x86 instruction listings

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

The x86 instruction set refers to the set of instructions that x86-compatible microprocessors support. The instructions are usually part of an executable program, often stored as a computer file and executed on the processor.

The x86 instruction set has been extended several times, introducing wider registers and datatypes as well as new functionality.[1]

x86 integer instructions[edit]

Below is the full 8086/8088 instruction set of Intel (81 instructions total). Most if not all of these instructions are available in 32-bit mode; they just operate on 32-bit registers (eax, ebx, etc.) and values instead of their 16-bit (ax, bx, etc.) counterparts. The updated instruction set is also grouped according to architecture (i386, i486, i686) and more generally is referred to as (32-bit) x86 and (64-bit) x86-64 (also known as AMD64).

Original 8086/8088 instructions[edit]

Original 8086/8088 instruction set
Instruction Meaning Notes Opcode
AAA ASCII adjust AL after addition used with unpacked binary-coded decimal 0x37
AAD ASCII adjust AX before division 8086/8088 datasheet documents only base 10 version of the AAD instruction (opcode 0xD5 0x0A), but any other base will work. Later Intel's documentation has the generic form too. NEC V20 and V30 (and possibly other NEC V-series CPUs) always use base 10, and ignore the argument, causing a number of incompatibilities 0xD5
AAM ASCII adjust AX after multiplication Only base 10 version (Operand is 0xA) is documented, see notes for AAD 0xD4
AAS ASCII adjust AL after subtraction 0x3F
ADC Add with carry destination = destination + source + carry_flag 0x100x15, 0x800x81/2, 0x820x83/2 (since 80186)
ADD Add (1) r/m += r/imm; (2) r += m/imm; 0x000x05, 0x80/00x81/0, 0x82/00x83/0 (since 80186)
AND Logical AND (1) r/m &= r/imm; (2) r &= m/imm; 0x200x25, 0x800x81/4, 0x820x83/4 (since 80186)
CALL Call procedure push eip; eip points to the instruction directly after the call 0x9A, 0xE8, 0xFF/2, 0xFF/3
CBW Convert byte to word 0x98
CLC Clear carry flag CF = 0; 0xF8
CLD Clear direction flag DF = 0; 0xFC
CLI Clear interrupt flag IF = 0; 0xFA
CMC Complement carry flag 0xF5
CMP Compare operands 0x380x3D, 0x800x81/7, 0x820x83/7 (since 80186)
CMPSB Compare bytes in memory. May be used with a REP prefix to repeat the instruction CX times. 0xA6
CMPSW Compare words. May be used with a REP prefix to repeat the instruction CX times. 0xA7
CWD Convert word to doubleword 0x99
DAA Decimal adjust AL after addition (used with packed binary-coded decimal) 0x27
DAS Decimal adjust AL after subtraction 0x2F
DEC Decrement by 1 0x480x4F, 0xFE/1, 0xFF/1
DIV Unsigned divide (1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder 0xF7/6, 0xF6/6
ESC Used with floating-point unit 0xD8..0xDF
HLT Enter halt state 0xF4
IDIV Signed divide (1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder 0xF7/7, 0xF6/7
IMUL Signed multiply in One-operand form (1) DX:AX = AX * r/m; (2) AX = AL * r/m 0x69, 0x6B (both since 80186), 0xF7/5, 0xF6/5, 0x0FAF (since 80386)
IN Input from port (1) AL = port[imm]; (2) AL = port[DX]; (3) AX = port[imm]; (4) AX = port[DX]; 0xE4, 0xE5, 0xEC, 0xED
INC Increment by 1 0x400x47, 0xFE/0, 0xFF/0
INT Call to interrupt 0xCC, 0xCD
INTO Call to interrupt if overflow 0xCE
IRET Return from interrupt 0xCF
Jcc Jump if condition (JA, JAE, JB, JBE, JC, JE, JG, JGE, JL, JLE, JNA, JNAE, JNB, JNBE, JNC, JNE, JNG, JNGE, JNL, JNLE, JNO, JNP, JNS, JNZ, JO, JP, JPE, JPO, JS, JZ) 0x700x7F, 0x0F800x0F8F (since 80386)
JCXZ Jump if CX is zero 0xE3
JMP Jump 0xE90xEB, 0xFF/4, 0xFF/5
LAHF Load FLAGS into AH register 0x9F
LDS Load pointer using DS 0xC5
LEA Load Effective Address 0x8D
LES Load ES with pointer 0xC4
LOCK Assert BUS LOCK# signal (for multiprocessing) 0xF0
LODSB Load string byte. May be used with a REP prefix to repeat the instruction CX times. if (DF==0) AL = *SI++; else AL = *SI--; 0xAC
LODSW Load string word. May be used with a REP prefix to repeat the instruction CX times. if (DF==0) AX = *SI++; else AX = *SI--; 0xAD
LOOP/LOOPx Loop control (LOOPE, LOOPNE, LOOPNZ, LOOPZ) if (x && --CX) goto lbl; 0xE00xE2
MOV Move copies data from one location to another, (1) r/m = r; (2) r = r/m; 0xA0...0xA3
MOVSB Move byte from string to string. May be used with a REP prefix to repeat the instruction CX times.
if (DF==0) 
  *(byte*)DI++ = *(byte*)SI++; 
else 
  *(byte*)DI-- = *(byte*)SI--;
.
0xA4
MOVSW Move word from string to string. May be used with a REP prefix to repeat the instruction CX times.
if (DF==0) 
  *(word*)DI++ = *(word*)SI++; 
else 
  *(word*)DI-- = *(word*)SI--;
0xA5
MUL Unsigned multiply (1) DX:AX = AX * r/m; (2) AX = AL * r/m; 0xF7/4, 0xF6/4
NEG Two's complement negation r/m *= -1; 0xF6/30xF7/3
NOP No operation opcode equivalent to XCHG EAX, EAX 0x90
NOT Negate the operand, logical NOT r/m ^= -1; 0xF6/20xF7/2
OR Logical OR (1) r/m |= r/imm; (2) r |= m/imm; 0x080x0D, 0x800x81/1, 0x820x83/1 (since 80186)
OUT Output to port (1) port[imm] = AL; (2) port[DX] = AL; (3) port[imm] = AX; (4) port[DX] = AX; 0xE6, 0xE7, 0xEE, 0xEF
POP Pop data from stack r/m = *SP++; POP CS (opcode 0x0F) works only on 8086/8088. Later CPUs use 0x0F as a prefix for newer instructions. 0x07, 0x0F(8086/8088 only), 0x17, 0x1F, 0x580x5F, 0x8F/0
POPF Pop FLAGS register from stack FLAGS = *SP++; 0x9D
PUSH Push data onto stack *--SP = r/m; 0x06, 0x0E, 0x16, 0x1E, 0x500x57, 0x68, 0x6A (both since 80186), 0xFF/6
PUSHF Push FLAGS onto stack *--SP = FLAGS; 0x9C
RCL Rotate left (with carry) 0xC00xC1/2 (since 80186), 0xD00xD3/2
RCR Rotate right (with carry) 0xC00xC1/3 (since 80186), 0xD00xD3/3
REPxx Repeat MOVS/STOS/CMPS/LODS/SCAS (REP, REPE, REPNE, REPNZ, REPZ) 0xF2, 0xF3
RET Return from procedure Not a real instruction. The assembler will translate these to a RETN or a RETF depending on the memory model of the target system.
RETN Return from near procedure 0xC2, 0xC3
RETF Return from far procedure 0xCA, 0xCB
ROL Rotate left 0xC00xC1/0 (since 80186), 0xD00xD3/0
ROR Rotate right 0xC00xC1/1 (since 80186), 0xD00xD3/1
SAHF Store AH into FLAGS 0x9E
SAL Shift Arithmetically left (signed shift left) (1) r/m <<= 1; (2) r/m <<= CL; 0xC00xC1/4 (since 80186), 0xD00xD3/4
SAR Shift Arithmetically right (signed shift right) (1) (signed) r/m >>= 1; (2) (signed) r/m >>= CL; 0xC00xC1/7 (since 80186), 0xD00xD3/7
SBB Subtraction with borrow alternative 1-byte encoding of SBB AL, AL is available via undocumented SALC instruction 0x180x1D, 0x800x81/3, 0x820x83/3 (since 80186)
SCASB Compare byte string. May be used with a REP prefix to repeat the instruction CX times. 0xAE
SCASW Compare word string. May be used with a REP prefix to repeat the instruction CX times. 0xAF
SHL Shift left (unsigned shift left) 0xC00xC1/4 (since 80186), 0xD00xD3/4
SHR Shift right (unsigned shift right) 0xC00xC1/5 (since 80186), 0xD00xD3/5
STC Set carry flag CF = 1; 0xF9
STD Set direction flag DF = 1; 0xFD
STI Set interrupt flag IF = 1; 0xFB
STOSB Store byte in string. May be used with a REP prefix to repeat the instruction CX times. if (DF==0) *ES:DI++ = AL; else *ES:DI-- = AL; 0xAA
STOSW Store word in string. May be used with a REP prefix to repeat the instruction CX times. if (DF==0) *ES:DI++ = AX; else *ES:DI-- = AX; 0xAB
SUB Subtraction (1) r/m -= r/imm; (2) r -= m/imm; 0x280x2D, 0x800x81/5, 0x820x83/5 (since 80186)
TEST Logical compare (AND) (1) r/m & r/imm; (2) r & m/imm; 0x84, 0x84, 0xA8, 0xA9, 0xF6/0, 0xF7/0
WAIT Wait until not busy Waits until BUSY# pin is inactive (used with floating-point unit) 0x9B
XCHG Exchange data r :=: r/m; A spinlock typically uses xchg as an atomic operation. (coma bug). 0x86, 0x87, 0x910x97
XLAT Table look-up translation behaves like MOV AL, [BX+AL] 0xD7
XOR Exclusive OR (1) r/m ^= r/imm; (2) r ^= m/imm; 0x300x35, 0x800x81/6, 0x820x83/6 (since 80186)

