x86 Instruction Set – AVX and F16C

Introduction

AVX (Advanced Vector Extensions) widened the vector registers from 128 to 256 bits and brought a new instruction prefix, VEX. The 16 xmm registers became the low halves of 16 ymm registers, ymm0–ymm15 (8 outside 64-bit mode). Intel brought AVX with Sandy Bridge, in 2011, and AMD with Bulldozer later the same year.

AVX did three things:

• It gave almost every SSE instruction on the xmm registers, from SSE to SSE4.2, AES-NI and PCLMULQDQ, a VEX form. The forms on the MMX registers, and AMD’s SSE4a, got none. The VEX form has a v before its name, takes an extra source operand so that it does not have to overwrite one (vaddps xmm0, xmm1, xmm2 rather than addps xmm0, xmm1), and clears the destination’s bits above 127.
• It gave the floating-point instructions 256-bit forms on the ymm registers. The integer instructions stayed at 128 bits; their 256-bit forms came with AVX2.
• It added a few new instructions: broadcasts, inserts and extracts of 128-bit halves, permutes, masked loads and stores, vtestps, and vzeroupper and vzeroall.

F16C adds two instructions that convert between single precision and half precision (FP16). Intel brought it with Ivy Bridge, in 2012, and AMD with Piledriver, also in 2012.

A program checks for AVX with CPUID leaf 01H, ECX bit 28 (AVX), and for F16C with ECX bit 29 (F16C). The processor’s bit is not enough: the operating system must also save the ymm registers on a task switch. So a program also checks ECX bit 27 (OSXSAVE), then runs XGETBV with ECX = 0 and checks that bits 1 (SSE state) and 2 (AVX state) of XCR0 are set.

AVX uses the vector registers, the MXCSR register for rounding and exception masks, and EFLAGS for the compares and tests that set flags. The legacy SSE forms and the AES-NI and PCLMULQDQ instructions are on their own pages (SSE, SSE2, SSE3 and SSSE3, SSE4, Cryptography); this page has their VEX forms, apart from AES-NI and PCLMULQDQ, whose VEX forms are on the Cryptography page.

The VEX prefix

A VEX prefix takes the place of the legacy prefixes 66, F2 and F3, of REX, and of the 0F, 0F 38 and 0F 3A escape bytes. It has two forms:

• C5 and one byte: R (inverted), vvvv (a register, inverted), L and pp. The map is 0F, and W is 0.
• C4 and two bytes: R, X and B (inverted) and the map (1 = 0F, 2 = 0F 38, 3 = 0F 3A), then W, vvvv, L and pp.

pp stands for the mandatory prefix the SSE form used: 0 none, 1 66, 2 F3, 3 F2. L is the length: 0 for 128 bits, 1 for 256. vvvv names the extra source register. Outside 64-bit mode C4 and C5 are also les and lds; a processor reads them as VEX when the next byte’s top two bits are both 1, which les and lds cannot have, as they need a memory operand. See Instruction encoding for the details.

The encodings below are written as Intel writes them: VEX.L.pp.map.W opcode. A missing pp means no prefix. WIG means W is ignored, LIG means L is ignored, and LZ means L must be 0. /r means a ModRM byte with a register in ModRM.reg, /n a ModRM byte whose reg field is n, ib an immediate byte, and /is4 an immediate byte whose bits 7:4 name a fourth register.

Instructions

In the forms, the first operand is the destination. Where there are three, the second is the register in VEX.vvvv and the third the register or memory in ModRM.rm. A scalar instruction (ss or sd) with three operands works on the low element and copies bits 127:32 (or 127:64) of the result from the second operand. Every 128-bit form clears bits 255:128 of its destination register.

Notes

• Alignment. Unlike their SSE forms, VEX instructions do not need aligned memory, except the moves that say so: vmovaps, vmovapd, vmovdqa, vmovntps, vmovntpd, vmovntdq and vmovntdqa.
• Mixing VEX and legacy SSE code. A legacy SSE instruction leaves bits 255:128 of its destination alone, while a VEX.128 instruction clears them. On many processors, running legacy SSE code while those bits are not zero is slow, so compilers put vzeroupper before calls into such code.
• Exceptions. The floating-point instructions raise the SIMD floating-point exceptions (invalid, denormal, divide by zero, overflow, underflow, precision), masked or not by MXCSR. Apart from vcomiss, vucomiss, their double-precision forms, vptest, vtestps, vtestpd and the string compares, none of these instructions changes EFLAGS.
• VEX.L. Where a row shows only 128-bit forms, VEX.L must be 0; vbroadcastsd, vbroadcastf128, vinsertf128, vextractf128 and vperm2f128 have only VEX.256. The scalar forms ignore VEX.L (LIG).
• VEX.W. WIG means W is ignored. For vpextrb, vpextrw, vpinsrb and vpinsrw, Intel’s manual gives W0 (and says that VEX.W1 is ignored for vpextrb); we decode W1 the same way, as LLVM does. Outside 64-bit mode, VEX.W1 does not make vmovq, vpextrq, vpinsrq, vcvtsi2ss and the rest 64-bit: they act as their 32-bit forms, and we show them so.
• The fourth register outside 64-bit mode. For vblendvps, vblendvpd and vpblendvb, only xmm0–xmm7 exist there, so bit 7 of the /is4 byte has no register to name. We ignore it, as GNU binutils does; LLVM does not.
• 16-bit code. VEX instructions run in 16-bit protected mode, so we decode them in 16-bit code too. They are not available in real mode or virtual-8086 mode.
• The compare predicates. The predicate names are LLVM’s and GNU’s pseudo-mnemonics, one instruction with different immediates. Intel’s manual lists the same names as pseudo-ops of VCMPPS and the rest.
• Memory sizes. vcvtpd2dq, vcvttpd2dq and vcvtpd2ps write an xmm register from either an xmm or a ymm source, so their memory forms differ only in size. Intel syntax shows the size (xmmword ptr or ymmword ptr); AT&T syntax writes the mnemonic with an x or y at the end.

Links