Intel 64 and IA-32 Architectures. Software Developer’s Manual (Collection, 2023)

INSTRUCTION SET REFERENCE, W-Z

WRPKRU—Write Data to User Page Key Register

Opcode/

Op/

64/32bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F 01 EF

V/V

OSPKE

Writes EAX into PKRU.

WRPKRU

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Writes the value of EAX into PKRU. ECX and EDX must be 0 when WRPKRU is executed; otherwise, a general-

protection exception (#GP) occurs.

WRPKRU can be executed only if CR4.PKE = 1; otherwise, an invalid-opcode exception (#UD) occurs. Software can

discover the value of CR4.PKE by examining CPUID.(EAX=07H,ECX=0H):ECX.OSPKE [bit 4].

On processors that support the Intel 64 Architecture, the high-order 32-bits of RCX, RDX, and RAX are ignored.

WRPKRU will never execute speculatively. Memory accesses affected by PKRU register will not execute (even spec-

ulatively) until all prior executions of WRPKRU have completed execution and updated the PKRU register.

Operation

IF (ECX = 0 AND EDX = 0)

THEN PKRU := EAX;

ELSE #GP(0);

FI;

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

WRPKRU:

void _wrpkru(uint32_t);

Protected Mode Exceptions

#GP(0)

If ECX ≠ 0.

If EDX ≠ 0.

#UD

If the LOCK prefix is used.

If CR4.PKE = 0.

Real-Address Mode Exceptions

Same exceptions as in protected mode.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

WRPKRU—Write Data to User Page Key Register

Vol. 2D

6-11

INSTRUCTION SET REFERENCE, W-Z

WRSSD/WRSSQ—Write to Shadow Stack

Opcode/

Op/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

0F 38 F6 !(11):rrr:bbb

V/V

CET_SS

Write 4 bytes to shadow stack.

WRSSD m32, r32

REX.W 0F 38 F6 !(11):rrr:bbb

V/N.E.

CET_SS

Write 8 bytes to shadow stack.

WRSSQ m64, r64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

Writes bytes in register source to the shadow stack.

Operation

IF CPL = 3

IF (CR4.CET & IA32_U_CET.SH_STK_EN) = 0

THEN #UD; FI;

IF (IA32_U_CET.WR_SHSTK_EN) = 0

THEN #UD; FI;

ELSE

IF (CR4.CET & IA32_S_CET.SH_STK_EN) = 0

THEN #UD; FI;

IF (IA32_S_CET.WR_SHSTK_EN) = 0

THEN #UD; FI;

FI;

DEST_LA = Linear_Address(mem operand)

IF (operand size is 64 bit)

THEN

(* Destination not 8B aligned *)

IF DEST_LA[2:0]

THEN GP(0); FI;

Shadow_stack_store 8 bytes of SRC to DEST_LA;

ELSE

(* Destination not 4B aligned *)

IF DEST_LA[1:0]

THEN GP(0); FI;

Shadow_stack_store 4 bytes of SRC[31:0] to DEST_LA;

FI;

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

WRSSD void _wrssd(__int32, void *);

WRSSQ void _wrssq(__int64, void *);

WRSSD/WRSSQ—Write to Shadow Stack

Vol. 2D

6-13

INSTRUCTION SET REFERENCE, W-Z

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

If CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

If CPL = 3 and IA32_U_CET.WR_SHSTK_EN = 0.

If CPL < 3 and IA32_S_CET.WR_SHSTK_EN = 0.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If destination is located in a non-writeable segment.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If linear address of destination is not 4 byte aligned.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs if destination is not a user shadow stack when CPL3 and not a supervisor

shadow stack when CPL < 3.

Other terminal and non-terminal faults.

Real-Address Mode Exceptions

#UD

The WRSS instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The WRSS instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

If CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

If CPL = 3 and IA32_U_CET.WR_SHSTK_EN = 0.

If CPL < 3 and IA32_S_CET.WR_SHSTK_EN = 0.

#PF(fault-code)

If a page fault occurs if destination is not a user shadow stack when CPL3 and not a supervisor

shadow stack when CPL < 3.

Other terminal and non-terminal faults.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

If CPL = 3 and IA32_U_CET.SH_STK_EN = 0.

If CPL < 3 and IA32_S_CET.SH_STK_EN = 0.

If CPL = 3 and IA32_U_CET.WR_SHSTK_EN = 0.

If CPL < 3 and IA32_S_CET.WR_SHSTK_EN = 0.

#GP(0)

If a memory address is in a non-canonical form.

If linear address of destination is not 4 byte aligned.

#PF(fault-code)

If a page fault occurs if destination is not a user shadow stack when CPL3 and not a supervisor

shadow stack when CPL < 3.

Other terminal and non-terminal faults.

6-14

Vol. 2D

WRSSD/WRSSQ—Write to Shadow Stack

INSTRUCTION SET REFERENCE, W-Z

WRUSSD/WRUSSQ—Write to User Shadow Stack

Opcode/

Op/

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

66 0F 38 F5 !(11):rrr:bbb

V/V

CET_SS

Write 4 bytes to shadow stack.

WRUSSD m32, r32

66 REX.W 0F 38 F5 !(11):rrr:bbb

V/N.E.

CET_SS

Write 8 bytes to shadow stack.

WRUSSQ m64, r64

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (w)

ModRM:reg (r)

N/A

Description

Writes bytes in register source to a user shadow stack page. The WRUSS instruction can be executed only if CPL =

0, however the processor treats its shadow-stack accesses as user accesses.

Operation

IF CR4.CET = 0

THEN #UD; FI;

IF CPL > 0

THEN #GP(0); FI;

DEST_LA = Linear_Address(mem operand)

IF (operand size is 64 bit)

THEN

(* Destination not 8B aligned *)

IF DEST_LA[2:0]

THEN GP(0); FI;

Shadow_stack_store 8 bytes of SRC to DEST_LA as user-mode access;

ELSE

(* Destination not 4B aligned *)

IF DEST_LA[1:0]

THEN GP(0); FI;

Shadow_stack_store 4 bytes of SRC[31:0] to DEST_LA as user-mode access;

FI;

Flags Affected

None.

C/C++ Compiler Intrinsic Equivalent

WRUSSD void _wrussd(__int32, void *);

WRUSSQ void _wrussq(__int64, void *);

WRUSSD/WRUSSQ—Write to User Shadow Stack

Vol. 2D

6-15

INSTRUCTION SET REFERENCE, W-Z

Protected Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If destination is located in a non-writeable segment.

If the DS, ES, FS, or GS register is used to access memory and it contains a NULL segment

selector.

If linear address of destination is not 4 byte aligned.

If CPL is not 0.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If destination is not a user shadow stack.

Other terminal and non-terminal faults.

Real-Address Mode Exceptions

#UD

The WRUSS instruction is not recognized in real-address mode.

Virtual-8086 Mode Exceptions

#UD

The WRUSS instruction is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

#GP(0)

If a memory address is in a non-canonical form.

If linear address of destination is not 4 byte aligned.

If CPL is not 0.

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#PF(fault-code)

If destination is not a user shadow stack.

Other terminal and non-terminal faults.

64-Bit Mode Exceptions

#UD

If the LOCK prefix is used.

If CR4.CET = 0.

#GP(0)

If a memory address is in a non-canonical form.

If linear address of destination is not 4 byte aligned.

If CPL is not 0.

#PF(fault-code)

If destination is not a user shadow stack.

Other terminal and non-terminal faults.

