

Vol. 2A

3-571

INSTRUCTION SET REFERENCE, A-L

KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD—Shift Right Mask Registers

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L0.66.0F3A.W1 30 /r

RRI

V/V

AVX512F

Shift right 16 bits in k2 by immediate and write result in k1.

KSHIFTRW k1, k2, imm8

VEX.L0.66.0F3A.W0 30 /r

RRI

V/V

AVX512DQ

Shift right 8 bits in k2 by immediate and write result in k1.

KSHIFTRB k1, k2, imm8

VEX.L0.66.0F3A.W1 31 /r

RRI

V/V

AVX512BW

Shift right 64 bits in k2 by immediate and write result in k1.

KSHIFTRQ k1, k2, imm8

VEX.L0.66.0F3A.W0 31 /r

RRI

V/V

AVX512BW

Shift right 32 bits in k2 by immediate and write result in k1.

KSHIFTRD k1, k2, imm8

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RRI

ModRM:reg (w)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

imm8

Description

Shifts 8/16/32/64 bits in the second operand (source operand) right by the count specified in immediate and place

the least significant 8/16/32/64 bits of the result in the destination operand. The higher bits of the destination are

zero-extended. The destination is set to zero if the count value is greater than 7 (for byte shift), 15 (for word shift),

31 (for doubleword shift) or 63 (for quadword shift).

Operation

KSHIFTRW

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=15

THEN DEST[15:0] := SRC1[15:0] >> COUNT;

FI;

KSHIFTRB

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=7

THEN DEST[7:0] := SRC1[7:0] >> COUNT;

FI;

KSHIFTRQ

COUNT := imm8[7:0]

DEST[MAX_KL-1:0] := 0

IF COUNT <=63

THEN DEST[63:0] := SRC1[63:0] >> COUNT;

FI;

KSHIFTRW/KSHIFTRB/KSHIFTRQ/KSHIFTRD—Shift Right Mask Registers

Vol. 2A

3-573

INSTRUCTION SET REFERENCE, A-L

KTESTW/KTESTB/KTESTQ/KTESTD—Packed Bit Test Masks and Set Flags

Opcode/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L0.0F.W0 99 /r

V/V

AVX512DQ

Set ZF and CF depending on sign bit AND and ANDN of 16 bits mask

KTESTW k1, k2

VEX.L0.66.0F.W0 99 /r

V/V

AVX512DQ

Set ZF and CF depending on sign bit AND and ANDN of 8 bits mask

KTESTB k1, k2

VEX.L0.0F.W1 99 /r

V/V

AVX512BW

Set ZF and CF depending on sign bit AND and ANDN of 64 bits mask

KTESTQ k1, k2

VEX.L0.66.0F.W1 99 /r

V/V

AVX512BW

Set ZF and CF depending on sign bit AND and ANDN of 32 bits mask

KTESTD k1, k2

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

ModRM:reg (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise comparison of the bits of the first source operand and corresponding bits in the second source

operand. If the AND operation produces all zeros, the ZF is set else the ZF is clear. If the bitwise AND operation of

the inverted first source operand with the second source operand produces all zeros the CF is set else the CF is

clear. Only the EFLAGS register is updated.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

KTESTW

TEMP[15:0] := SRC2[15:0] AND SRC1[15:0]

IF (TEMP[15:0] = = 0)

THEN ZF :=1;

ELSE ZF := 0;

FI;

TEMP[15:0] := SRC2[15:0] AND NOT SRC1[15:0]

IF (TEMP[15:0] = = 0)

THEN CF :=1;

ELSE CF := 0;

FI;

AF := OF := PF := SF := 0;

KTESTB

TEMP[7:0] := SRC2[7:0] AND SRC1[7:0]

IF (TEMP[7:0] = = 0)

THEN ZF :=1;

ELSE ZF := 0;

FI;

TEMP[7:0] := SRC2[7:0] AND NOT SRC1[7:0]

IF (TEMP[7:0] = = 0)

THEN CF :=1;

ELSE CF := 0;

FI;

AF := OF := PF := SF := 0;

KTESTW/KTESTB/KTESTQ/KTESTD—Packed Bit Test Masks and Set Flags

Vol. 2A

3-575

INSTRUCTION SET REFERENCE, A-L

KUNPCKBW/KUNPCKWD/KUNPCKDQ—Unpack for Mask Registers

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.66.0F.W0 4B /r

RVR

V/V

AVX512F

Unpack 8-bit masks in k2 and k3 and write word result in k1.

