x86 instruction listings

The x86 instruction set refers to the set of instructions that x86-compatible microprocessors support. The instructions are usually part of an executable program, often stored as a computer file and executed on the processor.

The x86 instruction set has been extended several times, introducing wider registers and datatypes as well as new functionality.

x86 integer instructions

Main article: x86 assembly language

Below is the full 8086/8088 instruction set of Intel (81 instructions total). Most if not all of these instructions are available in 32-bit mode; they just operate on 32-bit registers (eax, ebx, etc.) and values instead of their 16-bit (ax, bx, etc.) counterparts. The updated instruction set is also grouped according to architecture (i386, i486, i686) and more generally is referred to as (32-bit) x86 and (64-bit) x86-64 (also known as AMD64).

Original 8086/8088 instructions

Original 8086/8088 instruction set

Instruction	Meaning	Notes	Opcode
AAA	ASCII adjust AL after addition	used with unpacked binary-coded decimal	0x37
AAD	ASCII adjust AX before division	8086/8088 datasheet documents only base 10 version of the AAD instruction (opcode 0xD5 0x0A), but any other base will work. Later Intel's documentation has the generic form too. NEC V20 and V30 (and possibly other NEC V-series CPUs) always use base 10, and ignore the argument, causing a number of incompatibilities	0xD5
AAM	ASCII adjust AX after multiplication	Only base 10 version (Operand is 0xA) is documented, see notes for AAD	0xD4
AAS	ASCII adjust AL after subtraction		0x3F
ADC	Add with carry	destination = destination + source + carry_flag	0x10…0x15, 0x80…0x81/2, 0x82…0x83/2 (since 80186)
ADD	Add	(1) r/m += r/imm; (2) r += m/imm;	0x00…0x05, 0x80/0…0x81/0, 0x82/0…0x83/0 (since 80186)
AND	Logical AND	(1) r/m &= r/imm; (2) r &= m/imm;	0x20…0x25, 0x80…0x81/4, 0x82…0x83/4 (since 80186)
CALL	Call procedure	push eip; eip points to the instruction directly after the call	0x9A, 0xE8, 0xFF/2, 0xFF/3
CBW	Convert byte to word		0x98
CLC	Clear carry flag	CF = 0;	0xF8
CLD	Clear direction flag	DF = 0;	0xFC
CLI	Clear interrupt flag	IF = 0;	0xFA
CMC	Complement carry flag		0xF5
CMP	Compare operands		0x38…0x3D, 0x80…0x81/7, 0x82…0x83/7 (since 80186)
CMPSB	Compare bytes in memory. May be used with a REP prefix to repeat the instruction CX times.		0xA6
CMPSW	Compare words. May be used with a REP prefix to repeat the instruction CX times.		0xA7
CWD	Convert word to doubleword		0x99
DAA	Decimal adjust AL after addition	(used with packed binary-coded decimal)	0x27
DAS	Decimal adjust AL after subtraction		0x2F
DEC	Decrement by 1		0x48…0x4F, 0xFE/1, 0xFF/1
DIV	Unsigned divide	(1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder	0xF7/6, 0xF6/6
ESC	Used with floating-point unit		0xD8..0xDF
HLT	Enter halt state		0xF4
IDIV	Signed divide	(1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder	0xF7/7, 0xF6/7
IMUL	Signed multiply in One-operand form	(1) DX:AX = AX * r/m; (2) AX = AL * r/m	0x69, 0x6B (both since 80186), 0xF7/5, 0xF6/5, 0x0FAF (since 80386)
IN	Input from port	(1) AL = port[imm]; (2) AL = port[DX]; (3) AX = port[imm]; (4) AX = port[DX];	0xE4, 0xE5, 0xEC, 0xED
INC	Increment by 1		0x40…0x47, 0xFE/0, 0xFF/0
INT	Call to interrupt		0xCC, 0xCD
INTO	Call to interrupt if overflow		0xCE
IRET	Return from interrupt		0xCF
Jcc	Jump if condition	(JA, JAE, JB, JBE, JC, JE, JG, JGE, JL, JLE, JNA, JNAE, JNB, JNBE, JNC, JNE, JNG, JNGE, JNL, JNLE, JNO, JNP, JNS, JNZ, JO, JP, JPE, JPO, JS, JZ)	0x70…0x7F, 0x0F80…0x0F8F (since 80386)
JCXZ	Jump if CX is zero		0xE3
JMP	Jump		0xE9…0xEB, 0xFF/4, 0xFF/5
LAHF	Load FLAGS into AH register		0x9F
LDS	Load pointer using DS		0xC5
LEA	Load Effective Address		0x8D
LES	Load ES with pointer		0xC4
LOCK	Assert BUS LOCK# signal	(for multiprocessing)	0xF0
LODSB	Load string byte. May be used with a REP prefix to repeat the instruction CX times.	if (DF==0) AL = *SI++; else AL = *SI--;	0xAC
LODSW	Load string word. May be used with a REP prefix to repeat the instruction CX times.	if (DF==0) AX = *SI++; else AX = *SI--;	0xAD
LOOP/LOOPx	Loop control	(LOOPE, LOOPNE, LOOPNZ, LOOPZ) if (x && --CX) goto lbl;	0xE0…0xE2
MOV	Move	copies data from one location to another, (1) r/m = r; (2) r = r/m;	0xA0...0xA3
MOVSB	Move byte from string to string. May be used with a REP prefix to repeat the instruction CX times.	if (DF==0) *(byte*)DI++ = *(byte*)SI++; else *(byte*)DI-- = *(byte*)SI--; .	0xA4
MOVSW	Move word from string to string. May be used with a REP prefix to repeat the instruction CX times.	if (DF==0) *(word*)DI++ = *(word*)SI++; else *(word*)DI-- = *(word*)SI--;	0xA5
MUL	Unsigned multiply	(1) DX:AX = AX * r/m; (2) AX = AL * r/m;	0xF7/4, 0xF6/4
NEG	Two's complement negation	r/m *= -1;	0xF6/3…0xF7/3
NOP	No operation	opcode equivalent to XCHG EAX, EAX	0x90
NOT	Negate the operand, logical NOT	r/m ^= -1;	0xF6/2…0xF7/2
OR	Logical OR	(1) r/m |= r/imm; (2) r |= m/imm;	0x08…0x0D, 0x80…0x81/1, 0x82…0x83/1 (since 80186)
OUT	Output to port	(1) port[imm] = AL; (2) port[DX] = AL; (3) port[imm] = AX; (4) port[DX] = AX;	0xE6, 0xE7, 0xEE, 0xEF
POP	Pop data from stack	r/m = *SP++; POP CS (opcode 0x0F) works only on 8086/8088. Later CPUs use 0x0F as a prefix for newer instructions.	0x07, 0x0F(8086/8088 only), 0x17, 0x1F, 0x58…0x5F, 0x8F/0
POPF	Pop FLAGS register from stack	FLAGS = *SP++;	0x9D
PUSH	Push data onto stack	*--SP = r/m;	0x06, 0x0E, 0x16, 0x1E, 0x50…0x57, 0x68, 0x6A (both since 80186), 0xFF/6
PUSHF	Push FLAGS onto stack	*--SP = FLAGS;	0x9C
RCL	Rotate left (with carry)		0xC0…0xC1/2 (since 80186), 0xD0…0xD3/2
RCR	Rotate right (with carry)		0xC0…0xC1/3 (since 80186), 0xD0…0xD3/3
REPxx	Repeat MOVS/STOS/CMPS/LODS/SCAS	(REP, REPE, REPNE, REPNZ, REPZ)	0xF2, 0xF3
RET	Return from procedure	Not a real instruction. The assembler will translate these to a RETN or a RETF depending on the memory model of the target system.
RETN	Return from near procedure		0xC2, 0xC3
RETF	Return from far procedure		0xCA, 0xCB
ROL	Rotate left		0xC0…0xC1/0 (since 80186), 0xD0…0xD3/0
ROR	Rotate right		0xC0…0xC1/1 (since 80186), 0xD0…0xD3/1
SAHF	Store AH into FLAGS		0x9E
SAL	Shift Arithmetically left (signed shift left)	(1) r/m <<= 1; (2) r/m <<= CL;	0xC0…0xC1/4 (since 80186), 0xD0…0xD3/4
SAR	Shift Arithmetically right (signed shift right)	(1) (signed) r/m >>= 1; (2) (signed) r/m >>= CL;	0xC0…0xC1/7 (since 80186), 0xD0…0xD3/7
SBB	Subtraction with borrow	alternative 1-byte encoding of SBB AL, AL is available via undocumented SALC instruction	0x18…0x1D, 0x80…0x81/3, 0x82…0x83/3 (since 80186)
SCASB	Compare byte string. May be used with a REP prefix to repeat the instruction CX times.		0xAE
SCASW	Compare word string. May be used with a REP prefix to repeat the instruction CX times.		0xAF
SHL	Shift left (unsigned shift left)		0xC0…0xC1/4 (since 80186), 0xD0…0xD3/4
SHR	Shift right (unsigned shift right)		0xC0…0xC1/5 (since 80186), 0xD0…0xD3/5
STC	Set carry flag	CF = 1;	0xF9
STD	Set direction flag	DF = 1;	0xFD
STI	Set interrupt flag	IF = 1;	0xFB
STOSB	Store byte in string. May be used with a REP prefix to repeat the instruction CX times.	if (DF==0) *ES:DI++ = AL; else *ES:DI-- = AL;	0xAA
STOSW	Store word in string. May be used with a REP prefix to repeat the instruction CX times.	if (DF==0) *ES:DI++ = AX; else *ES:DI-- = AX;	0xAB
SUB	Subtraction	(1) r/m -= r/imm; (2) r -= m/imm;	0x28…0x2D, 0x80…0x81/5, 0x82…0x83/5 (since 80186)
TEST	Logical compare (AND)	(1) r/m & r/imm; (2) r & m/imm;	0x84, 0x84, 0xA8, 0xA9, 0xF6/0, 0xF7/0
WAIT	Wait until not busy	Waits until BUSY# pin is inactive (used with floating-point unit)	0x9B
XCHG	Exchange data	r :=: r/m; A spinlock typically uses xchg as an atomic operation. (coma bug).	0x86, 0x87, 0x91…0x97
XLAT	Table look-up translation	behaves like MOV AL, [BX+AL]	0xD7
XOR	Exclusive OR	(1) r/m ^= r/imm; (2) r ^= m/imm;	0x30…0x35, 0x80…0x81/6, 0x82…0x83/6 (since 80186)

Added in specific Intel processors

Added with 80186/80188

Instruction	Opcode	Meaning	Notes
BOUND	62 /r	Check array index against bounds	raises software interrupt 5 if test fails
ENTER	C8 iw ib	Enter stack frame	Modifies stack for entry to procedure for high level language. Takes two operands: the amount of storage to be allocated on the stack and the nesting level of the procedure.
INSB/INSW	6C	Input from port to string	equivalent to: IN AX, DX MOV ES:[DI], AX ; adjust DI according to operand size and DF
	6D
LEAVE	C9	Leave stack frame	Releases the local stack storage created by the previous ENTER instruction.
OUTSB/OUTSW	6E	Output string to port	equivalent to: MOV AX, DS:[SI] OUT DX, AX ; adjust SI according to operand size and DF
	6F
POPA	61	Pop all general purpose registers from stack	equivalent to: POP DI POP SI POP BP POP AX ; no POP SP here, all it does is ADD SP, 2 (since AX will be overwritten later) POP BX POP DX POP CX POP AX
PUSHA	60	Push all general purpose registers onto stack	equivalent to: PUSH AX PUSH CX PUSH DX PUSH BX PUSH SP ; The value stored is the initial SP value PUSH BP PUSH SI PUSH DI
PUSH immediate	6A ib	Push an immediate byte/word value onto the stack	example: PUSH 12h PUSH 1200h
	68 iw
IMUL immediate	6B /r ib	Signed and unsigned multiplication of immediate byte/word value	example: IMUL BX,12h IMUL DX,1200h IMUL CX, DX, 12h IMUL BX, SI, 1200h IMUL DI, word ptr [BX+SI], 12h IMUL SI, word ptr [BP-4], 1200h Note that since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well.
	69 /r iw
SHL/SHR/SAL/SAR/ROL/ROR/RCL/RCR immediate	C0	Rotate/shift bits with an immediate value greater than 1	example: ROL AX,3 SHR BL,3
	C1

Added with 80286

Instruction	Opcode	Meaning	Notes
ARPL r/m16, r16	63 /r	Adjust RPL field of selector	Available in 16/32-bit protected mode only. Causes #UD in Real mode and Virtual 8086 Mode - Windows 95 and OS/2 2.x are known to make extensive use of this #UD to use the 63 opcode as a one-byte breakpoint to transition from Virtual 8086 Mode to kernel mode.
CLTS	0F 06	Clear task-switched flag in Machine Status Word.
LAR r,r/m16	0F 02 /r	Load access rights byte from the specified segment descriptor	Sets ZF=1 if the descriptor could be loaded, ZF=0 otherwise. 32-bit variant of LAR instruction is documented to load undefined data into bits 19:16 of destination register on Intel CPUs.
LSL r,r/m16	0F 03 /r	Load segment limit from the specified segment descriptor	Sets ZF=1 if the descriptor could be loaded, ZF=0 otherwise.
LGDT m16&32	0F 01 /2	Load Global Descriptor Table Register	Each of these instructions loads a 2-part table descriptor. The first part is a 16-bit value, specifying table size in bytes minus 1. The second part is a 32-bit value (64-bit value in 64-bit mode), specifying the linear start address for the table. This address is ANDed with 00FFFFFFh for the 16-bit variants of these instructions. LIDT can relocate the Interrupt Vector Table in Real Mode as well. LGDT and LIDT are serializing instructions.
LIDT m16&32	0F 01 /3	Load Interrupt Descriptor Table Register
LLDT r/m16	0F 00 /2	Load Local Descriptor Table Register	LLDT and LTR are serializing instructions.
LTR r/m16	0F 00 /3	Load Task Register
LMSW r/m16	0F 01 /6	Load Machine Status Word	On 80386 and later, the "Machine Status Word" is the same as the CR0 register, however LMSW can only modify the bottom 4 bits of this register. LMSW can be used to enter but not leave x86 Protected Mode. On the 80286, it is not possible to leave Protected Mode at all without a CPU reset - on 80386 and later, it is possible to leave Protected Mode, but this requires the use of the 80386-and-later MOV to CR0 instruction. LMSW is a serializing instruction.
SGDT m16&32	0F 01 /0	Store Global Descriptor Table Register	The SGDT,SIDT,SLDT,SMSW,STR were unprivileged on all x86 CPUs from 80286 onwards until the introduction of UMIP in 2017. This has been a significant security problem for software-based virtualization, since it enables these instructions to be used by a VM guest to detect that it is running inside a VM. The 16-bit variants of the SGDT and SIDT instructions also show a difference between Intel documentation and actual behavior observed on Intel CPUs: as of Intel SDM revision 076, December 2021, the last 8 bits of the descriptor is documented as being written as 0, however observed behavior is that bits 31:24 of the descriptor table address are written instead. SLDT and SMSW (but not STR) with a 32-bit register argument are documented to set the top 16 bits of the specified register to an undefined value on Intel CPUs.
SIDT m16&32	0F 01 /1	Store Interrupt Descriptor Table Register
SLDT r/m16	0F 00 /0	Store Local Descriptor Table Register
SMSW r/m16	0F 01 /4	Store Machine Status Word
STR r/m16	0F 00 /1	Store Task Register
VERR r/m16	0F 00 /4	Verify a segment for reading	Sets ZF=1 if segment can be read, ZF=0 otherwise.
VERW r/m16	0F 00 /5	Verify a segment for writing	Sets ZF=1 if segment can be written, ZF=0 otherwise. On some Intel CPU/microcode combinations from 2019 onwards, the VERW instruction also flushes microarchitectural data buffers. This enables it to be used as part of workarounds for Microarchitectural Data Sampling security vulnerabilities.
LOADALL	0F 05	Load all CPU registers, including internal ones such as GDT	Undocumented, 80286 only. (A different variant of LOADALL with a different opcode and memory layout exists on 80386.)

