List of discontinued x86 instructions
Instructions that have at some point been present as documented instructions in one or more x86 processors, but where the processor series containing the instructions are discontinued or superseded, with no known plans to reintroduce the instructions.
Intel instructions
i386 instructions
The following instructions were introduced in the Intel 80386, but later discontinued:
Description | Instruction | Opcode | Eventual fate |
---|---|---|---|
Extract Bit String | XBTS r,r/m | 0F A6 /r | Discontinued from revision B1 of the 80386 onwards. |
Insert Bit String | IBTS r/m, r | 0F A7 /r | |
Move from test register | MOV r32,TRx | 0F 24 /r | Present in Intel 386 and 486 - not present in Intel Pentium or any later Intel CPUs. Present in all Cyrix CPUs. |
Move to test register | MOV TRx,r32 | 0F 26 /r |
Itanium instructions
These instructions are only present in the x86 operation mode of early Intel Itanium processors with hardware support for x86. This support was added in "Merced" and removed in "Montecito", replaced with software emulation.
Instruction | Opcode | Meaning |
---|---|---|
JMPE r/m16/32 | 0F 00 /6 | Jump To Intel Itanium Instruction Set.[1] |
JMPE disp16/32 | 0F B8 rel16/32 |
MPX instructions
These instructions were introduced in 6th generation Intel Core "Skylake" CPUs. The last CPU generation to support them was the 9th generation Core "Coffee Lake" CPUs.
Intel MPX adds 4 new registers, BND0 to BND3, that each contains a pair of addresses. MPX also defines a bounds-table as a 2-level directory/table data structure in memory that contains sets of upper/lower bounds.
Instruction | Opcode | Description | Notes |
---|---|---|---|
BMDMK b,m | F3 0F 1B /r | Make lower and upper bound from memory address expression. | The lower bound is given by base component of address, the upper bound by 1-s complement of the address as a whole. Using RIP-relative addressing not permitted (results in #UD) |
BNDCL b, r/m | F3 0F 1A /r | Check address against lower bound. | Produces a #BR exception if the bounds check fails. |
BNDCU b, r/m | F2 0F 1A /r | Check address against upper bound in 1's-complement form | |
BNDCN b, r/m | F2 0F 1B /r | Check address against upper bound | |
BMDMOV b, b/m | 66 0F 1A /r | Move a pair of memory bounds to/from memory or between bounds-registers | |
BNDMOV b/m, b | 66 0F 1B /r | ||
BNDLDX b,mib | 0F 1A /r | Load bounds from the bounds-table, using address translation using an sib-addressing expression mib | Requires memory addressing modes that use the SIB byte.
Produces a #BR exception if bounds directory entry is not valid (which prevents address translation). |
BNDSTX mib,b | 0F 1B /r | Store bounds into the bounds-table, using address translation using an sib-addressing expression mib | |
BND | F2 | Instruction prefix used with certain branch instructions to indicate that they should not clear the bounds registers. | If the BNDPRESERVE config bit is not set, then branches without this prefix will clear all four bounds registers. |
Hardware Lock Elision
The Hardware Lock Elision feature of Intel TSX is marked in the Intel SDM as removed from 2019 onwards.[2] This feature took the form of two instruction prefixes, XACQUIRE
and XRELEASE
, that could be attached to memory atomics/stores to elide the memory locking that they represent.
Instruction prefix | Opcode | Description |
---|---|---|
XACQUIRE | F2 | Instruction prefix to indicate start of hardware lock elision, used with memory atomic instructions only (for other instructions, the F2 prefix may have other meanings). When used with such instructions, may start a transaction instead of performing the memory atomic operation. |
XRELEASE | F3 | Instruction prefix to indicate end of hardware lock elision, used with memory atomic/store instructions only (for other instructions, the F3 prefix may have other meanings). When used with such instructions during hardware lock elision, will end the associated transaction instead of performing the store/atomic. |
Xeon Phi "Knights Corner" instructions
The first generation Xeon Phi processors, codenamed "Knights Corner", supported a large number of instructions that are not seen in any later x86 processor. An instruction reference can be found at [1]. Most of these instructions are similar but not identical to instructions in AVX-512 - later Xeon Phi processors replaced these instructions with AVX-512.
Xeon Phi "Knights Landing" and "Knights Mill" instructions
Some of the AVX-512 instructions in the Xeon Phi "Knights Landing" and later models belong to the AVX-512 subsets "AVX512ER", "AVX512_4FMAPS", "AVX512PF" and "AVX512_4VNNIW", all of which are unique to the Xeon Phi series of processors.
The ER and 4FMAPS instructions are floating-point artihmetic instructions that all follow a given pattern where:
- EVEX.W is used to specify floating-point format (0=FP32, 1=FP64)
- The bottom opcode bit is used to select between packed and scalar operation (0: packed, 1:scalar)
- For a given operation, all the scalar/packed variants belong to the same AVX-512 subset.
- The instructions all support result masking by opmask registers. The AVX512ER instructions also all support broadcast of memory operands.
- The only supported vector width is 512 bits.
