CMPXCHG16B

CMPXCHG16B is CMPXCHG8B with REX.W: it compares RDX:RAX with 16 bytes of memory and, if they match, stores RCX:RBX there, reporting the outcome in ZF. It is the double-width compare-and-swap of 64-bit code, for two words that must change together: a pointer and a version counter against the ABA problem in a lock-free stack, or the head and tail of a queue. Like CMPXCHG, it writes the memory back when the values differ, so the page must be writable either way.

The alignment rule#

The operand must be aligned to 16 bytes, or the instruction raises #GP(0), with or without LOCK; Zen 5 recorded both. CMPXCHG8B has no such rule. A structure of two pointers is aligned to only 8 bytes unless declared otherwise, for example with alignas(16).

Not in the baseline#

AMD’s manual calls support for it implementation dependent. It has its own CPUID bit, leaf 1, ECX bit 13 (cx16 in Linux), and belongs to x86-64-v2 rather than the baseline. Without the bit, AMD’s manual raises #UD, while Intel’s lists #GP(0) for 64-bit mode.

From C#

GCC 14 and Clang 23 at -O2 emit it only with -mcx16 or a -march that includes it; otherwise both call libatomic’s __atomic_compare_exchange_16. With -mcx16:

• Clang inlines LOCK CMPXCHG16B for __atomic_compare_exchange_n and C11’s atomic_compare_exchange_strong on 16-byte types, and pushes RBX, which is callee-saved, around it.
• GCC inlines it only for the old __sync_val_compare_and_swap; its __atomic and C11 forms still call libatomic.
• Clang even makes a 16-byte atomic load out of it: zeros in all four registers, then LOCK CMPXCHG16B, which either stores 0 over 0 or fails and returns the value. That load is a write, so it faults on read-only memory. With AVX (-march=x86-64-v3), Clang loads with VMOVDQA instead: Intel’s and AMD’s manuals both make aligned 16-byte loads and stores atomic on processors that report AVX (Intel’s Volume 3A, Section 11.1.1; AMD’s Volume 2, Section 7.3.2).

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

if dest.address % 16 != 0:
    fault(GP, 0)                 # m128 must be 16-byte aligned, with or
                                 # without LOCK
old = dest.read()                # with LOCK: one atomic read-modify-write
if old == rdx << 64 | rax:
    zf = 1
    dest.write(rcx << 64 | rbx)
else:
    zf = 0
    rdx = old >> 64
    rax = old
    dest.write(old)              # memory is written back all the same
# the other flags stay as they were

Operands

Flags

Attributes

What else XED records about the forms. How to read.

All forms

aligned memory operand

Memory forms without LOCK

accepts a LOCK prefix

LOCK forms

locked: atomic read-modify-write

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.