Added with 80386

Instruction	Meaning	Notes
BSF	Bit scan forward	BSF and BSR produce undefined results if the source argument is all-0s.
BSR	Bit scan reverse
BT	Bit test
BTC	Bit test and complement	Instructions atomic only if LOCK prefix present.
BTR	Bit test and reset
BTS	Bit test and set
CDQ	Convert double-word to quad-word	Sign-extends EAX into EDX, forming the quad-word EDX:EAX. Since (I)DIV uses EDX:EAX as its input, CDQ must be called after setting EAX if EDX is not manually initialized (as in 64/32 division) before (I)DIV.
CMPSD	Compare string double-word	Compares ES:[(E)DI] with DS:[(E)SI] and increments or decrements both (E)DI and (E)SI, depending on DF; can be prefixed with REP
CWDE	Convert word to double-word	Unlike CWD, CWDE sign-extends AX to EAX instead of AX to DX:AX
IBTS	Insert Bit String	Discontinued with B1 step of 80386.
IMUL	Two-operand form of IMUL: Signed and Unsigned	Allows to multiply two registers directly, storing the partial (truncated) lower bit result. Since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well
INSD	Input from port to string double-word	*(long)ES:EDI±± = port[DX]; (±± depends on DF, ES: cannot be overridden). Can be prefixed with REP.
IRETx	Interrupt return; D suffix means 32-bit return, F suffix means do not generate epilogue code (i.e. LEAVE instruction)	Use IRETD rather than IRET in 32-bit situations
Jxx (near)	Jump conditionally	Conditional near jump instructions for all 8086 Jxx short jump instructions
JECXZ	Jump if ECX is zero
LFS, LGS	Load far pointer
LSS	Load stack segment and register	Normally used to update both SS and SP at the same time.
LODSD	Load string double-word	EAX = *DS:(E)SI±±; (±± depends on DF, DS: can be overridden); can be prefixed with REP
LOOPW, LOOPccW	Loop, conditional loop	Same as LOOP, LOOPcc for earlier processors
LOOPD, LOOPccD	Loop while equal	if (cc && --ECX) goto lbl;, cc = Z(ero), E(qual), NonZero, N(on)E(qual)
MOV to/from CR/DR/TR	Move to/from special registers	CR=control registers, DR=debug registers, TR=test registers (up to 80486)
MOVSD	Move string double-word	*(dword*)ES:EDI±± = *(dword*)ESI±±; (±± depends on DF); can be prefixed with REP
MOVSX	Move with sign-extension	(long)r = (signed char) r/m; and similar
MOVZX	Move with zero-extension	(long)r = (unsigned char) r/m; and similar
OUTSD	Output to port from string double-word	port[DX] = *(long*)DS:ESI±±; (±± depends on DF, DS: can be overridden); can be prefixed with REP.
POPAD	Pop all double-word (32-bit) registers from stack	Does not pop register ESP off of stack
POPFD	Pop data into EFLAGS register
PUSHAD	Push all double-word (32-bit) registers onto stack
PUSHFD	Push EFLAGS register onto stack
PUSHD	Push a double-word (32-bit) value onto stack
SCASD	Scan string data double-word	Compares ES:[(E)DI] with EAX and increments or decrements (E)DI, depending on DF; can be prefixed with REP
SETcc	Set byte to one on condition, zero otherwise	(SETA, SETAE, SETB, SETBE, SETC, SETE, SETG, SETGE, SETL, SETLE, SETNA, SETNAE, SETNB, SETNBE, SETNC, SETNE, SETNG, SETNGE, SETNL, SETNLE, SETNO, SETNP, SETNS, SETNZ, SETO, SETP, SETPE, SETPO, SETS, SETZ)
SHLD	Shift left double	r1 = r1<<CL ∣ r2>>(register_width - CL); Instead of CL, 8-bit immediate can be used.
SHRD	Shift right double	r1 = r1>>CL ∣ r2<<(register_width - CL); Instead of CL, 8-bit immediate can be used. SHLD and SHRD with 16-bit arguments and a shift-amount greater than 16 produce undefined results. (Actual results differ between different Intel CPUs, with at least three different behaviors known.)
STOSD	Store string double-word	*ES:EDI±± = EAX; (±± depends on DF, ES cannot be overridden); can be prefixed with REP
XBTS	Extract Bit String	Discontinued with B1 step of 80386. Used by software mainly for detection of the buggy B0 stepping of the 80386. Microsoft Windows (v2.01 and later) will attempt to run the XBTS instruction as part of its CPU detection if CPUID is not present, and will refuse to boot if XBTS is found to be working.

Compared to earlier sets, the 80386 instruction set also adds opcodes with different parameter combinations for the following instructions: BOUND, IMUL, LDS, LES, MOV, POP, PUSH and prefix opcodes for FS and GS segment overrides.

Added with 80486

Instruction	Opcode	Meaning	Notes
BSWAP r32	0F C8+r	Byte Swap	r = r<<24 | r<<8&0x00FF0000 | r>>8&0x0000FF00 | r>>24; Only defined for 32-bit registers. Usually used to change between little endian and big endian representations. When used with 16-bit registers produces various different results on 486, 586, and Bochs/QEMU.
CMPXCHG r/m8, r8	0F A6 /r	Compare and Exchange	0F A6/A7 encodings only available on 80486 stepping A. 0F B0/B1 encodings available on 80486 stepping B and later x86 CPUs. Instruction atomic only if used with LOCK prefix.
	0F B0 /r
CMPXCHG r/m, r16/32	0F A7 /r
	0F B1 /r
INVD	0F 08	Invalidate Internal Caches	Flush internal caches. Modified data present in the cache are not written back to memory, potentially causing data loss.
INVLPG m8	0F 01 /7	Invalidate TLB Entry	Invalidate TLB Entry for page that contains data specified.
WBINVD	0F 09	Write Back and Invalidate Cache	Writes back all modified cache lines in the processor's internal cache to main memory and invalidates the internal caches.
XADD r/m,r8	0F C0 /r	eXchange and ADD	Exchanges the first operand with the second operand, then loads the sum of the two values into the destination operand. Instruction atomic only if used with LOCK prefix.
XADD r/m,r16/32	0F C1 /r

Added with Pentium

Instruction	Opcode	Meaning	Notes
CPUID	0F A2	CPU IDentification	Returns data regarding processor identification and features, and returns data to the EAX, EBX, ECX, and EDX registers. Instruction functions specified by the EAX register. This was also added to later 80486 processors
CMPXCHG8B m64	0F C7 /1	CoMPare and eXCHanGe 8 bytes	Compare EDX:EAX with m64. If equal, set ZF and load ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX. Instruction atomic only if used with LOCK prefix. LOCK CMPXCHG8B with a register operand (which is an invalid encoding) can cause hangs on some Intel Pentium CPUs (Pentium F00F bug).
RDMSR	0F 32	ReaD from Model-specific register	Load MSR specified by ECX into EDX:EAX
RDTSC	0F 31	ReaD Time Stamp Counter	Returns the number of processor ticks since the processor being "ONLINE" (since the last power on of system)
WRMSR	0F 30	WRite to Model-Specific Register	Write the value in EDX:EAX to MSR specified by ECX
RSM	0F AA	Resume from System Management Mode	This was introduced by the i386SL and later and is also in the i486SL and later, as well as Cyrix 486SLC/e and later. Resumes from System Management Mode (SMM)

Added with Pentium MMX

Instruction	Opcode	Meaning	Notes
RDPMC	0F 33	Read the PMC [Performance Monitoring Counter]	Specified in the ECX register into registers EDX:EAX

Also MMX registers and MMX support instructions were added. They are usable for both integer and floating point operations, see below.

Added with Pentium Pro

Instruction	Opcode	Meaning	Notes
CMOVcc r16,r/m CMOVcc r32,r/m	0F 4x /r	Conditional move	(CMOVA, CMOVAE, CMOVB, CMOVBE, CMOVC, CMOVE, CMOVG, CMOVGE, CMOVL, CMOVLE, CMOVNA, CMOVNAE, CMOVNB, CMOVNBE, CMOVNC, CMOVNE, CMOVNG, CMOVNGE, CMOVNL, CMOVNLE, CMOVNO, CMOVNP, CMOVNS, CMOVNZ, CMOVO, CMOVP, CMOVPE, CMOVPO, CMOVS, CMOVZ)
UD2	0F 0B	Undefined Instruction	Generates an invalid opcode exception. This instruction is provided for software testing to explicitly generate an invalid opcode. The opcode for this instruction is reserved for this purpose.
NOP r/m	0F 1F /0	Official long NOP	Introduced in the Pentium Pro, but undocumented until 2006. The whole 0F 18..1F opcode range was NOP in Pentium Pro. However, except for 0F 1F /0, Intel does not guarantee that these opcodes will remain NOP in future processors, and have indeed assigned some of these opcodes to other instructions in at least some processors.

Added with Pentium II

Instruction	Opcode	Meaning	Notes
SYSENTER	0F 34	SYStem call ENTER	Sometimes called the Fast System Call instruction, this instruction was intended to increase the performance of operating system calls. On the Pentium Pro, the CPUID instruction reports these instructions as available. This is considered incorrect, as the instructions are not officially supported on the Pentium Pro. (Third party testing indicates that the instructions are present but too defective to be usable on the Pentium Pro.)
SYSEXIT	0F 35	SYStem call EXIT

Added in specific non-Intel processors

Added with AMD K6

These instructions were added with AMD-K6, and are present in all later AMD x86 CPUs. They were also made an integral part of x86-64, and are therefore supported in the 64-bit "Long Mode" operation mode of all 64-bit x86 processors, including processors from Intel and VIA.

Instruction	Opcode	Meaning	Notes
SYSCALL	0F 05	Fast System Call	functionally equivalent to SYSENTER
SYSRET	0F 07	Fast System Return	functionally equivalent to SYSEXIT

AMD changed the CPUID detection bit for this feature from the K6-II on.

Added as instruction set extensions

SSE instructions (non-SIMD)

Added with SSE

Instruction	Opcode	Meaning	Notes
PREFETCHT0	0F 18 /1	Prefetch Data from Address	Prefetch into all cache levels
PREFETCHT1	0F 18 /2	Prefetch Data from Address	Prefetch into all cache levels EXCEPT L1
PREFETCHT2	0F 18 /3	Prefetch Data from Address	Prefetch into all cache levels EXCEPT L1 and L2
PREFETCHNTA	0F 18 /0	Prefetch Data from Address	Prefetch to non-temporal cache structure, minimizing cache pollution.
SFENCE	0F AE F8	Store Fence	Processor hint to make sure all store operations that took place prior to the SFENCE call are globally visible

Added with SSE2

Instruction	Opcode	Meaning	Notes
CLFLUSH m8	0F AE /7	Cache Line Flush	Invalidates the cache line that contains the linear address specified with the source operand from all levels of the processor cache hierarchy
LFENCE	0F AE E8	Load Fence	Serializes load operations.
MFENCE	0F AE F0	Memory Fence	Performs a serializing operation on all load and store instructions that were issued prior the MFENCE instruction.
MOVNTI m32, r32	0F C3 /r	Move Doubleword Non-Temporal	Move doubleword from r32 to m32, minimizing pollution in the cache hierarchy.
PAUSE	F3 90	Hint To Suspend Execution	Provides a hint to the processor that the following code is a spin loop. Suspends execution of the thread for a number of cycles to free resources for the sibling SMT thread to proceed.

Added with SSE3

Instruction	Opcode	Meaning	Notes
MONITOR EAX, ECX, EDX	0F 01 C8	Setup Monitor Address	Sets up a linear address range to be monitored by hardware and activates the monitor.
MWAIT EAX, ECX	0F 01 C9	Monitor Wait	Processor hint to stop instruction execution and enter an implementation-dependent optimized state until occurrence of a class of events.

Added with SSE4.2

Instruction	Opcode	Meaning	Notes
CRC32 r32, r/m8	F2 0F 38 F0 /r	Accumulate CRC32	Computes CRC value using the CRC-32C (Castagnoli) polynomial 0x11EDC6F41 (normal form 0x1EDC6F41). This is the polynomial used in iSCSI. In contrast to the more popular one used in Ethernet, its parity is even, and it can thus detect any error with an odd number of changed bits.
CRC32 r32, r/m8	F2 REX 0F 38 F0 /r
CRC32 r32, r/m16	F2 0F 38 F1 /r
CRC32 r32, r/m32	F2 0F 38 F1 /r
CRC32 r64, r/m8	F2 REX.W 0F 38 F0 /r
CRC32 r64, r/m64	F2 REX.W 0F 38 F1 /r
CRC32 r32, r/m8	F2 0F 38 F0 /r

Added with x86-64

Except for RDTSCP, these instructions can only be encoded in 64 bit mode. They fall in four groups:

• original instructions that reuse existing opcodes for a different purpose (MOVSXD replacing ARPL)
• original instructions with new opcodes (RDTSCP and SWAPGS)
• existing instructions extended to a 64 bit address size (JRCXZ)
• existing instructions extended to a 64 bit operand size (remaining instructions)

Most instructions with a 64 bit operand size encode this using a REX.W prefix; in the absence of the REX.W prefix, the corresponding instruction with 32 bit operand size is encoded. This mechanism also applies to most other instructions with 32 bit operand size. These are not listed here as they do not gain a new mnemonic in Intel syntax when used with a 64 bit operand size.

Instruction	Encoding	Meaning
CDQE	REX.W 98	Sign extend EAX into RAX
CQO	REX.W 99	Sign extend RAX into RDX:RAX
CMPSQ	REX.W A7	CoMPare String Quadword
CMPXCHG16B m128	REX.W 0F C7 /1	CoMPare and eXCHanGe 16 Bytes. Atomic only if used with LOCK prefix.
IRETQ	REX.W CF	64-bit Return from Interrupt
JRCXZ rel8	E3 cb	Jump if RCX is zero
LODSQ	REX.W AD	LoaD String Quadword
MOVSXD r64,r/m32	REX.W 63 /r	MOV with Sign Extend 32-bit to 64-bit
MOVSQ	REX.W A5	Move String Quadword
POPFQ	9D	POP RFLAGS Register
PUSHFQ	9C	PUSH RFLAGS Register
RDTSCP	0F 01 F9	ReaD Time Stamp Counter and Processor ID
SCASQ	REX.W AF	SCAn String Quadword
STOSQ	REX.W AB	STOre String Quadword
SWAPGS	0F 01 F8	Exchange GS base with KernelGSBase MSR

Bit manipulation extensions

Main article: X86 Bit manipulation instruction set

Added with ABM

LZCNT, POPCNT (POPulation CouNT) – advanced bit manipulation

Added with BMI1

ANDN, BEXTR, BLSI, BLSMSK, BLSR, TZCNT

Added with BMI2

BZHI, MULX, PDEP, PEXT, RORX, SARX, SHRX, SHLX

Added with CLMUL instruction set

Instruction	Opcode	Description
PCLMULQDQ xmmreg,xmmrm,imm	66 0f 3a 44 /r ib	Perform a carry-less multiplication of two 64-bit polynomials over the finite field GF(2k).
PCLMULLQLQDQ xmmreg,xmmrm	66 0f 3a 44 /r 00	Multiply the low halves of the two registers.
PCLMULHQLQDQ xmmreg,xmmrm	66 0f 3a 44 /r 01	Multiply the high half of the destination register by the low half of the source register.
PCLMULLQHQDQ xmmreg,xmmrm	66 0f 3a 44 /r 10	Multiply the low half of the destination register by the high half of the source register.
PCLMULHQHQDQ xmmreg,xmmrm	66 0f 3a 44 /r 11	Multiply the high halves of the two registers.

Added with Intel ADX

Instruction	Description
ADCX	Adds two unsigned integers plus carry, reading the carry from the carry flag and if necessary setting it there. Does not affect other flags than the carry.
ADOX	Adds two unsigned integers plus carry, reading the carry from the overflow flag and if necessary setting it there. Does not affect other flags than the overflow.

Added with Intel TSX

Instruction	Opcode	Description
XBEGIN rel16/32	C7 F8 cw/cd	Start transaction. If transaction fails, perform a branch to the given relative offset.
XEND	0F 01 D5	End transaction.
XABORT imm8	C6 F8 ib	Abort transaction with 8-bit immediate as error code.
XACQUIRE	F2	Instruction prefix to indicate start of hardware lock elision, used with memory atomic instructions only (for other instructions, the F2 prefix may have other meanings). When used with such instructions, may start a transaction instead of performing the memory atomic operation.
XRELEASE	F3	Instruction prefix to indicate end of hardware lock elision, used with memory atomic/store instructions only (for other instructions, the F3 prefix may have other meanings). When used with such instructions during hardware lock elision, will end the associated transaction instead of performing the store/atomic.