Operation | AVX-512 subset |
Basic opcode | FP32 instructions (W=0) | FP64 instructions (W=1) | RC/SAE | |||||
---|---|---|---|---|---|---|---|---|---|---|
Packed | Scalar | Packed | Scalar | |||||||
Xeon Phi specific instructions (ER, 4FMAPS) | ||||||||||
Reciprocal approximation with an accuracy of 2^-28 | AVX512ER | EVEX.66.0F38 (CA/CB) /r | VRCP28PS z,z,z/m512 | VRCP28SS x,x,x/m32 | VRCP28PD z,z,z/m512 | VRCP28SD x,x,x/m64 | SAE | |||
Reciprocal square root approximation with an accuracy of 2^-28 | AVX512ER | EVEX.66.0F38 (CC/CD) /r | VRCP28PS z,z,z/m512 | VRCP28SS x,x,x/m32 | VRCP28PD z,z,z/m512 | VRCP28SD x,x,x/m64 | SAE | |||
Exponential 2^x approximation with 2^-23 relative error | AVX512ER | EVEX.66.0F38 C8 /r | VEXP2PS z,z/m512 | No | VEXP2PD z,z/m512 | No | SAE | |||
Fused-multiply-add, 4 iterations | AVX512_4FMAPS | EVEX.F2.0F38 (9A/9B) /r | V4FMADDPS z,z+3,m128 | V4FMADDSS x,x+3,m128 | No | No | ||||
Fused negate-multiply-add, 4 iterations | AVX512_4FMAPS | EVEX.F2.0F38 (AA/AB) /r | V4FNMADDPS z,z+3,m128 | V4FNMADDSS x,x+3,m128 | No | No |
AMD instructions
Am386 SMM instructions
A handful of instructions to support System Management Mode were introduced in the Am386SXLV and Am386DXLV processors.[3][4] They were also present in the later Am486SXLV and Am486DXLV processors.
The SMM functionality of these processors was implemented using Intel ICE microcode without a valid license, resulting in a lawsuit that AMD lost in 1994.[5] As a result of this loss, the ICE microcode was removed from all later AMD CPUs, and the SMM instructions removed with it.
Instruction | Opcode | Description |
---|---|---|
SMI | F1 | Call SMM interrupt handler |
UMOV r/m8,r8 | 0F 10 /r | Move data between registers and main system memory |
UMOV r/m, r16/32 | 0F 11 /r | |
UMOV r8, r/m8 | 0F 12 /r | |
UMOV r16/32, r/m | 0F 13 /r | |
RES3 | 0F 07 | Return from SMM interrupt handler (Am386SXLV/DXLV only) Takes a pointer in ES:EDI to a processor save state to resume from - this save state has format nearly identical to that of the undocumented Intel 386 LOADALL instruction.[6] |
RES4 | 0F 07 | Return from SMM interrupt handler (Am486SXLV/DXLV only). Similar to RES3, but with a different save state format.[7] |
3DNow! instructions
The 3DNow! instruction set extension was introduced in the AMD K6-2, mainly adding support for floating-point SIMD instructions using the MMX registers (two FP32 components in a 64-bit vector). The instructions were mainly promoted by AMD, but were supported on some non-AMD CPUs as well. The processors supporting 3DNow! were:
- AMD K6-2, K6-III, and all processors based on the K7, K8 and K10 microarchitectures. (Later AMD microarchitectures such as Bulldozer, Bobcat and Zen do not support 3DNow!)
- IDT WinChip 2 and 3
- VIA Cyrix III, and the "Samuel" and "Ezra" revisions of VIA C3. (Later VIA CPUs, from C3 "Nehemiah" onwards, dropped 3DNow! in favor of SSE.)
- National Semiconductor Geode GX2; AMD Geode GX and LX.
Instruction | Opcode | Meaning |
---|---|---|
FEMMS | 0F 0E | Faster Enter/Exit of the MMX or floating-point state |
PAVGUSB mm1, mm2/m64 | 0F 0F /r BF | Average of unsigned packed 8-bit values |
PF2ID mm1, mm2/m64 | 0F 0F /r 1D | Converts packed floating-point operand to packed 32-bit integer |
PFACC mm1, mm2/m64 | 0F 0F /r AE | Floating-point accumulate |
PFADD mm1, mm2/m64 | 0F 0F /r 9E | Packed, floating-point addition |
PFCMPEQ mm1, mm2/m64 | 0F 0F /r B0 | Packed floating-point comparison, equal to |
PFCMPGE mm1, mm2/m64 | 0F 0F /r 90 | Packed floating-point comparison, greater than or equal to |
PFCMPGT mm1, mm2/m64 | 0F 0F /r A0 | Packed floating-point comparison, greater than |
PFMAX mm1, mm2/m64 | 0F 0F /r A4 | Packed floating-point maximum |
PFMIN mm1, mm2/m64 | 0F 0F /r 94 | Packed floating-point minimum |
PFMUL mm1, mm2/m64 | 0F 0F /r B4 | Packed floating-point multiplication |
PFRCP mm1, mm2/m64 | 0F 0F /r 96 | Floating-point reciprocal approximation |
PFRCPIT1 mm1, mm2/m64 | 0F 0F /r A6 | Packed floating-point reciprocal, first iteration step |
PFRCPIT2 mm1, mm2/m64 | 0F 0F /r B6 | Packed floating-point reciprocal/reciprocal square root, second iteration step |
PFRSQIT1 mm1, mm2/m64 | 0F 0F /r A7 | Packed floating-point reciprocal square root, first iteration step |
PFRSQRT mm1, mm2/m64 | 0F 0F /r 97 | Floating-point reciprocal square root approximation |
PFSUB mm1, mm2/m64 | 0F 0F /r 9A | Packed floating-point subtraction |
PFSUBR mm1, mm2/m64 | 0F 0F /r AA | Packed floating-point reverse subtraction |
PI2FD mm1, mm2/m64 | 0F 0F /r 0D | Packed 32-bit integer to floating-point conversion |
PMULHRW mm1, mm2/m64 | 0F 0F /r B7 | Multiply signed packed 16-bit values with rounding and store the high 16 bits |
3DNow! also introduced a couple of prefetch instructions: PREFETCH m8
(opcode 0F 0D /0
) and PREFETCHW m8
(opcode 0F 0D /1
). These instructions, unlike the rest of 3DNow!, are not discontinued but continue to be supported on modern AMD CPUs. The PREFETCHW
instruction is also supported on Intel CPUs starting with 65 nm Pentium 4,[8] albeit executed as NOP until Broadwell.