KUNPCKBW k1, k2, k3

VEX.L1.0F.W0 4B /r

RVR

V/V

AVX512BW

Unpack 16-bit masks in k2 and k3 and write doubleword result

KUNPCKWD k1, k2, k3

in k1.

VEX.L1.0F.W1 4B /r

RVR

V/V

AVX512BW

Unpack 32-bit masks in k2 and k3 and write quadword result

KUNPCKDQ k1, k2, k3

in k1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Unpacks the lower 8/16/32 bits of the second and third operands (source operands) into the low part of the first

operand (destination operand), starting from the low bytes. The result is zero-extended in the destination.

Operation

KUNPCKBW

DEST[7:0] := SRC2[7:0]

DEST[15:8] := SRC1[7:0]

DEST[MAX_KL-1:16] := 0

KUNPCKWD

DEST[15:0] := SRC2[15:0]

DEST[31:16] := SRC1[15:0]

DEST[MAX_KL-1:32] := 0

KUNPCKDQ

DEST[31:0] := SRC2[31:0]

DEST[63:32] := SRC1[31:0]

DEST[MAX_KL-1:64] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KUNPCKBW __mmask16 _mm512_kunpackb(__mmask16 a, __mmask16 b);

KUNPCKDQ __mmask64 _mm512_kunpackd(__mmask64 a, __mmask64 b);

KUNPCKWD __mmask32 _mm512_kunpackw(__mmask32 a, __mmask32 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

KUNPCKBW/KUNPCKWD/KUNPCKDQ—Unpack for Mask Registers

Vol. 2A

3-577

INSTRUCTION SET REFERENCE, A-L

KXNORW/KXNORB/KXNORQ/KXNORD—Bitwise Logical XNOR Masks

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.0F.W0 46 /r

RVR

V/V

AVX512F

Bitwise XNOR 16-bit masks k2 and k3 and place result in k1.

KXNORW k1, k2, k3

VEX.L1.66.0F.W0 46 /r

RVR

V/V

AVX512DQ

Bitwise XNOR 8-bit masks k2 and k3 and place result in k1.

KXNORB k1, k2, k3

VEX.L1.0F.W1 46 /r

RVR

V/V

AVX512BW

Bitwise XNOR 64-bit masks k2 and k3 and place result in k1.

KXNORQ k1, k2, k3

VEX.L1.66.0F.W1 46 /r

RVR

V/V

AVX512BW

Bitwise XNOR 32-bit masks k2 and k3 and place result in k1.

KXNORD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise XNOR between the vector mask k2 and the vector mask k3, and writes the result into vector

mask k1 (three-operand form).

Operation

KXNORW

DEST[15:0] := NOT (SRC1[15:0] BITWISE XOR SRC2[15:0])

DEST[MAX_KL-1:16] := 0

KXNORB

DEST[7:0] := NOT (SRC1[7:0] BITWISE XOR SRC2[7:0])

DEST[MAX_KL-1:8] := 0

KXNORQ

DEST[63:0] := NOT (SRC1[63:0] BITWISE XOR SRC2[63:0])

DEST[MAX_KL-1:64] := 0

KXNORD

DEST[31:0] := NOT (SRC1[31:0] BITWISE XOR SRC2[31:0])

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KXNORW __mmask16 _mm512_kxnor(__mmask16 a, __mmask16 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

3-578

Vol. 2A

KXNORW/KXNORB/KXNORQ/KXNORD—Bitwise Logical XNOR Masks

INSTRUCTION SET REFERENCE, A-L

KXORW/KXORB/KXORQ/KXORD—Bitwise Logical XOR Masks

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

VEX.L1.0F.W0 47 /r

RVR

V/V

AVX512F

Bitwise XOR 16-bit masks k2 and k3 and place result in k1.