6-16

Vol. 2D

WRUSSD/WRUSSQ—Write to User Shadow Stack

INSTRUCTION SET REFERENCE, W-Z

XABORT—Transactional Abort

Opcode/Instruction

Op/

64/32bit

CPUID

Description

Mode

Feature

Support

Flag

C6 F8 ib

V/V

RTM

Causes an RTM abort if in RTM execution.

XABORT imm8

Instruction Operand Encoding

Op/En

Operand 1

Operand2

Operand3

Operand4

imm8

N/A

Description

XABORT forces an RTM abort. Following an RTM abort, the logical processor resumes execution at the fallback

address computed through the outermost XBEGIN instruction. The EAX register is updated to reflect an XABORT

instruction caused the abort, and the imm8 argument will be provided in bits 31:24 of EAX.

Operation

XABORT

IF RTM_ACTIVE = 0

THEN

Treat as NOP;

ELSE

GOTO RTM_ABORT_PROCESSING;

FI;

(* For any RTM abort condition encountered during RTM execution *)

RTM_ABORT_PROCESSING:

Restore architectural register state;

Discard memory updates performed in transaction;

Update EAX with status and XABORT argument;

RTM_NEST_COUNT:= 0;

RTM_ACTIVE:= 0;

SUSLDTRK_ACTIVE := 0;

IF 64-bit Mode

THEN

RIP:= fallbackRIP;

ELSE

EIP := fallbackEIP;

FI;

END

Flags Affected

None

Intel C/C++ Compiler Intrinsic Equivalent

XABORT:

void _xabort( unsigned int);

SIMD Floating-Point Exceptions

None

XABORT—Transactional Abort

Vol. 2D

6-17

INSTRUCTION SET REFERENCE, W-Z

XACQUIRE/XRELEASE—Hardware Lock Elision Prefix Hints

Opcode/Instruction

64/32bit

CPUID

Description

Mode

Feature

Support

Flag

V/V

HLE¹

A hint used with an “XACQUIRE-enabled“ instruction to start lock

XACQUIRE

elision on the instruction memory operand address.

V/V

HLE

A hint used with an “XRELEASE-enabled“ instruction to end lock

XRELEASE

elision on the instruction memory operand address.

NOTES:

1. Software is not required to check the HLE feature flag to use XACQUIRE or XRELEASE, as they are treated as regular prefix if HLE

feature flag reports 0.

Description

The XACQUIRE prefix is a hint to start lock elision on the memory address specified by the instruction and the

XRELEASE prefix is a hint to end lock elision on the memory address specified by the instruction.

The XACQUIRE prefix hint can only be used with the following instructions (these instructions are also referred to

as XACQUIRE-enabled when used with the XACQUIRE prefix):

• Instructions with an explicit LOCK prefix (F0H) prepended to forms of the instruction where the destination

operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCHG8B, DEC, INC, NEG, NOT,

OR, SBB, SUB, XOR, XADD, and XCHG.

• The XCHG instruction either with or without the presence of the LOCK prefix.

The XRELEASE prefix hint can only be used with the following instructions (also referred to as XRELEASE-enabled

when used with the XRELEASE prefix):

• Instructions with an explicit LOCK prefix (F0H) prepended to forms of the instruction where the destination

operand is a memory operand: ADD, ADC, AND, BTC, BTR, BTS, CMPXCHG, CMPXCHG8B, DEC, INC, NEG, NOT,

OR, SBB, SUB, XOR, XADD, and XCHG.

• The XCHG instruction either with or without the presence of the LOCK prefix.

• The “MOV mem, reg” (Opcode 88H/89H) and “MOV mem, imm” (Opcode C6H/C7H) instructions. In these

cases, the XRELEASE is recognized without the presence of the LOCK prefix.

The lock variables must satisfy the guidelines described in Intel® 64 and IA-32 Architectures Software Developer’s

Manual, Volume 1, Section 16.3.3, for elision to be successful, otherwise an HLE abort may be signaled.

If an encoded byte sequence that meets XACQUIRE/XRELEASE requirements includes both prefixes, then the HLE

semantic is determined by the prefix byte that is placed closest to the instruction opcode. For example, an F3F2C6

will not be treated as a XRELEASE-enabled instruction since the F2H (XACQUIRE) is closest to the instruction

opcode C6. Similarly, an F2F3F0 prefixed instruction will be treated as a XRELEASE-enabled instruction since F3H

(XRELEASE) is closest to the instruction opcode.

XACQUIRE/XRELEASE—Hardware Lock Elision Prefix Hints

Vol. 2D

6-19

INSTRUCTION SET REFERENCE, W-Z

Intel 64 and IA-32 Compatibility

The effect of the XACQUIRE/XRELEASE prefix hint is the same in non-64-bit modes and in 64-bit mode.

For instructions that do not support the XACQUIRE hint, the presence of the F2H prefix behaves the same way as

prior hardware, according to

• REPNE/REPNZ semantics for string instructions,

• Serve as SIMD prefix for legacy SIMD instructions operating on XMM register

• Cause #UD if prepending the VEX prefix.

• Undefined for non-string instructions or other situations.

For instructions that do not support the XRELEASE hint, the presence of the F3H prefix behaves the same way as in

prior hardware, according to

• REP/REPE/REPZ semantics for string instructions,

• Serve as SIMD prefix for legacy SIMD instructions operating on XMM register

• Cause #UD if prepending the VEX prefix.

• Undefined for non-string instructions or other situations.

Operation

XACQUIRE

IF XACQUIRE-enabled instruction

THEN

IF (HLE_NEST_COUNT < MAX_HLE_NEST_COUNT) THEN

HLE_NEST_COUNT++

IF (HLE_NEST_COUNT = 1) THEN

HLE_ACTIVE := 1

IF 64-bit mode

THEN

restartRIP := instruction pointer of the XACQUIRE-enabled instruction

ELSE

restartEIP := instruction pointer of the XACQUIRE-enabled instruction

FI;

Enter HLE Execution (* record register state, start tracking memory state *)

FI; (* HLE_NEST_COUNT = 1*)

IF ElisionBufferAvailable

THEN

Allocate elision buffer

Record address and data for forwarding and commit checking

Perform elision

ELSE

Perform lock acquire operation transactionally but without elision

FI;

ELSE (* HLE_NEST_COUNT = MAX_HLE_NEST_COUNT*)

GOTO HLE_ABORT_PROCESSING

FI;

ELSE

Treat instruction as non-XACQUIRE F2H prefixed legacy instruction

FI;

6-20

Vol. 2D

XACQUIRE/XRELEASE—Hardware Lock Elision Prefix Hints

INSTRUCTION SET REFERENCE, W-Z

XRELEASE

IF XRELEASE-enabled instruction

THEN

IF (HLE_NEST_COUNT > 0)

THEN

HLE_NEST_COUNT--

IF lock address matches in elision buffer THEN

IF lock satisfies address and value requirements THEN

Deallocate elision buffer

ELSE

GOTO HLE_ABORT_PROCESSING

FI;

IF (HLE_NEST_COUNT = 0)

THEN

IF NoAllocatedElisionBuffer

THEN

Try to commit transactional execution

IF fail to commit transactional execution

THEN

GOTO HLE_ABORT_PROCESSING;

ELSE (* commit success *)

HLE_ACTIVE := 0

FI;

ELSE

GOTO HLE_ABORT_PROCESSING

FI;

FI; (* HLE_NEST_COUNT > 0 *)

ELSE

Treat instruction as non-XRELEASE F3H prefixed legacy instruction

FI;

(* For any HLE abort condition encountered during HLE execution *)

HLE_ABORT_PROCESSING:

HLE_ACTIVE := 0

HLE_NEST_COUNT := 0

Restore architectural register state

Discard memory updates performed in transaction

Free any allocated lock elision buffers

IF 64-bit mode

THEN

RIP := restartRIP

ELSE

EIP := restartEIP

FI;

Execute and retire instruction at RIP (or EIP) and ignore any HLE hint

END

XACQUIRE/XRELEASE—Hardware Lock Elision Prefix Hints

Vol. 2D

6-21

INSTRUCTION SET REFERENCE, W-Z

XADD—Exchange and Add

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

0F C0 /r

XADD r/m8, r8

Valid

Exchange r8 and r/m8; load sum into r/m8.