3DNow+ instructions added with Athlon and K6-2+
Instruction | Opcode | Meaning | Notes |
---|---|---|---|
PF2IW mm1, mm2/m64 | 0F 0F /r 1C | Packed Floating-point to 16-bit Integer Conversion | Also present as undocumented instructions on original K6-2.[9][10] |
PI2FW mm1, mm2/m64 | 0F 0F /r 0C | Packed 16-bit Integer to Floating-point Conversion | |
PSWAPD mm1, mm2/m64 | 0F 0F /r BB | Packed Swap Doubleword | Uses same opcode as older undocumented K6-2 PSWAPW instruction.[10] |
PFNACC mm1, mm2/m64 | 0F 0F /r 8A | Packed Floating-Point Negative Accumulate | |
PFPNACC mm1, mm2/m64 | 0F 0F /r 8E | Packed Floating-Point Positive-Negative Accumulate | For complex number arithmetic. |
3DNow! instructions specific to Geode GX and LX
Instruction | Opcode | Meaning |
---|---|---|
PFRCPV mm1, mm2/m64 | 0F 0F /r 86 | Packed Floating-point Reciprocal Approximation |
PFRQSRTV mm1, mm2/m64 | 0F 0F /r 87 | Packed Floating-point Reciprocal Square Root Approximation |
SSE5 derived instructions
SSE5 was a proposed SSE extension by AMD. The bundle did not include the full set of Intel's SSE4 instructions, making it a competitor to SSE4 rather than a successor. AMD chose not to implement SSE5 as originally proposed, however, derived SSE extensions were introduced.
XOP
Introduced with the bulldozer processor core, removed again from Zen (microarchitecture) onward.
A revision of most of the SSE5 instruction set
FMA4
Supported in AMD processors starting with the Bulldozer architecture, removed in Zen. Not supported by any intel chip as of 2017.
Fused multiply-add with four operands. FMA4 was realized in hardware before FMA3.
Instruction | Opcode | Meaning | Notes |
---|---|---|---|
VFMADDPD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 69 /r /is4 | Fused Multiply-Add of Packed Double-Precision Floating-Point Values | |
VFMADDPS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 68 /r /is4 | Fused Multiply-Add of Packed Single-Precision Floating-Point Values | |
VFMADDSD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 6B /r /is4 | Fused Multiply-Add of Scalar Double-Precision Floating-Point Values | |
VFMADDSS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 6A /r /is4 | Fused Multiply-Add of Scalar Single-Precision Floating-Point Values | |
VFMADDSUBPD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 5D /r /is4 | Fused Multiply-Alternating Add/Subtract of Packed Double-Precision Floating-Point Values | |
VFMADDSUBPS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 5C /r /is4 | Fused Multiply-Alternating Add/Subtract of Packed Single-Precision Floating-Point Values | |
VFMSUBADDPD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 5F /r /is4 | Fused Multiply-Alternating Subtract/Add of Packed Double-Precision Floating-Point Values | |
VFMSUBADDPS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 5E /r /is4 | Fused Multiply-Alternating Subtract/Add of Packed Single-Precision Floating-Point Values | |
VFMSUBPD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 6D /r /is4 | Fused Multiply-Subtract of Packed Double-Precision Floating-Point Values | |
VFMSUBPS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 6C /r /is4 | Fused Multiply-Subtract of Packed Single-Precision Floating-Point Values | |
VFMSUBSD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 6F /r /is4 | Fused Multiply-Subtract of Scalar Double-Precision Floating-Point Values | |
VFMSUBSS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 6E /r /is4 | Fused Multiply-Subtract of Scalar Single-Precision Floating-Point Values | |
VFNMADDPD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 79 /r /is4 | Fused Negative Multiply-Add of Packed Double-Precision Floating-Point Values | |
VFNMADDPS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 78 /r /is4 | Fused Negative Multiply-Add of Packed Single-Precision Floating-Point Values | |
VFNMADDSD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 7B /r /is4 | Fused Negative Multiply-Add of Scalar Double-Precision Floating-Point Values | |
VFNMADDSS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 7A /r /is4 | Fused Negative Multiply-Add of Scalar Single-Precision Floating-Point Values | |
VFNMSUBPD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 7D /r /is4 | Fused Negative Multiply-Subtract of Packed Double-Precision Floating-Point Values | |
VFNMSUBPS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 7C /r /is4 | Fused Negative Multiply-Subtract of Packed Single-Precision Floating-Point Values | |
VFNMSUBSD xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 7F /r /is4 | Fused Negative Multiply-Subtract of Scalar Double-Precision Floating-Point Values | |
VFNMSUBSS xmm0, xmm1, xmm2, xmm3 | C4E3 WvvvvL01 7E /r /is4 | Fused Negative Multiply-Subtract of Scalar Single-Precision Floating-Point Values |
AMD Trailing Bit Manipulation Instructions
AMD introduced TBM together with BMI1 in its Piledriver[11] line of processors; later AMD Jaguar and Zen-based processors do not support TBM.[12] No Intel processors (as of 2020) support TBM.
