OUT

OUT writes AL, AX or EAX to an I/O port: the reverse of IN, with the same port numbers, an immediate byte for ports 0 to FFH or DX for any of the 65,536, and the same rules for wider accesses, which cover consecutive ports. As with IN, REX.W does not widen it: AMD’s manual says a 64-bit operand size still writes 32 bits. OUTS writes a run of elements from memory.

Permission#

OUT is I/O-sensitive. In protected and 64-bit mode it runs when CPL is at most IOPL; otherwise every port it writes must have its bit clear in the I/O permission bit map of the task state segment, and anything else raises #GP(0) before the port is touched. The IN page gives the details of the map, which reads and writes share.

The probe runs at CPL 3 with IOPL 0. There, Zen 5 raised #GP for each form at each operand size, with ports 80H and FFH as immediates and 3F8H and FFFFH in DX.

A write that is never buffered#

Stores to memory wait in a write buffer; OUT does not. Intel’s Volume 1 says that the processor never buffers writes to the I/O space, and that the instruction after an OUT does not start until the OUT and every earlier store have completed (Section 20.6, Table 20-1). AMD’s Volume 2 says the same of I/O instructions in general (Section 7.5.1). A command written with OUT has thus left the processor before the next instruction runs, although Intel adds that a chipset may still post some I/O writes.

From C#

glibc’s <sys/io.h> provides outb(value, port) and its wider siblings as inline assembly, with the value first, unlike the instruction’s operand order in Intel syntax. GCC 14 and Clang 23 at -O2 compile outb(v, 0x80) to a move of the value into EAX and an OUT to the immediate port 80H, and a variable port goes through EDX.

Under a hypervisor, OUT is checked against the same VMX I/O bitmaps or SVM I/O permissions map as IN, and an exit tells the hypervisor the port, the size and the direction. AMD’s Zen 5 guide lists OUT as microcoded.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

p = port.read()                  # imm8: ports 0 to FFH; DX: 0 to FFFFH
n = src.bits                     # AL, AX or EAX; REX.W does not make
                                 # it RAX
if CPL > iopl and not io_allowed(p, n):
    fault(GP, 0)                 # as in the probe's cases: CPL 3,
                                 # IOPL 0, the port not allowed
io_write(p, n, src)

Operands

Flags

Attributes

What else XED records about the forms. How to read.

OUT imm8, AL OUT imm8, eAX

may abort a TSX transaction

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP
• NOT
• OR
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SCAS
• SETcc
• SHL
• SHLD

All 109 General-purpose instructions