REX + 0F C0 /r

XADD r/m8*, r8*

Valid

N.E.

Exchange r8 and r/m8; load sum into r/m8.

0F C1 /r

XADD r/m16, r16

Valid

Exchange r16 and r/m16; load sum into r/m16.

0F C1 /r

XADD r/m32, r32

Valid

Exchange r32 and r/m32; load sum into r/m32.

REX.W + 0F C1 /r

XADD r/m64, r64

Valid

N.E.

Exchange r64 and r/m64; load sum into r/m64.

NOTES:

* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r, w)

ModRM:reg (r, w)

N/A

Description

Exchanges the first operand (destination operand) with the second operand (source operand), then loads the sum

of the two values into the destination operand. The destination operand can be a register or a memory location; the

source operand is a register.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

IA-32 Architecture Compatibility

IA-32 processors earlier than the Intel486 processor do not recognize this instruction. If this instruction is used,

you should provide an equivalent code sequence that runs on earlier processors.

Operation

TEMP := SRC + DEST;

SRC := DEST;

DEST := TEMP;

Flags Affected

The CF, PF, AF, SF, ZF, and OF flags are set according to the result of the addition, which is stored in the destination

operand.

Protected Mode Exceptions

#GP(0)

If the destination is located in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

XADD—Exchange and Add

Vol. 2D

6-23

INSTRUCTION SET REFERENCE, W-Z

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

6-24

Vol. 2D

XADD—Exchange and Add

INSTRUCTION SET REFERENCE, W-Z

XBEGIN—Transactional Begin

Opcode/Instruction

Op/

64/32bit

CPUID

Description

Mode

Feature

Support

Flag

C7 F8

V/V

RTM

Specifies the start of an RTM region. Provides a 16-bit relative

XBEGIN rel16

offset to compute the address of the fallback instruction address at

which execution resumes following an RTM abort.

C7 F8

V/V

RTM

Specifies the start of an RTM region. Provides a 32-bit relative

XBEGIN rel32

offset to compute the address of the fallback instruction address at

which execution resumes following an RTM abort.

Instruction Operand Encoding

Op/En

Operand 1

Operand2

Operand3

Operand4

Offset

N/A

Description

The XBEGIN instruction specifies the start of an RTM code region. If the logical processor was not already in trans-

actional execution, then the XBEGIN instruction causes the logical processor to transition into transactional execu-

tion. The XBEGIN instruction that transitions the logical processor into transactional execution is referred to as the

outermost XBEGIN instruction. The instruction also specifies a relative offset to compute the address of the fallback

code path following a transactional abort. (Use of the 16-bit operand size does not cause this address to be trun-

cated to 16 bits, unlike a near jump to a relative offset.)

On an RTM abort, the logical processor discards all architectural register and memory updates performed during

the RTM execution and restores architectural state to that corresponding to the outermost XBEGIN instruction. The

fallback address following an abort is computed from the outermost XBEGIN instruction.

Execution of XBEGIN while in a suspend read address tracking region causes a transactional abort.

Operation

XBEGIN

IF RTM_NEST_COUNT < MAX_RTM_NEST_COUNT AND SUSLDTRK_ACTIVE = 0

THEN

RTM_NEST_COUNT++

IF RTM_NEST_COUNT = 1 THEN

IF 64-bit Mode

THEN

IF OperandSize = 16

THEN fallbackRIP := RIP + SignExtend64(rel16);

ELSE fallbackRIP := RIP + SignExtend64(rel32);

FI;

IF fallbackRIP is not canonical

THEN #GP(0);

FI;

ELSE

IF OperandSize = 16

THEN fallbackEIP := EIP + SignExtend32(rel16);

ELSE fallbackEIP := EIP + rel32;

FI;

IF fallbackEIP outside code segment limit

THEN #GP(0);

FI;

RTM_ACTIVE := 1

XBEGIN—Transactional Begin

Vol. 2D

6-25

INSTRUCTION SET REFERENCE, W-Z

Enter RTM Execution (* record register state, start tracking memory state*)

FI; (* RTM_NEST_COUNT = 1 *)

ELSE (* RTM_NEST_COUNT = MAX_RTM_NEST_COUNT OR SUSLDTRK_ACTIVE = 1 *)

GOTO RTM_ABORT_PROCESSING

FI;

(* For any RTM abort condition encountered during RTM execution *)

RTM_ABORT_PROCESSING:

Restore architectural register state

Discard memory updates performed in transaction

Update EAX with status

RTM_NEST_COUNT := 0

RTM_ACTIVE := 0

SUSLDTRK_ACTIVE := 0

IF 64-bit mode

THEN

RIP := fallbackRIP

ELSE

EIP := fallbackEIP

FI;

END

Flags Affected

None

Intel C/C++ Compiler Intrinsic Equivalent

XBEGIN:

unsigned int _xbegin( void );

SIMD Floating-Point Exceptions

None

Protected Mode Exceptions

#UD

CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11]=0.

If LOCK prefix is used.

#GP(0)

If the fallback address is outside the CS segment.

Real-Address Mode Exceptions

#GP(0)

If the fallback address is outside the address space 0000H and FFFFH.

#UD

CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11]=0.

If LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If the fallback address is outside the address space 0000H and FFFFH.

#UD

CPUID.(EAX=7, ECX=0):EBX.RTM[bit 11]=0.

If LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

6-26

Vol. 2D

XBEGIN—Transactional Begin

INSTRUCTION SET REFERENCE, W-Z

XCHG—Exchange Register/Memory With Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

90+rw

XCHG AX, r16

Valid

Exchange r16 with AX.

90+rw

XCHG r16, AX

Valid

Exchange AX with r16.

90+rd

XCHG EAX, r32

Valid

Exchange r32 with EAX.

REX.W + 90+rd

XCHG RAX, r64

Valid

N.E.

Exchange r64 with RAX.

90+rd

XCHG r32, EAX

Valid

Exchange EAX with r32.

REX.W + 90+rd

XCHG r64, RAX

Valid

N.E.

Exchange RAX with r64.

86 /r

XCHG r/m8, r8

Valid

Exchange r8 (byte register) with byte from

r/m8.

REX + 86 /r

XCHG r/m8*, r8*

Valid

N.E.

Exchange r8 (byte register) with byte from

r/m8.

86 /r

XCHG r8, r/m8

Valid

Exchange byte from r/m8 with r8 (byte

REX + 86 /r

XCHG r8*, r/m8*

Valid

N.E.

Exchange byte from r/m8 with r8 (byte

87 /r

XCHG r/m16, r16

Valid

Exchange r16 with word from r/m16.

87 /r

XCHG r16, r/m16

Valid

Exchange word from r/m16 with r16.