Instruction | Description[13] | Equivalent C expression[14] |
---|---|---|
BEXTR | Bit field extract (with immediate) | (src >> start) & ((1 << len) - 1)
|
BLCFILL | Fill from lowest clear bit | x & (x + 1)
|
BLCI | Isolate lowest clear bit | x | ~(x + 1)
|
BLCIC | Isolate lowest clear bit and complement | ~x & (x + 1)
|
BLCMSK | Mask from lowest clear bit | x ^ (x + 1)
|
BLCS | Set lowest clear bit | x | (x + 1)
|
BLSFILL | Fill from lowest set bit | x | (x - 1)
|
BLSIC | Isolate lowest set bit and complement | ~x | (x - 1)
|
T1MSKC | Inverse mask from trailing ones | ~x | (x + 1)
|
TZMSK | Mask from trailing zeros | ~x & (x - 1)
|
Instructions from other vendors
Instructions specific to NEC V-series processors
These instructions are specific to the NEC V20/V30 CPUs and their successors, and do not appear in any non-NEC CPUs. Many of their opcodes have been reassigned to other instructions in later non-NEC CPUs.
Opcode | Instruction | Description | Available on |
---|---|---|---|
0F 10 /0 | TEST1 r/m8, CL | Test one bit.
First argument specifies an 8/16-bit register or memory location. Second argument specifies which bit to test. |
All V-series[15] except V30MZ[16] |
0F 11 /0 | TEST1 r/m16, CL | ||
0F 18 /0 ib | TEST1 r/m8, imm8 | ||
0F 19 /0 ib | TEST1 r/m16, imm8 | ||
0F 12 /0 | CLR1 r/m8, CL | Clear one bit. | |
0F 13 /0 | CLR1 r/m16, CL | ||
0F 1A /0 ib | CLR1 r/m8, imm8 | ||
0F 1B /0 ib | CLR1 r/m16, imm8 | ||
0F 14 /0 | SET1 r/m8, CL | Set one bit. | |
0F 15 /0 | SET1 r/m16, CL | ||
0F 1C /0 ib | SET1 r/m8, imm8 | ||
0F 1D /0 ib | SET1 r/m16, imm8 | ||
0F 16 /0 | NOT1 r/m8, CL | Invert one bit. | |
0F 17 /0 | NOT1 r/m16, CL | ||
0F 1E /0 ib | NOT1 r/m8, imm8 | ||
0F 1F /0 ib | NOT1 r/m16, imm8 | ||
0F 20 | ADD4S | Add Nibble Strings.
Performs a string addition of integers in packed BCD format (2 BCD digits per byte). DS:SI points to a source integer, ES:DI to a destination integer, and CL provides the number of digits to add. The operation is then: destination <- destination + source | |
0F 22 | SUB4S | Subtract Nibble Strings.
destination <- destination - source | |
0F 26 | CMP4S | Compare Nibble Strings. | |
0F 28 /0 | ROL4 r/m8 | Rotate Left Nibble.
Concatenates its 8-bit argument with the bottom 4 bits of AL to form a 12-bit bitvector, then left-rotates this bitvector by 4 bits, then writes this bitvector back to its argument and the bottom 4 bits of AL. | |
0F 2A /0 | ROR4 r/m8 | Rotate Right Nibble. Similar to ROL4, except performs a right-rotate by 4 bits. | |
0F 30 /r | EXT r8,r8 | Bitfield extract.
Perform a bitfield read from memory. DS:SI (DS0:IX in NEC nomenclature) points to memory location to read from, first argument specifies bit-offset to read from, and second argument specifies the number of bits to read minus 1. The result is placed in AX. After the bitfield read, SI and the first argument are updated to point just beyond the just-read bitfield. | |
0F 38 /0 ib | EXT r8,imm8 | ||
0F 31 /r | INS r8,r8 | Bitfield Insert.
Perform a bitfield write to memory. ES:DI (DS1:IY in NEC nomenclature) points to memory location to write to, AX contains data to write, first argument specifies bit-offset to write to, and second argument specifies the number of bits to write minus 1. After the bitfield write, DI and the first argument are updated to point just beyond the just-written bitfield. | |
0F 39 /0 ib | INS r8,imm8 | ||
64 | REPC | Repeat if carry. Instruction prefix for use with CMPS/SCAS. | |
65 | REPNC | Repeat if not carry. Instruction prefix for use with CMPS/SCAS. | |
66 /r
67 /r |
FPO2 | "Floating Point Operation 2": extra escape opcodes for floating-point coprocessor, in addition to the standard D8-DF ones used for x87.