Added in specific Intel processors[edit]

Added with 80186/80188[edit]

Instruction Opcode Meaning Notes
BOUND 62 /r Check array index against bounds raises software interrupt 5 if test fails
ENTER C8 iw ib Enter stack frame Modifies stack for entry to procedure for high level language. Takes two operands: the amount of storage to be allocated on the stack and the nesting level of the procedure.
INSB/INSW 6C Input from port to string equivalent to:
IN AX, DX
MOV ES:[DI], AX
; adjust DI according to operand size and DF
6D
LEAVE C9 Leave stack frame Releases the local stack storage created by the previous ENTER instruction.
OUTSB/OUTSW 6E Output string to port equivalent to:
MOV AX, DS:[SI]
OUT DX, AX
; adjust SI according to operand size and DF
6F
POPA 61 Pop all general purpose registers from stack equivalent to:
POP DI
POP SI
POP BP
POP AX ; no POP SP here, all it does is ADD SP, 2 (since AX will be overwritten later)
POP BX
POP DX
POP CX
POP AX
PUSHA 60 Push all general purpose registers onto stack equivalent to:
PUSH AX
PUSH CX
PUSH DX
PUSH BX
PUSH SP ; The value stored is the initial SP value
PUSH BP
PUSH SI
PUSH DI
PUSH immediate 6A ib Push an immediate byte/word value onto the stack example:
PUSH 12h
PUSH 1200h
68 iw
IMUL immediate 6B /r ib Signed and unsigned multiplication of immediate byte/word value example:
IMUL BX,12h
IMUL DX,1200h
IMUL CX, DX, 12h
IMUL BX, SI, 1200h
IMUL DI, word ptr [BX+SI], 12h
IMUL SI, word ptr [BP-4], 1200h

Note that since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well.

69 /r iw
SHL/SHR/SAL/SAR/ROL/ROR/RCL/RCR immediate C0 Rotate/shift bits with an immediate value greater than 1 example:
ROL AX,3
SHR BL,3
C1

Added with 80286[edit]

Instruction Opcode Meaning Notes
ARPL r/m16, r16 63 /r Adjust RPL field of selector Available in 16/32-bit protected mode only.

Causes #UD in Real mode and Virtual 8086 Mode - Windows 95 and OS/2 2.x are known to make extensive use of this #UD to use the 63 opcode as a one-byte breakpoint to transition from Virtual 8086 Mode to kernel mode.[2][3]

CLTS 0F 06 Clear task-switched flag in Machine Status Word.
LAR r,r/m16 0F 02 /r Load access rights byte from the specified segment descriptor Sets ZF=1 if the descriptor could be loaded, ZF=0 otherwise.

32-bit variant of LAR instruction is documented to load undefined data into bits 19:16 of destination register on Intel CPUs.

LSL r,r/m16 0F 03 /r Load segment limit from the specified segment descriptor Sets ZF=1 if the descriptor could be loaded, ZF=0 otherwise.
LGDT m16&32 0F 01 /2 Load Global Descriptor Table Register Each of these instructions loads a 2-part table descriptor. The first part is a 16-bit value, specifying table size in bytes minus 1. The second part is a 32-bit value (64-bit value in 64-bit mode), specifying the linear start address for the table. This address is ANDed with 00FFFFFFh for the 16-bit variants of these instructions.

LIDT can relocate the Interrupt Vector Table in Real Mode as well.

LGDT and LIDT are serializing instructions.

LIDT m16&32 0F 01 /3 Load Interrupt Descriptor Table Register
LLDT r/m16 0F 00 /2 Load Local Descriptor Table Register LLDT and LTR are serializing instructions.
LTR r/m16 0F 00 /3 Load Task Register
LMSW r/m16 0F 01 /6 Load Machine Status Word On 80386 and later, the "Machine Status Word" is the same as the CR0 register, however LMSW can only modify the bottom 4 bits of this register.

LMSW can be used to enter but not leave x86 Protected Mode. On the 80286, it is not possible to leave Protected Mode at all without a CPU reset - on 80386 and later, it is possible to leave Protected Mode, but this requires the use of the 80386-and-later MOV to CR0 instruction.

LMSW is a serializing instruction.

SGDT m16&32 0F 01 /0 Store Global Descriptor Table Register The SGDT,SIDT,SLDT,SMSW,STR were unprivileged on all x86 CPUs from 80286 onwards until the introduction of UMIP in 2017.[4]

This has been a significant security problem for software-based virtualization, since it enables these instructions to be used by a VM guest to detect that it is running inside a VM.[5][6]

The 16-bit variants of the SGDT and SIDT instructions also show a difference between Intel documentation and actual behavior observed on Intel CPUs: as of Intel SDM revision 076, December 2021, the last 8 bits of the descriptor is documented as being written as 0, however observed behavior is that bits 31:24 of the descriptor table address are written instead.[7]

SLDT and SMSW (but not STR) with a 32-bit register argument are documented to set the top 16 bits of the specified register to an undefined value on Intel CPUs.

SIDT m16&32 0F 01 /1 Store Interrupt Descriptor Table Register
SLDT r/m16 0F 00 /0 Store Local Descriptor Table Register
SMSW r/m16 0F 01 /4 Store Machine Status Word
STR r/m16 0F 00 /1 Store Task Register
VERR r/m16 0F 00 /4 Verify a segment for reading Sets ZF=1 if segment can be read, ZF=0 otherwise.
VERW r/m16 0F 00 /5 Verify a segment for writing Sets ZF=1 if segment can be written, ZF=0 otherwise.

On some Intel CPU/microcode combinations from 2019 onwards, the VERW instruction also flushes microarchitectural data buffers. This enables it to be used as part of workarounds for Microarchitectural Data Sampling security vulnerabilities.[8][9]

LOADALL 0F 05 Load all CPU registers, including internal ones such as GDT Undocumented, 80286 only. (A different variant of LOADALL with a different opcode and memory layout exists on 80386.)