Added with Intel CET

CET adds two distinct features to help protect against security exploits such as return-oriented programming: a shadow stack (CET_SS), and indirect branch tracking (CET_IBT).

Instruction	Opcode	Description	Notes
INCSSPD r32	F3 0F AE /5	Increment shadow stack pointer	Shadow stack (CET_SS). When shadow stacks are enabled, return addresses are pushed on both the regular stack and the shadow stack when a function call is made. They are then both popped on return from the function call - if they do not match, then the stack is assumed to be corrupted, and a #CP exception is issued. The shadow stack is additionally required to be stored in specially marked memory pages which cannot be modified by normal memory store instructions.
INCSSPQ r64	F3 REX.W 0F AE /5
RDSSPD r32	F3 0F 1E /1	Read shadow stack pointer into register (low 32 bits)
RDSSPQ r64	F3 REX.W 0F 1E /1	Read shadow stack pointer into register (full 64 bits)
SAVEPREVSSP	F3 0F 01 EA	Save previous shadow stack pointer
RSTORSSP m64	F3 0F 01 /5	Restore saved shadow stack pointer
WRSSD m32,r32	0F 38 F6 /r	Write 4 bytes to shadow stack
WRSSQ m64,r64	REX.W 0F 38 F6 /r	Write 8 bytes to shadow stack
WRUSSD m32,r32	66 0F 38 F5 /r	Write 4 bytes to user shadow stack
WRUSSQ m64,r64	66 REX.W 0F 38 F5 /r	Write 8 bytes to user shadow stack
SETSSBSY	F3 0F 01 E8	Mark shadow stack busy
CLRSSBSY m64	F3 0F AE /6	Clear shadow stack busy flag
ENDBR32	F3 0F 1E FB	Terminate indirect branch in 32-bit mode	Indirect Branch Tracking (CBT_IBT). When IBT is enabled, an indirect branch (jump, call, return) to any instruction that is not an ENDBR32/64 instruction will cause a #CP exception.
ENDBR64	F3 0F 1E FA	Terminate indirect branch in 64-bit mode
(no mnemonic)	3E	Prefix used with indirect CALL/JMP near instructions (opcodes FF /2 and FF /4) to indicate that the branch target is not required to start with an ENDBR32/64 instruction. Prefix only honored when NO_TRACK_EN flag is set. This prefix has the same encoding as the DS: segment override prefix - as of April 2022, Intel documentation does not appear to specify whether this prefix also retains its old segment-override function when used as a no-track prefix, nor does it provide an official mnemonic for this prefix. (GNU binutils use "notrack")

x87 floating-point instructions

The x87 coprocessor, if present, provides support for floating-point arithmetic. The coprocessor provides eight data registers, each holding one 80-bit floating-point value (1 sign bit, 15 exponent bits, 64 mantissa bits) - these registers are organized as a stack, with the top-of-stack register referred to as "st" or "st(0)", and the other registers referred to as st(1),st(2),...st(7). It additionally provides a number of control and status registers, including "PC" (precision control, to control whether floating-point operations should be rounded to 24, 53 or 64 mantissa bits) and "RC" (rounding control, to pick rounding-mode: round-to-zero, round-to-positive-infinity, round-to-negative-infinity, round-to-nearest-even) and a 4-bit condition code register "CC", whose four bits are individually referred to as C0,C1,C2 and C3). Not all of the arithmetic instructions provided by x87 obey PC and RC.

Original 8087 instructions

Instruction description	Mnemonic	Opcode	Additional items
x87 Non-Waiting FPU Control Instructions			Waiting mnemonic
Initialize x87 FPU	FNINIT	DB E3	FINIT
Load x87 Control Word	FLDCW m16	D9 /5	(none)
Store x87 Control Word	FNSTCW m16	D9 /7	FSTCW
Store x87 Status Word	FNSTSW m16	DD /7	FSTSW
Clear x87 Exception Flags	FNCLEX	DB E2	FCLEX
Load x87 FPU Environment	FLDENV m112/m224	D9 /4	(none)
Store x87 FPU Environment	FNSTENV m112/m224	D9 /6	FSTENV
Save x87 FPU State, then initialize x87 FPU	FNSAVE m752/m864	DD /6	FSAVE
Restore x87 FPU State	FRSTOR m752/m864	DD /4	(none)
Enable Interrupts (8087 only)	FNENI	DB E0	FENI
Disable Interrupts (8087 only)	FNDISI	DB E1	FDISI
x87 Floating-point Load/Store/Move Instructions			precision control	rounding control
Load floating-point value onto stack	FLD m32	D9 /0	No	—
	FLD m64	DD /0
	FLD m80	DB /5
	FLD st(i)	D9 C0+i
Store top-of-stack floating-point value to memory or stack register	FST m32	D9 /2	No	Yes
	FST m64	DD /2
	FST st(i)	DD D0+i	No	—
Store top-of-stack floating-point value to memory or stack register, then pop	FSTP m32	D9 /3	No	Yes
	FSTP m64	DD /3
	FSTP m80	DB /7	No	—
	FSTP st(i)	DD D8+i
		DF D0+i
		DF D8+i
Push +0.0 onto stack	FLDZ	D9 EE	No	—
Push +1.0 onto stack	FLD1	D9 E8
Push π (approximately 3.14159) onto stack	FLDPI	D9 EB	No	387
Push $\log _{2}\left(10\right)$ (approximately 3.32193) onto stack	FLDL2T	D9 E9
Push $\log _{2}\left(e\right)$ (approximately 1.44269) onto stack	FLDL2E	D9 EA
Push $\log _{10}\left(2\right)$ (approximately 0.30103) onto stack	FLDLG2	D9 EC
Push $\ln \left(2\right)$ (approximately 0.69315) onto stack	FLDLN2	D9 ED
Exchange top-of-stack register with other stack register	FXCH st(i)	D9 C8+i	No	—
		DD C8+i
		DF C8+i
x87 Integer Load/Store Instructions			precision control	rounding control
Load signed integer value onto stack from memory, with conversion to floating-point	FILD m16	DF /0	No	—
	FILD m32	DB /0
	FILD m64	DF /5
Store top-of-stack value to memory, with conversion to signed integer	FIST m16	DF /2	No	Yes
	FIST m32	DB /2
Store top-of-stack value to memory, with conversion to signed integer, then pop stack	FISTP m16	DF /3	No	Yes
	FISTP m32	DB /3
	FISTP m64	DF /7
Load 18-digit Binary-Coded-Decimal integer value onto stack from memory, with conversion to floating-point	FBLD m80	DF /4	No	—
Store top-of-stack value to memory, with conversion to 18-digit Binary-Coded-Decimal integer, then pop stack	FBSTP m80	DF /6	No	387
x87 Basic Arithmetic Instructions			precision control	rounding control
Floating-point add dst <- dst + src	FADD m32	D8 /0	Yes	Yes
	FADD m64	DC /0
	FADD st,st(i)	D8 C0+i
	FADD st(i),st	DC C0+i
Floating-point multiple dst <- dst * src	FMUL m32	D8 /1	Yes	Yes
	FMUL m64	DC /1
	FMUL st,st(i)	D8 C8+i
	FMUL st(i),st	DC C8+i
Floating-point subtract dst <- dst - src	FSUB m32	D8 /4	Yes	Yes
	FSUB m64	DC /4
	FSUB st,st(i)	D8 E0+i
	FSUB st(i),st	DC E8+i
Floating-point reverse subtract dst <- src - dst	FSUBR m32	D8 /5	Yes	Yes
	FSUBR m64	DC /5
	FSUBR st,st(i)	D8 E8+i
	FSUBR st(i),st	DC E0+i
Floating-point divide dst <- dst / src	FDIV m32	D8 /6	Yes	Yes
	FDIV m64	DC /6
	FDIV st,st(i)	D8 F0+i
	FDIV st(i),st	DC F8+i
Floating-point reverse divide dst <- src / dst	FDIVR m32	D8 /7	Yes	Yes
	FDIVR m64	DC /7
	FDIVR st,st(i)	D8 F8+i
	FDIVR st(i),st	DC F0+i
Floating-point compare CC <- result_of( st(0) - src ) Same operation as subtract, except that it updates the x87 CC status register instead of any of the FPU stack registers	FCOM m32	D8 /2	No	—
	FCOM m64	DC /2
	FCOM st(i)	D8 D0+i
		DC D0+i
x87 Basic Arithmetic Instructions with Stack Pop			precision control	rounding control
Floating-point add and pop	FADDP st(i),st	DE C0+i	Yes	Yes
Floating-point multiply and pop	FMULP st(i),st	DE C8+i	Yes	Yes
Floating-point subtract and pop	FSUBP st(i),st	DE E8+i	Yes	Yes
Floating-point reverse-subtract and pop	FSUBRP st(i),st	DE E0+i	Yes	Yes
Floating-point divide and pop	FDIVP st(i),st	DE F8+i	Yes	Yes
Floating-point reverse-divide and pop	FDIVRP st(i),st	DE F0+i	Yes	Yes
Floating-point compare and pop	FCOMP m32	D8 /3	No	—
	FCOMP m64	DC /3
	FCOMP st(i)	D8 D8+i
		DC D8+i
		DE D0+i
Floating-point compare to st(1), then pop twice	FCOMPP	DE D9	No	—
x87 Basic Arithmetic Instructions with Integer Source Argument			precision control	rounding control
Floating-point add by integer	FIADD m16	DA /0	Yes	Yes
	FIADD m32	DE /0
Floating-point multiply by integer	FIMUL m16	DA /1	Yes	Yes
	FIMUL m32	DE /1
Floating-point subtract by integer	FISUB m16	DA /4	Yes	Yes
	FISUB m32	DE /4
Floating-point reverse-subtract by integer	FISUBR m16	DA /5	Yes	Yes
	FISUBR m32	DE /5
Floating-point divide by integer	FIDIV m16	DA /6	Yes	Yes
	FIDIV m32	DE /6
Floating-point reverse-divide by integer	FIDIVR m16	DA /7	Yes	Yes
	FIDIVR m32	DE /7
Floating-point compare to integer	FICOM m16	DA /2	No	—
	FICOM m32	DE /2
Floating-point compare to integer, and stack pop	FICOMP m16	DA /3	No	—
	FICOMP m32	DE /3
x87 Additional Arithmetic Instructions			precision control	rounding control
Floating-point change sign	FCHS	D9 E0	No	—
Floating-point absolute value	FABS	D9 E1	No	—
Floating-point compare top-of-stack value to 0	FTST	D9 E4	No	—
Classify top-of-stack st(0) register value. The classification result is stored in the x87 CC register.	FXAM	D9 E5	No	—
Split the st(0) value into two values E and M representing the exponent and mantissa of st(0). The split is done such that $M*2^{E}=st(0)$, where E is an integer and M is a number whose absolute value is within the range $1\leq \left|M\right|<2$.   st(0) is then replaced with E, after which M is pushed onto the stack.	FXTRACT	D9 F4	No	—
Floating-point partial remainder (not IEEE 754 compliant): $$Q\leftarrow {\mathtt {IntegerRoundToZero}}\left({\frac {st(0)}{st(1)}}\right)$$ $$st(0)\leftarrow st(0)-st(1)*Q$$	FPREM	D9 F8	No	—
Floating-point square root	FSQRT	D9 FA	Yes	Yes
Floating-point round to integer	FRNDINT	D9 FC	No	Yes
Floating-point power-of-2 scaling. Rounds the value of st(1) to integer with round-to-zero, then uses it as a scale factor for st(0): $$st(0)\leftarrow st(0)*2^{{\mathtt {IntegerRoundToZero}}\left(st(1)\right)}$$	FSCALE	D9 FD	No	Yes
x87 Transcendental Instructions			Source operand range restriction
Base-2 exponential minus 1, with extra precision for st(0) close to 0: $$st(0)\leftarrow 2^{st(0)}-1$$	F2XM1	D9 F0	8087: $0\leq st(0)\leq {\frac {1}{2}}$ 80387: $-1\leq st(0)\leq 1$
Base-2 Logarithm: $$st(1)\leftarrow st(1)*\log _{2}\left(st(0)\right)$$ followed by stack pop	FYL2X	D9 F1	no restrictions
Partial Tangent: Computes from st(0) a pair of values X and Y, such that $$\tan \left(st(0)\right)={\frac {Y}{X}}$$ The Y value replaces the top-of-stack value, and then X is pushed onto the stack. On 80387 and later x87, but not original 8087, X is always 1.0	FPTAN	D9 F2	8087: $0\leq \left|st(0)\right|\leq {\frac {\pi }{4}}$ 80387: $0\leq \left|st(0)\right|<2^{63}$
Two-argument arctangent with quadrant adjustment: $$st(1)\leftarrow \arctan \left({\frac {st(1)}{st(0)}}\right)$$ followed by stack pop	FPATAN	D9 F3	8087: $\left|st(1)\right|\leq \left|st(0)\right|<\infty$ 80387: no restrictions
Base-2 Logarithm plus 1, with extra precision for st(0) close to 0: $$st(1)\leftarrow st(1)*\log _{2}\left(st(0)+1\right)$$ followed by stack pop	FYL2XP1	D9 F9	Intel: $\left|st(0)\right|<\left(1-{\sqrt {\frac {1}{2}}}\right)$ AMD: $\left({\sqrt {\frac {1}{2}}}-1\right)<st(0)<\left({\sqrt {2}}-1\right)$
Other x87 Instructions
No operation	FNOP	D9 D0
Decrement x87 FPU Register Stack Pointer	FDECSTP	D9 F6
Increment x87 FPU Register Stack Pointer	FINCSTP	D9 F7
Free x87 FPU Register	FFREE st(i)	DD C0+i
Check and handle pending unmasked x87 FPU exceptions	WAIT, FWAIT	9B
Floating-point store and pop, without stack underflow exception	FSTPNCE st(i)	D9 D8+i
Free x87 register, then stack pop	FFREEP st(i)	DF C0+i

x87 instructions added in later processors

Instruction description	Mnemonic	Opcode	Additional items
x87 Non-Waiting Control Instructions added in 80287			Waiting mnemonic
Notify FPU of entry into Protected Mode	FNSETPM	DB E4	FSETPM
Store x87 Status Word to AX	FNSTSW AX	DF E0	FSTSW AX
x87 Instructions added in 80387			Source operand range restriction
Floating-point unordered compare Similar to regular compare, except will not produce an exception in response to any qNaN operands.	FUCOM st(i)	DD E0+i	no restriction
Floating-point unordered compare and pop	FUCOMP st(i)	DD E8+i
Floating-point unordered compare to st(1), then pop twice	FUCOMPP	DA E9
IEEE 754 compliant floating-point partial remainder.	FPREM1	D9 F5
Floating-point sine and cosine. Computes two values $S=\sin \left(k*st(0)\right)$ and $C=\cos \left(k*st(0)\right)$  Top-of-stack st(0) is replaced with S, after which C is pushed onto the stack.	FSINCOS	D9 FB	$\left|st(0)\right|<2^{63}$
Floating-point sine. $$st(0)\leftarrow \sin \left(k*st(0)\right)$$	FSIN	D9 FE
Floating-point cosine. $$st(0)\leftarrow \cos \left(k*st(0)\right)$$	FCOS	D9 FF
x87 Instructions added in Pentium Pro			Condition for conditional moves
Floating-point conditional move to st(0) based on EFLAGS	FCMOVB st(0),st(i)	DA C0+i	below (CF=1)
	FCMOVE st(0),st(i)	DA C8+i	equal (ZF=1)
	FCMOVBE st(0),st(i)	DA D0+i	below or equal (CF=1 or ZF=1)
	FCMOVU st(0),st(i)	DA D8+i	unordered (PF=1)
	FCMOVNB st(0),st(i)	DB C0+i	not below (CF=0)
	FCMOVNE st(0),st(i)	DB C8+i	not equal (ZF=0)
	FCMOVNBE st(0),st(i)	DB D0+i	not below or equal (CF=0 and ZF=0)
	FCMOVNU st(0),st(i)	DB D8+i	not unordered (PF=0)
Floating-point compare and set EFLAGS. Differs from regular floating-point compare in that it puts its result in the integer EFLAGS register rather than the x87 CC register.	FCOMI st(0),st(i)	DB F0+i
Floating-point compare and set EFLAGS, then pop	FCOMIP st(0),st(i)	DF F0+i
Floating-point unordered compare and set EFLAGS	FUCOMI st(0),st(i)	DB E8+i
Floating-point unordered compare and set EFLAGS, then pop	FUCOMIP st(0),st(i)	DF E8+i
x87 Non-Waiting Instructions added in Pentium II
Save x87, MMX and SSE state to 512-byte data structure	FXSAVE m512byte	NP 0F AE /0
Restore x87, MMX and SSE state from 512-byte data structure	FXRSTOR m512byte	NP 0F AE /1
x87 Instructions added as part of SSE3
Floating-point store integer and pop, with round-to-zero	FISTTP m16	DF /1
	FISTTP m32	DB /1
	FISTTP m64	DD /1

SIMD instructions

MMX instructions

MMX instructions operate on the mm registers, which are 64 bits wide. They are shared with the FPU registers.