Used by the NEC 72291 floating-point coprocessor. A listing of the opcodes/instructions supported by the 72291 is available.[17] | |
0F FF ib | BRKEM imm8 | Break to 8080 emulation mode.
Jump to an address picked from the Interrupt Vector Table using the imm8 argument, similar to the INT instruction, but start executing as Intel 8080 code rather than x86 code. |
V20, V30, V40, V50[15] |
0F E0 ib | BRKXA imm8 | Break to Extended Address Mode.
Jump to an address picked from the Interrupt Vector Table using the imm8 argument. Enables a simple memory paging mechanism after reading the IVT but before executing the jump. The paging mechanism uses an on-chip page table with 16Kbyte pages and no access rights checking.[18] |
V33, V53[15] |
0F F0 ib | RETXA imm8 | Return from Extended Address Mode.
Jump to an address picked from the Interrupt Vector Table using the imm8 argument. Disables paging after reading the IVT but before executing the jump. | |
0F 25 | MOVSPA | Transfer both SS and SP of old register bank after the bank has been switched by an interrupt or BRKCS instruction. | V25, V35,[19] V55[20] |
0F 2D /0 | BRKCS r16 | Perform software interrupt with context switch to register bank specified by low 3 bits of r16. | |
0F 91 | RETRBI | Return from register bank context switch interrupt. | |
0F 92 | FINT | Finish Interrupt. | |
0F 94 /7 | TSKSW r16 | Perform task switch to register bank indicated by low 3 bits of r16. | |
0F 95 /7 | MOVSPB r16 | Transfer SS and SP of current register bank to register bank indicated by low 3 bits of r16. | |
0F 9C ib ib rel8 | BTCLR imm8,imm8,cb | Bit Test and Clear.
The first argument specifies a V25/V35 Special Function Register to test a bit in. The second argument specifies a bit position in that register. The third argument specifies a short branch offset. If the bit was set to 1, then it is cleared and a short branch is taken, else the branch is not taken. | |
0F 9E | STOP | CPU Halt. Differs from conventional 8086 HLT in that the clock is stopped too, so that an NMI or CPU reset is needed to resume operation. | |
F1 ib | BRKS imm8 | Break and Enable Software Guard.
Jump to an address picked from the Interrupt Vector Table using the imm8 argument, and then continue execution with "Software Guard" enabled. The "Software Guard" is an 8-bit Substitution cipher that, during instruction fetch/decode, translates opcode bytes using a 256-entry lookup table stored in an on-chip Mask ROM. |
V25, V35 "Software Guard"[21] |
63 ib | BRKN imm8 | Break and Enable Native Mode. Similar to BRKS, excepts disables "Software Guard" rather than enabling it. | |
8C /6 | MOV r/m,DS3 | Move to/from DS2 and DS3 extended segment registers. These registers, specific to V55, act similar to regular x86 real-mode segment registers except that they are left-shifted by 8 rather than 4, enabling access to 16MB of memory. | V55[20] |
8C /7 | MOV r/m,DS2 | ||
8E /6 | MOV DS3,r/m | ||
8E /7 | MOV DS2,r/m | ||
0F 76[22] | PUSH DS3 | ||
0F 77 | POP DS3 | ||
0F 7E | PUSH DS2 | ||
0F 7F | POP DS2 | ||
0F 36 /r | MOV DS3,r16,m32 | Instructions to load both extended segment register and general-purpose register at once, similar to 8086's LDS and LES instructions | |
0F 3E /r | MOV DS2,r16,m32 | ||
63 | DS2: | Segment prefixes for the DS2 and DS3 extended segments | |
D6 | DS3: | ||
F1 | IRAM: | Register File Override Prefix. Will cause memory operands to index into register file rather than general memory | |
0F 3C /0 | BSCH r/m8 | Count Trailing Zeroes and store result in CL. Sets ZF=1 for all-0s input. | |
0F 3D /0 | BSCH r/m16 | ||
0F 96 ib ib | RSTWDT imm8,imm8 | Watchdog Timer Manipulation Instruction | |
0F 9D ib ib rel8 | BTCLRL imm8,imm8,cb | Bit test and clear for second bank of special purpose registers (similar to BTCLR) | |
0F E0 iw | QHOUT imm16 | Queue manipulation instructions | |
0F E1 iw | QOUT imm16 | ||
0F E2 iw | QTIN imm16 | ||
0F 9F | IDLE | Put CPU in idle mode | V55SC[23] |
0F 9A | ALBIT | Dedicated fax instructions | V55PI[20] |
0F 9B | COLTRP | ||
0F 93 | MHENC | ||
0F 97 | MRENC | ||
0F 78 | SCHEOL | ||
0F 79 | GETBIT | ||
0F 7C | MHDEC | ||
0F 7D | MRDEC | ||
0F 7A | CNVTRP | ||
63 | (no mnemonic) | Designated opcode for termination of the x86 emulation mode on the NEC V60.[24] | V60, V70 |
Instructions specific to Cyrix and Geode CPUs
These instructions are present in Cyrix CPUs as well as NatSemi/AMD Geode CPUs derived from Cyrix microarchitectures (Geode GX and LX, but not NX). They are also present in Cyrix manufacturing partner CPUs from IBM, ST and TI, as well as a few SoCs such as STPC ATLAS and ZFMicro ZFx86.[25] Many of these opcodes have been reassigned to other instructions in later non-Cyrix CPUs.