Added with 80386[edit]

Instruction Meaning Notes
BSF Bit scan forward BSF and BSR produce undefined results if the source argument is all-0s.
BSR Bit scan reverse
BT Bit test
BTC Bit test and complement Instructions atomic only if LOCK prefix present.
BTR Bit test and reset
BTS Bit test and set
CDQ Convert double-word to quad-word Sign-extends EAX into EDX, forming the quad-word EDX:EAX. Since (I)DIV uses EDX:EAX as its input, CDQ must be called after setting EAX if EDX is not manually initialized (as in 64/32 division) before (I)DIV.
CMPSD Compare string double-word Compares ES:[(E)DI] with DS:[(E)SI] and increments or decrements both (E)DI and (E)SI, depending on DF; can be prefixed with REP
CWDE Convert word to double-word Unlike CWD, CWDE sign-extends AX to EAX instead of AX to DX:AX
IBTS Insert Bit String Discontinued with B1 step of 80386.
IMUL Two-operand form of IMUL: Signed and Unsigned Allows to multiply two registers directly, storing the partial (truncated) lower bit result. Since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well
INSD Input from port to string double-word *(long)ES:EDI±± = port[DX]; (±± depends on DF, ES: cannot be overridden). Can be prefixed with REP.
IRETx Interrupt return; D suffix means 32-bit return, F suffix means do not generate epilogue code (i.e. LEAVE instruction) Use IRETD rather than IRET in 32-bit situations
Jxx (near) Jump conditionally Conditional near jump instructions for all 8086 Jxx short jump instructions
JECXZ Jump if ECX is zero
LFS, LGS Load far pointer
LSS Load stack segment and register Normally used to update both SS and SP at the same time.
LODSD Load string double-word EAX = *DS:(E)SI±±; (±± depends on DF, DS: can be overridden); can be prefixed with REP
LOOPW, LOOPccW Loop, conditional loop Same as LOOP, LOOPcc for earlier processors
LOOPD, LOOPccD Loop while equal if (cc && --ECX) goto lbl;, cc = Z(ero), E(qual), NonZero, N(on)E(qual)
MOV to/from CR/DR/TR Move to/from special registers CR=control registers, DR=debug registers, TR=test registers (up to 80486)
MOVSD Move string double-word *(dword*)ES:EDI±± = *(dword*)ESI±±; (±± depends on DF); can be prefixed with REP
MOVSX Move with sign-extension (long)r = (signed char) r/m; and similar
MOVZX Move with zero-extension (long)r = (unsigned char) r/m; and similar
OUTSD Output to port from string double-word port[DX] = *(long*)DS:ESI±±; (±± depends on DF, DS: can be overridden); can be prefixed with REP.
POPAD Pop all double-word (32-bit) registers from stack Does not pop register ESP off of stack
POPFD Pop data into EFLAGS register
PUSHAD Push all double-word (32-bit) registers onto stack
PUSHFD Push EFLAGS register onto stack
PUSHD Push a double-word (32-bit) value onto stack
SCASD Scan string data double-word Compares ES:[(E)DI] with EAX and increments or decrements (E)DI, depending on DF; can be prefixed with REP
SETcc Set byte to one on condition, zero otherwise (SETA, SETAE, SETB, SETBE, SETC, SETE, SETG, SETGE, SETL, SETLE, SETNA, SETNAE, SETNB, SETNBE, SETNC, SETNE, SETNG, SETNGE, SETNL, SETNLE, SETNO, SETNP, SETNS, SETNZ, SETO, SETP, SETPE, SETPO, SETS, SETZ)
SHLD Shift left double r1 = r1<<CL r2>>(register_width - CL); Instead of CL, 8-bit immediate can be used.
SHRD Shift right double r1 = r1>>CL r2<<(register_width - CL); Instead of CL, 8-bit immediate can be used.

SHLD and SHRD with 16-bit arguments and a shift-amount greater than 16 produce undefined results. (Actual results differ between different Intel CPUs, with at least three different behaviors known.[10])

STOSD Store string double-word *ES:EDI±± = EAX; (±± depends on DF, ES cannot be overridden); can be prefixed with REP
XBTS Extract Bit String Discontinued with B1 step of 80386.

Used by software mainly for detection of the buggy[11] B0 stepping of the 80386. Microsoft Windows (v2.01 and later) will attempt to run the XBTS instruction as part of its CPU detection if CPUID is not present, and will refuse to boot if XBTS is found to be working.[12]

Compared to earlier sets, the 80386 instruction set also adds opcodes with different parameter combinations for the following instructions: BOUND, IMUL, LDS, LES, MOV, POP, PUSH and prefix opcodes for FS and GS segment overrides.

Added with 80486[edit]

Instruction Opcode Meaning Notes
BSWAP r32 0F C8+r Byte Swap r = r<<24 | r<<8&0x00FF0000 | r>>8&0x0000FF00 | r>>24; Only defined for 32-bit registers. Usually used to change between little endian and big endian representations. When used with 16-bit registers produces various different results on 486,[13] 586, and Bochs/QEMU.[14]
CMPXCHG r/m8, r8 0F A6 /r[15] Compare and Exchange 0F A6/A7 encodings only available on 80486 stepping A.[16]

0F B0/B1 encodings available on 80486 stepping B and later x86 CPUs.

Instruction atomic only if used with LOCK prefix.

0F B0 /r[17]
CMPXCHG r/m, r16/32 0F A7 /r
0F B1 /r
INVD 0F 08 Invalidate Internal Caches Flush internal caches. Modified data present in the cache are not written back to memory, potentially causing data loss.
INVLPG m8 0F 01 /7 Invalidate TLB Entry Invalidate TLB Entry for page that contains data specified.
WBINVD 0F 09 Write Back and Invalidate Cache Writes back all modified cache lines in the processor's internal cache to main memory and invalidates the internal caches.
XADD r/m,r8 0F C0 /r eXchange and ADD Exchanges the first operand with the second operand, then loads the sum of the two values into the destination operand.

Instruction atomic only if used with LOCK prefix.

XADD r/m,r16/32 0F C1 /r

Added with Pentium[edit]

Instruction Opcode Meaning Notes
CPUID 0F A2 CPU IDentification Returns data regarding processor identification and features, and returns data to the EAX, EBX, ECX, and EDX registers. Instruction functions specified by the EAX register.[1] This was also added to later 80486 processors
CMPXCHG8B m64 0F C7 /1 CoMPare and eXCHanGe 8 bytes Compare EDX:EAX with m64. If equal, set ZF and load ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX.

Instruction atomic only if used with LOCK prefix.

LOCK CMPXCHG8B with a register operand (which is an invalid encoding) can cause hangs on some Intel Pentium CPUs (Pentium F00F bug).

RDMSR 0F 32 ReaD from Model-specific register Load MSR specified by ECX into EDX:EAX
RDTSC 0F 31 ReaD Time Stamp Counter Returns the number of processor ticks since the processor being "ONLINE" (since the last power on of system)
WRMSR 0F 30 WRite to Model-Specific Register Write the value in EDX:EAX to MSR specified by ECX
RSM[18] 0F AA Resume from System Management Mode This was introduced by the i386SL and later and is also in the i486SL and later, as well as Cyrix 486SLC/e[19] and later. Resumes from System Management Mode (SMM)

Added with Pentium MMX[edit]

Instruction Opcode Meaning Notes
RDPMC 0F 33 Read the PMC [Performance Monitoring Counter] Specified in the ECX register into registers EDX:EAX

Also MMX registers and MMX support instructions were added. They are usable for both integer and floating point operations, see below.

Added with Pentium Pro[edit]

Instruction Opcode Meaning Notes
CMOVcc r16,r/m
CMOVcc r32,r/m
0F 4x /r Conditional move (CMOVA, CMOVAE, CMOVB, CMOVBE, CMOVC, CMOVE, CMOVG, CMOVGE, CMOVL, CMOVLE, CMOVNA, CMOVNAE, CMOVNB, CMOVNBE, CMOVNC, CMOVNE, CMOVNG, CMOVNGE, CMOVNL, CMOVNLE, CMOVNO, CMOVNP, CMOVNS, CMOVNZ, CMOVO, CMOVP, CMOVPE, CMOVPO, CMOVS, CMOVZ)
UD2 0F 0B Undefined Instruction Generates an invalid opcode exception. This instruction is provided for software testing to explicitly generate an invalid opcode. The opcode for this instruction is reserved for this purpose.
NOP r/m 0F 1F /0 Official long NOP Introduced in the Pentium Pro, but undocumented until 2006.[20]

The whole 0F 18..1F opcode range was NOP in Pentium Pro. However, except for 0F 1F /0, Intel does not guarantee that these opcodes will remain NOP in future processors, and have indeed assigned some of these opcodes to other instructions in at least some processors.[21]

Added with Pentium II[edit]

Instruction Opcode Meaning Notes
SYSENTER 0F 34 SYStem call ENTER Sometimes called the Fast System Call instruction, this instruction was intended to increase the performance of operating system calls.

