OUTS

OUTS writes one element, a byte, word or doubleword, from [RSI] to the I/O port in DX, then moves RSI to the next element: up while the direction flag is clear, down while it is set. With a REP prefix it repeats RCX times, so rep outsw sends a buffer to a device’s data port, which OUT would do one register at a time. INS runs the other way; its page covers what the two share, including Intel’s caution about devices that cannot keep up.

What is particular to OUTS#

• The segment may change. The source is DS:rSI, and a segment prefix replaces DS, where INS’s ES is fixed. In 64-bit mode DS adds nothing, but an FS or GS prefix adds that segment’s base.
• No quadword. With REX.W the element is still a doubleword, both manuals say, and RSI steps by 4.
• The port first. The permission check of OUT comes before the read of memory. At CPL 3 with IOPL 0, Zen 5 raised #GP for OUTSB, OUTSW and OUTSD, with REX.W, in the REP forms with RCX = 0, and with RSI = 8, in page 0, which the probe leaves unmapped, where a page fault might have been expected. RSI, RCX and memory were left alone.
• Not buffered. Intel’s Volume 1 treats OUTS and REP OUTS as OUT: the next instruction waits until the write and every earlier store have completed (Table 20-1).
• Stopping half way. An interrupt or exception during REP OUTS leaves RSI and RCX at the next element, so that the run resumes where it stopped. Intel’s Volume 3 adds that an I/O breakpoint on the port fires after the first element.

From C#

glibc’s <sys/io.h> has outsb, outsw and outsl, which take a port, a buffer and a count. At -O2, GCC 14 and Clang 23 move the count into RCX and the port into EDX, while the buffer, the second argument, already arrives in RSI; the inline assembly then emits CLD and REP OUTSW, clearing the direction flag itself (see CLD). AMD’s Zen 5 guide lists OUTS as microcoded.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

n = min(OSIZE, 32)               # REX.W: still a doubleword
if CPL > iopl and not io_allowed(dx, n):
    fault(GP, 0)                 # as in the probe's cases: CPL 3,
                                 # IOPL 0, the port not allowed
io_write(dx, n, load(aSI, n))    # DS:rSI; an FS or GS prefix adds
                                 # that segment's base
step = -(n // 8) if df else n // 8
aSI = low(aSI + step, ASIZE)

n = min(OSIZE, 32)               # REX.W: still a doubleword
if CPL > iopl and not io_allowed(dx, n):
    fault(GP, 0)                 # even when aCX is 0 (Zen 5)
step = -(n // 8) if df else n // 8
s = aSI
for i in range(aCX):             # one port write per element
    io_write(dx, n, load(s, n))
    s = low(s + step, ASIZE)
aSI = s
aCX = 0

Operands

Flags

Attributes

What else XED records about the forms. How to read.

All forms

may abort a TSX transaction

REP forms

repeated: count in rCX

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NEG
• NOP
• NOT
• OR
• OUT
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SCAS
• SETcc
• SHL
• SHLD
• SHR

All 109 General-purpose instructions