Opcode | Instruction | Description | Available on |
---|---|---|---|
0F 78 /r | SVDC m80,sreg | Save segment register and descriptor to memory as a 10-byte data structure.
The first 8 bytes are the descriptor, the last two bytes are the selector.[26] |
System Management Mode instructions.
Not present on stepping A of Cx486SLC and Cx486DLC.[27] Present on Cx486SLC/e[28] and all later Cyrix CPUs. Present on all Cyrix-derived Geode CPUs. |
0F 79 /r | RSDC sreg,m80 | Restore segment register and descriptor from memory | |
0F 7A /0 | SVLDT m80 | Save LDTR and descriptor | |
0F 7B /0 | RSLDT m80 | Restore LDTR and descriptor | |
0F 7C /0 | SVTS m80 | Save TSR and descriptor | |
0F 7D /0 | RSTS m80 | Restore TSR and descriptor | |
0F 7E | SMINT | System management software interrupt.
Uses 0F 7E encoding on Cyrix 486, 5x86, 6x86 and ZFx86. Uses 0F 38 encoding on Cyrix 6x86MX, MII, MediaGX and Geode. | |
0F 38 | |||
0F 36 /0 | RDSHR r/m32 | Read SMM Header Pointer Register | Cyrix 6x86MX[29] and MII |
0F 37 /0 | WRSHR r/m32 | Write SMM Header Pointer Register | |
0F 3A | BB0_RESET | Reset BLT Buffer Pointer 0 to base | Cyrix MediaGX and MediaGXm[30]
NatSemi Geode GXm, GXLV, GX1 |
0F 3B | BB1_RESET | Reset BLT Buffer Pointer 1 to base | |
0F 3C | CPU_WRITE | Write to CPU internal special register (EBX=register-index, EAX=data) | |
0F 3D | CPU_READ | Read from CPU internal special register (EBX=register-index, EAX=data) | |
0F 39 | DMINT | Debug Management Mode Interrupt | NatSemi Geode GX2
AMD Geode GX, LX[31] |
0F 3A | RDM | Return from Debug Management Mode |
Cyrix EMMI instructions
These instructions were introduced in the Cyrix 6x86MX and MII processors, and were also present in the MediaGXm and Geode GX1[32] processors. (In later non-Cyrix processors, all of their opcodes have been used for SSE instructions.)
These instructions are integer SIMD instructions acting on 64-bit vectors in MMX registers or memory. Each instruction takes two explicit operands, where the first one is an MMX register operand and the second one is either a memory operand or a second MMX register. In addition, several of the instructions take an implied operand, which is an MMX register implied from the first operand as follows:
First explicit operand | mm0 | mm1 | mm2 | mm3 | mm4 | mm5 | mm6 | mm7 |
---|---|---|---|---|---|---|---|---|
Implied operand | mm1 | mm0 | mm3 | mm2 | mm5 | mm4 | mm7 | mm6 |
In the instruction descriptions in the below table, arg1
and arg2
refer to the two explicit operands of the instruction, and imp
to the implied operand. For PDISTIB
, PMACHRIW
and the PMV*
instructions, the second explicit operand is required to be a memory operand.
Description | Instruction | Opcode | Notes |
---|---|---|---|
Packed average bytes:arg1 <- (arg1+arg2) >> 1 |
PAVEB mm,mm/m64 |
0F 50 /r |
Implementations differ on whether the bytes are interpreted as signed or unsigned.[33] |
Packed add signed words with saturation, using implied destination:imp <- saturate_s16(arg1+arg2) |
PADDSIW mm,mm/m64 |
0F 51 /r
| |
Packed signed word magnitude maximum value:if (abs(arg2) > abs(arg1)) then arg1 <- arg2 |
PMAGW mm,mm/m64 |
0F 52 /r
| |
Packed unsigned byte distance and accumulate to implied destination, with saturation:imp <- saturate_u8(imp + (abs(arg1-arg2))) |
PDISTIB mm,m64 |
0F 54 /r
| |
Packed subtract signed words with saturation, using implied destination:imp <- saturate_s16(arg1-arg2) |
PSUBSIW mm,mm/m64 |
0F 55 /r
| |
Packed signed word multiply high with rounding:arg1 <- (arg1*arg2+0x4000)>>15 |
PMULHRW mm,mm/m64 |
0F 59 /r |
No saturation performed. |
Packed signed word multiply high with rounding and implied destination:imp <- (arg1*arg2+0x4000)>>15 |
PMULHRIW mm,mm/m64 |
0F 5D /r
| |
Packed signed word multiply high with rounding and accumulation to implied destination:imp <- imp + ((arg1*arg2+0x4000)>>15) |
PMACHRIW mm,m64 |
0F 5E /r
| |
Packed conditional load from memory to MMX register. Condition is evaluated on a per-byte-lane basis, by comparing byte lanes in the implied source to zero (with signed compare) - if the comparison passes, then the corresponding destination lane is loaded. |
PMVZB mm,m64 |
0F 58 /r |
if (imp == 0) then arg1 <- arg2
|
PMVNZB mm,m64 |
0F 5A /r |
if (imp != 0) then arg1 <- arg2
| |
PMVLZB mm,m64 |
0F 5B /r |
if (imp < 0) then arg1 <- arg2
| |
PMVGEZB mm,m64 |
0F 5C /r |
if (imp >= 0) then arg1 <- arg2
|
Instructions specific to Chips and Technologies CPUs