On the Pentium Pro, the CPUID instruction reports these instructions as available. This is considered incorrect, as the instructions are not officially supported on the Pentium Pro. (Third party testing indicates that the instructions are present but too defective to be usable on the Pentium Pro.[22])

SYSEXIT 0F 35 SYStem call EXIT

Added in specific non-Intel processors[edit]

Added with AMD K6[edit]

These instructions were added with AMD-K6, and are present in all later AMD x86 CPUs. They were also made an integral part of x86-64, and are therefore supported in the 64-bit "Long Mode" operation mode of all 64-bit x86 processors, including processors from Intel and VIA.

Instruction Opcode Meaning Notes
SYSCALL 0F 05 Fast System Call functionally equivalent to SYSENTER
SYSRET 0F 07 Fast System Return functionally equivalent to SYSEXIT

AMD changed the CPUID detection bit for this feature from the K6-II on.

Added as instruction set extensions[edit]

SSE instructions (non-SIMD)[edit]

Added with SSE[edit]
Instruction Opcode Meaning Notes
PREFETCHT0 0F 18 /1 Prefetch Data from Address Prefetch into all cache levels
PREFETCHT1 0F 18 /2 Prefetch Data from Address Prefetch into all cache levels EXCEPT[23][24] L1
PREFETCHT2 0F 18 /3 Prefetch Data from Address Prefetch into all cache levels EXCEPT L1 and L2
PREFETCHNTA 0F 18 /0 Prefetch Data from Address Prefetch to non-temporal cache structure, minimizing cache pollution.
SFENCE 0F AE F8 Store Fence Processor hint to make sure all store operations that took place prior to the SFENCE call are globally visible
Added with SSE2[edit]
Instruction Opcode Meaning Notes
CLFLUSH m8 0F AE /7 Cache Line Flush Invalidates the cache line that contains the linear address specified with the source operand from all levels of the processor cache hierarchy
LFENCE 0F AE E8 Load Fence Serializes load operations.
MFENCE 0F AE F0 Memory Fence Performs a serializing operation on all load and store instructions that were issued prior the MFENCE instruction.
MOVNTI m32, r32 0F C3 /r Move Doubleword Non-Temporal Move doubleword from r32 to m32, minimizing pollution in the cache hierarchy.
PAUSE F3 90 Hint To Suspend Execution Provides a hint to the processor that the following code is a spin loop. Suspends execution of the thread for a number of cycles to free resources for the sibling SMT thread to proceed.
Added with SSE3[edit]
Instruction Opcode Meaning Notes
MONITOR EAX, ECX, EDX 0F 01 C8 Setup Monitor Address Sets up a linear address range to be monitored by hardware and activates the monitor.
MWAIT EAX, ECX 0F 01 C9 Monitor Wait Processor hint to stop instruction execution and enter an implementation-dependent optimized state until occurrence of a class of events.
Added with SSE4.2[edit]
Instruction Opcode Meaning Notes
CRC32 r32, r/m8 F2 0F 38 F0 /r Accumulate CRC32 Computes CRC value using the CRC-32C (Castagnoli) polynomial 0x11EDC6F41 (normal form 0x1EDC6F41). This is the polynomial used in iSCSI. In contrast to the more popular one used in Ethernet, its parity is even, and it can thus detect any error with an odd number of changed bits.
CRC32 r32, r/m8 F2 REX 0F 38 F0 /r
CRC32 r32, r/m16 F2 0F 38 F1 /r
CRC32 r32, r/m32 F2 0F 38 F1 /r
CRC32 r64, r/m8 F2 REX.W 0F 38 F0 /r
CRC32 r64, r/m64 F2 REX.W 0F 38 F1 /r
CRC32 r32, r/m8 F2 0F 38 F0 /r

Added with x86-64[edit]

Except for RDTSCP, these instructions can only be encoded in 64 bit mode. They fall in four groups:

  • original instructions that reuse existing opcodes for a different purpose (MOVSXD replacing ARPL)
  • original instructions with new opcodes (RDTSCP and SWAPGS)
  • existing instructions extended to a 64 bit address size (JRCXZ)
  • existing instructions extended to a 64 bit operand size (remaining instructions)

Most instructions with a 64 bit operand size encode this using a REX.W prefix; in the absence of the REX.W prefix, the corresponding instruction with 32 bit operand size is encoded. This mechanism also applies to most other instructions with 32 bit operand size. These are not listed here as they do not gain a new mnemonic in Intel syntax when used with a 64 bit operand size.

Instruction Encoding Meaning
CDQE REX.W 98 Sign extend EAX into RAX
CQO REX.W 99 Sign extend RAX into RDX:RAX
CMPSQ REX.W A7 CoMPare String Quadword
CMPXCHG16B m128[a] REX.W 0F C7 /1 CoMPare and eXCHanGe 16 Bytes.

Atomic only if used with LOCK prefix.

IRETQ REX.W CF 64-bit Return from Interrupt
JRCXZ rel8 E3 cb Jump if RCX is zero
LODSQ REX.W AD LoaD String Quadword
MOVSXD r64,r/m32 REX.W 63 /r[b] MOV with Sign Extend 32-bit to 64-bit
MOVSQ REX.W A5 Move String Quadword
POPFQ 9D POP RFLAGS Register
PUSHFQ 9C PUSH RFLAGS Register
RDTSCP 0F 01 F9 ReaD Time Stamp Counter and Processor ID
SCASQ REX.W AF SCAn String Quadword
STOSQ REX.W AB STOre String Quadword
SWAPGS 0F 01 F8 Exchange GS base with KernelGSBase MSR
  1. ^ The CMPXCHG16B instruction was absent from a few of the earliest Intel/AMD x86-64 processors. On Intel processors, the instruction was missing from Xeon "Nocona" stepping D,[25] but added in stepping E.[26] On AMD K8 family processors, it was added in stepping F, at the same time as DDR2 support was introduced.[27]

    For this reason, CMPXCHG16B has its own CPUID flag, separate from the rest of x86-64.

  2. ^ Encodings of MOVSXD without REX.W prefix are permitted but discouraged[28] - such encodings behave identically to 16/32-bit MOV (8B /r).

Bit manipulation extensions[edit]

Added with ABM[edit]

LZCNT, POPCNT (POPulation CouNT) – advanced bit manipulation

Added with BMI1[edit]

ANDN, BEXTR, BLSI, BLSMSK, BLSR, TZCNT

Added with BMI2[edit]

BZHI, MULX, PDEP, PEXT, RORX, SARX, SHRX, SHLX

Added with CLMUL instruction set[edit]

Instruction Opcode Description
PCLMULQDQ xmmreg,xmmrm,imm 66 0f 3a 44 /r ib Perform a carry-less multiplication of two 64-bit polynomials over the finite field GF(2k).
PCLMULLQLQDQ xmmreg,xmmrm 66 0f 3a 44 /r 00 Multiply the low halves of the two registers.
PCLMULHQLQDQ xmmreg,xmmrm 66 0f 3a 44 /r 01 Multiply the high half of the destination register by the low half of the source register.
PCLMULLQHQDQ xmmreg,xmmrm 66 0f 3a 44 /r 10 Multiply the low half of the destination register by the high half of the source register.
PCLMULHQHQDQ xmmreg,xmmrm 66 0f 3a 44 /r 11 Multiply the high halves of the two registers.

Added with Intel ADX[edit]

Instruction Description
ADCX Adds two unsigned integers plus carry, reading the carry from the carry flag and if necessary setting it there. Does not affect other flags than the carry.
ADOX Adds two unsigned integers plus carry, reading the carry from the overflow flag and if necessary setting it there. Does not affect other flags than the overflow.

Added with Intel TSX[edit]

Instruction Opcode Description
XBEGIN rel16/32 C7 F8 cw/cd Start transaction. If transaction fails, perform a branch to the given relative offset.
XEND 0F 01 D5 End transaction.
XABORT imm8 C6 F8 ib Abort transaction with 8-bit immediate as error code.
XACQUIRE F2 Instruction prefix to indicate start of hardware lock elision, used with memory atomic instructions only (for other instructions, the F2 prefix may have other meanings). When used with such instructions, may start a transaction instead of performing the memory atomic operation.
XRELEASE F3 Instruction prefix to indicate end of hardware lock elision, used with memory atomic/store instructions only (for other instructions, the F3 prefix may have other meanings). When used with such instructions during hardware lock elision, will end the associated transaction instead of performing the store/atomic.