Original MMX instructions

Added with Pentium MMX

Instruction	Opcode	Meaning	Notes
EMMS	0F 77	Empty MMX Technology State	Marks all x87 FPU registers for use by FPU
MOVD mm, r/m32	0F 6E /r	Move doubleword
MOVD r/m32, mm	0F 7E /r	Move doubleword
MOVQ mm/m64, mm	0F 7F /r	Move quadword
MOVQ mm, mm/m64	0F 6F /r	Move quadword
MOVQ mm, r/m64	REX.W + 0F 6E /r	Move quadword
MOVQ r/m64, mm	REX.W + 0F 7E /r	Move quadword
PACKSSDW mm1, mm2/m64	0F 6B /r	Pack doublewords to words (signed with saturation)
PACKSSWB mm1, mm2/m64	0F 63 /r	Pack words to bytes (signed with saturation)
PACKUSWB mm, mm/m64	0F 67 /r	Pack words to bytes (unsigned with saturation)
PADDB mm, mm/m64	0F FC /r	Add packed byte integers
PADDW mm, mm/m64	0F FD /r	Add packed word integers
PADDD mm, mm/m64	0F FE /r	Add packed doubleword integers
PADDQ mm, mm/m64	0F D4 /r	Add packed quadword integers
PADDSB mm, mm/m64	0F EC /r	Add packed signed byte integers and saturate
PADDSW mm, mm/m64	0F ED /r	Add packed signed word integers and saturate
PADDUSB mm, mm/m64	0F DC /r	Add packed unsigned byte integers and saturate
PADDUSW mm, mm/m64	0F DD /r	Add packed unsigned word integers and saturate
PAND mm, mm/m64	0F DB /r	Bitwise AND
PANDN mm, mm/m64	0F DF /r	Bitwise AND NOT
POR mm, mm/m64	0F EB /r	Bitwise OR
PXOR mm, mm/m64	0F EF /r	Bitwise XOR
PCMPEQB mm, mm/m64	0F 74 /r	Compare packed bytes for equality
PCMPEQW mm, mm/m64	0F 75 /r	Compare packed words for equality
PCMPEQD mm, mm/m64	0F 76 /r	Compare packed doublewords for equality
PCMPGTB mm, mm/m64	0F 64 /r	Compare packed signed byte integers for greater than
PCMPGTW mm, mm/m64	0F 65 /r	Compare packed signed word integers for greater than
PCMPGTD mm, mm/m64	0F 66 /r	Compare packed signed doubleword integers for greater than
PMADDWD mm, mm/m64	0F F5 /r	Multiply packed words, add adjacent doubleword results
PMULHW mm, mm/m64	0F E5 /r	Multiply packed signed word integers, store high 16 bits of results
PMULLW mm, mm/m64	0F D5 /r	Multiply packed signed word integers, store low 16 bits of results
PSLLW mm1, imm8	0F 71 /6 ib	Shift left words, shift in zeros
PSLLW mm, mm/m64	0F F1 /r	Shift left words, shift in zeros
PSLLD mm, imm8	0F 72 /6 ib	Shift left doublewords, shift in zeros
PSLLD mm, mm/m64	0F F2 /r	Shift left doublewords, shift in zeros
PSLLQ mm, imm8	0F 73 /6 ib	Shift left quadword, shift in zeros
PSLLQ mm, mm/m64	0F F3 /r	Shift left quadword, shift in zeros
PSRAD mm, imm8	0F 72 /4 ib	Shift right doublewords, shift in sign bits
PSRAD mm, mm/m64	0F E2 /r	Shift right doublewords, shift in sign bits
PSRAW mm, imm8	0F 71 /4 ib	Shift right words, shift in sign bits
PSRAW mm, mm/m64	0F E1 /r	Shift right words, shift in sign bits
PSRLW mm, imm8	0F 71 /2 ib	Shift right words, shift in zeros
PSRLW mm, mm/m64	0F D1 /r	Shift right words, shift in zeros
PSRLD mm, imm8	0F 72 /2 ib	Shift right doublewords, shift in zeros
PSRLD mm, mm/m64	0F D2 /r	Shift right doublewords, shift in zeros
PSRLQ mm, imm8	0F 73 /2 ib	Shift right quadword, shift in zeros
PSRLQ mm, mm/m64	0F D3 /r	Shift right quadword, shift in zeros
PSUBB mm, mm/m64	0F F8 /r	Subtract packed byte integers
PSUBW mm, mm/m64	0F F9 /r	Subtract packed word integers
PSUBD mm, mm/m64	0F FA /r	Subtract packed doubleword integers
PSUBSB mm, mm/m64	0F E8 /r	Subtract signed packed bytes with saturation
PSUBSW mm, mm/m64	0F E9 /r	Subtract signed packed words with saturation
PSUBUSB mm, mm/m64	0F D8 /r	Subtract unsigned packed bytes with saturation
PSUBUSW mm, mm/m64	0F D9 /r	Subtract unsigned packed words with saturation
PUNPCKHBW mm, mm/m64	0F 68 /r	Unpack and interleave high-order bytes
PUNPCKHWD mm, mm/m64	0F 69 /r	Unpack and interleave high-order words
PUNPCKHDQ mm, mm/m64	0F 6A /r	Unpack and interleave high-order doublewords
PUNPCKLBW mm, mm/m32	0F 60 /r	Unpack and interleave low-order bytes
PUNPCKLWD mm, mm/m32	0F 61 /r	Unpack and interleave low-order words
PUNPCKLDQ mm, mm/m32	0F 62 /r	Unpack and interleave low-order doublewords

MMX instructions added in specific processors

MMX instructions added with MMX+ and SSE

The following MMX instruction were added with SSE. They are also available on the Athlon under the name MMX+.

Instruction	Opcode	Meaning
MASKMOVQ mm1, mm2	0F F7 /r	Masked Move of Quadword
MOVNTQ m64, mm	0F E7 /r	Move Quadword Using Non-Temporal Hint
PSHUFW mm1, mm2/m64, imm8	0F 70 /r ib	Shuffle Packed Words
PINSRW mm, r32/m16, imm8	0F C4 /r	Insert Word
PEXTRW reg, mm, imm8	0F C5 /r	Extract Word
PMOVMSKB reg, mm	0F D7 /r	Move Byte Mask
PMINUB mm1, mm2/m64	0F DA /r	Minimum of Packed Unsigned Byte Integers
PMAXUB mm1, mm2/m64	0F DE /r	Maximum of Packed Unsigned Byte Integers
PAVGB mm1, mm2/m64	0F E0 /r	Average Packed Integers
PAVGW mm1, mm2/m64	0F E3 /r	Average Packed Integers
PMULHUW mm1, mm2/m64	0F E4 /r	Multiply Packed Unsigned Integers and Store High Result
PMINSW mm1, mm2/m64	0F EA /r	Minimum of Packed Signed Word Integers
PMAXSW mm1, mm2/m64	0F EE /r	Maximum of Packed Signed Word Integers
PSADBW mm1, mm2/m64	0F F6 /r	Compute Sum of Absolute Differences

MMX instructions added with SSE2

The following MMX instructions were added with SSE2:

Instruction	Opcode	Meaning
PSUBQ mm1, mm2/m64	0F FB /r	Subtract quadword integer
PMULUDQ mm1, mm2/m64	0F F4 /r	Multiply unsigned doubleword integer

MMX instructions added with SSSE3

Instruction	Opcode	Meaning
PSIGNB mm1, mm2/m64	0F 38 08 /r	Negate/zero/preserve packed byte integers depending on corresponding sign
PSIGNW mm1, mm2/m64	0F 38 09 /r	Negate/zero/preserve packed word integers depending on corresponding sign
PSIGND mm1, mm2/m64	0F 38 0A /r	Negate/zero/preserve packed doubleword integers depending on corresponding sign
PSHUFB mm1, mm2/m64	0F 38 00 /r	Shuffle bytes
PMULHRSW mm1, mm2/m64	0F 38 0B /r	Multiply 16-bit signed words, scale and round signed doublewords, pack high 16 bits
PMADDUBSW mm1, mm2/m64	0F 38 04 /r	Multiply signed and unsigned bytes, add horizontal pair of signed words, pack saturated signed-words
PHSUBW mm1, mm2/m64	0F 38 05 /r	Subtract and pack 16-bit signed integers horizontally
PHSUBSW mm1, mm2/m64	0F 38 07 /r	Subtract and pack 16-bit signed integer horizontally with saturation
PHSUBD mm1, mm2/m64	0F 38 06 /r	Subtract and pack 32-bit signed integers horizontally
PHADDSW mm1, mm2/m64	0F 38 03 /r	Add and pack 16-bit signed integers horizontally, pack saturated integers to mm1.
PHADDW mm1, mm2/m64	0F 38 01 /r	Add and pack 16-bit integers horizontally
PHADDD mm1, mm2/m64	0F 38 02 /r	Add and pack 32-bit integers horizontally
PALIGNR mm1, mm2/m64, imm8	0F 3A 0F /r ib	Concatenate destination and source operands, extract byte-aligned result shifted to the right
PABSB mm1, mm2/m64	0F 38 1C /r	Compute the absolute value of bytes and store unsigned result
PABSW mm1, mm2/m64	0F 38 1D /r	Compute the absolute value of 16-bit integers and store unsigned result
PABSD mm1, mm2/m64	0F 38 1E /r	Compute the absolute value of 32-bit integers and store unsigned result

SSE instructions

Added with Pentium III

SSE instructions operate on xmm registers, which are 128 bit wide.

SSE consists of the following SSE SIMD floating-point instructions:

Instruction	Opcode	Meaning
ANDPS* xmm1, xmm2/m128	0F 54 /r	Bitwise Logical AND of Packed Single-Precision Floating-Point Values
ANDNPS* xmm1, xmm2/m128	0F 55 /r	Bitwise Logical AND NOT of Packed Single-Precision Floating-Point Values
ORPS* xmm1, xmm2/m128	0F 56 /r	Bitwise Logical OR of Single-Precision Floating-Point Values
XORPS* xmm1, xmm2/m128	0F 57 /r	Bitwise Logical XOR for Single-Precision Floating-Point Values
MOVUPS xmm1, xmm2/m128	0F 10 /r	Move Unaligned Packed Single-Precision Floating-Point Values
MOVSS xmm1, xmm2/m32	F3 0F 10 /r	Move Scalar Single-Precision Floating-Point Values
MOVUPS xmm2/m128, xmm1	0F 11 /r	Move Unaligned Packed Single-Precision Floating-Point Values
MOVSS xmm2/m32, xmm1	F3 0F 11 /r	Move Scalar Single-Precision Floating-Point Values
MOVLPS xmm, m64	0F 12 /r	Move Low Packed Single-Precision Floating-Point Values
MOVHLPS xmm1, xmm2	0F 12 /r	Move Packed Single-Precision Floating-Point Values High to Low
MOVLPS m64, xmm	0F 13 /r	Move Low Packed Single-Precision Floating-Point Values
UNPCKLPS xmm1, xmm2/m128	0F 14 /r	Unpack and Interleave Low Packed Single-Precision Floating-Point Values
UNPCKHPS xmm1, xmm2/m128	0F 15 /r	Unpack and Interleave High Packed Single-Precision Floating-Point Values
MOVHPS xmm, m64	0F 16 /r	Move High Packed Single-Precision Floating-Point Values
MOVLHPS xmm1, xmm2	0F 16 /r	Move Packed Single-Precision Floating-Point Values Low to High
MOVHPS m64, xmm	0F 17 /r	Move High Packed Single-Precision Floating-Point Values
MOVAPS xmm1, xmm2/m128	0F 28 /r	Move Aligned Packed Single-Precision Floating-Point Values
MOVAPS xmm2/m128, xmm1	0F 29 /r	Move Aligned Packed Single-Precision Floating-Point Values
MOVNTPS m128, xmm1	0F 2B /r	Move Aligned Four Packed Single-FP Non Temporal
MOVMSKPS reg, xmm	0F 50 /r	Extract Packed Single-Precision Floating-Point 4-bit Sign Mask. The upper bits of the register are filled with zeros.
CVTPI2PS xmm, mm/m64	0F 2A /r	Convert Packed Dword Integers to Packed Single-Precision FP Values
CVTSI2SS xmm, r/m32	F3 0F 2A /r	Convert Dword Integer to Scalar Single-Precision FP Value
CVTSI2SS xmm, r/m64	F3 REX.W 0F 2A /r	Convert Qword Integer to Scalar Single-Precision FP Value
MOVNTPS m128, xmm	0F 2B /r	Store Packed Single-Precision Floating-Point Values Using Non-Temporal Hint
CVTTPS2PI mm, xmm/m64	0F 2C /r	Convert with Truncation Packed Single-Precision FP Values to Packed Dword Integers
CVTTSS2SI r32, xmm/m32	F3 0F 2C /r	Convert with Truncation Scalar Single-Precision FP Value to Dword Integer
CVTTSS2SI r64, xmm1/m32	F3 REX.W 0F 2C /r	Convert with Truncation Scalar Single-Precision FP Value to Qword Integer
CVTPS2PI mm, xmm/m64	0F 2D /r	Convert Packed Single-Precision FP Values to Packed Dword Integers
CVTSS2SI r32, xmm/m32	F3 0F 2D /r	Convert Scalar Single-Precision FP Value to Dword Integer
CVTSS2SI r64, xmm1/m32	F3 REX.W 0F 2D /r	Convert Scalar Single-Precision FP Value to Qword Integer
UCOMISS xmm1, xmm2/m32	0F 2E /r	Unordered Compare Scalar Single-Precision Floating-Point Values and Set EFLAGS
COMISS xmm1, xmm2/m32	0F 2F /r	Compare Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS
SQRTPS xmm1, xmm2/m128	0F 51 /r	Compute Square Roots of Packed Single-Precision Floating-Point Values
SQRTSS xmm1, xmm2/m32	F3 0F 51 /r	Compute Square Root of Scalar Single-Precision Floating-Point Value
RSQRTPS xmm1, xmm2/m128	0F 52 /r	Compute Reciprocal of Square Root of Packed Single-Precision Floating-Point Value
RSQRTSS xmm1, xmm2/m32	F3 0F 52 /r	Compute Reciprocal of Square Root of Scalar Single-Precision Floating-Point Value
RCPPS xmm1, xmm2/m128	0F 53 /r	Compute Reciprocal of Packed Single-Precision Floating-Point Values
RCPSS xmm1, xmm2/m32	F3 0F 53 /r	Compute Reciprocal of Scalar Single-Precision Floating-Point Values
ADDPS xmm1, xmm2/m128	0F 58 /r	Add Packed Single-Precision Floating-Point Values
ADDSS xmm1, xmm2/m32	F3 0F 58 /r	Add Scalar Single-Precision Floating-Point Values
MULPS xmm1, xmm2/m128	0F 59 /r	Multiply Packed Single-Precision Floating-Point Values
MULSS xmm1, xmm2/m32	F3 0F 59 /r	Multiply Scalar Single-Precision Floating-Point Values
SUBPS xmm1, xmm2/m128	0F 5C /r	Subtract Packed Single-Precision Floating-Point Values
SUBSS xmm1, xmm2/m32	F3 0F 5C /r	Subtract Scalar Single-Precision Floating-Point Values
MINPS xmm1, xmm2/m128	0F 5D /r	Return Minimum Packed Single-Precision Floating-Point Values
MINSS xmm1, xmm2/m32	F3 0F 5D /r	Return Minimum Scalar Single-Precision Floating-Point Values
DIVPS xmm1, xmm2/m128	0F 5E /r	Divide Packed Single-Precision Floating-Point Values
DIVSS xmm1, xmm2/m32	F3 0F 5E /r	Divide Scalar Single-Precision Floating-Point Values
MAXPS xmm1, xmm2/m128	0F 5F /r	Return Maximum Packed Single-Precision Floating-Point Values
MAXSS xmm1, xmm2/m32	F3 0F 5F /r	Return Maximum Scalar Single-Precision Floating-Point Values
LDMXCSR m32	0F AE /2	Load MXCSR Register State
STMXCSR m32	0F AE /3	Store MXCSR Register State
CMPPS xmm1, xmm2/m128, imm8	0F C2 /r ib	Compare Packed Single-Precision Floating-Point Values
CMPSS xmm1, xmm2/m32, imm8	F3 0F C2 /r ib	Compare Scalar Single-Precision Floating-Point Values
SHUFPS xmm1, xmm2/m128, imm8	0F C6 /r ib	Shuffle Packed Single-Precision Floating-Point Values

• The floating point single bitwise operations ANDPS, ANDNPS, ORPS and XORPS produce the same result as the SSE2 integer (PAND, PANDN, POR, PXOR) and double ones (ANDPD, ANDNPD, ORPD, XORPD), but can introduce extra latency for domain changes when applied values of the wrong type.

