XSTORE instruction (VIA PadLock)

Forms

Every encoding of XSTORE that Intel XED knows, one row per XED instruction form (iform). How to read the notation.

Instruction	Encoding	Requires
`XSTORE` XSTORE	`0F A7 C0`	VIA_PADLOCK_RNG + VIA_PADLOCK_RNG_EN
`REP XSTORE` REP_XSTORE	`F3 0F A7 C0`	VIA_PADLOCK_RNG + VIA_PADLOCK_RNG_EN

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

All forms but the REP forms

via = cpuid_leaf(0xC0000001, 0)[3]
if via >> 2 & 3 != 3:
    fault(UD)                    # CPUID: no RNG, or it is off
if not cr4 >> 9 & 1 or not rng_msr >> 6 & 1:
    fault(UD)                    # no SSE, or the generator off
q = edx & 3                      # how many random bytes in a
n = 8 >> q                       # store: 8, 4, 2 or 1
k = 0                            # the bytes stored
if random_ready():               # 8 bytes in the generator
    k = n
    r = random(8 * n)            # n random bytes, zeros above:
    store(aDI, 64 if q == 0 else 32, r)  # 8 bytes, or 4
    aDI = aDI + n
eax = rng_msr & ~31 | k          # MSR 110B's bits 31:5, the
edx = q                          # count in 4:0; EDX's other
                                 # bits cleared
# without 8 bytes ready nothing is stored, and the count is 0.
# The direction flag does not count; ES is the segment, whatever
# a prefix says

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no PadLock RNG, and raised an exception.

REP forms

via = cpuid_leaf(0xC0000001, 0)[3]
if via >> 2 & 3 != 3:
    fault(UD)                    # CPUID: no RNG, or it is off
if not cr4 >> 9 & 1 or not rng_msr >> 6 & 1:
    fault(UD)                    # no SSE, or the generator off
q = edx & 3                      # how many random bytes in a
n = 8 >> q                       # store: 8, 4, 2 or 1
left = aCX                       # the bytes asked for
d = aDI
for i in range(left):            # one store a step, after
    if left <= 0:                # waiting for the generator
        break
    r = random(8 * n)
    store(d, 64 if q == 0 else 32, r)
    d += n
    left -= n
aDI = d                          # past a last store that went
aCX = 0                          # beyond the count
eax = UNDEFINED                  # MSR 110B's bits 31:5; the
edx = q                          # count in 4:0 is not defined
# a count that n does not divide gets random bytes past it: up
# to 7 more bytes are written than asked for

Run on AMD Zen 5 (EPYC 9645): 1 case. It ran where CPUID reported no PadLock RNG, and raised an exception.

Operands

What each form reads and writes, as Intel XED records it: the operands of its syntax, in order, and the implicit ones that the syntax does not name. How to read.

Operand	Kind	Action
`XSTORE`
`m8 at ES:[rDI]`	implicit	write
`rCX`	implicit	read
`rDX`	implicit	read, write
`rAX`	implicit	write
`rDI`	implicit	read, write
`REP XSTORE`
`m8 at ES:[rDI]`	implicit	write
`rCX`	implicit	read, write
`rDX`	implicit	read, write
`rAX`	implicit	write
`rDI`	implicit	read, write

Flags

None: XED records no flag that the forms test or change.

Attributes

What else XED records about the forms. How to read.

REP forms: repeated: count in rCX

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.

ISA set	CPUID	Processors
`VIA_PADLOCK_RNG` VIA PadLock	VIA_PADLOCK_RNG + VIA_PADLOCK_RNG_EN `CPUID.C0000001H:EDX[2]` VIA_PADLOCK_RNG `CPUID.C0000001H:EDX[3]` VIA_PADLOCK_RNG_EN	None in XED’s model.

XSTORE