Added with Intel CET[edit]

CET adds two distinct features to help protect against security exploits such as return-oriented programming: a shadow stack (CET_SS), and indirect branch tracking (CET_IBT).

Instruction Opcode Description Notes
INCSSPD r32 F3 0F AE /5 Increment shadow stack pointer Shadow stack (CET_SS).

When shadow stacks are enabled, return addresses are pushed on both the regular stack and the shadow stack when a function call is made. They are then both popped on return from the function call - if they do not match, then the stack is assumed to be corrupted, and a #CP exception is issued.

The shadow stack is additionally required to be stored in specially marked memory pages which cannot be modified by normal memory store instructions.

INCSSPQ r64 F3 REX.W 0F AE /5
RDSSPD r32 F3 0F 1E /1 Read shadow stack pointer into register (low 32 bits)
RDSSPQ r64 F3 REX.W 0F 1E /1 Read shadow stack pointer into register (full 64 bits)
SAVEPREVSSP F3 0F 01 EA Save previous shadow stack pointer
RSTORSSP m64 F3 0F 01 /5 Restore saved shadow stack pointer
WRSSD m32,r32 0F 38 F6 /r Write 4 bytes to shadow stack
WRSSQ m64,r64 REX.W 0F 38 F6 /r Write 8 bytes to shadow stack
WRUSSD m32,r32 66 0F 38 F5 /r Write 4 bytes to user shadow stack
WRUSSQ m64,r64 66 REX.W 0F 38 F5 /r Write 8 bytes to user shadow stack
SETSSBSY F3 0F 01 E8 Mark shadow stack busy
CLRSSBSY m64 F3 0F AE /6 Clear shadow stack busy flag
ENDBR32 F3 0F 1E FB Terminate indirect branch in 32-bit mode Indirect Branch Tracking (CBT_IBT).

When IBT is enabled, an indirect branch (jump, call, return) to any instruction that is not an ENDBR32/64 instruction will cause a #CP exception.

ENDBR64 F3 0F 1E FA Terminate indirect branch in 64-bit mode
(no mnemonic) 3E Prefix used with indirect CALL/JMP near instructions (opcodes FF /2 and FF /4) to indicate that the branch target is not required to start with an ENDBR32/64 instruction. Prefix only honored when NO_TRACK_EN flag is set.

This prefix has the same encoding as the DS: segment override prefix - as of April 2022, Intel documentation does not appear to specify whether this prefix also retains its old segment-override function when used as a no-track prefix, nor does it provide an official mnemonic for this prefix.[29][30] (GNU binutils use "notrack"[31])

x87 floating-point instructions[edit]

The x87 coprocessor, if present, provides support for floating-point arithmetic. The coprocessor provides eight data registers, each holding one 80-bit floating-point value (1 sign bit, 15 exponent bits, 64 mantissa bits) - these registers are organized as a stack, with the top-of-stack register referred to as "st" or "st(0)", and the other registers referred to as st(1),st(2),...st(7). It additionally provides a number of control and status registers, including "PC" (precision control, to control whether floating-point operations should be rounded to 24, 53 or 64 mantissa bits) and "RC" (rounding control, to pick rounding-mode: round-to-zero, round-to-positive-infinity, round-to-negative-infinity, round-to-nearest-even) and a 4-bit condition code register "CC", whose four bits are individually referred to as C0,C1,C2 and C3). Not all of the arithmetic instructions provided by x87 obey PC and RC.

Original 8087 instructions[edit]