87 /r

XCHG r/m32, r32

Valid

Exchange r32 with doubleword from r/m32.

REX.W + 87 /r

XCHG r/m64, r64

Valid

N.E.

Exchange r64 with quadword from r/m64.

87 /r

XCHG r32, r/m32

Valid

Exchange doubleword from r/m32 with r32.

REX.W + 87 /r

XCHG r64, r/m64

Valid

N.E.

Exchange quadword from r/m64 with r64.

NOTES:

* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

AX/EAX/RAX (r, w)

opcode + rd (r, w)

N/A

opcode + rd (r, w)

AX/EAX/RAX (r, w)

N/A

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

ModRM:reg (w)

ModRM:r/m (r)

N/A

Description

Exchanges the contents of the destination (first) and source (second) operands. The operands can be two general-

purpose registers or a register and a memory location. If a memory operand is referenced, the processor’s locking

protocol is automatically implemented for the duration of the exchange operation, regardless of the presence or

absence of the LOCK prefix or of the value of the IOPL. (See the LOCK prefix description in this chapter for more

information on the locking protocol.)

This instruction is useful for implementing semaphores or similar data structures for process synchronization. (See

“Bus Locking” in Chapter 9 of the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, for

more information on bus locking.)

The XCHG instruction can also be used instead of the BSWAP instruction for 16-bit operands.

In 64-bit mode, the instruction’s default operation size is 32 bits. Using a REX prefix in the form of REX.R permits

access to additional registers (R8-R15). Using a REX prefix in the form of REX.W promotes operation to 64 bits. See

the summary chart at the beginning of this section for encoding data and limits.

6-28

Vol. 2D

XCHG—Exchange Register/Memory With Register

INSTRUCTION SET REFERENCE, W-Z

NOTE

XCHG (E)AX, (E)AX (encoded instruction byte is 90H) is an alias for NOP regardless of data size

prefixes, including REX.W.

Operation

TEMP := DEST;

DEST := SRC;

SRC := TEMP;

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If either operand is in a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

XCHG—Exchange Register/Memory With Register

Vol. 2D

6-29

INSTRUCTION SET REFERENCE, W-Z

XEND—Transactional End

Opcode/Instruction

Op/

64/32bit

CPUID

Description

Mode

Feature

Support

Flag

NP 0F 01 D5

V/V

RTM

Specifies the end of an RTM code region.

XEND

Instruction Operand Encoding

Op/En

Operand 1

Operand2

Operand3

Operand4

N/A

Description

The instruction marks the end of an RTM code region. If this corresponds to the outermost scope (that is, including

this XEND instruction, the number of XBEGIN instructions is the same as number of XEND instructions), the logical

processor will attempt to commit the logical processor state atomically. If the commit fails, the logical processor will

rollback all architectural register and memory updates performed during the RTM execution. The logical processor

will resume execution at the fallback address computed from the outermost XBEGIN instruction. The EAX register

is updated to reflect RTM abort information.

Execution of XEND outside a transactional region causes a general-protection exception (#GP). Execution of XEND

while in a suspend read address tracking region causes a transactional abort.

Operation

XEND

IF (RTM_ACTIVE = 0) THEN

SIGNAL #GP

ELSE

IF SUSLDTRK_ACTIVE = 1

THEN GOTO RTM_ABORT_PROCESSING;

FI;

RTM_NEST_COUNT--

IF (RTM_NEST_COUNT = 0) THEN

Try to commit transaction

IF fail to commit transactional execution

THEN

GOTO RTM_ABORT_PROCESSING;

ELSE (* commit success *)

RTM_ACTIVE := 0

FI;

(* For any RTM abort condition encountered during RTM execution *)

RTM_ABORT_PROCESSING:

Restore architectural register state

Discard memory updates performed in transaction

Update EAX with status

RTM_NEST_COUNT := 0

RTM_ACTIVE := 0

SUSLDTRK_ACTIVE := 0

IF 64-bit Mode

THEN

RIP := fallbackRIP

6-30

Vol. 2D

XEND—Transactional End

INSTRUCTION SET REFERENCE, W-Z

XGETBV—Get Value of Extended Control Register

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

NP 0F 01 D0

XGETBV

Valid

Reads an XCR specified by ECX into EDX:EAX.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Reads the contents of the extended control register (XCR) specified in the ECX register into registers EDX:EAX. (On

processors that support the Intel 64 architecture, the high-order 32 bits of RCX are ignored.) The EDX register is

loaded with the high-order 32 bits of the XCR and the EAX register is loaded with the low-order 32 bits. (On proces-

sors that support the Intel 64 architecture, the high-order 32 bits of each of RAX and RDX are cleared.) If fewer

than 64 bits are implemented in the XCR being read, the values returned to EDX:EAX in unimplemented bit loca-

tions are undefined.

XCR0 is supported on any processor that supports the XGETBV instruction. If

CPUID.(EAX=0DH,ECX=1):EAX.XG1[bit 2] = 1, executing XGETBV with ECX = 1 returns in EDX:EAX the logical-

AND of XCR0 and the current value of the XINUSE state-component bitmap. This allows software to discover the

state of the init optimization used by XSAVEOPT and XSAVES. See Chapter 13, “Managing State Using the XSAVE

Feature Set‚” in Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1.

Use of any other value for ECX results in a general-protection (#GP) exception.

Operation

EDX:EAX := XCR[ECX];

Flags Affected

None.

Intel C/C++ Compiler Intrinsic Equivalent

XGETBV:

unsigned __int64 _xgetbv( unsigned int);

Protected Mode Exceptions

#GP(0)

If an invalid XCR is specified in ECX (includes ECX = 1 if

CPUID.(EAX=0DH,ECX=1):EAX.XG1[bit 2] = 0).

#UD

If CPUID.01H:ECX.XSAVE[bit 26] = 0.

If CR4.OSXSAVE[bit 18] = 0.

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP(0)

If an invalid XCR is specified in ECX (includes ECX = 1 if

CPUID.(EAX=0DH,ECX=1):EAX.XG1[bit 2] = 0).

#UD

If CPUID.01H:ECX.XSAVE[bit 26] = 0.

If CR4.OSXSAVE[bit 18] = 0.

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode.

6-32

Vol. 2D

XGETBV—Get Value of Extended Control Register

INSTRUCTION SET REFERENCE, W-Z

XLAT/XLATB—Table Look-up Translation

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

XLAT m8

Valid

Set AL to memory byte DS:[(E)BX + unsigned

AL].

XLATB

Valid

Set AL to memory byte DS:[(E)BX + unsigned

AL].

REX.W + D7

XLATB

Valid

N.E.

Set AL to memory byte [RBX + unsigned AL].

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

Locates a byte entry in a table in memory, using the contents of the AL register as a table index, then copies the

contents of the table entry back into the AL register. The index in the AL register is treated as an unsigned integer.

The XLAT and XLATB instructions get the base address of the table in memory from either the DS:EBX or the DS:BX

registers (depending on the address-size attribute of the instruction, 32 or 16, respectively). (The DS segment may

be overridden with a segment override prefix.)

At the assembly-code level, two forms of this instruction are allowed: the “explicit-operand” form and the “no-

operand” form. The explicit-operand form (specified with the XLAT mnemonic) allows the base address of the table

to be specified explicitly with a symbol. This explicit-operands form is provided to allow documentation; however,

note that the documentation provided by this form can be misleading. That is, the symbol does not have to specify

the correct base address. The base address is always specified by the DS:(E)BX registers, which must be loaded

correctly before the XLAT instruction is executed.