KXORW k1, k2, k3

VEX.L1.66.0F.W0 47 /r

RVR

V/V

AVX512DQ

Bitwise XOR 8-bit masks k2 and k3 and place result in k1.

KXORB k1, k2, k3

VEX.L1.0F.W1 47 /r

RVR

V/V

AVX512BW

Bitwise XOR 64-bit masks k2 and k3 and place result in k1.

KXORQ k1, k2, k3

VEX.L1.66.0F.W1 47 /r

RVR

V/V

AVX512BW

Bitwise XOR 32-bit masks k2 and k3 and place result in k1.

KXORD k1, k2, k3

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

RVR

ModRM:reg (w)

VEX.1vvv (r)

ModRM:r/m (r, ModRM:[7:6] must be 11b)

Description

Performs a bitwise XOR between the vector mask k2 and the vector mask k3, and writes the result into vector mask

k1 (three-operand form).

Operation

KXORW

DEST[15:0] := SRC1[15:0] BITWISE XOR SRC2[15:0]

DEST[MAX_KL-1:16] := 0

KXORB

DEST[7:0] := SRC1[7:0] BITWISE XOR SRC2[7:0]

DEST[MAX_KL-1:8] := 0

KXORQ

DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0]

DEST[MAX_KL-1:64] := 0

KXORD

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0]

DEST[MAX_KL-1:32] := 0

Intel C/C++ Compiler Intrinsic Equivalent

KXORW __mmask16 _mm512_kxor(__mmask16 a, __mmask16 b);

Flags Affected

None

SIMD Floating-Point Exceptions

None

Other Exceptions

See Table 2-63, “TYPE K20 Exception Definition (VEX-Encoded OpMask Instructions w/o Memory Arg)”.

KXORW/KXORB/KXORQ/KXORD—Bitwise Logical XOR Masks

Vol. 2A

3-579

INSTRUCTION SET REFERENCE, A-L

LAHF—Load Status Flags Into AH Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

LAHF

Invalid¹

Valid

Load: AH := EFLAGS(SF:ZF:0:AF:0:PF:1:CF).

NOTES:

1. Valid in specific steppings; see Description section.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

This instruction executes as described above in compatibility mode and legacy mode. It is valid in 64-bit mode only

if CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1.

Operation

IF 64-Bit Mode

THEN

IF CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 1;

THEN AH := RFLAGS(SF:ZF:0:AF:0:PF:1:CF);

ELSE #UD;

FI;

ELSE

AH := EFLAGS(SF:ZF:0:AF:0:PF:1:CF);

FI;

Flags Affected

None. The state of the flags in the EFLAGS register is not affected.

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#UD

If CPUID.80000001H:ECX.LAHF-SAHF[bit 0] = 0.

If the LOCK prefix is used.

3-580

Vol. 2A

LAHF—Load Status Flags Into AH Register

INSTRUCTION SET REFERENCE, A-L

LAR—Load Access Rights Byte

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F 02 /r

LAR r16, r16/m16

Valid

r16 := access rights referenced by r16/m16

0F 02 /r

LAR reg, r32/m16¹

Valid

reg := access rights referenced by r32/m16

NOTES:

1. For all loads (regardless of source or destination sizing) only bits 16-0 are used. Other bits are ignored.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Loads the access rights from the segment descriptor specified by the second operand (source operand) into the

first operand (destination operand) and sets the ZF flag in the flag register. The source operand (which can be a

source operand is a memory address, only 16 bits of data are accessed. The destination operand is a general-

purpose register.

The processor performs access checks as part of the loading process. Once loaded in the destination register, soft-

ware can perform additional checks on the access rights information.

The access rights for a segment descriptor include fields located in the second doubleword (bytes 4-7) of the

segment descriptor. The following fields are loaded by the LAR instruction:

• Bits 7:0 are returned as 0

• Bits 11:8 return the segment type.

• Bit 12 returns the S flag.