Instruction description Mnemonic Opcode Additional items
x87 Non-Waiting[a] FPU Control Instructions Waiting
mnemonic[b]
Initialize x87 FPU FNINIT DB E3 FINIT
Load x87 Control Word FLDCW m16 D9 /5 (none)
Store x87 Control Word FNSTCW m16 D9 /7 FSTCW
Store x87 Status Word FNSTSW m16 DD /7 FSTSW
Clear x87 Exception Flags FNCLEX DB E2 FCLEX
Load x87 FPU Environment FLDENV m112/m224[c] D9 /4 (none)
Store x87 FPU Environment FNSTENV m112/m224[c] D9 /6 FSTENV
Save x87 FPU State, then initialize x87 FPU FNSAVE m752/m864[c] DD /6 FSAVE
Restore x87 FPU State FRSTOR m752/m864[c] DD /4 (none)
Enable Interrupts (8087 only)[d] FNENI DB E0 FENI
Disable Interrupts (8087 only)[d] FNDISI DB E1 FDISI
x87 Floating-point Load/Store/Move Instructions precision
control
rounding
control
Load floating-point value onto stack FLD m32 D9 /0 No
FLD m64 DD /0
FLD m80 DB /5
FLD st(i) D9 C0+i
Store top-of-stack floating-point value to memory or stack register FST m32 D9 /2 No Yes
FST m64 DD /2
FST st(i)[e] DD D0+i No
Store top-of-stack floating-point value to memory or stack register, then pop FSTP m32 D9 /3 No Yes
FSTP m64 DD /3
FSTP m80[e] DB /7 No
FSTP st(i)[e][f] DD D8+i
DF D0+i[g]
DF D8+i[g]
Push +0.0 onto stack FLDZ D9 EE No
Push +1.0 onto stack FLD1 D9 E8
Push π (approximately 3.14159) onto stack FLDPI D9 EB No 387[h]
Push (approximately 3.32193) onto stack FLDL2T D9 E9
Push (approximately 1.44269) onto stack FLDL2E D9 EA
Push (approximately 0.30103) onto stack FLDLG2 D9 EC
Push (approximately 0.69315) onto stack FLDLN2 D9 ED
Exchange top-of-stack register with other stack register FXCH st(i)[i][j] D9 C8+i No
DD C8+i[g]
DF C8+i[g]
x87 Integer Load/Store Instructions precision
control
rounding
control
Load signed integer value onto stack from memory, with conversion to floating-point FILD m16 DF /0 No
FILD m32 DB /0
FILD m64 DF /5
Store top-of-stack value to memory, with conversion to signed integer FIST m16 DF /2 No Yes
FIST m32 DB /2
Store top-of-stack value to memory, with conversion to signed integer, then pop stack FISTP m16 DF /3 No Yes
FISTP m32 DB /3
FISTP m64 DF /7
Load 18-digit Binary-Coded-Decimal integer value onto stack from memory, with conversion to floating-point FBLD m80[k] DF /4 No
Store top-of-stack value to memory, with conversion to 18-digit Binary-Coded-Decimal integer, then pop stack FBSTP m80 DF /6 No 387[h]
x87 Basic Arithmetic Instructions precision
control
rounding
control
Floating-point add
dst <- dst + src
FADD m32 D8 /0 Yes Yes
FADD m64 DC /0
FADD st,st(i) D8 C0+i
FADD st(i),st DC C0+i
Floating-point multiple
dst <- dst * src
FMUL m32 D8 /1 Yes Yes
FMUL m64 DC /1
FMUL st,st(i) D8 C8+i
FMUL st(i),st DC C8+i
Floating-point subtract
dst <- dst - src
FSUB m32 D8 /4 Yes Yes
FSUB m64 DC /4
FSUB st,st(i) D8 E0+i
FSUB st(i),st DC E8+i
Floating-point reverse subtract
dst <- src - dst
FSUBR m32 D8 /5 Yes Yes
FSUBR m64 DC /5
FSUBR st,st(i) D8 E8+i
FSUBR st(i),st DC E0+i
Floating-point divide[l]
dst <- dst / src
FDIV m32 D8 /6 Yes Yes
FDIV m64 DC /6
FDIV st,st(i) D8 F0+i
FDIV st(i),st DC F8+i
Floating-point reverse divide
dst <- src / dst
FDIVR m32 D8 /7 Yes Yes
FDIVR m64 DC /7
FDIVR st,st(i) D8 F8+i
FDIVR st(i),st DC F0+i
Floating-point compare
CC <- result_of( st(0) - src )
Same operation as subtract, except that it updates the x87 CC status register instead of any of the FPU stack registers
FCOM m32 D8 /2 No
FCOM m64 DC /2
FCOM st(i)[i] D8 D0+i
DC D0+i[g]
x87 Basic Arithmetic Instructions with Stack Pop precision
control
rounding
control
Floating-point add and pop FADDP st(i),st[i] DE C0+i Yes Yes
Floating-point multiply and pop FMULP st(i),st[i] DE C8+i Yes Yes
Floating-point subtract and pop FSUBP st(i),st[i] DE E8+i Yes Yes
Floating-point reverse-subtract and pop FSUBRP st(i),st[i] DE E0+i Yes Yes
Floating-point divide and pop FDIVP st(i),st[i] DE F8+i Yes Yes
Floating-point reverse-divide and pop FDIVRP st(i),st[i] DE F0+i Yes Yes
Floating-point compare and pop FCOMP m32 D8 /3 No
FCOMP m64 DC /3
FCOMP st(i)[i] D8 D8+i
DC D8+i[g]
DE D0+i[g]
Floating-point compare to st(1), then pop twice FCOMPP DE D9 No
x87 Basic Arithmetic Instructions with Integer Source Argument precision
control
rounding
control
Floating-point add by integer FIADD m16 DA /0 Yes Yes
FIADD m32 DE /0
Floating-point multiply by integer FIMUL m16 DA /1 Yes Yes
FIMUL m32 DE /1
Floating-point subtract by integer FISUB m16 DA /4 Yes Yes
FISUB m32 DE /4
Floating-point reverse-subtract by integer FISUBR m16 DA /5 Yes Yes
FISUBR m32 DE /5
Floating-point divide by integer FIDIV m16 DA /6 Yes Yes
FIDIV m32 DE /6
Floating-point reverse-divide by integer FIDIVR m16 DA /7 Yes Yes
FIDIVR m32 DE /7
Floating-point compare to integer FICOM m16 DA /2 No
FICOM m32 DE /2
Floating-point compare to integer, and stack pop FICOMP m16 DA /3 No
FICOMP m32 DE /3
x87 Additional Arithmetic Instructions precision
control
rounding
control
Floating-point change sign FCHS D9 E0 No
Floating-point absolute value FABS D9 E1 No
Floating-point compare top-of-stack value to 0 FTST D9 E4 No
Classify top-of-stack st(0) register value.
The classification result is stored in the x87 CC register.[m]
FXAM D9 E5 No
Split the st(0) value into two values E and M representing the exponent and mantissa of st(0).
The split is done such that , where E is an integer and M is a number whose absolute value is within the range .  [n]
st(0) is then replaced with E, after which M is pushed onto the stack.
FXTRACT D9 F4 No
Floating-point partial[o] remainder (not IEEE 754 compliant):
FPREM D9 F8 No [p]
Floating-point square root FSQRT D9 FA Yes Yes
Floating-point round to integer FRNDINT D9 FC No Yes
Floating-point power-of-2 scaling. Rounds the value of st(1) to integer with round-to-zero, then uses it as a scale factor for st(0):[q]
FSCALE D9 FD No Yes
x87 Transcendental Instructions[r] Source operand
range restriction
Base-2 exponential minus 1, with extra precision for st(0) close to 0:
F2XM1 D9 F0 8087: 
80387: 
Base-2 Logarithm:
followed by stack pop
FYL2X[s] D9 F1 no restrictions
Partial Tangent: Computes from st(0) a pair of values X and Y, such that
The Y value replaces the top-of-stack value, and then X is pushed onto the stack.
On 80387 and later x87, but not original 8087, X is always 1.0
FPTAN D9 F2 8087: 
80387: 
Two-argument arctangent with quadrant adjustment:[t]
followed by stack pop
FPATAN D9 F3 8087: 
80387: no restrictions
Base-2 Logarithm plus 1, with extra precision for st(0) close to 0:
followed by stack pop
FYL2XP1[s] D9 F9 Intel: 
AMD: 
Other x87 Instructions
No operation[u] FNOP D9 D0
Decrement x87 FPU Register Stack Pointer FDECSTP D9 F6
Increment x87 FPU Register Stack Pointer FINCSTP D9 F7
Free x87 FPU Register FFREE st(i) DD C0+i
Check and handle pending unmasked x87 FPU exceptions WAIT,
FWAIT
9B
Floating-point store and pop, without stack underflow exception FSTPNCE st(i) D9 D8+i[g]
Free x87 register, then stack pop FFREEP st(i) DF C0+i[g]
  1. ^ x87 coprocessors (other than the 8087) handle exceptions in a fairly unusual way. When an x87 instruction generates an unmasked arithmetic exception, it will still complete without causing a CPU fault - instead of causing a fault, it will record within the coprocessor information needed to handle the exception (instruction pointer, opcode, data pointer if the instruction had a memory operand) and set FPU status-word flag to indicate that a pending exception is present. This pending exception will then cause a CPU fault when the next x87, MMX or WAIT instruction is executed.
    The exception to this is x87's "Non-Waiting" instructions, which will execute without causing such a fault even if a pending exception is present. These instructions are mostly control instructions that can inspect and/or modify the pending-exception state of the x87 FPU.
  2. ^ For each non-waiting x87 instruction whose mnemonic begins with FN, there exists a pseudo-instruction that has the same mnemonic except without the N. These pseudo-instructions consist of a WAIT instruction (opcode 9B) followed by the corresponding non-waiting x87 instruction. For example:
    • FNCLEX is an instruction with the opcode DB E2. The corresponding pseudo-instruction FCLEX is then encoded as 9B DB E2.
    • FNSAVE ES:[BX+6] is an instruction with the opcode 26 DD 77 06. The corresponding pseudo-instruction FSAVE ES:[BX+6] is then encoded as 9B 26 DD 77 06
    These pseudo-instructions are commonly recognized by x86 assemblers and disassemblers and treated as single instructions, even though all x86 CPUs with x87 coprocessors execute them as a sequence of two instructions.
  3. ^ a b c d On 80387 and later x87 FPUs, FLDENV, F(N)STENV, FRSTOR and F(N)SAVE exist in 16-bit and 32-bit variants. The 16-bit variants will load/store a 14-byte floating-point environment data structure to/from memory - the 32-bit variants will load/store a 28-byte data structure instead. (F(N)SAVE/FRSTOR will additionally load/store an additional 80 bytes of FPU data register content after the FPU environment, for a total of 94 or 108 bytes). The choice between the 16-bit and 32-bit variants is based on the CS.D bit and the presence of the 66h instruction prefix. On 8087 and 80287, only the 16-bit variants are available.
    64-bit variants of these instructions do not exist - using REX.W under x86-64 will cause the 32-bit variants to be used. Since these can only load/store the bottom 32 bits of FIP and FDP, it is recommended to use FXSAVE/FXRSTOR instead if 64-bit operation is desired.
  4. ^ a b In the case of an x87 instruction producing an unmasked FPU exception, the 8087 FPU will signal an IRQ some indeterminate time after the instruction was issued. This may not always be possible to handle,[32] and so the FPU offers the F(N)DISI and F(N)ENI instructions to set/clear the Interrupt Mask bit (bit 7) of the x87 Control Word,[33] to control the interrupt.
    Later x87 FPUs, from 80287 onwards, changed the FPU exception mechanism to instead produce a CPU exception on the next x87 instruction. This made the Interrupt Mask bit unnecessary, so it was removed.[34] In The F(N)ENI and F(N)DISI instructions were kept for backwards compatibility, executing as NOPs that do not modify any x87 state.
  5. ^ a b c FST/FSTP with an 80-bit destination (m80 or st(i)) and an sNaN source value will produce exceptions on AMD but not Intel FPUs.
  6. ^ FSTP ST(0) is a commonly used idiom for popping a single register off the x87 register stack.
  7. ^ a b c d e f g h i Intel x87 alias opcode. Use of this opcode is not recommended.