SSE2 instructions

Added with Pentium 4

SSE2 SIMD floating-point instructions

SSE2 data movement instructions

Instruction	Opcode	Meaning
MOVAPD xmm1, xmm2/m128	66 0F 28 /r	Move Aligned Packed Double-Precision Floating-Point Values
MOVAPD xmm2/m128, xmm1	66 0F 29 /r	Move Aligned Packed Double-Precision Floating-Point Values
MOVNTPD m128, xmm1	66 0F 2B /r	Store Packed Double-Precision Floating-Point Values Using Non-Temporal Hint
MOVHPD xmm1, m64	66 0F 16 /r	Move High Packed Double-Precision Floating-Point Value
MOVHPD m64, xmm1	66 0F 17 /r	Move High Packed Double-Precision Floating-Point Value
MOVLPD xmm1, m64	66 0F 12 /r	Move Low Packed Double-Precision Floating-Point Value
MOVLPD m64, xmm1	66 0F 13/r	Move Low Packed Double-Precision Floating-Point Value
MOVUPD xmm1, xmm2/m128	66 0F 10 /r	Move Unaligned Packed Double-Precision Floating-Point Values
MOVUPD xmm2/m128, xmm1	66 0F 11 /r	Move Unaligned Packed Double-Precision Floating-Point Values
MOVMSKPD reg, xmm	66 0F 50 /r	Extract Packed Double-Precision Floating-Point Sign Mask
MOVSD* xmm1, xmm2/m64	F2 0F 10 /r	Move or Merge Scalar Double-Precision Floating-Point Value
MOVSD xmm1/m64, xmm2	F2 0F 11 /r	Move or Merge Scalar Double-Precision Floating-Point Value

SSE2 packed arithmetic instructions

Instruction	Opcode	Meaning
ADDPD xmm1, xmm2/m128	66 0F 58 /r	Add Packed Double-Precision Floating-Point Values
ADDSD xmm1, xmm2/m64	F2 0F 58 /r	Add Low Double-Precision Floating-Point Value
DIVPD xmm1, xmm2/m128	66 0F 5E /r	Divide Packed Double-Precision Floating-Point Values
DIVSD xmm1, xmm2/m64	F2 0F 5E /r	Divide Scalar Double-Precision Floating-Point Value
MAXPD xmm1, xmm2/m128	66 0F 5F /r	Maximum of Packed Double-Precision Floating-Point Values
MAXSD xmm1, xmm2/m64	F2 0F 5F /r	Return Maximum Scalar Double-Precision Floating-Point Value
MINPD xmm1, xmm2/m128	66 0F 5D /r	Minimum of Packed Double-Precision Floating-Point Values
MINSD xmm1, xmm2/m64	F2 0F 5D /r	Return Minimum Scalar Double-Precision Floating-Point Value
MULPD xmm1, xmm2/m128	66 0F 59 /r	Multiply Packed Double-Precision Floating-Point Values
MULSD xmm1,xmm2/m64	F2 0F 59 /r	Multiply Scalar Double-Precision Floating-Point Value
SQRTPD xmm1, xmm2/m128	66 0F 51 /r	Square Root of Double-Precision Floating-Point Values
SQRTSD xmm1,xmm2/m64	F2 0F 51/r	Compute Square Root of Scalar Double-Precision Floating-Point Value
SUBPD xmm1, xmm2/m128	66 0F 5C /r	Subtract Packed Double-Precision Floating-Point Values
SUBSD xmm1, xmm2/m64	F2 0F 5C /r	Subtract Scalar Double-Precision Floating-Point Value

SSE2 logical instructions

Instruction	Opcode	Meaning
ANDPD xmm1, xmm2/m128	66 0F 54 /r	Bitwise Logical AND of Packed Double Precision Floating-Point Values
ANDNPD xmm1, xmm2/m128	66 0F 55 /r	Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
ORPD xmm1, xmm2/m128	66 0F 56/r	Bitwise Logical OR of Packed Double Precision Floating-Point Values
XORPD xmm1, xmm2/m128	66 0F 57/r	Bitwise Logical XOR of Packed Double Precision Floating-Point Values

SSE2 compare instructions

Instruction	Opcode	Meaning
CMPPD xmm1, xmm2/m128, imm8	66 0F C2 /r ib	Compare Packed Double-Precision Floating-Point Values
CMPSD* xmm1, xmm2/m64, imm8	F2 0F C2 /r ib	Compare Low Double-Precision Floating-Point Values
COMISD xmm1, xmm2/m64	66 0F 2F /r	Compare Scalar Ordered Double-Precision Floating-Point Values and Set EFLAGS
UCOMISD xmm1, xmm2/m64	66 0F 2E /r	Unordered Compare Scalar Double-Precision Floating-Point Values and Set EFLAGS

SSE2 shuffle and unpack instructions

Instruction	Opcode	Meaning
SHUFPD xmm1, xmm2/m128, imm8	66 0F C6 /r ib	Packed Interleave Shuffle of Pairs of Double-Precision Floating-Point Values
UNPCKHPD xmm1, xmm2/m128	66 0F 15 /r	Unpack and Interleave High Packed Double-Precision Floating-Point Values
UNPCKLPD xmm1, xmm2/m128	66 0F 14 /r	Unpack and Interleave Low Packed Double-Precision Floating-Point Values

SSE2 conversion instructions

Instruction	Opcode	Meaning
CVTDQ2PD xmm1, xmm2/m64	F3 0F E6 /r	Convert Packed Doubleword Integers to Packed Double-Precision Floating-Point Values
CVTDQ2PS xmm1, xmm2/m128	0F 5B /r	Convert Packed Doubleword Integers to Packed Single-Precision Floating-Point Values
CVTPD2DQ xmm1, xmm2/m128	F2 0F E6 /r	Convert Packed Double-Precision Floating-Point Values to Packed Doubleword Integers
CVTPD2PI mm, xmm/m128	66 0F 2D /r	Convert Packed Double-Precision FP Values to Packed Dword Integers
CVTPD2PS xmm1, xmm2/m128	66 0F 5A /r	Convert Packed Double-Precision Floating-Point Values to Packed Single-Precision Floating-Point Values
CVTPI2PD xmm, mm/m64	66 0F 2A /r	Convert Packed Dword Integers to Packed Double-Precision FP Values
CVTPS2DQ xmm1, xmm2/m128	66 0F 5B /r	Convert Packed Single-Precision Floating-Point Values to Packed Signed Doubleword Integer Values
CVTPS2PD xmm1, xmm2/m64	0F 5A /r	Convert Packed Single-Precision Floating-Point Values to Packed Double-Precision Floating-Point Values
CVTSD2SI r32, xmm1/m64	F2 0F 2D /r	Convert Scalar Double-Precision Floating-Point Value to Doubleword Integer
CVTSD2SI r64, xmm1/m64	F2 REX.W 0F 2D /r	Convert Scalar Double-Precision Floating-Point Value to Quadword Integer With Sign Extension
CVTSD2SS xmm1, xmm2/m64	F2 0F 5A /r	Convert Scalar Double-Precision Floating-Point Value to Scalar Single-Precision Floating-Point Value
CVTSI2SD xmm1, r32/m32	F2 0F 2A /r	Convert Doubleword Integer to Scalar Double-Precision Floating-Point Value
CVTSI2SD xmm1, r/m64	F2 REX.W 0F 2A /r	Convert Quadword Integer to Scalar Double-Precision Floating-Point value
CVTSS2SD xmm1, xmm2/m32	F3 0F 5A /r	Convert Scalar Single-Precision Floating-Point Value to Scalar Double-Precision Floating-Point Value
CVTTPD2DQ xmm1, xmm2/m128	66 0F E6 /r	Convert with Truncation Packed Double-Precision Floating-Point Values to Packed Doubleword Integers
CVTTPD2PI mm, xmm/m128	66 0F 2C /r	Convert with Truncation Packed Double-Precision FP Values to Packed Dword Integers
CVTTPS2DQ xmm1, xmm2/m128	F3 0F 5B /r	Convert with Truncation Packed Single-Precision Floating-Point Values to Packed Signed Doubleword Integer Values
CVTTSD2SI r32, xmm1/m64	F2 0F 2C /r	Convert with Truncation Scalar Double-Precision Floating-Point Value to Signed Dword Integer
CVTTSD2SI r64, xmm1/m64	F2 REX.W 0F 2C /r	Convert with Truncation Scalar Double-Precision Floating-Point Value To Signed Qword Integer

• CMPSD and MOVSD have the same name as the string instruction mnemonics CMPSD (CMPS) and MOVSD (MOVS); however, the former refer to scalar double-precision floating-points whereas the latters refer to doubleword strings.

SSE2 SIMD integer instructions

SSE2 MMX-like instructions extended to SSE registers

SSE2 allows execution of MMX instructions on SSE registers, processing twice the amount of data at once.

Instruction	Opcode	Meaning
MOVD xmm, r/m32	66 0F 6E /r	Move doubleword
MOVD r/m32, xmm	66 0F 7E /r	Move doubleword
MOVQ xmm1, xmm2/m64	F3 0F 7E /r	Move quadword
MOVQ xmm2/m64, xmm1	66 0F D6 /r	Move quadword
MOVQ r/m64, xmm	66 REX.W 0F 7E /r	Move quadword
MOVQ xmm, r/m64	66 REX.W 0F 6E /r	Move quadword
PMOVMSKB reg, xmm	66 0F D7 /r	Move a byte mask, zeroing the upper bits of the register
PEXTRW reg, xmm, imm8	66 0F C5 /r ib	Extract specified word and move it to reg, setting bits 15-0 and zeroing the rest
PINSRW xmm, r32/m16, imm8	66 0F C4 /r ib	Move low word at the specified word position
PACKSSDW xmm1, xmm2/m128	66 0F 6B /r	Converts 4 packed signed doubleword integers into 8 packed signed word integers with saturation
PACKSSWB xmm1, xmm2/m128	66 0F 63 /r	Converts 8 packed signed word integers into 16 packed signed byte integers with saturation
PACKUSWB xmm1, xmm2/m128	66 0F 67 /r	Converts 8 signed word integers into 16 unsigned byte integers with saturation
PADDB xmm1, xmm2/m128	66 0F FC /r	Add packed byte integers
PADDW xmm1, xmm2/m128	66 0F FD /r	Add packed word integers
PADDD xmm1, xmm2/m128	66 0F FE /r	Add packed doubleword integers
PADDQ xmm1, xmm2/m128	66 0F D4 /r	Add packed quadword integers.
PADDSB xmm1, xmm2/m128	66 0F EC /r	Add packed signed byte integers with saturation
PADDSW xmm1, xmm2/m128	66 0F ED /r	Add packed signed word integers with saturation
PADDUSB xmm1, xmm2/m128	66 0F DC /r	Add packed unsigned byte integers with saturation
PADDUSW xmm1, xmm2/m128	66 0F DD /r	Add packed unsigned word integers with saturation
PAND xmm1, xmm2/m128	66 0F DB /r	Bitwise AND
PANDN xmm1, xmm2/m128	66 0F DF /r	Bitwise AND NOT
POR xmm1, xmm2/m128	66 0F EB /r	Bitwise OR
PXOR xmm1, xmm2/m128	66 0F EF /r	Bitwise XOR
PCMPEQB xmm1, xmm2/m128	66 0F 74 /r	Compare packed bytes for equality.
PCMPEQW xmm1, xmm2/m128	66 0F 75 /r	Compare packed words for equality.
PCMPEQD xmm1, xmm2/m128	66 0F 76 /r	Compare packed doublewords for equality.
PCMPGTB xmm1, xmm2/m128	66 0F 64 /r	Compare packed signed byte integers for greater than
PCMPGTW xmm1, xmm2/m128	66 0F 65 /r	Compare packed signed word integers for greater than
PCMPGTD xmm1, xmm2/m128	66 0F 66 /r	Compare packed signed doubleword integers for greater than
PMULLW xmm1, xmm2/m128	66 0F D5 /r	Multiply packed signed word integers with saturation
PMULHW xmm1, xmm2/m128	66 0F E5 /r	Multiply the packed signed word integers, store the high 16 bits of the results
PMULHUW xmm1, xmm2/m128	66 0F E4 /r	Multiply packed unsigned word integers, store the high 16 bits of the results
PMULUDQ xmm1, xmm2/m128	66 0F F4 /r	Multiply packed unsigned doubleword integers
PSLLW xmm1, xmm2/m128	66 0F F1 /r	Shift words left while shifting in 0s
PSLLW xmm1, imm8	66 0F 71 /6 ib	Shift words left while shifting in 0s
PSLLD xmm1, xmm2/m128	66 0F F2 /r	Shift doublewords left while shifting in 0s
PSLLD xmm1, imm8	66 0F 72 /6 ib	Shift doublewords left while shifting in 0s
PSLLQ xmm1, xmm2/m128	66 0F F3 /r	Shift quadwords left while shifting in 0s
PSLLQ xmm1, imm8	66 0F 73 /6 ib	Shift quadwords left while shifting in 0s
PSRAD xmm1, xmm2/m128	66 0F E2 /r	Shift doubleword right while shifting in sign bits
PSRAD xmm1, imm8	66 0F 72 /4 ib	Shift doublewords right while shifting in sign bits
PSRAW xmm1, xmm2/m128	66 0F E1 /r	Shift words right while shifting in sign bits
PSRAW xmm1, imm8	66 0F 71 /4 ib	Shift words right while shifting in sign bits
PSRLW xmm1, xmm2/m128	66 0F D1 /r	Shift words right while shifting in 0s
PSRLW xmm1, imm8	66 0F 71 /2 ib	Shift words right while shifting in 0s
PSRLD xmm1, xmm2/m128	66 0F D2 /r	Shift doublewords right while shifting in 0s
PSRLD xmm1, imm8	66 0F 72 /2 ib	Shift doublewords right while shifting in 0s
PSRLQ xmm1, xmm2/m128	66 0F D3 /r	Shift quadwords right while shifting in 0s
PSRLQ xmm1, imm8	66 0F 73 /2 ib	Shift quadwords right while shifting in 0s
PSUBB xmm1, xmm2/m128	66 0F F8 /r	Subtract packed byte integers
PSUBW xmm1, xmm2/m128	66 0F F9 /r	Subtract packed word integers
PSUBD xmm1, xmm2/m128	66 0F FA /r	Subtract packed doubleword integers
PSUBQ xmm1, xmm2/m128	66 0F FB /r	Subtract packed quadword integers.
PSUBSB xmm1, xmm2/m128	66 0F E8 /r	Subtract packed signed byte integers with saturation
PSUBSW xmm1, xmm2/m128	66 0F E9 /r	Subtract packed signed word integers with saturation
PMADDWD xmm1, xmm2/m128	66 0F F5 /r	Multiply the packed word integers, add adjacent doubleword results
PSUBUSB xmm1, xmm2/m128	66 0F D8 /r	Subtract packed unsigned byte integers with saturation
PSUBUSW xmm1, xmm2/m128	66 0F D9 /r	Subtract packed unsigned word integers with saturation
PUNPCKHBW xmm1, xmm2/m128	66 0F 68 /r	Unpack and interleave high-order bytes
PUNPCKHWD xmm1, xmm2/m128	66 0F 69 /r	Unpack and interleave high-order words
PUNPCKHDQ xmm1, xmm2/m128	66 0F 6A /r	Unpack and interleave high-order doublewords
PUNPCKLBW xmm1, xmm2/m128	66 0F 60 /r	Interleave low-order bytes
PUNPCKLWD xmm1, xmm2/m128	66 0F 61 /r	Interleave low-order words
PUNPCKLDQ xmm1, xmm2/m128	66 0F 62 /r	Interleave low-order doublewords
PAVGB xmm1, xmm2/m128	66 0F E0, /r	Average packed unsigned byte integers with rounding
PAVGW xmm1, xmm2/m128	66 0F E3 /r	Average packed unsigned word integers with rounding
PMINUB xmm1, xmm2/m128	66 0F DA /r	Compare packed unsigned byte integers and store packed minimum values
PMINSW xmm1, xmm2/m128	66 0F EA /r	Compare packed signed word integers and store packed minimum values
PMAXSW xmm1, xmm2/m128	66 0F EE /r	Compare packed signed word integers and store maximum packed values
PMAXUB xmm1, xmm2/m128	66 0F DE /r	Compare packed unsigned byte integers and store packed maximum values
PSADBW xmm1, xmm2/m128	66 0F F6 /r	Computes the absolute differences of the packed unsigned byte integers; the 8 low differences and 8 high differences are then summed separately to produce two unsigned word integer results