• Bits 14:13 return the DPL.

• Bit 15 returns the P flag.

• The following fields are returned only if the operand size is greater than 16 bits:

— Bits 19:16 are undefined.

— Bit 20 returns the software-available bit in the descriptor.

— Bit 21 returns the L flag.

— Bit 22 returns the D/B flag.

— Bit 23 returns the G flag.

— Bits 31:24 are returned as 0.

This instruction performs the following checks before it loads the access rights in the destination register:

• Checks that the segment selector is not NULL.

• Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being

accessed

• Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for

(can be accessed with) the LAR instruction. The valid system segment and gate descriptor types are given in

Table 3-53.

• If the segment is not a conforming code segment, it checks that the specified segment descriptor is visible at

the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of the segment

selector).

If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no

access rights are loaded in the destination operand.

LAR—Load Access Rights Byte

Vol. 2A

3-581

INSTRUCTION SET REFERENCE, A-L

The LAR instruction can only be executed in protected mode and IA-32e mode.

Table 3-53. Segment and Gate Types

Type

Protected Mode

IA-32e Mode

Name

Valid

Name

Valid

Reserved

Available 16-bit TSS

Yes

Reserved

LDT

Yes

LDT

Yes

Busy 16-bit TSS

Yes

Reserved

16-bit call gate

Yes

Reserved

16-bit/32-bit task gate

Yes

Reserved

16-bit interrupt gate

Reserved

16-bit trap gate

Reserved

Available 32-bit TSS

Yes

Available 64-bit TSS

Yes

Reserved

Busy 32-bit TSS

Yes

Busy 64-bit TSS

Yes

32-bit call gate

Yes

64-bit call gate

Yes

Reserved

32-bit interrupt gate

64-bit interrupt gate

32-bit trap gate

64-bit trap gate

Operation

IF Offset(SRC) > descriptor table limit

THEN

ZF := 0;

ELSE

SegmentDescriptor := descriptor referenced by SRC;

IF SegmentDescriptor(Type) ≠ conforming code segment

and (CPL > DPL) or (RPL > DPL)

or SegmentDescriptor(Type) is not valid for instruction

THEN

ZF := 0;

ELSE

DEST := access rights from SegmentDescriptor as given in Description section;

ZF := 1;

FI;

Flags Affected

The ZF flag is set to 1 if the access rights are loaded successfully; otherwise, it is cleared to 0.

3-582

Vol. 2A

LAR—Load Access Rights Byte

INSTRUCTION SET REFERENCE, A-L

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and the memory operand effective address is unaligned while

the current privilege level is 3.

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#UD

The LAR instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The LAR instruction cannot be executed in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If the memory operand effective address referencing the SS segment is in a non-canonical

form.

#GP(0)

If the memory operand effective address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and the memory operand effective address is unaligned while

the current privilege level is 3.

#UD

If the LOCK prefix is used.

LAR—Load Access Rights Byte

Vol. 2A

3-583

INSTRUCTION SET REFERENCE, A-L

LDDQU—Load Unaligned Integer 128 Bits

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

F2 0F F0 /r

V/V

SSE3

Load unaligned data from mem and return

double quadword in xmm1.

LDDQU xmm1, mem

VEX.128.F2.0F.WIG F0 /r

V/V

AVX

Load unaligned packed integer values from

mem to xmm1.

VLDDQU xmm1, m128

VEX.256.F2.0F.WIG F0 /r

V/V

AVX

Load unaligned packed integer values from

VLDDQU ymm1, m256

mem to ymm1.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

The instruction is functionally similar to (V)MOVDQU ymm/xmm, m256/m128 for loading from memory. That is:

32/16 bytes of data starting at an address specified by the source memory operand (second operand) are fetched

from memory and placed in a destination register (first operand). The source operand need not be aligned on a

32/16-byte boundary. Up to 64/32 bytes may be loaded from memory; this is implementation dependent.

This instruction may improve performance relative to (V)MOVDQU if the source operand crosses a cache line

boundary. In situations that require the data loaded by (V)LDDQU be modified and stored to the same location, use

(V)MOVDQU or (V)MOVDQA instead of (V)LDDQU. To move a double quadword to or from memory locations that

are known to be aligned on 16-byte boundaries, use the (V)MOVDQA instruction.