    On the Intel 8087 coprocessor, several reserved opcodes would perform operations behaving similarly to existing defined x87 instructions. These opcodes were documented for the 8087[35] and 80287,[36] but then omitted from later manuals until the October 2017 update of the Intel SDM.[37]

    They are present on all known Intel x87 FPUs but unavailable on some older non-Intel FPUs, such as AMD Geode GX/LX, DM&P Vortex86[38] and NexGen 586PF.[39]

  8. ^ a b On the 8087 and 80287, FBSTP and the load-constant instructions always use the round-to-nearest rounding mode. On the 80387 and later x87 FPUs, these instructions will use the rounding mode specified in the x87 RC register.
  9. ^ a b c d e f g h i For the FADDP, FSUBP, FSUBRP, FMULP, FDIVP, FDIVRP, FCOM, FCOMP and FXCH instructions, x86 assemblers/disassemblers may recognize variants of the instructions with no arguments. Such variants are equivalent to variants using st(1) as their first argument.
  10. ^ On Intel Pentium and later processors, FXCH is implemented as a register renaming rather than a true data move. This has no semantic effect, but enables zero-cycle-latency operation. It also allows the instruction to break data dependencies for the x87 top-of-stack value, improving attainable performance for code optimized for these processors.
  11. ^ The result of executing the FBLD instruction on non-BCD data is undefined.
  12. ^ On early Intel Pentium processors, floating-point divide was subject to the Pentium FDIV bug. This also affected instructions that perform divide as part of their operations, such as FPREM and FPATAN.[40]
  13. ^ The FXAM instruction will set C0, C2 and C3 based on value type in st(0) as follows:
    C3 C2 C0 Classification
    0 0 0 Unsupported (unnormal or pseudo-NaN)
    0 0 1 NaN
    0 1 0 Normal finite number
    0 1 1 Infinity
    1 0 0 Zero
    1 0 1 Empty
    1 1 0 Denormal number
    1 1 1 Empty (may occur on 8087/80287 only)

    C1 is set to the sign-bit of st(0), regardless of whether st(0) is Empty or not.

  14. ^ For FXTRACT, if st(0) is zero or ±∞, then M is set equal to st(0). If st(0) is zero, E is set to 0 on 8087/80287 but -∞ on 80387 and later. If st(0) is ±∞, then E is set to +∞.
  15. ^ For FPREM, if the quotient Q is larger than , then the remainder calculation may have been done only partially - in this case, the FPREM instruction will need to be run again in order to complete the remainder calculation. This is indicated by the instruction setting C2 to 1.
    If the instruction did complete the remainder calculation, it will set C2 to 0 and set the three bits {C0,C3,C1} to the bottom three bits of the quotient Q.
  16. ^ The remainder computation done by the FPREM instruction is always exact with no roundoff errors.
  17. ^ For the FSCALE instruction on 8087 and 80287, st(1) is required to be in the range . Also, its absolute value must be either 0 or at least 1. If these requirements are not satisfied, the result is undefined.
    These restrictions were removed in the 80387.
  18. ^ The x87 transcendental instructions do not obey PC or RC, but instead compute full 80-bit results. These results are not necessarily correctly rounded (see Table-maker's dilemma) - they may have an error of up to ±1 ulp on Pentium or later, or up to ±1.5 ulps on earlier x87 coprocessors.
  19. ^ a b For the FYL2X and FYL2XP1, the maximum error bound of ±1 ulp only holds for st(1)=1.0 - for other values of st(1), the error bound is increased to ±1.35 ulps.
  20. ^ For FPATAN, the following adjustments are done as compared to just computing a one-argument arctangent of the ratio :
    • If both st(0) and st(1) are ±∞, then the arctangent is computed as if each of st(0) and st(1) had been replaced with ±1 of the same sign. This produces a result that is an odd multiple of .
    • If both st(0) and st(1) are ±0, then the arctangent is computed as if st(0) had been replaced with ±1 of the same sign, producing a result of ±0 or .
    • If st(0) is negative (has sign bit set), then an addend of with the same sign as st(1) is added to the result.
  21. ^ While FNOP is a no-op in the sense that will leave the x87 FPU register stack unmodified, it may still modify FIP and CC, and it may fault if a pending x87 FPU exception is present.

x87 instructions added in later processors[edit]

Instruction description Mnemonic Opcode Additional items
x87 Non-Waiting Control Instructions added in 80287 Waiting
mnemonic
Notify FPU of entry into Protected Mode FNSETPM[a] DB E4 FSETPM
Store x87 Status Word to AX FNSTSW AX DF E0 FSTSW AX
x87 Instructions added in 80387 Source operand
range restriction
Floating-point unordered compare
Similar to regular compare, except will not produce an exception in response to any qNaN operands.
FUCOM st(i)[b] DD E0+i no restriction
Floating-point unordered compare and pop FUCOMP st(i)[b] DD E8+i
Floating-point unordered compare to st(1), then pop twice FUCOMPP DA E9
IEEE 754 compliant floating-point partial remainder.[c] FPREM1 D9 F5
Floating-point sine and cosine.
Computes two values and  [d]
Top-of-stack st(0) is replaced with S, after which C is pushed onto the stack.
FSINCOS D9 FB
Floating-point sine.[d]
FSIN D9 FE
Floating-point cosine.[d]
FCOS D9 FF
x87 Instructions added in Pentium Pro Condition for
conditional moves
Floating-point conditional move to st(0) based on EFLAGS FCMOVB st(0),st(i) DA C0+i below (CF=1)
FCMOVE st(0),st(i) DA C8+i equal (ZF=1)
FCMOVBE st(0),st(i) DA D0+i below or equal
(CF=1 or ZF=1)
FCMOVU st(0),st(i) DA D8+i unordered (PF=1)
FCMOVNB st(0),st(i) DB C0+i not below (CF=0)
FCMOVNE st(0),st(i) DB C8+i not equal (ZF=0)
FCMOVNBE st(0),st(i) DB D0+i not below or equal
(CF=0 and ZF=0)
FCMOVNU st(0),st(i) DB D8+i not unordered (PF=0)
Floating-point compare and set EFLAGS.
Differs from regular floating-point compare in that it puts its result in the integer EFLAGS register rather than the x87 CC register.[e]
FCOMI st(0),st(i) DB F0+i
Floating-point compare and set EFLAGS, then pop FCOMIP st(0),st(i) DF F0+i
Floating-point unordered compare and set EFLAGS FUCOMI st(0),st(i) DB E8+i
Floating-point unordered compare and set EFLAGS, then pop FUCOMIP st(0),st(i) DF E8+i
x87 Non-Waiting Instructions added in Pentium II[f]
Save x87, MMX and SSE state to 512-byte data structure[g][h][i] FXSAVE m512byte NP 0F AE /0
Restore x87, MMX and SSE state from 512-byte data structure[g][h] FXRSTOR m512byte NP 0F AE /1
x87 Instructions added as part of SSE3
Floating-point store integer and pop, with round-to-zero FISTTP m16 DF /1
FISTTP m32 DB /1
FISTTP m64 DD /1
  1. ^ The x87 FPU needs to know whether it is operating in Real Mode or Protected Mode because the floating-point environment accessed by the F(N)SAVE, FRSTOR, FLDENV and F(N)STENV instructions has different formats in Real Mode and Protected Mode. On 80287, the F(N)SETPM instruction is required to communicate the real-to-protected mode transition to the FPU. On 80387 and later x87 FPUs, real↔protected mode transitions are communicated automatically to the FPU without the need for any dedicated instructions - therefore, on these FPUs, FNSETPM executes as a NOP that does not modify any FPU state.
  2. ^ a b For the FUCOM and FUCOMP instructions, x86 assemblers/disassemblers may recognize variants of the instructions with no arguments. Such variants are equivalent to variants using st(1) as their first argument.
  3. ^ The 80387 FPREM1 instruction differs from the older FPREM (D9 F8) instruction in that the quotient Q is rounded to integer with round-to-nearest-even rounding rather than the round-to-zero rounding used by FPREM. Like FPREM, FPREM1 always computes an exact result with no roundoff errors. Like FPREM, it may also perform a partial computation if the quotient is too large, in which case it must be run again.
  4. ^ a b c Due to the x87 FPU performing argument reduction for sin/cos with only about 68 bits of precision, the value of k used in the calculation of FSIN, FCOS and FSINCOS is not precisely 1.0, but instead given by[41][42]
    This argument reduction inaccuracy also affects the FPTAN instruction.
  5. ^ The FCOMI, FCOMIP, FUCOMI and FUCOMIP instructions write their results to the ZF, CF and PF bits of the EFLAGS register. On Intel but not AMD processors, the SF, AF and OF bits of EFLAGS are also zeroed out by these instructions.
  6. ^ The FXSAVE and FXRSTOR instructions were added in the "Deschutes" revision of Pentium II, and are not present in earlier "Klamath" revision.
  7. ^ a b The FXSAVE and FXRSTOR instructions will save/restore SSE state only on processors that support SSE. Otherwise, they will only save/restore x87 and MMX state.
    The x87 section of the state saved/restored by FXSAVE/FXRSTOR has a completely different layout than the data structure of the older F(N)SAVE/FRSTOR instructions, enabling faster save/restore.
  8. ^ a b When floating-point emulation is enabled with CR0.EM=1, FXSAVE and FXRSTOR are considered to be x87 instructions and will accordingly produce an #NM (device-not-available) exception. Other than WAIT, these are the only opcodes outside the D8..DF ESC opcode space that exhibit this behavior. (All opcodes in D8..DF will produce #NM if CR0.EM=1, even for undefined opcodes that would produce #UD otherwise.
  9. ^ Unlike the older F(N)SAVE instruction, FXSAVE will not initialize the FPU after saving its state to memory, but instead leave the x87 coprocessor state unmodified.

