The VEX prefix (from "vector extensions") and VEX coding scheme are an extension to the x86-64 instruction set architecture for microprocessors from Intel, AMD and others. It was introduced with the AVX instruction set.
The VEX prefix consists of three bytes and can be added to new and existing instructions. It is a superset of the REX prefix and provides 16 bits of payload in total. The VEX prefix can also be encoded into a shorter two-byte variant, if the omitted bits have specific values.
The VEX coding scheme allows the definition of new instructions and the extension or modification of previously existing instruction codes. This serves the following purposes:
The VEX prefix replaces the most commonly used instruction prefix bytes and escape bytes. In many cases, the number of prefix bytes and escape bytes that are replaced is the same as the number of bytes in the VEX prefix, so that the total length of the VEX-encoded instruction is the same as the length of the legacy instruction code. In other cases, the VEX-encoded version is longer or shorter than the legacy code. In 32-bit mode VEX encoded instructions can only access the first 8 YMM/XMM registers; the encodings for the other registers would be interpreted as the legacy LDS and LES instructions that are not supported in 64-bit mode.
While it is required for 256-bit AVX operations, the VEX prefix simply provides an alternative encoding for 128-bit SSE operations. For the most part, the operation is identical no matter which encoding is used. There is, however, one major difference:
When a VEX prefix is used, the high bits of the destination register are cleared (zeroed), while SSE operations without VEX leave the high bits of destination SIMD registers unmodified.
This does not affect the computation itself, but does affect any required save and restore operations. In particular, a called function written without knowledge of AVX or VEX may save a callee-saved register, use the register, and restore its value, using 128-bit operations, all without disturbing the more-significant bits.
This merging of unmodified and newly-computed portions of a register is difficult for the (now-ubiquitous) optimization of register renaming, as the unchanged portions of the destination register must be copied to the renamed destination register. x86 processors use special techniques to optimize this (such as the vzeroupper instruction), but it still comes at a performance penalty. [1]
| # of bytes | 0, 2, 3 | 1 | 1 | 0, 1 | 0, 1, 2, 4 | 0, 1 | |
|---|---|---|---|---|---|---|---|
| Part | [Prefixes] | [VEX] | OPCODE | ModR/M | [SIB] | [DISP] | [IMM] |
The VEX coding scheme uses a opcode prefix consisting of two or three bytes, which may be added to existing or new instruction codes. [2]
Two instructions (that were previously defined as invalid opcodes in 64-bit mode) were repurposed as the leading byte of the new VEX prefixes: 0xC4 for the three-byte variant and 0xC5 for the two-byte variant.
The VEX prefix replaces the 0x66, 0xF2 and 0xF3 opcode prefixes, the REX prefix, and the 0x0F, 0x0F 0x2E or 0x0F 0x3E opcode prefixes. It may not be used with one-byte opcodes which do not begin with 0x0F, nor with the LOCK (0xF0) prefix. It may be preceded only by address size (0x67) or segment (0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65) prefixes.
In the x86 architecture, instructions with a memory operand almost always use the ModR/M byte which specifies the addressing mode. This byte has three bit fields:
The base-plus-index and scale-plus-index forms of 32-bit addressing (encoded with r/m = 100 and mod ≠ 11) require another addressing byte, the SIB byte. It has the following fields:
| Byte | Bit | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| VEX3 (3-byte VEX) | |||||||||
| 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ||
| 0 (0xC4) | 1 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | |
| 1 | R̅ | X̅ | B̅ | m4 | m3 | m2 | m1 | m0 | |
| 2 | W | v̅3 | v̅2 | v̅1 | v̅0 | L | p1 | p0 | |
| VEX2 (2-byte VEX) | |||||||||
| 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | ||
| 0 (0xC5) | 1 | 1 | 0 | 0 | 0 | 1 | 0 | 1 | |
| 1 | R̅ | v̅3 | v̅2 | v̅1 | v̅0 | L | p1 | p0 | |
The VEX3 prefix contains all bit-fields from the REX prefix as well as various other prefixes, expanding addressing mode, register enumeration, operand size and width:
0x0F, 0x0F 0x38 and 0x0F 0x3A, respectively. The other VEX opcode maps have seen little use - as of December 2023, the only known uses of other maps are map 0 for the Xeon Phi-specific JKZD/JKNZD instructions [3] and map 7 for the planned URDMSR/UWRMSR instructions. [4] Maps 4/5/6 are used with the EVEX prefix, but none of the instructions in those maps are VEX-encodable.The VEX2 prefix is a 2-byte abbreviation of the VEX3 prefix, which may be used when the omitted fields have the following values:
Instructions which require different values for these fields must be encoded with the VEX3 prefix. VEX2 does include an R̅ bit, an L bit, two p bits, and an additional 4-bit source register (v), so is useful for many SSE and AVX instructions as long as the register/memory operand uses only the first 8 registers.
| Addressing mode | Bit 3 | Bits [2:0] | Register type | Common usage |
|---|---|---|---|---|
| REG | VEX.R | ModRM.reg | General purpose, mask, vector | Register operand |
| RM (if ModRM.mod = 11) | VEX.B | ModRM.r/m | GPR, mask, vector | Register operand |
| RM | VEX.B | ModRM.r/m | GPR | Register memory address |
| BASE | VEX.B | SIB.base | GPR | Base + index × scale memory address |
| INDEX | VEX.X | SIB.index | GPR | Base + index × scale memory address |
| VIDX | VEX.X | SIB.index | Vector | Base + vector index × scale memory address |
| NDS/NDD | VEX.v3v2v1v0 | GPR, mask, vector | Register operand | |
| IS4 | Imm8[7:4] | Vector | Register operand | |
Instructions coded with the VEX prefix can have up to four variable operands (in registers or memory) and one constant operand (immediate value). Instructions that need more than three variable operands use immediate operand bits to specify a 4th register operand (IS4 above). At most one of the operands can be a memory operand; and at most one of the operands can be an immediate constant of 4 or 8 bits. The remaining operands are registers.
The AVX instruction set is the first instruction set extension to use the VEX coding scheme. The AVX instruction set uses the VEX prefix only for instructions using the SIMD XMM registers.
However, the VEX coding scheme has been used for other instruction types as well in subsequent expansions of the instruction set. For example:
The VEX prefix's initial-byte values, 0xC4 and 0xC5, are the same as the opcodes of the LDS and LES instructions. Not supported in 64-bit mode, the ambiguity is resolved in 32-bit mode by exploiting the fact that a legal LDS or LES's ModR/M byte cannot specify a register source operand; i.e., be of the form 11xxxxxx. Various bit-fields in the VEX prefix's second byte are inverted to ensure that the byte is always of this form.
Legacy SIMD instructions with a VEX prefix added are equivalent to the same instructions without VEX prefix with the following differences:
Instructions that use the whole 256-bit YMM register should not be mixed with non-VEX instructions that leave the upper half of the register unchanged, for reasons of efficiency. [6] [7]
The VEX prefix is not supported in real mode and virtual-8086 mode (all instructions with the VEX prefix will cause #UD in these modes).