The no-operands form (XLATB) provides a “short form” of the XLAT instructions. Here also the processor assumes

that the DS:(E)BX registers contain the base address of the table.

In 64-bit mode, operation is similar to that in legacy or compatibility mode. AL is used to specify the table index

(the operand size is fixed at 8 bits). RBX, however, is used to specify the table’s base address. See the summary

chart at the beginning of this section for encoding data and limits.

Operation

IF AddressSize = 16

THEN

AL := (DS:BX + ZeroExtend(AL));

ELSE IF (AddressSize = 32)

AL := (DS:EBX + ZeroExtend(AL)); FI;

ELSE (AddressSize = 64)

AL := (RBX + ZeroExtend(AL));

FI;

Flags Affected

None.

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

6-34

Vol. 2D

XLAT/XLATB—Table Look-up Translation

INSTRUCTION SET REFERENCE, W-Z

#UD

If the LOCK prefix is used.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#UD

If the LOCK prefix is used.

XLAT/XLATB—Table Look-up Translation

Vol. 2D

6-35

INSTRUCTION SET REFERENCE, W-Z

XOR—Logical Exclusive OR

Opcode

Instruction

Op/

64-Bit

Compat/

Description

Mode

Leg Mode

34 ib

XOR AL, imm8

Valid

AL XOR imm8.

35 iw

XOR AX, imm16

Valid

AX XOR imm16.

35 id

XOR EAX, imm32

Valid

EAX XOR imm32.

REX.W + 35 id

XOR RAX, imm32

Valid

N.E.

RAX XOR imm32 (sign-extended).

80 /6 ib

XOR r/m8, imm8

Valid

r/m8 XOR imm8.

REX + 80 /6 ib

XOR r/m8*, imm8

Valid

N.E.

r/m8 XOR imm8.

81 /6 iw

XOR r/m16, imm16

Valid

r/m16 XOR imm16.

81 /6 id

XOR r/m32, imm32

Valid

r/m32 XOR imm32.

REX.W + 81 /6 id

XOR r/m64, imm32

Valid

N.E.

r/m64 XOR imm32 (sign-extended).

83 /6 ib

XOR r/m16, imm8

Valid

r/m16 XOR imm8 (sign-extended).

83 /6 ib

XOR r/m32, imm8

Valid

r/m32 XOR imm8 (sign-extended).

REX.W + 83 /6 ib

XOR r/m64, imm8

Valid

N.E.

r/m64 XOR imm8 (sign-extended).

30 /r

XOR r/m8, r8

Valid

r/m8 XOR r8.

REX + 30 /r

XOR r/m8*, r8*

Valid

N.E.

r/m8 XOR r8.

31 /r

XOR r/m16, r16

Valid

r/m16 XOR r16.

31 /r

XOR r/m32, r32

Valid

r/m32 XOR r32.

REX.W + 31 /r

XOR r/m64, r64

Valid

N.E.

r/m64 XOR r64.

32 /r

XOR r8, r/m8

Valid

r8 XOR r/m8.

REX + 32 /r

XOR r8*, r/m8*

Valid

N.E.

r8 XOR r/m8.

33 /r

XOR r16, r/m16

Valid

r16 XOR r/m16.

33 /r

XOR r32, r/m32

Valid

r32 XOR r/m32.

REX.W + 33 /r

XOR r64, r/m64

Valid

N.E.

r64 XOR r/m64.

NOTES:

* In 64-bit mode, r/m8 can not be encoded to access the following byte registers if a REX prefix is used: AH, BH, CH, DH.

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

AL/AX/EAX/RAX

imm8/16/32

N/A

ModRM:r/m (r, w)

imm8/16/32

N/A

ModRM:r/m (r, w)

ModRM:reg (r)

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

Description

Performs a bitwise exclusive OR (XOR) operation on the destination (first) and source (second) operands and

stores the result in the destination operand location. The source operand can be an immediate, a register, or a

memory location; the destination operand can be a register or a memory location. (However, two memory oper-

ands cannot be used in one instruction.) Each bit of the result is 1 if the corresponding bits of the operands are

different; each bit is 0 if the corresponding bits are the same.

This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically.

6-36

Vol. 2D

XOR—Logical Exclusive OR

INSTRUCTION SET REFERENCE, W-Z

In 64-bit mode, using a REX prefix in the form of REX.R permits access to additional registers (R8-R15). Using a

REX prefix in the form of REX.W promotes operation to 64 bits. See the summary chart at the beginning of this

section for encoding data and limits.

Operation

DEST := DEST XOR SRC;

Flags Affected

The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is

undefined.

Protected Mode Exceptions

#GP(0)

If the destination operand points to a non-writable segment.

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If the DS, ES, FS, or GS register contains a NULL segment selector.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Real-Address Mode Exceptions

#GP

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS

If a memory operand effective address is outside the SS segment limit.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Virtual-8086 Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0)

If a memory address referencing the SS segment is in a non-canonical form.

#GP(0)

If the memory address is in a non-canonical form.

#PF(fault-code)

If a page fault occurs.

#AC(0)

If alignment checking is enabled and an unaligned memory reference is made while the

current privilege level is 3.

#UD

If the LOCK prefix is used but the destination is not a memory operand.

XOR—Logical Exclusive OR

Vol. 2D

6-37

INSTRUCTION SET REFERENCE, W-Z

XORPD—Bitwise Logical XOR of Packed Double Precision Floating-Point Values

Opcode/

Op /

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

66 0F 57/r

V/V

SSE2

Return the bitwise logical XOR of packed double

XORPD xmm1, xmm2/m128

precision floating-point values in xmm1 and xmm2/mem.

VEX.128.66.0F.WIG 57 /r

V/V

AVX

Return the bitwise logical XOR of packed double

VXORPD xmm1,xmm2,

precision floating-point values in xmm2 and xmm3/mem.

xmm3/m128

VEX.256.66.0F.WIG 57 /r

V/V

AVX

Return the bitwise logical XOR of packed double

VXORPD ymm1, ymm2,

precision floating-point values in ymm2 and ymm3/mem.

ymm3/m256

EVEX.128.66.0F.W1 57 /r

V/V

AVX512VL

Return the bitwise logical XOR of packed double

VXORPD xmm1 {k1}{z}, xmm2,

AVX512DQ

precision floating-point values in xmm2 and

xmm3/m128/m64bcst

xmm3/m128/m64bcst subject to writemask k1.

EVEX.256.66.0F.W1 57 /r

V/V

AVX512VL

Return the bitwise logical XOR of packed double

VXORPD ymm1 {k1}{z}, ymm2,

AVX512DQ

precision floating-point values in ymm2 and

ymm3/m256/m64bcst

ymm3/m256/m64bcst subject to writemask k1.

EVEX.512.66.0F.W1 57 /r

V/V

AVX512DQ

Return the bitwise logical XOR of packed double

VXORPD zmm1 {k1}{z}, zmm2,

precision floating-point values in zmm2 and

zmm3/m512/m64bcst

zmm3/m512/m64bcst subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical XOR of the two, four or eight packed double precision floating-point values from the first

source operand and the second source operand, and stores the result in the destination operand.

EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand can be a ZMM

writemask k1.

VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register. The second source operand

is a YMM register or a 256-bit memory location. The destination operand is a YMM register (conditionally updated

with writemask k1 in case of EVEX). The upper bits (MAXVL-1:256) of the corresponding ZMM register destination

are zeroed.

VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand

is an XMM register or 128-bit memory location. The destination operand is an XMM register (conditionally updated

with writemask k1 in case of EVEX). The upper bits (MAXVL-1:128) of the corresponding ZMM register destination

are zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

6-38

Vol. 2D

XORPD—Bitwise Logical XOR of Packed Double Precision Floating-Point Values

INSTRUCTION SET REFERENCE, W-Z

Operation

VXORPD (EVEX encoded versions)

(KL, VL) = (2, 128), (4, 256), (8, 512)

FOR j := 0 TO KL-1

i := j * 64

IF k1[j] OR *no writemask* THEN

IF (EVEX.b == 1) AND (SRC2 *is memory*)

THEN DEST[i+63:i] := SRC1[i+63:i] BITWISE XOR SRC2[63:0];

ELSE DEST[i+63:i] := SRC1[i+63:i] BITWISE XOR SRC2[i+63:i];

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+63:i] remains unchanged*

ELSE *zeroing-masking*

; zeroing-masking

DEST[i+63:i] = 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VXORPD (VEX.256 encoded version)

DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0]

DEST[127:64] := SRC1[127:64] BITWISE XOR SRC2[127:64]

DEST[191:128] := SRC1[191:128] BITWISE XOR SRC2[191:128]

DEST[255:192] := SRC1[255:192] BITWISE XOR SRC2[255:192]

DEST[MAXVL-1:256] := 0

VXORPD (VEX.128 encoded version)

DEST[63:0] := SRC1[63:0] BITWISE XOR SRC2[63:0]

DEST[127:64] := SRC1[127:64] BITWISE XOR SRC2[127:64]

DEST[MAXVL-1:128] := 0

XORPD (128-bit Legacy SSE version)

DEST[63:0] := DEST[63:0] BITWISE XOR SRC[63:0]

DEST[127:64] := DEST[127:64] BITWISE XOR SRC[127:64]

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VXORPD __m512d _mm512_xor_pd (__m512d a, __m512d b);

VXORPD __m512d _mm512_mask_xor_pd (__m512d a, __mmask8 m, __m512d b);

VXORPD __m512d _mm512_maskz_xor_pd (__mmask8 m, __m512d a);

VXORPD __m256d _mm256_xor_pd (__m256d a, __m256d b);

VXORPD __m256d _mm256_mask_xor_pd (__m256d a, __mmask8 m, __m256d b);

VXORPD __m256d _mm256_maskz_xor_pd (__mmask8 m, __m256d a);

XORPD __m128d _mm_xor_pd (__m128d a, __m128d b);

VXORPD __m128d _mm_mask_xor_pd (__m128d a, __mmask8 m, __m128d b);

VXORPD __m128d _mm_maskz_xor_pd (__mmask8 m, __m128d a);

SIMD Floating-Point Exceptions

None

XORPD—Bitwise Logical XOR of Packed Double Precision Floating-Point Values

Vol. 2D

6-39

INSTRUCTION SET REFERENCE, W-Z

XORPS—Bitwise Logical XOR of Packed Single Precision Floating-Point Values

Opcode/

Op /

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

NP 0F 57 /r

V/V

SSE

Return the bitwise logical XOR of packed single-

XORPS xmm1, xmm2/m128

precision floating-point values in xmm1 and

xmm2/mem.

VEX.128.0F.WIG 57 /r

V/V

AVX

Return the bitwise logical XOR of packed single-

VXORPS xmm1,xmm2, xmm3/m128

precision floating-point values in xmm2 and

xmm3/mem.

VEX.256.0F.WIG 57 /r

V/V

AVX

Return the bitwise logical XOR of packed single-

VXORPS ymm1, ymm2, ymm3/m256

precision floating-point values in ymm2 and

ymm3/mem.

EVEX.128.0F.W0 57 /r

V/V

AVX512VL

Return the bitwise logical XOR of packed single-

VXORPS xmm1 {k1}{z}, xmm2,

AVX512DQ

precision floating-point values in xmm2 and

xmm3/m128/m32bcst

xmm3/m128/m32bcst subject to writemask k1.

EVEX.256.0F.W0 57 /r

V/V

AVX512VL

Return the bitwise logical XOR of packed single-

VXORPS ymm1 {k1}{z}, ymm2,

AVX512DQ

precision floating-point values in ymm2 and

ymm3/m256/m32bcst

ymm3/m256/m32bcst subject to writemask k1.

EVEX.512.0F.W0 57 /r

V/V

AVX512DQ

Return the bitwise logical XOR of packed single-

VXORPS zmm1 {k1}{z}, zmm2,

precision floating-point values in zmm2 and

zmm3/m512/m32bcst

zmm3/m512/m32bcst subject to writemask k1.

Instruction Operand Encoding

Op/En

Tuple Type

Operand 1

Operand 2

Operand 3

Operand 4

N/A

ModRM:reg (r, w)

ModRM:r/m (r)

N/A

ModRM:reg (w)

VEX.vvvv (r)

ModRM:r/m (r)

N/A

Full

ModRM:reg (w)

EVEX.vvvv (r)

ModRM:r/m (r)

N/A

Description

Performs a bitwise logical XOR of the four, eight or sixteen packed single-precision floating-point values from the

first source operand and the second source operand, and stores the result in the destination operand

EVEX.512 encoded version: The first source operand is a ZMM register. The second source operand can be a ZMM

writemask k1.

VEX.256 and EVEX.256 encoded versions: The first source operand is a YMM register. The second source operand

is a YMM register or a 256-bit memory location. The destination operand is a YMM register (conditionally updated

with writemask k1 in case of EVEX). The upper bits (MAXVL-1:256) of the corresponding ZMM register destination

are zeroed.

VEX.128 and EVEX.128 encoded versions: The first source operand is an XMM register. The second source operand

is an XMM register or 128-bit memory location. The destination operand is an XMM register (conditionally updated

with writemask k1 in case of EVEX). The upper bits (MAXVL-1:128) of the corresponding ZMM register destination

are zeroed.

128-bit Legacy SSE version: The second source can be an XMM register or an 128-bit memory location. The desti-

nation is not distinct from the first source XMM register and the upper bits (MAXVL-1:128) of the corresponding

XORPS—Bitwise Logical XOR of Packed Single Precision Floating-Point Values

Vol. 2D

6-41

INSTRUCTION SET REFERENCE, W-Z

Operation

VXORPS (EVEX encoded versions)

(KL, VL) = (4, 128), (8, 256), (16, 512)

FOR j := 0 TO KL-1

i := j * 32

IF k1[j] OR *no writemask* THEN

IF (EVEX.b == 1) AND (SRC2 *is memory*)

THEN DEST[i+31:i] := SRC1[i+31:i] BITWISE XOR SRC2[31:0];

ELSE DEST[i+31:i] := SRC1[i+31:i] BITWISE XOR SRC2[i+31:i];

FI;

ELSE

IF *merging-masking*

; merging-masking

THEN *DEST[i+31:i] remains unchanged*

ELSE *zeroing-masking*

; zeroing-masking

DEST[i+31:i] = 0

FI;

ENDFOR

DEST[MAXVL-1:VL] := 0

VXORPS (VEX.256 encoded version)

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0]

DEST[63:32] := SRC1[63:32] BITWISE XOR SRC2[63:32]

DEST[95:64] := SRC1[95:64] BITWISE XOR SRC2[95:64]

DEST[127:96] := SRC1[127:96] BITWISE XOR SRC2[127:96]

DEST[159:128] := SRC1[159:128] BITWISE XOR SRC2[159:128]

DEST[191:160] := SRC1[191:160] BITWISE XOR SRC2[191:160]

DEST[223:192] := SRC1[223:192] BITWISE XOR SRC2[223:192]

DEST[255:224] := SRC1[255:224] BITWISE XOR SRC2[255:224].