SSE2 integer instructions for SSE registers only

The following instructions can be used only on SSE registers, since by their nature they do not work on MMX registers

Instruction	Opcode	Meaning
MASKMOVDQU xmm1, xmm2	66 0F F7 /r	Non-Temporal Store of Selected Bytes from an XMM Register into Memory
MOVDQ2Q mm, xmm	F2 0F D6 /r	Move low quadword from XMM to MMX register.
MOVDQA xmm1, xmm2/m128	66 0F 6F /r	Move aligned double quadword
MOVDQA xmm2/m128, xmm1	66 0F 7F /r	Move aligned double quadword
MOVDQU xmm1, xmm2/m128	F3 0F 6F /r	Move unaligned double quadword
MOVDQU xmm2/m128, xmm1	F3 0F 7F /r	Move unaligned double quadword
MOVQ2DQ xmm, mm	F3 0F D6 /r	Move quadword from MMX register to low quadword of XMM register
MOVNTDQ m128, xmm1	66 0F E7 /r	Store Packed Integers Using Non-Temporal Hint
PSHUFHW xmm1, xmm2/m128, imm8	F3 0F 70 /r ib	Shuffle packed high words.
PSHUFLW xmm1, xmm2/m128, imm8	F2 0F 70 /r ib	Shuffle packed low words.
PSHUFD xmm1, xmm2/m128, imm8	66 0F 70 /r ib	Shuffle packed doublewords.
PSLLDQ xmm1, imm8	66 0F 73 /7 ib	Packed shift left logical double quadwords.
PSRLDQ xmm1, imm8	66 0F 73 /3 ib	Packed shift right logical double quadwords.
PUNPCKHQDQ xmm1, xmm2/m128	66 0F 6D /r	Unpack and interleave high-order quadwords,
PUNPCKLQDQ xmm1, xmm2/m128	66 0F 6C /r	Interleave low quadwords,

SSE3 instructions

Added with Pentium 4 supporting SSE3

SSE3 SIMD floating-point instructions

Instruction	Opcode	Meaning	Notes
ADDSUBPS xmm1, xmm2/m128	F2 0F D0 /r	Add/subtract single-precision floating-point values	for Complex Arithmetic
ADDSUBPD xmm1, xmm2/m128	66 0F D0 /r	Add/subtract double-precision floating-point values
MOVDDUP xmm1, xmm2/m64	F2 0F 12 /r	Move double-precision floating-point value and duplicate
MOVSLDUP xmm1, xmm2/m128	F3 0F 12 /r	Move and duplicate even index single-precision floating-point values
MOVSHDUP xmm1, xmm2/m128	F3 0F 16 /r	Move and duplicate odd index single-precision floating-point values
HADDPS xmm1, xmm2/m128	F2 0F 7C /r	Horizontal add packed single-precision floating-point values	for Graphics
HADDPD xmm1, xmm2/m128	66 0F 7C /r	Horizontal add packed double-precision floating-point values
HSUBPS xmm1, xmm2/m128	F2 0F 7D /r	Horizontal subtract packed single-precision floating-point values
HSUBPD xmm1, xmm2/m128	66 0F 7D /r	Horizontal subtract packed double-precision floating-point values

SSE3 SIMD integer instructions

Instruction	Opcode	Meaning	Notes
LDDQU xmm1, mem	F2 0F F0 /r	Load unaligned data and return double quadword	Instructionally equivalent to MOVDQU. For video encoding

SSSE3 instructions

Added with Xeon 5100 series and initial Core 2

The following MMX-like instructions extended to SSE registers were added with SSSE3

Instruction	Opcode	Meaning
PSIGNB xmm1, xmm2/m128	66 0F 38 08 /r	Negate/zero/preserve packed byte integers depending on corresponding sign
PSIGNW xmm1, xmm2/m128	66 0F 38 09 /r	Negate/zero/preserve packed word integers depending on corresponding sign
PSIGND xmm1, xmm2/m128	66 0F 38 0A /r	Negate/zero/preserve packed doubleword integers depending on corresponding
PSHUFB xmm1, xmm2/m128	66 0F 38 00 /r	Shuffle bytes
PMULHRSW xmm1, xmm2/m128	66 0F 38 0B /r	Multiply 16-bit signed words, scale and round signed doublewords, pack high 16 bits
PMADDUBSW xmm1, xmm2/m128	66 0F 38 04 /r	Multiply signed and unsigned bytes, add horizontal pair of signed words, pack saturated signed-words
PHSUBW xmm1, xmm2/m128	66 0F 38 05 /r	Subtract and pack 16-bit signed integers horizontally
PHSUBSW xmm1, xmm2/m128	66 0F 38 07 /r	Subtract and pack 16-bit signed integer horizontally with saturation
PHSUBD xmm1, xmm2/m128	66 0F 38 06 /r	Subtract and pack 32-bit signed integers horizontally
PHADDSW xmm1, xmm2/m128	66 0F 38 03 /r	Add and pack 16-bit signed integers horizontally with saturation
PHADDW xmm1, xmm2/m128	66 0F 38 01 /r	Add and pack 16-bit integers horizontally
PHADDD xmm1, xmm2/m128	66 0F 38 02 /r	Add and pack 32-bit integers horizontally
PALIGNR xmm1, xmm2/m128, imm8	66 0F 3A 0F /r ib	Concatenate destination and source operands, extract byte-aligned result shifted to the right
PABSB xmm1, xmm2/m128	66 0F 38 1C /r	Compute the absolute value of bytes and store unsigned result
PABSW xmm1, xmm2/m128	66 0F 38 1D /r	Compute the absolute value of 16-bit integers and store unsigned result
PABSD xmm1, xmm2/m128	66 0F 38 1E /r	Compute the absolute value of 32-bit integers and store unsigned result

SSE4 instructions

SSE4.1

Added with Core 2 manufactured in 45nm

SSE4.1 SIMD floating-point instructions

Instruction	Opcode	Meaning
DPPS xmm1, xmm2/m128, imm8	66 0F 3A 40 /r ib	Selectively multiply packed SP floating-point values, add and selectively store
DPPD xmm1, xmm2/m128, imm8	66 0F 3A 41 /r ib	Selectively multiply packed DP floating-point values, add and selectively store
BLENDPS xmm1, xmm2/m128, imm8	66 0F 3A 0C /r ib	Select packed single precision floating-point values from specified mask
BLENDVPS xmm1, xmm2/m128, <XMM0>	66 0F 38 14 /r	Select packed single precision floating-point values from specified mask
BLENDPD xmm1, xmm2/m128, imm8	66 0F 3A 0D /r ib	Select packed DP-FP values from specified mask
BLENDVPD xmm1, xmm2/m128, <XMM0>	66 0F 38 15 /r	Select packed DP FP values from specified mask
ROUNDPS xmm1, xmm2/m128, imm8	66 0F 3A 08 /r ib	Round packed single precision floating-point values
ROUNDSS xmm1, xmm2/m32, imm8	66 0F 3A 0A /r ib	Round the low packed single precision floating-point value
ROUNDPD xmm1, xmm2/m128, imm8	66 0F 3A 09 /r ib	Round packed double precision floating-point values
ROUNDSD xmm1, xmm2/m64, imm8	66 0F 3A 0B /r ib	Round the low packed double precision floating-point value
INSERTPS xmm1, xmm2/m32, imm8	66 0F 3A 21 /r ib	Insert a selected single-precision floating-point value at the specified destination element and zero out destination elements
EXTRACTPS reg/m32, xmm1, imm8	66 0F 3A 17 /r ib	Extract one single-precision floating-point value at specified offset and store the result (zero-extended, if applicable)

SSE4.1 SIMD integer instructions

Instruction	Opcode	Meaning
MPSADBW xmm1, xmm2/m128, imm8	66 0F 3A 42 /r ib	Sums absolute 8-bit integer difference of adjacent groups of 4 byte integers with starting offset
PHMINPOSUW xmm1, xmm2/m128	66 0F 38 41 /r	Find the minimum unsigned word
PMULLD xmm1, xmm2/m128	66 0F 38 40 /r	Multiply the packed dword signed integers and store the low 32 bits
PMULDQ xmm1, xmm2/m128	66 0F 38 28 /r	Multiply packed signed doubleword integers and store quadword result
PBLENDVB xmm1, xmm2/m128, <XMM0>	66 0F 38 10 /r	Select byte values from specified mask
PBLENDW xmm1, xmm2/m128, imm8	66 0F 3A 0E /r ib	Select words from specified mask
PMINSB xmm1, xmm2/m128	66 0F 38 38 /r	Compare packed signed byte integers
PMINUW xmm1, xmm2/m128	66 0F 38 3A/r	Compare packed unsigned word integers
PMINSD xmm1, xmm2/m128	66 0F 38 39 /r	Compare packed signed dword integers
PMINUD xmm1, xmm2/m128	66 0F 38 3B /r	Compare packed unsigned dword integers
PMAXSB xmm1, xmm2/m128	66 0F 38 3C /r	Compare packed signed byte integers
PMAXUW xmm1, xmm2/m128	66 0F 38 3E/r	Compare packed unsigned word integers
PMAXSD xmm1, xmm2/m128	66 0F 38 3D /r	Compare packed signed dword integers
PMAXUD xmm1, xmm2/m128	66 0F 38 3F /r	Compare packed unsigned dword integers
PINSRB xmm1, r32/m8, imm8	66 0F 3A 20 /r ib	Insert a byte integer value at specified destination element
PINSRD xmm1, r/m32, imm8	66 0F 3A 22 /r ib	Insert a dword integer value at specified destination element
PINSRQ xmm1, r/m64, imm8	66 REX.W 0F 3A 22 /r ib	Insert a qword integer value at specified destination element
PEXTRB reg/m8, xmm2, imm8	66 0F 3A 14 /r ib	Extract a byte integer value at source byte offset, upper bits are zeroed.
PEXTRW reg/m16, xmm, imm8	66 0F 3A 15 /r ib	Extract word and copy to lowest 16 bits, zero-extended
PEXTRD r/m32, xmm2, imm8	66 0F 3A 16 /r ib	Extract a dword integer value at source dword offset
PEXTRQ r/m64, xmm2, imm8	66 REX.W 0F 3A 16 /r ib	Extract a qword integer value at source qword offset
PMOVSXBW xmm1, xmm2/m64	66 0f 38 20 /r	Sign extend 8 packed 8-bit integers to 8 packed 16-bit integers
PMOVZXBW xmm1, xmm2/m64	66 0f 38 30 /r	Zero extend 8 packed 8-bit integers to 8 packed 16-bit integers
PMOVSXBD xmm1, xmm2/m32	66 0f 38 21 /r	Sign extend 4 packed 8-bit integers to 4 packed 32-bit integers
PMOVZXBD xmm1, xmm2/m32	66 0f 38 31 /r	Zero extend 4 packed 8-bit integers to 4 packed 32-bit integers
PMOVSXBQ xmm1, xmm2/m16	66 0f 38 22 /r	Sign extend 2 packed 8-bit integers to 2 packed 64-bit integers
PMOVZXBQ xmm1, xmm2/m16	66 0f 38 32 /r	Zero extend 2 packed 8-bit integers to 2 packed 64-bit integers
PMOVSXWD xmm1, xmm2/m64	66 0f 38 23/r	Sign extend 4 packed 16-bit integers to 4 packed 32-bit integers
PMOVZXWD xmm1, xmm2/m64	66 0f 38 33 /r	Zero extend 4 packed 16-bit integers to 4 packed 32-bit integers
PMOVSXWQ xmm1, xmm2/m32	66 0f 38 24 /r	Sign extend 2 packed 16-bit integers to 2 packed 64-bit integers
PMOVZXWQ xmm1, xmm2/m32	66 0f 38 34 /r	Zero extend 2 packed 16-bit integers to 2 packed 64-bit integers
PMOVSXDQ xmm1, xmm2/m64	66 0f 38 25 /r	Sign extend 2 packed 32-bit integers to 2 packed 64-bit integers
PMOVZXDQ xmm1, xmm2/m64	66 0f 38 35 /r	Zero extend 2 packed 32-bit integers to 2 packed 64-bit integers
PTEST xmm1, xmm2/m128	66 0F 38 17 /r	Set ZF if AND result is all 0s, set CF if AND NOT result is all 0s
PCMPEQQ xmm1, xmm2/m128	66 0F 38 29 /r	Compare packed qwords for equality
PACKUSDW xmm1, xmm2/m128	66 0F 38 2B /r	Convert 2 × 4 packed signed doubleword integers into 8 packed unsigned word integers with saturation
MOVNTDQA xmm1, m128	66 0F 38 2A /r	Move double quadword using non-temporal hint if WC memory type

SSE4a

Added with Phenom processors

Instruction	Opcode	Meaning
EXTRQ	66 0F 78 /0 ib ib	Extract Field From Register
	66 0F 79 /r
INSERTQ	F2 0F 78 /r ib ib	Insert Field
	F2 0F 79 /r
MOVNTSD	F2 0F 2B /r	Move Non-Temporal Scalar Double-Precision Floating-Point
MOVNTSS	F3 0F 2B /r	Move Non-Temporal Scalar Single-Precision Floating-Point

SSE4.2

Added with Nehalem processors

Instruction	Opcode	Meaning
PCMPESTRI xmm1, xmm2/m128, imm8	66 0F 3A 61 /r imm8	Packed comparison of string data with explicit lengths, generating an index
PCMPESTRM xmm1, xmm2/m128, imm8	66 0F 3A 60 /r imm8	Packed comparison of string data with explicit lengths, generating a mask
PCMPISTRI xmm1, xmm2/m128, imm8	66 0F 3A 63 /r imm8	Packed comparison of string data with implicit lengths, generating an index
PCMPISTRM xmm1, xmm2/m128, imm8	66 0F 3A 62 /r imm8	Packed comparison of string data with implicit lengths, generating a mask
PCMPGTQ xmm1,xmm2/m128	66 0F 38 37 /r	Compare packed signed qwords for greater than.

F16C

Half-precision floating-point conversion.