The C&T F8680 PC/Chip is a system-on-a-chip featuring an 80186-compatible CPU core, with a few additional instructions to support the F8680-specific "SuperState R"[34] supervisor/system-management feature. Some of the added instructions for "SuperState R" are:[35]
Opcode | Instruction | Description |
---|---|---|
FE F8 | LFEAT AX | Load datum into F8680 "CREG" configuration register (AH=register-index, AL=datum)[36] |
FE F0 ib | STFEAT AL,imm8 | Read F8680 status register into AL (imm8=register-index) |
C&T also developed a 386-compatible processor known as the Super386. This processor supports, in addition to the basic Intel 386 instruction set, a number of instructions to support the Super386-specific "SuperState V" system-management feature. The added instructions for "SuperState V" are:[3]
Opcode | Instruction | Description |
---|---|---|
0F 18 /0 | SCALL r/m | Call SMM interrupt handler[37][38] |
0F 19 | SRET | Return from SMM interrupt handler |
0F 1A | SRESUME | Return from SMM with interrupts disabled for one instruction |
0F 1B | SVECTOR | Exit from SMM and issue a shutdown cycle |
0F 1E | EPIC | Load one of the six interrupt or I/O traps |
0F 3C | RARF1 | Read from bank 1 of the register file (includes visible and invisible CPU registers) |
0F 3D | RARF2 | Read from bank 2 of the register file |
0F 3E | RARF3 | Read from bank 3 of the register file |
0F F0 | LTLB | Load TLB with page table entry |
0F F1 | RCT | Read cache tag |
0F F2 | WCT | Write cache tag |
0F F3 | RCD | Read cache data |
0F F4 | WCD | Write cache data |
0F F5 | RTLBPA | Read TLB data (physical address) |
0F F6 | RTLBLA | Read TLB tag (linear address) |
0F F7 | LCFG | Load configuration register |
0F F8 | SCFG | Store configuration register |
0F F9 | RGPR | Read general-purpose register or any bank of register file |
0F FA | RARF0 | Read from bank 0 of the register file |
0F FB | RARFE | Read from extra bank of the register file |
0F FD | WGPR | Write general-purpose register or any bank of register file |
0F FE | WARFE | Write extra bank of the register file |
Instructions specific to ALi/DM&P M6117 MCUs
The M6117 series of embedded microcontrollers feature a 386SX-class CPU core with a few M6117-specific additions to the Intel 386 instruction set. The ones documented for DM&P M1167D are:[39]
Opcode | Instruction | Description |
---|---|---|
F1 | BRKPM | System management interrupt - enters "hyper state mode" |
D6 E6 | RETPM | Return from "hyper state mode" |
D6 CA 03 A0 | LDUSR UGRS,EAX | Set page address of SMI entry point |
D6 C8 03 A0 | (mnemonic not listed) | Read page address of SMI entry point |
D6 FA 03 02 | MOV PWRCR,EAX | Write to power control register |
Instructions present in specific 80387 clones
Several 80387-class floating-point coprocessors provided extra instructions in addition to the standard 80387 ones - none of these are supported in later processors:
Instruction | Opcode | Description | Available on |
---|---|---|---|
FRSTPM | DB F4[40]
or DB E5[41] |
FPU Reset Protected Mode.
Instruction to signal to the FPU that the main CPU is exiting protected mode, similar to how the FSETPM instruction is used to signal to the FPU that the CPU is entering protected mode. Different sources provide different encodings for this instruction. |
Intel 287XL |
FNSTDW AX | DF E1 | Store FPU Device Word to AX | Intel 387SL[41][42] |
FNSTSG AX | DF E2 | Store FPU Signature Register to AX | |
FSBP0 | DB E8 | Select Coprocessor Register Bank 0 | IIT 2c87, 3c87[41][43] |
FSBP1 | DB EB | Select Coprocessor Register Bank 1 | |
FSBP2 | DB EA | Select Coprocessor Register Bank 2 | |
FSBP3 | DB E9[44] | Select Coprocessor Register Bank 3 (undocumented) | |
F4X4,
FMUL4X4 |
DB F1 | Multiply 4-component vector with 4x4 matrix. For proper operation, the matrix must be preloaded into Coprocessor Register banks 1 and 2 (unique to IIT FPUs), and the vector must be loaded into Coprocessor Register Bank 0. Example code is available.[43][45] | |
FTSTP | D9 E6 | Equivalent to FTST followed by a stack pop. | Cyrix 387+[45] |
FRINT2 | DB FC | Round st(0) to integer, with round-to-nearest rounding. | Cyrix EMC87, 83s87, 83d87, 387+[45][41] |
FRICHOP | DD FC | Round st(0) to integer, with round-to-zero rounding. | |
FRINEAR | DF FC | Round st(0) to integer, with round-to-nearest ties-away-from-zero rounding. |
See also
References
- ^ Intel Itanium Architecture Software Developer's Manual, volume 4, (document number: 323208, revision 2.3, may 2010).