DEST[MAXVL-1:256] := 0

VXORPS (VEX.128 encoded version)

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0]

DEST[63:32] := SRC1[63:32] BITWISE XOR SRC2[63:32]

DEST[95:64] := SRC1[95:64] BITWISE XOR SRC2[95:64]

DEST[127:96] := SRC1[127:96] BITWISE XOR SRC2[127:96]

DEST[MAXVL-1:128] := 0

XORPS (128-bit Legacy SSE version)

DEST[31:0] := SRC1[31:0] BITWISE XOR SRC2[31:0]

DEST[63:32] := SRC1[63:32] BITWISE XOR SRC2[63:32]

DEST[95:64] := SRC1[95:64] BITWISE XOR SRC2[95:64]

DEST[127:96] := SRC1[127:96] BITWISE XOR SRC2[127:96]

DEST[MAXVL-1:128] (Unmodified)

Intel C/C++ Compiler Intrinsic Equivalent

VXORPS __m512 _mm512_xor_ps (__m512 a, __m512 b);

VXORPS __m512 _mm512_mask_xor_ps (__m512 a, __mmask16 m, __m512 b);

VXORPS __m512 _mm512_maskz_xor_ps (__mmask16 m, __m512 a);

VXORPS __m256 _mm256_xor_ps (__m256 a, __m256 b);

VXORPS __m256 _mm256_mask_xor_ps (__m256 a, __mmask8 m, __m256 b);

VXORPS __m256 _mm256_maskz_xor_ps (__mmask8 m, __m256 a);

XORPS __m128 _mm_xor_ps (__m128 a, __m128 b);

VXORPS __m128 _mm_mask_xor_ps (__m128 a, __mmask8 m, __m128 b);

6-42

Vol. 2D

XORPS—Bitwise Logical XOR of Packed Single Precision Floating-Point Values

INSTRUCTION SET REFERENCE, W-Z

XRESLDTRK—Resume Tracking Load Addresses

Opcode/

Op/

64/32

CPUID Feature

Description

Instruction

bit Mode

Flag

Support

F2 0F 01 E9

V/V

TSXLDTRK

Specifies the end of an Intel TSX suspend read

XRESLDTRK

address tracking region.

Instruction Operand Encoding

Op/En

Tuple

Operand 1

Operand 2

Operand 3

Operand 4

N/A

Description

The instruction marks the end of an Intel TSX (RTM) suspend load address tracking region. If the instruction is used

inside a suspend load address tracking region it will end the suspend region and all following load addresses will be

added to the transaction read set. If this instruction is used inside an active transaction but not in a suspend region

it will cause transaction abort.

If the instruction is used outside of a transactional region it behaves like a NOP.

Chapter 16, “Programming with Intel® Transactional Synchronization Extensions” in the Intel® 64 and IA-32

Architectures Software Developer’s Manual, Volume 1 provides additional information on Intel^® TSX Suspend Load

Address Tracking.

Operation

XRESLDTRK

IF RTM_ACTIVE = 1:

IF SUSLDTRK_ACTIVE = 1:

SUSLDTRK_ACTIVE := 0

ELSE:

RTM_ABORT

ELSE:

NOP

Flags Affected

None.

Intel C/C++ Compiler Intrinsic Equivalent

XRESLDTRK void _xresldtrk(void);

SIMD Floating-Point Exceptions

None.

Other Exceptions

#UD

If CPUID.(EAX=7, ECX=0):EDX.TSXLDTRK[bit 16] = 0.

If the LOCK prefix is used.

6-44

Vol. 2D

XRESLDTRK—Resume Tracking Load Addresses

INSTRUCTION SET REFERENCE, W-Z

XRSTOR—Restore Processor Extended States

Opcode /

Op/

64/32 bit

CPUID

Description

Instruction

Mode

Feature

Support

Flag

NP 0F AE /5

V/V

XSAVE

Restore state components specified by EDX:EAX from

mem.

XRSTOR mem

NP REX.W + 0F AE /5

V/N.E.

XSAVE

Restore state components specified by EDX:EAX from

mem.

XRSTOR64 mem

Instruction Operand Encoding

Op/En

Operand 1

Operand 2

Operand 3

Operand 4

ModRM:r/m (r)

N/A

Description

Performs a full or partial restore of processor state components from the XSAVE area located at the memory

address specified by the source operand. The implicit EDX:EAX register pair specifies a 64-bit instruction mask.

The specific state components restored correspond to the bits set in the requested-feature bitmap (RFBM), which

is the logical-AND of EDX:EAX and XCR0.

The format of the XSAVE area is detailed in Section 13.4, “XSAVE Area,” of Intel® 64 and IA-32 Architectures Soft-

ware Developer’s Manual, Volume 1. Like FXRSTOR and FXSAVE, the memory format used for x87 state depends

on a REX.W prefix; see Section 13.5.1, “x87 State” of Intel® 64 and IA-32 Architectures Software Developer’s

Manual, Volume 1.

Section 13.8, “Operation of XRSTOR,” of Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume

1 provides a detailed description of the operation of the XRSTOR instruction. The following items provide a high-

level outline:

• Execution of XRSTOR may take one of two forms: standard and compacted. Bit 63 of the XCOMP_BV field in the

XSAVE header determines which form is used: value 0 specifies the standard form, while value 1 specifies the

compacted form.

• If RFBM[i] = 0, XRSTOR does not update state component i.¹

• If RFBM[i] = 1 and bit i is clear in the XSTATE_BV field in the XSAVE header, XRSTOR initializes state

component i.

• If RFBM[i] = 1 and XSTATE_BV[i] = 1, XRSTOR loads state component i from the XSAVE area.

• The standard form of XRSTOR treats MXCSR (which is part of state component 1 — SSE) differently from the

XMM registers. If either form attempts to load MXCSR with an illegal value, a general-protection exception

(#GP) occurs.

• XRSTOR loads the internal value XRSTOR_INFO, which may be used to optimize a subsequent execution of

XSAVEOPT or XSAVES.

• Immediately following an execution of XRSTOR, the processor tracks as in-use (not in initial configuration) any

state component i for which RFBM[i] = 1 and XSTATE_BV[i] = 1; it tracks as modified any state component

i for which RFBM[i] = 0.

Use of a source operand not aligned to 64-byte boundary (for 64-bit and 32-bit modes) results in a general-protec-

tion (#GP) exception. In 64-bit mode, the upper 32 bits of RDX and RAX are ignored.

See Section 13.6, “Processor Tracking of XSAVE-Managed State,” of Intel® 64 and IA-32 Architectures Software

Developer’s Manual, Volume 1 for discussion of the bitmaps XINUSE and XMODIFIED and of the quantity

XRSTOR_INFO.

1. There is an exception if RFBM[1] = 0 and RFBM[2] = 1. In this case, the standard form of XRSTOR will load MXCSR from memory,

even though MXCSR is part of state component 1 — SSE. The compacted form of XRSTOR does not make this exception.