Instruction	Meaning
VCVTPH2PS xmmreg,xmmrm64	Convert four half-precision floating point values in memory or the bottom half of an XMM register to four single-precision floating-point values in an XMM register
VCVTPH2PS ymmreg,xmmrm128	Convert eight half-precision floating point values in memory or an XMM register (the bottom half of a YMM register) to eight single-precision floating-point values in a YMM register
VCVTPS2PH xmmrm64,xmmreg,imm8	Convert four single-precision floating point values in an XMM register to half-precision floating-point values in memory or the bottom half an XMM register
VCVTPS2PH xmmrm128,ymmreg,imm8	Convert eight single-precision floating point values in a YMM register to half-precision floating-point values in memory or an XMM register

FMA3

Supported in AMD processors starting with the Piledriver architecture and Intel starting with Haswell processors and Broadwell processors since 2014.

Fused multiply-add (floating-point vector multiply–accumulate) with three operands.

Instruction	Meaning
VFMADD132PD	Fused Multiply-Add of Packed Double-Precision Floating-Point Values
VFMADD213PD
VFMADD231PD
VFMADD132PS	Fused Multiply-Add of Packed Single-Precision Floating-Point Values
VFMADD213PS
VFMADD231PS
VFMADD132SD	Fused Multiply-Add of Scalar Double-Precision Floating-Point Values
VFMADD213SD
VFMADD231SD
VFMADD132SS	Fused Multiply-Add of Scalar Single-Precision Floating-Point Values
VFMADD213SS
VFMADD231SS
VFMADDSUB132PD	Fused Multiply-Alternating Add/Subtract of Packed Double-Precision Floating-Point Values
VFMADDSUB213PD
VFMADDSUB231PD
VFMADDSUB132PS	Fused Multiply-Alternating Add/Subtract of Packed Single-Precision Floating-Point Values
VFMADDSUB213PS
VFMADDSUB231PS
VFMSUB132PD	Fused Multiply-Subtract of Packed Double-Precision Floating-Point Values
VFMSUB213PD
VFMSUB231PD
VFMSUB132PS	Fused Multiply-Subtract of Packed Single-Precision Floating-Point Values
VFMSUB213PS
VFMSUB231PS
VFMSUB132SD	Fused Multiply-Subtract of Scalar Double-Precision Floating-Point Values
VFMSUB213SD
VFMSUB231SD
VFMSUB132SS	Fused Multiply-Subtract of Scalar Single-Precision Floating-Point Values
VFMSUB213SS
VFMSUB231SS
VFMSUBADD132PD	Fused Multiply-Alternating Subtract/Add of Packed Double-Precision Floating-Point Values
VFMSUBADD213PD
VFMSUBADD231PD
VFMSUBADD132PS	Fused Multiply-Alternating Subtract/Add of Packed Single-Precision Floating-Point Values
VFMSUBADD213PS
VFMSUBADD231PS
VFNMADD132PD	Fused Negative Multiply-Add of Packed Double-Precision Floating-Point Values
VFNMADD213PD
VFNMADD231PD
VFNMADD132PS	Fused Negative Multiply-Add of Packed Single-Precision Floating-Point Values
VFNMADD213PS
VFNMADD231PS
VFNMADD132SD	Fused Negative Multiply-Add of Scalar Double-Precision Floating-Point Values
VFNMADD213SD
VFNMADD231SD
VFNMADD132SS	Fused Negative Multiply-Add of Scalar Single-Precision Floating-Point Values
VFNMADD213SS
VFNMADD231SS
VFNMSUB132PD	Fused Negative Multiply-Subtract of Packed Double-Precision Floating-Point Values
VFNMSUB213PD
VFNMSUB231PD
VFNMSUB132PS	Fused Negative Multiply-Subtract of Packed Single-Precision Floating-Point Values
VFNMSUB213PS
VFNMSUB231PS
VFNMSUB132SD	Fused Negative Multiply-Subtract of Scalar Double-Precision Floating-Point Values
VFNMSUB213SD
VFNMSUB231SD
VFNMSUB132SS	Fused Negative Multiply-Subtract of Scalar Single-Precision Floating-Point Values
VFNMSUB213SS
VFNMSUB231SS

AVX

AVX were first supported by Intel with Sandy Bridge and by AMD with Bulldozer.

Vector operations on 256 bit registers.

Instruction	Description
VBROADCASTSS	Copy a 32-bit, 64-bit or 128-bit memory operand to all elements of a XMM or YMM vector register.
VBROADCASTSD
VBROADCASTF128
VINSERTF128	Replaces either the lower half or the upper half of a 256-bit YMM register with the value of a 128-bit source operand. The other half of the destination is unchanged.
VEXTRACTF128	Extracts either the lower half or the upper half of a 256-bit YMM register and copies the value to a 128-bit destination operand.
VMASKMOVPS	Conditionally reads any number of elements from a SIMD vector memory operand into a destination register, leaving the remaining vector elements unread and setting the corresponding elements in the destination register to zero. Alternatively, conditionally writes any number of elements from a SIMD vector register operand to a vector memory operand, leaving the remaining elements of the memory operand unchanged. On the AMD Jaguar processor architecture, this instruction with a memory source operand takes more than 300 clock cycles when the mask is zero, in which case the instruction should do nothing. This appears to be a design flaw.
VMASKMOVPD
VPERMILPS	Permute In-Lane. Shuffle the 32-bit or 64-bit vector elements of one input operand. These are in-lane 256-bit instructions, meaning that they operate on all 256 bits with two separate 128-bit shuffles, so they can not shuffle across the 128-bit lanes.
VPERMILPD
VPERM2F128	Shuffle the four 128-bit vector elements of two 256-bit source operands into a 256-bit destination operand, with an immediate constant as selector.
VZEROALL	Set all YMM registers to zero and tag them as unused. Used when switching between 128-bit use and 256-bit use.
VZEROUPPER	Set the upper half of all YMM registers to zero. Used when switching between 128-bit use and 256-bit use.

AVX2

Introduced in Intel's Haswell microarchitecture and AMD's Excavator.

Expansion of most vector integer SSE and AVX instructions to 256 bits

Instruction	Description
VBROADCASTSS	Copy a 32-bit or 64-bit register operand to all elements of a XMM or YMM vector register. These are register versions of the same instructions in AVX1. There is no 128-bit version however, but the same effect can be simply achieved using VINSERTF128.
VBROADCASTSD
VPBROADCASTB	Copy an 8, 16, 32 or 64-bit integer register or memory operand to all elements of a XMM or YMM vector register.
VPBROADCASTW
VPBROADCASTD
VPBROADCASTQ
VBROADCASTI128	Copy a 128-bit memory operand to all elements of a YMM vector register.
VINSERTI128	Replaces either the lower half or the upper half of a 256-bit YMM register with the value of a 128-bit source operand. The other half of the destination is unchanged.
VEXTRACTI128	Extracts either the lower half or the upper half of a 256-bit YMM register and copies the value to a 128-bit destination operand.
VGATHERDPD	Gathers single or double precision floating point values using either 32 or 64-bit indices and scale.
VGATHERQPD
VGATHERDPS
VGATHERQPS
VPGATHERDD	Gathers 32 or 64-bit integer values using either 32 or 64-bit indices and scale.
VPGATHERDQ
VPGATHERQD
VPGATHERQQ
VPMASKMOVD	Conditionally reads any number of elements from a SIMD vector memory operand into a destination register, leaving the remaining vector elements unread and setting the corresponding elements in the destination register to zero. Alternatively, conditionally writes any number of elements from a SIMD vector register operand to a vector memory operand, leaving the remaining elements of the memory operand unchanged.
VPMASKMOVQ
VPERMPS	Shuffle the eight 32-bit vector elements of one 256-bit source operand into a 256-bit destination operand, with a register or memory operand as selector.
VPERMD
VPERMPD	Shuffle the four 64-bit vector elements of one 256-bit source operand into a 256-bit destination operand, with a register or memory operand as selector.
VPERMQ
VPERM2I128	Shuffle (two of) the four 128-bit vector elements of two 256-bit source operands into a 256-bit destination operand, with an immediate constant as selector.
VPBLENDD	Doubleword immediate version of the PBLEND instructions from SSE4.
VPSLLVD	Shift left logical. Allows variable shifts where each element is shifted according to the packed input.
VPSLLVQ
VPSRLVD	Shift right logical. Allows variable shifts where each element is shifted according to the packed input.
VPSRLVQ
VPSRAVD	Shift right arithmetically. Allows variable shifts where each element is shifted according to the packed input.

AVX-512

Main article: AVX-512 § New instructions by sets

AVX-512, introduced in 2014, adds 512-bit wide vector registers (extending the 256-bit registers, which become the new registers' lower halves) and doubles their count to 32; the new registers are thus named zmm0 through zmm31. It adds eight mask registers, named k0 through k7, which may be used to restrict operations to specific parts of a vector register. Unlike previous instruction set extensions, AVX-512 is implemented in several groups; only the foundation ("AVX-512F") extension is mandatory. Most of the added instructions may also be used with the 256- and 128-bit registers.

Cryptographic instructions

Intel AES instructions

Main article: AES instruction set

6 new instructions.

Instruction	Encoding	Description
AESENC	66 0F 38 DC /r	Perform one round of an AES encryption flow
AESENCLAST	66 0F 38 DD /r	Perform the last round of an AES encryption flow
AESDEC	66 0F 38 DE /r	Perform one round of an AES decryption flow
AESDECLAST	66 0F 38 DF /r	Perform the last round of an AES decryption flow
AESKEYGENASSIST	66 0F 3A DF /r ib	Assist in AES round key generation
AESIMC	66 0F 38 DB /r	Assist in AES Inverse Mix Columns

RDRAND and RDSEED

Main article: RDRAND

Instruction	Encoding	Description
RDRAND	0F C7 /6	Read Random Number
RDSEED	0F C7 /7	Read Random Seed

Intel SHA instructions

Main article: Intel SHA extensions

7 new instructions.

Instruction	Encoding	Description
SHA1RNDS4	0F 3A CC /r ib	Perform Four Rounds of SHA1 Operation
SHA1NEXTE	0F 38 C8 /r	Calculate SHA1 State Variable E after Four Rounds
SHA1MSG1	0F 38 C9 /r	Perform an Intermediate Calculation for the Next Four SHA1 Message Dwords
SHA1MSG2	0F 38 CA /r	Perform a Final Calculation for the Next Four SHA1 Message Dwords
SHA256RNDS2	0F 38 CB /r	Perform Two Rounds of SHA256 Operation
SHA256MSG1	0F 38 CC /r	Perform an Intermediate Calculation for the Next Four SHA256 Message Dwords
SHA256MSG2	0F 38 CD /r	Perform a Final Calculation for the Next Four SHA256 Message Dwords

Intel AES Key Locker instructions

These instructions, available in Tiger Lake and later Intel processors, are designed to enable encryption/decryption with an AES key without having access to any unencrypted copies of the key during the actual encryption/decryption process.

Instruction	Encoding	Description	Notes
LOADIWKEY xmm1,xmm2	F3 0F 38 DC /r	Load internal wrapping key ("IWKey") from xmm1, xmm2 and XMM0.	The two explicit operands (which must be register operands) specify a 256-bit encryption key. The implicit operand in XMM0 specifies a 128-bit integrity key. EAX contains flags controlling operation of instruction. After being loaded, the IWKey cannot be directly read from software, but is used for the key wrapping done by ENCODEKEY128/256 and checked by the Key Locker encode/decode instructions. LOADIWKEY is privileged and can run in Ring 0 only.
ENCODEKEY128 r32,r32	F3 0F 38 FA /r	Wrap a 128-bit AES key from XMM0 into a 384-bit key handle and output handle in XMM0-2.	Source operand specifies handle restrictions to build into the handle. Destination operand is initialized with information about the source and attributes of the key. The instruction also modifies XMM4-6 (zeroed out in existing implementations, but this should not be relied on).
ENCODEKEY256 r32,32	F3 0F 3A FB /r	Wrap a 256-bit AES key from XMM1:XMM0 into a 512-bit key handle and output handle in XMM0-3.
AESENC128KL xmm,m384	F3 0F 38 DC /r	Encrypt xmm using 128-bit AES key indicated by handle at m384 and store result in xmm.	All of the Key Locker encode/decode instructions will check whether the handle is valid for the current IWKey and encode/decode data only if the handle is valid. The ZF flag is used to indicate whether the provided handle was valid (ZF=0) or not (ZF=1).
AESDEC128KL xmm,m384	F3 0F 38 DD /r	Decrypt xmm using 128-bit AES key indicated by handle at m384 and store result in xmm.
AESENC256KL xmm,m512	F3 0F 38 DE /r	Encrypt xmm using 256-bit AES key indicated by handle at m512 and store result in xmm.
AESDEC256KL xmm,m512	F3 0F 38 DF /r	Decrypt xmm using 256-bit AES key indicated by handle at m512 and store result in xmm.
AESENCWIDE128KL m384	F3 0F 38 D8 /0	Encrypt XMM0-7 using 128-bit AES key indicated by handle at m384 and store each resultant block back to its corresponding register.
AESDECWIDE128KL m384	F3 0F 38 D8 /1	Decrypt XMM0-7 using 128-bit AES key indicated by handle at m384 and store each resultant block back to its corresponding register.
AESENCWIDE256KL m512	F3 0F 38 D8 /2	Encrypt XMM0-7 using 256-bit AES key indicated by handle at m512 and store each resultant block back to its corresponding register.
AESDECWIDE256KL m512	F3 0F 38 D8 /3	Decrypt XMM0-7 using 256-bit AES key indicated by handle at m512 and store each resultant block back to its corresponding register.

VIA PadLock instructions

Main article: VIA PadLock

Instruction	Encoding	Description
REP MONTMUL	F3 0F A6 C0	Perform Montgomery Multiplication
REP XSHA1	F3 0F A6 C8	Compute SHA-1 hash for ECX bytes
REP XSHA256	F3 0F A6 D0	Compute SHA-256 hash for ECX bytes
CCS_HASH	F3 0F A6 E8	Compute SM3 hash for ECX units (bytes or 64-byte blocks) (Zhaoxin CPUs only)
XSTORE	0F A7 C0	Store Available Random Bytes (0 to 8 bytes)
REP XSTORE	F3 0F A7 C0	Store ECX Random Bytes
REP XCRYPTECB	F3 0F A7 C8	Encrypt/Decrypt ECX 128-bit blocks, using AES in ECB block mode
REP XCRYPTCBC	F3 0F A7 D0	Encrypt/Decrypt ECX 128-bit blocks, using AES in CBC block mode
REP XCRYPTCTR	F3 0F A7 D8	Encrypt/Decrypt ECX 128-bit blocks, using AES in CTR block mode
REP XCRYPTCFB	F3 0F A7 E0	Encrypt/Decrypt ECX 128-bit blocks, using AES in CFB block mode
REP XCRYPTOFB	F3 0F A7 E8	Encrypt/Decrypt ECX 128-bit blocks, using AES in OFB block mode
CCS_ENCRYPT	F3 0F A7 F0	Encrypt/Decrypt ECX 128-bit blocks, using SM4 encryption (Zhaoxin CPUs only)

Other instructions

Main article: List of discontinued x86 instructions

x86 also includes discontinued instruction sets which are no longer supported by Intel and AMD, and undocumented instructions which execute but are not officially documented.

Virtualization instructions

AMD-V instructions

Instruction	Opcode	Meaning	Notes
Basic SVM instructions
VMRUN	0F 01 D8	Run virtual machine	Performs a switch to the guest OS.
VMMCALL	0F 01 D9	Call VMM	Used exclusively to communicate with VMM.
VMLOAD	0F 01 DA	Load state From VMCB	Loads a subset of processor state from the VMCB specified by the physical address in the RAX register.
VMSAVE	0F 01 DB	Save state To VMCB	Saves additional guest state to VMCB.
STGI	0F 01 DC	Set Global Interrupt Flag	Normally used by the VMM. Available to the VM guest if VGIF feature is supported.
CLGI	0F 01 DD	Clear Global Interrupt Flag
SKINIT	0F 01 DE	Secure Init and Jump with Attestation	Verifiable startup of trusted software based on secure hash comparison
INVLPGA	0F 01 DF	Invalidate TLB entry in a specified ASID	Invalidates the TLB mapping for the virtual page specified in RAX and the ASID specified in ECX.
Virtualization Encrypted State (SEV-ES) instructions
VMGEXIT	F2/F3 0F 01 D9	SEV-ES Exit to VMM	Explicit communication with the VMM for SEV-ES VMs. Executed as VMMCALL if not executed by a SEV-ES guest.
Secure Nested Paging (SEV-SNP) Reverse-Map Table instructions
PSMASH	F3 0F 01 FF	Page Smash	Expands a 2MB-page RMP entry into a corresponding set of contiguous 4KB-page RMP entries. The 2MB page's system physical address is specified in the RAX register.
PVALIDATE	F2 0F 01 FF	Page Validate	Validates or rescinds validation of a guest page's RMP entry. The guest virtual address is specified in the register operand rAX.
RMPADJUST	F3 0F 01 FE	Adjust RMP Permissions	Modifies RMP permissions for a guest page. The guest virtual address is specified in the RAX register. The page size is specified in RCX[0]. The target VMPL and its permissions are specified in the RDX register.
RMPUPDATE	F2 0F 01 FE	Write RMP Entry	Writes a new RMP entry. The system physical address of a page whose RMP entry is modified is specified in the RAX register. The RCX register provides the effective address of a 16-byte data structure which contains the new RMP state.
RMPQUERY	F3 0F 01 FD	Read RMP Permissions	Reads an RMP permission mask for a guest page. The guest virtual address is specified in the RAX register. The target VMPL is specified in RDX[7:0]. RMP permissions for the specified VMPL are returned in RDX[63:8] and the RCX register.