- ^ Intel SDM, volume 1, order no. 253665-072, may 2020, chapter 2.25
- ^ a b Microprocessor Report, System Management Mode Explained (vol 6, no. 8, june 17, 1992) - includes a listing of the AMD/Cyrix SMM opcodes and the C&T Super386 "SuperState V" opcodes.
- ^ "Am386®SX/SXL/SXLV High-Performance, Low-Power, Embedded Microprocessors" (PDF)., publication #21020, rev A, apr 1997 - has SMM instruction descriptions on pages 5 and 6.
- ^ Intel vs AMD, "Case No.C-93-20301 PVT, Findings of fact and conclusions of law following "ICE" module of trial". Oct 7, 1994.
- ^ Potemkin's Hackers Group's OPCODE.LST v4.51
- ^ Hans Peter Messmer, "The Indispensable PC Hardware Book" (ISBN 0201403994), chapter 10.6.1, pages 280-281
- ^ "Windows 10 64-bit requirements: Does my CPU support CMPXCHG16b, PrefetchW and LAHF/SAHF?".
- ^ Grzegorz Mazur, AMD 3DNow! undocumented instructions
- ^ a b "Undocumented 3DNow! Instructions". grafi.ii.pw.edu.pl. Archived from the original on 30 January 2003. Retrieved 22 February 2022.
- ^ Hollingsworth, Brent. "New "Bulldozer" and "Piledriver" instructions" (PDF). Advanced Micro Devices, Inc. Retrieved 11 December 2014.
- ^ "Family 16h AMD A-Series Data Sheet" (PDF). amd.com. AMD. October 2013. Retrieved 2014-01-02.
- ^ "AMD64 Architecture Programmer's Manual, Volume 3: General-Purpose and System Instructions" (PDF). amd.com. AMD. October 2013. Retrieved 2014-01-02.
- ^ "tbmintrin.h from GCC 4.8". Retrieved 2014-03-17.
- ^ a b c NEC 16-bit V-series User's Manual
- ^ NEC V30MZ Preliminary User's Manual, p.14
- ^ NEC 72291 FPU: an instruction listing can be found in the HP 64873 V-series Cross Assembler Reference, pages F-31 to F-34.
- ^ NEC 16-bit V-series Microprocessor Data Book, 1991, p. 360-361
- ^ Renesas Data Sheet MOS Integrated Circuit uPD70320
- ^ a b c NEC V55PI 16-bit microprocessor Data Sheet, U11775E
- ^ NEC 16-bit V-series Microprocessor Data Book, 1991, p. 765-766
- ^ NEC V55PI Users Manual Instruction, U10231J (Japanese). Opcodes for PUSH/POP DS2/DS3 listed in macro definitions on p. 378.
- ^ NEC V55SC 16-bit Microprocessor Preliminary Data Sheet (O.D.No ID-8206A, March 1993), p.127. Located on Apr 20, 2022 by searching for "nec v55sc" at datasheetarchive.com.
- ^ NEC uPD70616 Programmer's Reference Manual (november 1986), p.287
- ^ ZFMicro, ZFx86 System-on-a-chip Data Book 1.0 Rev D, june 5, 2005, section 2.2.6.3, page 76
- ^ Texas Instruments, TI486 Microprocessor Reference Guide, 1993, section A.14, page 308
- ^ Debbie Wiles, CPU identification, archived on 2004-06-04
- ^ Cyrix 486SLC/e Data Sheet (1992), section 2.6.4
- ^ Cyrix 6x86MX Data Book, section 2.15.3
- ^ Cyrix MediaGX Data Book, section 4.1.5
- ^ AMD Geode LX Processors Data Book, section 8.3.4
- ^ AMD, AMD Geode GX1 Processor Data Book, rev 5.0, dec 2003, p. 226
- ^ Cyrix, Application Note 108 - Cyrix Extensions to the Multimedia Instruction Set, rev 0.93, 9 sep 1998, page 7
- ^ BYTE Magazine, november 1991, page 245
- ^ Institute Of Oceanographic Sciences, Sonic buoy - Formatter Handbook contains some F8680 instruction macros on page 34
- ^ The F8680 PC/Chip System Design Guide contains descriptions of many of the F8680 CREG registers.
- ^ Michal Necasek, More on the C&T Super386
- ^ Corexor, Calling C&T SCALL safely
- ^ DM&P, M6117D : System on a chip, pages 31,34,68. Archived on Jul 20,2006.
- ^ Intel "Intel287 XL/XLT Math Coprocessor", (oct 1992, order no 290376-003) p.33
- ^ a b c d Potemkin's Hacker Group's OPCODE.LST, v4.51
- ^ Intel "Intel387 SL Mobile Math Coprocessor" (feb 1992, order no 290427-001), appendix A. Located on Jan 7, 2022 by searching for "intel387 sl" at datasheetarchive.com.
- ^ a b IIT 3c87 Advanced Math CoProcessor Data Book
- ^ Harald Feldmann, Hamarsoft 86BUGS List
- ^ a b c Norbert Juffa "Everything You Always Wanted To Know About Math Coprocessors", 01-oct-94 revision