XRSTOR—Restore Processor Extended States

Vol. 2D

6-45

INSTRUCTION SET REFERENCE, W-Z

Operation

RFBM := XCR0 AND EDX:EAX;

/* bitwise logical AND */

COMPMASK := XCOMP_BV field from XSAVE header;

RSTORMASK := XSTATE_BV field from XSAVE header;

IF COMPMASK[63] = 0

THEN

/* Standard form of XRSTOR */

TO_BE_RESTORED := RFBM AND RSTORMASK;

TO_BE_INITIALIZED := RFBM AND NOT RSTORMASK;

IF TO_BE_RESTORED[0] = 1

THEN

XINUSE[0] := 1;

load x87 state from legacy region of XSAVE area;

ELSIF TO_BE_INITIALIZED[0] = 1

THEN

XINUSE[0] := 0;

initialize x87 state;

FI;

IF RFBM[1] = 1 OR RFBM[2] = 1

THEN load MXCSR from legacy region of XSAVE area;

FI;

IF TO_BE_RESTORED[1] = 1

THEN

XINUSE[1] := 1;

load XMM registers from legacy region of XSAVE area; // this step does not load MXCSR

ELSIF TO_BE_INITIALIZED[1] = 1

THEN

XINUSE[1] := 0;

set all XMM registers to 0; // this step does not initialize MXCSR

FI;

FOR i := 2 TO 62

IF TO_BE_RESTORED[i] = 1

THEN

XINUSE[i] := 1;

load XSAVE state component i at offset n from base of XSAVE area;

// n enumerated by CPUID(EAX=0DH,ECX=i):EBX)

ELSIF TO_BE_INITIALIZED[i] = 1

THEN

XINUSE[i] := 0;

initialize XSAVE state component i;

FI;

ENDFOR;

ELSE

/* Compacted form of XRSTOR */

IF CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0

THEN

/* compacted form not supported */

#GP(0);

6-46

Vol. 2D

XRSTOR—Restore Processor Extended States

INSTRUCTION SET REFERENCE, W-Z

FI;

FORMAT = COMPMASK AND 7FFFFFFF_FFFFFFFFH;

RESTORE_FEATURES = FORMAT AND RFBM;

TO_BE_RESTORED := RESTORE_FEATURES AND RSTORMASK;

FORCE_INIT := RFBM AND NOT FORMAT;

TO_BE_INITIALIZED = (RFBM AND NOT RSTORMASK) OR FORCE_INIT;

IF TO_BE_RESTORED[0] = 1

THEN

XINUSE[0] := 1;

load x87 state from legacy region of XSAVE area;

ELSIF TO_BE_INITIALIZED[0] = 1

THEN

XINUSE[0] := 0;

initialize x87 state;

FI;

IF TO_BE_RESTORED[1] = 1

THEN

XINUSE[1] := 1;

load SSE state from legacy region of XSAVE area; // this step loads the XMM registers and MXCSR

ELSIF TO_BE_INITIALIZED[1] = 1

THEN

set all XMM registers to 0;

XINUSE[1] := 0;

MXCSR := 1F80H;

FI;

NEXT_FEATURE_OFFSET = 576;

// Legacy area and XSAVE header consume 576 bytes

FOR i := 2 TO 62

IF FORMAT[i] = 1

THEN

IF TO_BE_RESTORED[i] = 1

THEN

XINUSE[i] := 1;

load XSAVE state component i at offset NEXT_FEATURE_OFFSET from base of XSAVE area;

FI;

NEXT_FEATURE_OFFSET = NEXT_FEATURE_OFFSET + n (n enumerated by CPUID(EAX=0DH,ECX=i):EAX);

FI;

IF TO_BE_INITIALIZED[i] = 1

THEN

XINUSE[i] := 0;

initialize XSAVE state component i;

FI;

ENDFOR;

FI;

XMODIFIED := NOT RFBM;

IF in VMX non-root operation

THEN VMXNR := 1;

ELSE VMXNR := 0;

FI;

XRSTOR—Restore Processor Extended States

Vol. 2D

6-47

INSTRUCTION SET REFERENCE, W-Z

LAXA := linear address of XSAVE area;

XRSTOR_INFO := CPL,VMXNR,LAXA,COMPMASK;

Flags Affected

None.

Intel C/C++ Compiler Intrinsic Equivalent

XRSTOR:

void _xrstor( void * , unsigned __int64);

XRSTOR:

void _xrstor64( void * , unsigned __int64);

Protected Mode Exceptions

#GP(0)

If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

If a memory operand is not aligned on a 64-byte boundary, regardless of segment.

If bit 63 of the XCOMP_BV field of the XSAVE header is 1 and

CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0.

If the standard form is executed and a bit in XCR0 is 0 and the corresponding bit in the

XSTATE_BV field of the XSAVE header is 1.

If the standard form is executed and bytes 23:8 of the XSAVE header are not all zero.

If the compacted form is executed and a bit in XCR0 is 0 and the corresponding bit in the

XCOMP_BV field of the XSAVE header is 1.

If the compacted form is executed and a bit in the XCOMP_BV field in the XSAVE header is 0

and the corresponding bit in the XSTATE_BV field is 1.

If the compacted form is executed and bytes 63:16 of the XSAVE header are not all zero.

If attempting to write any reserved bits of the MXCSR register with 1.

#SS(0)

If a memory operand effective address is outside the SS segment limit.

#PF(fault-code)

If a page fault occurs.

#NM

If CR0.TS[bit 3] = 1.

#UD

If CPUID.01H:ECX.XSAVE[bit 26] = 0.

If CR4.OSXSAVE[bit 18] = 0.

If the LOCK prefix is used.

#AC

If this exception is disabled a general protection exception (#GP) is signaled if the memory

operand is not aligned on a 64-byte boundary, as described above. If the alignment check

exception (#AC) is enabled (and the CPL is 3), signaling of #AC is not guaranteed and may

vary with implementation, as follows. In all implementations where #AC is not signaled, a

general protection exception is signaled in its place. In addition, the width of the alignment

check may also vary with implementation. For instance, for a given implementation, an align-

ment check exception might be signaled for a 2-byte misalignment, whereas a general protec-

tion exception might be signaled for all other misalignments (4-, 8-, or 16-byte

misalignments).

Real-Address Mode Exceptions

#GP

If a memory operand is not aligned on a 64-byte boundary, regardless of segment.

If any part of the operand lies outside the effective address space from 0 to FFFFH.

If bit 63 of the XCOMP_BV field of the XSAVE header is 1 and

CPUID.(EAX=0DH,ECX=1):EAX.XSAVEC[bit 1] = 0.

If the standard form is executed and a bit in XCR0 is 0 and the corresponding bit in the

XSTATE_BV field of the XSAVE header is 1.

If the standard form is executed and bytes 23:8 of the XSAVE header are not all zero.

If the compacted form is executed and a bit in XCR0 is 0 and the corresponding bit in the

XCOMP_BV field of the XSAVE header is 1.

6-48

Vol. 2D

XRSTOR—Restore Processor Extended States

INSTRUCTION SET REFERENCE, W-Z

If the compacted form is executed and a bit in the XCOMP_BV field in the XSAVE header is 0

and the corresponding bit in the XSTATE_BV field is 1.

If the compacted form is executed and bytes 63:16 of the XSAVE header are not all zero.

If attempting to write any reserved bits of the MXCSR register with 1.

#NM

If CR0.TS[bit 3] = 1.

#UD

If CPUID.01H:ECX.XSAVE[bit 26] = 0.

If CR4.OSXSAVE[bit 18] = 0.

If the LOCK prefix is used.

Virtual-8086 Mode Exceptions

Same exceptions as in protected mode