Implementation Notes

• If the source is aligned to a 32/16-byte boundary, based on the implementation, the 32/16 bytes may be

loaded more than once. For that reason, the usage of (V)LDDQU should be avoided when using uncached or

write-combining (WC) memory regions. For uncached or WC memory regions, keep using (V)MOVDQU.

• This instruction is a replacement for (V)MOVDQU (load) in situations where cache line splits significantly affect

performance. It should not be used in situations where store-load forwarding is performance critical. If

performance of store-load forwarding is critical to the application, use (V)MOVDQA store-load pairs when data

is 256/128-bit aligned or (V)MOVDQU store-load pairs when data is 256/128-bit unaligned.

• If the memory address is not aligned on 32/16-byte boundary, some implementations may load up to 64/32

bytes and return 32/16 bytes in the destination. Some processor implementations may issue multiple loads to

access the appropriate 32/16 bytes. Developers of multi-threaded or multi-processor software should be aware

that on these processors the loads will be performed in a non-atomic way.

• If alignment checking is enabled (CR0.AM = 1, RFLAGS.AC = 1, and CPL = 3), an alignment-check exception

(#AC) may or may not be generated (depending on processor implementation) when the memory address is

not aligned on an 8-byte boundary.

In 64-bit mode, use of the REX.R prefix permits this instruction to access additional registers (XMM8-XMM15).

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b otherwise instructions will #UD.

Operation

LDDQU (128-bit Legacy SSE version)

DEST[127:0] := SRC[127:0]

DEST[MAXVL-1:128] (Unmodified)

3-584

Vol. 2A

LDDQU—Load Unaligned Integer 128 Bits

INSTRUCTION SET REFERENCE, A-L

LDMXCSR—Load MXCSR Register

Opcode/

Op/

64/32-bit

CPUID

Description

Instruction

Mode

Feature

Flag

NP 0F AE /2

V/V

SSE

Load MXCSR register from m32.

LDMXCSR m32

VEX.LZ.0F.WIG AE /2

V/V

AVX

Load MXCSR register from m32.

VLDMXCSR m32

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Loads the source operand into the MXCSR control/status register. The source operand is a 32-bit memory location.

See “MXCSR Control and Status Register” in Chapter 10, of the Intel® 64 and IA-32 Architectures Software Devel-

oper’s Manual, Volume 1, for a description of the MXCSR register and its contents.

The LDMXCSR instruction is typically used in conjunction with the (V)STMXCSR instruction, which stores the

contents of the MXCSR register in memory.

The default MXCSR value at reset is 1F80H.

If a (V)LDMXCSR instruction clears a SIMD floating-point exception mask bit and sets the corresponding exception

flag bit, a SIMD floating-point exception will not be immediately generated. The exception will be generated only

upon the execution of the next instruction that meets both conditions below:

• the instruction must operate on an XMM or YMM register operand,

• the instruction causes that particular SIMD floating-point exception to be reported.

This instruction’s operation is the same in non-64-bit modes and 64-bit mode.

If VLDMXCSR is encoded with VEX.L= 1, an attempt to execute the instruction encoded with VEX.L= 1 will cause an

#UD exception.

Note: In VEX-encoded versions, VEX.vvvv is reserved and must be 1111b, otherwise instructions will #UD.

Operation

MXCSR := m32;

C/C++ Compiler Intrinsic Equivalent

_mm_setcsr(unsigned int i)

Numeric Exceptions

None

Other Exceptions

See Table 2-22, “Type 5 Class Exception Conditions”; additionally:

#GP

For an attempt to set reserved bits in MXCSR.

#UD

If VEX.vvvv ≠ 1111B.

3-586

Vol. 2A

LDMXCSR—Load MXCSR Register

INSTRUCTION SET REFERENCE, A-L

LDS/LES/LFS/LGS/LSS—Load Far Pointer

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

C5 /r

LDS r16,m16:16

Invalid

Valid

Load DS:r16 with far pointer from memory.