Intel VT-x instructions

Instruction	Meaning	Notes	Opcode
INVEPT	Invalidate Translations Derived from EPT	Invalidates EPT-derived entries in the TLBs and paging-structure caches.	66 0F 38 80
INVVPID	Invalidate Translations Based on VPID	Invalidates entries in the TLBs and paging-structure caches based on VPID.	66 0F 38 80
VMFUNC	Invoke VM function	Invoke VM function specified in EAX.	0F 01 D4
VMPTRLD	Load Pointer to Virtual-Machine Control Structure	Loads the current VMCS pointer from memory.	0F C7 /6
VMPTRST	Store Pointer to Virtual-Machine Control Structure	Stores the current-VMCS pointer into a specified memory address. The operand of this instruction is always 64 bits and is always in memory.	0F C7 /7
VMCLEAR	Clear Virtual-Machine Control Structure	Writes any cached data to the VMCS	66 0F C7 /6
VMREAD	Read Field from Virtual-Machine Control Structure	Reads out a field in the VMCS	0F 78 /r
VMWRITE	Write Field to Virtual-Machine Control Structure	Modifies a field in the VMCS	0F 79 /r
VMCALL	Call to VM Monitor	Calls VM Monitor function from Guest System	0F 01 C1
VMLAUNCH	Launch Virtual Machine	Launch virtual machine managed by current VMCS	0F 01 C2
VMRESUME	Resume Virtual Machine	Resume virtual machine managed by current VMCS	0F 01 C3
VMXOFF	Leave VMX Operation	Stops hardware supported virtualisation environment	0F 01 C4
VMXON	Enter VMX Operation	Enters hardware supported virtualisation environment	F3 0F C7 /6

Undocumented instructions

Undocumented x86 instructions

The x86 CPUs contain undocumented instructions which are implemented on the chips but not listed in some official documents. They can be found in various sources across the Internet, such as Ralf Brown's Interrupt List and at sandpile.org

Some of these instructions are widely available across many/most x86 CPUs, while others are specific to a narrow range of CPUs.

Undocumented instructions that are widely available across many x86 CPUs include

Mnemonics	Opcodes	Description	Status
AAM imm8	D4 imm8	ASCII-Adjust-after-Multiply. On the 8086, documented for imm8=0Ah only, which is used to convert a binary multiplication result to BCD. The actual operation is AH ← AL/imm8; AL ← AL mod imm8 for any imm8 value (except zero, which produces a divide-by-zero exception).	Available beginning with 8086, documented for imm8 values other than 0Ah since Pentium (earlier documentation lists no arguments).
AAD imm8	D5 imm8	ASCII-Adjust-Before-Division. On the 8086, documented for imm8=0Ah only, which is used to convert a BCD value to binary for a following division instruction. The actual operation is AL ← (AL+(AH*imm8)) & 0FFh; AH ← 0 for any imm8 value.
SALC, SETALC	D6	Set AL depending on the value of the Carry Flag (a 1-byte alternative of SBB AL, AL)	Available beginning with 8086, but only documented since Pentium Pro.
TEST	F6 /1 imm8, F7 /1 imm16/32	Undocumented variants of the TEST instruction. Performs the same operation as the documented F6 /0 and F7 /0 variants, respectively.	Available since the 8086. Unavailable on some 80486 steppings.
SHL, SAL	(D0..D3) /6, (C0..C1) /6 imm8	Undocumented variants of the SHL instruction. Performs the same operation as the documented (D0..D3) /4 and (C0..C1) /4 variants, respectively.	Available since the 80186 (performs different operation on the 8086)
(multiple)	82 /(0..7) imm8	Alias of opcode 80, which provides variants of 8-bit integer instructions (ADD, OR, ADC, SBB, AND, SUB, XOR, CMP) with an 8-bit immediate argument.	Available since the 8086. Explicitly unavailable in 64-bit mode but kept and reserved for compatibility.
OR,AND,XOR	83 /(1,4,6) imm8	16-bit OR/AND/XOR with a sign-extended 8-bit immediate.	Available on 8086, but only documented from 80386 onwards.
REPNZ MOVS	F2 (A4..A5)	The behavior of the F2 prefix (REPNZ, REPNE) when used with string instructions other than CMPS/SCAS is officially undefined, but there exists commercial software (e.g. the version of FDISK distributed with MS-DOS versions 3.30 to 6.22) that rely on it to behave in the same way as the documented F3 (REP) prefix.	Available since the 8086.
REPNZ STOS	F2 (AA..AB)
REP RET	F3 C3	The use of the REP prefix with the RET instruction is not listed as supported in either the Intel SDM or the AMD APM. However, AMD's optimization guide for the AMD-K8 describes the F3 C3 encoding as a way to encode a two-byte RET instruction - this is the recommended workaround for an issue in the AMD-K8's branch predictor that can cause branch prediction to fail for some 1-byte RET instructions. At least some versions of gcc are known to use this encoding.	Executes as RET on all known x86 CPUs.
NOP	67 90	NOP with address-size override prefix. The use of the 67 prefix for instructions without memory operands is listed by the Intel SDM (vol 2, section 2.1.1) as "reserved", but it is used in Microsoft Windows 95 as a workaround for a bug in the B1 stepping of Intel 80386.	Executes as NOP on 80386 and later.
ICEBP, INT1	F1	Single byte single-step exception / Invoke ICE	Available beginning with 80386, documented (as INT1) since Pentium Pro. Treated as undocumented instruction prefix on 8086 and 80286.
NOP r/m	0F 1F /0	Official long NOP. Introduced in the Pentium Pro in 1995, but remained undocumented until March 2006.	Available on Pentium Pro and AMD K7 and later. Unavailable on AMD K6, AMD Geode LX, VIA Nehemiah.
NOP r/m	0F 0D /r	Reserved-NOP. Introduced in 65 nm Pentium 4. Intel documentation lists this opcode as NOP in opcode tables but not instruction listings since June 2005. From Broadwell onwards, 0F 0D /1 has been documented as PREFETCHW. On AMD CPUs, 0F 0D with a memory argument is documented as PREFETCH/PREFETCHW since K6-2 - originally as part of 3dnow!, but has been kept in later AMD CPUs even after the rest of 3dnow! was dropped.	Available on Intel CPUs since 65 nm Pentium 4.
UD1	0F B9 /r	Intentionally undefined instructions, but unlike UD2 (0F 0B) these instructions were left unpublished until December 2016. Microsoft Windows 95 Setup is known to depend on 0F FF being invalid - it is used as a self check to test that its #UD exception handler is working properly. Other invalid opcodes that are being relied on by commercial software to produce #UD exceptions include FF FF (DIF-2, LaserLok) and C4 C4 ("BOP"), however as of January 2022 they are not published as intentionally invalid opcodes.	All of these opcodes produce #UD exceptions on 80186 and later (except on NEC V20/V30, which assign at least 0F FF to the BRKEM instruction.)
UD0	0F FF

Undocumented instructions that appear only in a limited subset of x86 CPUs include

Mnemonics	Opcodes	Description	Status
REP IMUL	F3 F6 /5, F3 F7 /5	A REP or REPNZ prefix on an IMUL instruction causes the result to be negated. This is due to the microcode using the “REP prefix present” bit to store the sign of the result.	8086/8088 only.
REP IDIV	F3 F6 /7, F3 F7 /7	A REP or REPNZ prefix on an IDIV instruction causes the quotient to be negated. This is due to the microcode using the “REP prefix present” bit to store the sign of the quotient.	8086/8088 only.
SAVEALL, STOREALL	0F 04	Exact purpose unknown, causes CPU hang (HCF). The only way out is CPU reset. In some implementations, emulated through BIOS as a halting sequence. In a forum post at the Vintage Computing Federation, this instruction is explained as SAVEALL. It interacts with ICE mode.	Only available on 80286
LOADALL	0F 05	Loads All Registers from Memory Address 0x000800H	Only available on 80286. Opcode reused for SYSCALL in AMD K6-2 and later CPUs.
LOADALLD	0F 07	Loads All Registers from Memory Address ES:EDI	Only available on 80386. Opcode reused for SYSRET in AMD K6-2 and later CPUs.
CL1INVMB	0F 0A	On the Intel SCC (Single-chip Cloud Computer), invalidate all message buffers. The menmonic and operation of the instruction, but not its opcode, are described in Intel's SCC architecture specification.	Available on the SCC only.
PATCH2	0F 0E	On AMD K6 and later maps to FEMMS operation (fast clear of MMX state) but on Intel identified as uarch data read on Intel	Only available in Red unlock state (0F 0F too)
PATCH3	0F 0F	Write uarch	Can change RAM part of microcode on Intel
UMOV r,r/m UMOV r/m,r	0F (10..13) /r	Moves data to/from user memory when operating in ICE HALT mode. Acts as regular MOV otherwise.	Available on some 386 and 486 processors only. Opcodes reused for SSE instructions in later CPUs.
NXOP	0F 55	NexGen hypercode interface.	Available on NexGen Nx586 only.
(multiple)	0F (E0..FB)	NexGen Nx586 "hyper mode" instructions. The NexGen Nx586 CPU uses "hyper code" (x86 code sequences unpacked at boot time and only accessible in a special "hyper mode" operation mode, similar to DEC Alpha's PALcode) for many complicated operations that are implemented with microcode in most other x86 CPUs. The Nx586 provides a large number of undocumented instructions to assist hyper mode operation.	Available in Nx586 hyper mode only.
PSWAPW mm,mm/m64	0F 0F /r BB	Undocumented AMD 3DNow! instruction on K6-2 and K6-3. Swaps 16-bit words within 64-bit MMX register. Instruction known to be recognized by MASM 6.13 and 6.14.	Available on K6-2 and K6-3 only. Opcode reused for documented PSWAPD instruction from AMD K7 onwards.
Un­known mnemonic	64 D6	Using the 64h (FS: segment) prefix with the undocumented D6 (SALC/SETALC) instruction will, on UMC CPUs only, cause EAX to be set to 0xAB6B1B07.	Available on the UMC Green CPU only. Executes as SALC on non-UMC CPUs.
FS: Jcc	64 (70..7F) rel8, 64 0F (80..8F) rel16/32	On Intel "NetBurst" (Pentium 4) CPUs, the 64h (FS: segment) instruction prefix will, when used with conditional branch instructions, act as a branch hint to indicate that the branch will be alternating between taken and not-taken. Unlike other NetBurst branch hints (CS: and DS: segment prefixes), this hint is not documented.	Available on NetBurst CPUs only. Segment prefixes on conditional branches are accepted but ignored by non-NetBurst CPUs.
ALTINST	0F 3F	Jump and execute instructions in the undocumented Alternate Instruction Set.	Only available on some x86 processors made by VIA Technologies.
(FMA4)	VEX.66.0F38 (5C..5F,68..6F,78..7F) /r imm8	On AMD Zen1, FMA4 instructions are present but undocumented (missing CPUID flag). The reason for leaving the feature undocumented may or may not have been due to a buggy implementation.	Removed from Zen2 onwards.
REP XSHA512	F3 0F A6 E0	Perform SHA-512 hashing. Supported by OpenSSL as part of its VIA PadLock support, but not documented by the VIA PadLock Programming Guide.	Only available on some x86 processors made by VIA Technologies and Zhaoxin.
REP XMODEXP	F3 0F A6 F8	Instructions to perform modular exponentiation and random number generation, respectively. Listed in a VIA-supplied patch to add support for VIA Nano-specific PadLock instructions to OpenSSL, but not documented by the VIA PadLock Programming Guide.
XRNG2	F3 0F A7 F8
Un­known mnemonic	0F A7 (C1..C7)	Detected by CPU fuzzing tools such as SandSifter and UISFuzz as executing without causing #UD on several different VIA and Zhaoxin CPUs. Unknown operation, may be related to the documented XSTORE (0F A7 C0) instruction.
(unknown, multiple)	0F 0F /r ??	The whitepapers for SandSifter and UISFuzz report the detection of large numbers of undocumented instructions in the 3DNow! opcode range on several different AMD CPUs (at least Geode NX and C-50). Their operation is not known. On at least AMD K6-2, all of the unassigned 3DNow! opcodes (other than the undocumented PF2IW, PI2FW and PSWAPW instructions) execute as equivalents of POR (MMX bitwise-OR instruction).	Present on some AMD CPUs with 3DNow!.
MONTMUL2	Un­known	Zhaoxin RSA/"xmodx" instructions. Mnemonics and CPUID flags are listed in a Linux kernel patch for OpenEuler, but opcodes and instruction descriptions are not available.	Un­known. Some Zhaoxin CPUs have the CPUID flags for these instructions set.
MOVDB, GP2MEM	Un­known	Microprocessor Report's article "MediaGX Targets Low-Cost PCs" from 1997, covering the introduction of the Cyrix MediaGX processor, lists several new instructions that are said to have been added to this processor in order to support its new "Virtual System Architecture" features, including MOVDB and GP2MEM - and also mentions that Cyrix did not intend to publish specifications for these instructions.	Un­known. No specification known to have been published.

Undocumented x87 instructions

Mnemonics	Opcodes	Description	Status
FENI, FENI8087_NOP	DB E0	FPU Enable Interrupts (8087)	Documented for the Intel 80287. Present on all Intel x87 FPUs from 80287 onwards. For FPUs other than the ones where they were introduced on (8087 for FENI/FDISI and 80287 for FSETPM), they act as NOPs. These instructions and their operation on modern CPUs are commonly mentioned in later Intel documentation, but with opcodes omitted and opcode table entries left blank (e.g. Intel SDM 325462-077, April 2022 mentions them twice without opcodes). The opcodes are, however, recognized by Intel XED.
FDISI, FDISI8087_NOP	DB E1	FPU Disable Interrupts (8087)
FSETPM, FSETPM287_NOP	DB E4	FPU Set Protected Mode (80287)
(no mnemonic)	D9 D7,  D9 E2, D9 E7,  DD FC, DE D8,  DE DA, DE DC,  DE DD, DE DE,  DF FC	"Reserved by Cyrix" opcodes	These opcodes are listed as reserved opcodes that will produce "unpredictable results" without generating exceptions on at least Cyrix 6x86, 6x86MX, MII, MediaGX, and AMD Geode GX/LX. (The documentation for these CPUs all list the same ten opcodes.) Their actual operation is not known, nor is it known whether their operation is the same on all of these CPUs.

See also

• CLMUL
• RDRAND
• Larrabee extensions
• Advanced Vector Extensions 2
• Bit Manipulation Instruction Sets
• CPUID
• List of discontinued x86 instructions

References

• Intel Corporation (April 2022). "Intel 64 and IA-32 Architectures Software Developer's Manual, Combined Volumes: 1, 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D and 4". Intel. Retrieved 21 June 2022.

External links

• Free IA-32 and x86-64 documentation, provided by Intel
• x86 Opcode and Instruction Reference
• x86 and amd64 instruction reference
• Instruction tables: Lists of instruction latencies, throughputs and micro-operation breakdowns for Intel, AMD and VIA CPUs
• Netwide Assembler Instruction List (from Netwide Assembler)