IN instruction (General-purpose)

IN reads a byte, word or doubleword from an I/O port into AL, AX or EAX. The ports are an address space of their own, apart from memory: byte-wide ports numbered 0 to FFFFH, which only IN, OUT, INS and OUTS reach. The port number is an immediate byte, for ports 0 to FFH, or DX, for any port. A wider access covers consecutive ports, so in eax, dx with DX = 3F8H reads ports 3F8H to 3FBH. REX.W does not make it a 64-bit read: AMD’s manual says it still reads 32 bits, and writing EAX clears bits 63:32 of RAX as any 32-bit result does.

Who may read a port

IN is I/O-sensitive, like OUT, INS, OUTS, CLI and STI: in protected and 64-bit mode it runs when CPL is at most IOPL, bits 13:12 of RFLAGS. Otherwise the processor looks up the I/O permission bit map of the task state segment, one bit per port, and allows the access only if the bits of every port it covers are clear; a port past the end of the map counts as set, and so does any port when there is no map. Anything else raises #GP(0). Only CPL 0 can change IOPL, with POPF or IRET.

The probe runs at CPL 3 with IOPL 0, and there Zen 5 raised #GP for every form it ran, with ports 80H and FFH as immediates and 3F8H and FFFFH in DX, leaving RAX as it was.

Ordering

Port I/O is ordered more strictly than memory. Intel’s Volume 3 (Section 11.2.5) and AMD’s Volume 2 (Section 7.5.1) say that an I/O instruction waits for the instructions and stores before it to complete, and that later reads and writes wait for it in turn.

From C

There is no intrinsic. glibc’s <sys/io.h> wraps IN in inline assembly; for inb(0x80), GCC 14 and Clang 23 at -O2 emit IN with the immediate port 80H, and with a variable port a move into EDX and IN from DX.

Under a hypervisor

Intel’s VMX can make every I/O instruction exit, or look each port up in two bitmaps covering 0 to 7FFFH and 8000H to FFFFH; AMD’s SVM checks an I/O permissions map with a bit per port, after the IOPL and TSS checks. AMD’s Zen 5 guide lists IN as microcoded.

Forms

Every encoding of IN that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`IN AL, imm8` IN_AL_IMMb	`E4 ib`	Base instruction set
`IN eAX, imm8` IN_OeAX_IMMb	`E5 ib`	Base instruction set
`IN AL, DX` IN_AL_DX	`EC`	Base instruction set
`IN eAX, DX` IN_OeAX_DX	`ED`	Base instruction set

Latency and throughput

What the scheduling models of LLVM 23.1.2 give for each form, not measurements: latency / reciprocal throughput in cycles, the ports under them. A row is a model, or models that agree; a dash, a form that its processors lack. Memory forms: latency from the address, ports without the load and store units. Which processors each model covers.

Model	`AL, imm8`	`eAX, imm8`	`AL, DX` `eAX, DX`	`eAX, DX`
Sandy Bridge	100 / 0.33p015	100 / 0.33p015	100 / 0.33p015	100 / 0.33p015
Haswell, Skylake, Skylake-SP, Ice Lake	35 / 5p012356	35 / 5p012356	35 / 5p012356	35 / 5p012356
Broadwell	34 / 5p012356	34 / 5p012356	34 / 5p012356	34 / 5p012356
Alder Lake, Sapphire Rapids	35 / 20p0 p1 p2 p3 p5 p6 p10 p11	35 / 21p0 p1 p2 p3 p5 p6 p10 p11	35 / 20p0 p1 p2 p3 p5 p6 p10 p11	1 / 21p0 p1 p2 p3 p5 p6 p10 p11
Lunar Lake	100 / 0.17p012345	100 / 0.17p012345	100 / 0.17p012345	100 / 0.17p012345
Bonnell	92 / 46p01	92 / 46p01	94 / 47p01	94 / 47p01
Silvermont	100 / 1FPC0	100 / 1FPC0	100 / 1FPC0	100 / 1FPC0
Piledriver	100 / 0.5EX0 EX1	100 / 0.5EX0 EX1	100 / 0.5EX0 EX1	100 / 0.5EX0 EX1
Zen, Zen 2	100 / 0.25	100 / 0.25	100 / 0.25	100 / 0.25
Zen 3, Zen 4	100 / 25ALU0 ALU1 ALU2 ALU3	100 / 25ALU0 ALU1 ALU2 ALU3	100 / 25ALU0 ALU1 ALU2 ALU3	100 / 25ALU0 ALU1 ALU2 ALU3
Jaguar	100 / 0.5ALU0 ALU1	100 / 0.5ALU0 ALU1	100 / 0.5ALU0 ALU1	100 / 0.5ALU0 ALU1

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

p = port.read()                  # imm8: ports 0 to FFH; DX: 0 to FFFFH
n = dest.bits                    # AL, AX or EAX; REX.W does not make
                                 # it RAX
if CPL > iopl and not io_allowed(p, n):
    fault(GP, 0)                 # as in the probe's cases: CPL 3,
                                 # IOPL 0, the port not allowed
dest.write(io_read(p, n))        # EAX: bits 63:32 of RAX cleared

Run on AMD Zen 5 (EPYC 9645): 16 cases. Every one raised an exception, at CPL 3, where the probe runs.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`IN AL, imm8` `IN eAX, imm8`
`AL, eAX`	explicit	write
`imm8`	explicit	read
`RFLAGS`	implicit	read
`IN AL, DX` `IN eAX, DX`
`AL, eAX`	explicit	write
`DX`	explicit	read
`RFLAGS`	implicit	read

Flags

T tested; blank: not affected. How to read.

IOPL
All forms
T

Attributes

What else XED records about the forms. How to read.

IN AL, imm8 IN eAX, imm8: may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`I86` General-purpose System	No CPUID bit: part of the base instruction set.	Every x86-64 processor in XED’s model and Zen 3 to Zen 6

More General-purpose instructions

All 109 General-purpose instructions

Who may read a port#

Ordering#

From C#

Under a hypervisor#