C5 /r

LDS r32,m16:32

Invalid

Valid

Load DS:r32 with far pointer from memory.

0F B2 /r

LSS r16,m16:16

Valid

Load SS:r16 with far pointer from memory.

0F B2 /r

LSS r32,m16:32

Valid

Load SS:r32 with far pointer from memory.

REX + 0F B2 /r

LSS r64,m16:64

Valid

N.E.

Load SS:r64 with far pointer from memory.

C4 /r

LES r16,m16:16

Invalid

Valid

Load ES:r16 with far pointer from memory.

C4 /r

LES r32,m16:32

Invalid

Valid

Load ES:r32 with far pointer from memory.

0F B4 /r

LFS r16,m16:16

Valid

Load FS:r16 with far pointer from memory.

0F B4 /r

LFS r32,m16:32

Valid

Load FS:r32 with far pointer from memory.

REX + 0F B4 /r

LFS r64,m16:64

Valid

N.E.

Load FS:r64 with far pointer from memory.

0F B5 /r

LGS r16,m16:16

Valid

Load GS:r16 with far pointer from memory.

0F B5 /r

LGS r32,m16:32

Valid

Load GS:r32 with far pointer from memory.

REX + 0F B5 /r

LGS r64,m16:64

Valid

N.E.

Load GS:r64 with far pointer from memory.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Loads a far pointer (segment selector and offset) from the second operand (source operand) into a segment

memory depending on the current setting of the operand-size attribute (32 bits or 16 bits, respectively). The

instruction opcode and the destination operand specify a segment register/general-purpose register pair. The 16-

bit segment selector from the source operand is loaded into the segment register specified with the opcode (DS,

SS, ES, FS, or GS). The 32-bit or 16-bit offset is loaded into the register specified with the destination operand.

If one of these instructions is executed in protected mode, additional information from the segment descriptor

pointed to by the segment selector in the source operand is loaded in the hidden part of the selected segment

Also in protected mode, a NULL selector (values 0000 through 0003) can be loaded into DS, ES, FS, or GS registers

without causing a protection exception. (Any subsequent reference to a segment whose corresponding segment

the segment occurs.)

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.W promotes

operation to specify a source operand referencing an 80-bit pointer (16-bit selector, 64-bit offset) in memory. Using

a REX prefix in the form of REX.R permits access to additional registers (R8-R15). See the summary chart at the

beginning of this section for encoding data and limits.

Operation

64-BIT_MODE

IF SS is loaded

THEN

IF SegmentSelector = NULL and ( (RPL = 3) or

(RPL ≠ 3 and RPL ≠ CPL) )

THEN #GP(0);

ELSE IF descriptor is in non-canonical space

LDS/LES/LFS/LGS/LSS—Load Far Pointer

Vol. 2A

3-587

INSTRUCTION SET REFERENCE, A-L

THEN #GP(selector); FI;

ELSE IF Segment selector index is not within descriptor table limits

or segment selector RPL ≠ CPL

or access rights indicate nonwritable data segment

or DPL ≠ CPL

THEN #GP(selector); FI;

ELSE IF Segment marked not present

THEN #SS(selector); FI;

FI;

SS := SegmentSelector(SRC);

SS := SegmentDescriptor([SRC]);

ELSE IF attempt to load DS, or ES

THEN #UD;

ELSE IF FS, or GS is loaded with non-NULL segment selector

THEN IF Segment selector index is not within descriptor table limits

or access rights indicate segment neither data nor readable code segment

or segment is data or nonconforming-code segment

and ( RPL > DPL or CPL > DPL)

THEN #GP(selector); FI;

ELSE IF Segment marked not present

THEN #NP(selector); FI;

FI;

SegmentRegister := SegmentSelector(SRC) ;

SegmentRegister := SegmentDescriptor([SRC]);

FI;

ELSE IF FS, or GS is loaded with a NULL selector:

THEN

SegmentRegister := NULLSelector;

SegmentRegister(DescriptorValidBit) := 0; FI; (* Hidden flag;

not accessible by software *)

FI;

DEST := Offset(SRC);

PREOTECTED MODE OR COMPATIBILITY MODE;

IF SS is loaded

THEN

IF SegementSelector = NULL

THEN #GP(0);

ELSE IF Segment selector index is not within descriptor table limits

or segment selector RPL ≠ CPL

or access rights indicate nonwritable data segment

or DPL ≠ CPL

THEN #GP(selector); FI;

ELSE IF Segment marked not present

THEN #SS(selector); FI;

FI;

SS := SegmentSelector(SRC);

SS := SegmentDescriptor([SRC]);

ELSE IF DS, ES, FS, or GS is loaded with non-NULL segment selector

THEN IF Segment selector index is not within descriptor table limits

or access rights indicate segment neither data nor readable code segment

or segment is data or nonconforming-code segment

and (RPL > DPL or CPL > DPL)

THEN #GP(selector); FI;

3-588

Vol. 2A

LDS/LES/LFS/LGS/LSS—Load Far Pointer

INSTRUCTION SET REFERENCE, A-L

ELSE IF Segment marked not present

THEN #NP(selector); FI;

FI;

SegmentRegister := SegmentSelector(SRC) AND RPL;

SegmentRegister := SegmentDescriptor([SRC]);

FI;

ELSE IF DS, ES, FS, or GS is loaded with a NULL selector:

THEN

SegmentRegister := NULLSelector;

SegmentRegister(DescriptorValidBit) := 0; FI; (* Hidden flag;

not accessible by software *)

FI;

DEST := Offset(SRC);

Real-Address or Virtual-8086 Mode

SegmentRegister := SegmentSelector(SRC); FI;

DEST := Offset(SRC);

Flags Affected

None

Protected Mode Exceptions

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

#GP(0)

If a NULL selector is loaded into the SS register.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

#GP(selector)

If the SS register is being loaded and any of the following is true: the segment selector index

is not within the descriptor table limits, the segment selector RPL is not equal to CPL, the

segment is a non-writable data segment, or DPL is not equal to CPL.

If the DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and any of

the following is true: the segment selector index is not within descriptor table limits, the

segment is neither a data nor a readable code segment, or the segment is a data or noncon-

forming-code segment and both RPL and CPL are greater than DPL.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#SS(selector)

If the SS register is being loaded and the segment is marked not present.

#NP(selector)

If DS, ES, FS, or GS register is being loaded with a non-NULL segment selector and the

segment is marked not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

LDS/LES/LFS/LGS/LSS—Load Far Pointer

Vol. 2A

3-589

INSTRUCTION SET REFERENCE, A-L

Virtual-8086 Mode Exceptions

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#GP(0)

If the memory address is in a non-canonical form.

If a NULL selector is attempted to be loaded into the SS register in compatibility mode.

If a NULL selector is attempted to be loaded into the SS register in CPL3 and 64-bit mode.

If a NULL selector is attempted to be loaded into the SS register in non-CPL3 and 64-bit mode

where its RPL is not equal to CPL.

#GP(Selector)

If the FS, or GS register is being loaded with a non-NULL segment selector and any of the

following is true: the segment selector index is not within descriptor table limits, the memory

address of the descriptor is non-canonical, the segment is neither a data nor a readable code

segment, or the segment is a data or nonconforming-code segment and both RPL and CPL are

greater than DPL.

If the SS register is being loaded and any of the following is true: the segment selector index

is not within the descriptor table limits, the memory address of the descriptor is non-canonical,

the segment selector RPL is not equal to CPL, the segment is a nonwritable data segment, or

DPL is not equal to CPL.

#SS(0)

If a memory operand effective address is non-canonical

#SS(Selector)

If the SS register is being loaded and the segment is marked not present.

#NP(selector)

If FS, or GS register is being loaded with a non-NULL segment selector and the segment is

marked not present.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If source operand is not a memory location.

If the LOCK prefix is used.

3-590

Vol. 2A

LDS/LES/LFS/LGS/LSS—Load Far Pointer

Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023) - page 75