SIMD instructions[edit]

MMX instructions[edit]

MMX instructions operate on the mm registers, which are 64 bits wide. They are shared with the FPU registers.

Original MMX instructions[edit]

Added with Pentium MMX

Instruction Opcode Meaning Notes
EMMS 0F 77 Empty MMX Technology State Marks all x87 FPU registers for use by FPU
MOVD mm, r/m32 0F 6E /r Move doubleword
MOVD r/m32, mm 0F 7E /r Move doubleword
MOVQ mm/m64, mm 0F 7F /r Move quadword
MOVQ mm, mm/m64 0F 6F /r Move quadword
MOVQ mm, r/m64 REX.W + 0F 6E /r Move quadword
MOVQ r/m64, mm REX.W + 0F 7E /r Move quadword
PACKSSDW mm1, mm2/m64 0F 6B /r Pack doublewords to words (signed with saturation)
PACKSSWB mm1, mm2/m64 0F 63 /r Pack words to bytes (signed with saturation)
PACKUSWB mm, mm/m64 0F 67 /r Pack words to bytes (unsigned with saturation)
PADDB mm, mm/m64 0F FC /r Add packed byte integers
PADDW mm, mm/m64 0F FD /r Add packed word integers
PADDD mm, mm/m64 0F FE /r Add packed doubleword integers
PADDQ mm, mm/m64 0F D4 /r Add packed quadword integers
PADDSB mm, mm/m64 0F EC /r Add packed signed byte integers and saturate
PADDSW mm, mm/m64 0F ED /r Add packed signed word integers and saturate
PADDUSB mm, mm/m64 0F DC /r Add packed unsigned byte integers and saturate
PADDUSW mm, mm/m64 0F DD /r Add packed unsigned word integers and saturate
PAND mm, mm/m64 0F DB /r Bitwise AND
PANDN mm, mm/m64 0F DF /r Bitwise AND NOT
POR mm, mm/m64 0F EB /r Bitwise OR
PXOR mm, mm/m64 0F EF /r Bitwise XOR
PCMPEQB mm, mm/m64 0F 74 /r Compare packed bytes for equality
PCMPEQW mm, mm/m64 0F 75 /r Compare packed words for equality
PCMPEQD mm, mm/m64 0F 76 /r Compare packed doublewords for equality
PCMPGTB mm, mm/m64 0F 64 /r Compare packed signed byte integers for greater than
PCMPGTW mm, mm/m64 0F 65 /r Compare packed signed word integers for greater than
PCMPGTD mm, mm/m64 0F 66 /r Compare packed signed doubleword integers for greater than
PMADDWD mm, mm/m64 0F F5 /r Multiply packed words, add adjacent doubleword results
PMULHW mm, mm/m64 0F E5 /r Multiply packed signed word integers, store high 16 bits of results
PMULLW mm, mm/m64 0F D5 /r Multiply packed signed word integers, store low 16 bits of results
PSLLW mm1, imm8 0F 71 /6 ib Shift left words, shift in zeros
PSLLW mm, mm/m64 0F F1 /r Shift left words, shift in zeros
PSLLD mm, imm8 0F 72 /6 ib Shift left doublewords, shift in zeros
PSLLD mm, mm/m64 0F F2 /r Shift left doublewords, shift in zeros
PSLLQ mm, imm8 0F 73 /6 ib Shift left quadword, shift in zeros
PSLLQ mm, mm/m64 0F F3 /r Shift left quadword, shift in zeros
PSRAD mm, imm8 0F 72 /4 ib Shift right doublewords, shift in sign bits
PSRAD mm, mm/m64 0F E2 /r Shift right doublewords, shift in sign bits
PSRAW mm, imm8 0F 71 /4 ib Shift right words, shift in sign bits
PSRAW mm, mm/m64 0F E1 /r Shift right words, shift in sign bits
PSRLW mm, imm8 0F 71 /2 ib Shift right words, shift in zeros
PSRLW mm, mm/m64 0F D1 /r Shift right words, shift in zeros
PSRLD mm, imm8 0F 72 /2 ib Shift right doublewords, shift in zeros
PSRLD mm, mm/m64 0F D2 /r Shift right doublewords, shift in zeros
PSRLQ mm, imm8 0F 73 /2 ib Shift right quadword, shift in zeros
PSRLQ mm, mm/m64 0F D3 /r Shift right quadword, shift in zeros
PSUBB mm, mm/m64 0F F8 /r Subtract packed byte integers
PSUBW mm, mm/m64 0F F9 /r Subtract packed word integers
PSUBD mm, mm/m64 0F FA /r Subtract packed doubleword integers
PSUBSB mm, mm/m64 0F E8 /r Subtract signed packed bytes with saturation
PSUBSW mm, mm/m64 0F E9 /r Subtract signed packed words with saturation
PSUBUSB mm, mm/m64 0F D8 /r Subtract unsigned packed bytes with saturation
PSUBUSW mm, mm/m64 0F D9 /r Subtract unsigned packed words with saturation
PUNPCKHBW mm, mm/m64 0F 68 /r Unpack and interleave high-order bytes
PUNPCKHWD mm, mm/m64 0F 69 /r Unpack and interleave high-order words
PUNPCKHDQ mm, mm/m64 0F 6A /r Unpack and interleave high-order doublewords
PUNPCKLBW mm, mm/m32 0F 60 /r Unpack and interleave low-order bytes
PUNPCKLWD mm, mm/m32 0F 61 /r Unpack and interleave low-order words
PUNPCKLDQ mm, mm/m32 0F 62 /r Unpack and interleave low-order doublewords

MMX instructions added in specific processors[edit]

MMX instructions added with MMX+ and SSE[edit]

The following MMX instruction were added with SSE. They are also available on the Athlon under the name MMX+.

Instruction Opcode Meaning
MASKMOVQ mm1, mm2 0F F7 /r Masked Move of Quadword
MOVNTQ m64, mm 0F E7 /r Move Quadword Using Non-Temporal Hint
PSHUFW mm1, mm2/m64, imm8 0F 70 /r ib Shuffle Packed Words
PINSRW mm, r32/m16, imm8 0F C4 /r Insert Word
PEXTRW reg, mm, imm8 0F C5 /r Extract Word
PMOVMSKB reg, mm 0F D7 /r Move Byte Mask
PMINUB mm1, mm2/m64 0F DA /r Minimum of Packed Unsigned Byte Integers
PMAXUB mm1, mm2/m64 0F DE /r Maximum of Packed Unsigned Byte Integers
PAVGB mm1, mm2/m64 0F E0 /r Average Packed Integers
PAVGW mm1, mm2/m64 0F E3 /r Average Packed Integers
PMULHUW mm1, mm2/m64 0F E4 /r Multiply Packed Unsigned Integers and Store High Result
PMINSW mm1, mm2/m64 0F EA /r Minimum of Packed Signed Word Integers
PMAXSW mm1, mm2/m64 0F EE /r Maximum of Packed Signed Word Integers
PSADBW mm1, mm2/m64 0F F6 /r Compute Sum of Absolute Differences
MMX instructions added with SSE2[edit]

The following MMX instructions were added with SSE2:

Instruction Opcode Meaning
PSUBQ mm1, mm2/m64 0F FB /r Subtract quadword integer
PMULUDQ mm1, mm2/m64 0F F4 /r Multiply unsigned doubleword integer
MMX instructions added with SSSE3[edit]
Instruction Opcode Meaning
PSIGNB mm1, mm2/m64 0F 38 08 /r Negate/zero/preserve packed byte integers depending on corresponding sign
PSIGNW mm1, mm2/m64 0F 38 09 /r Negate/zero/preserve packed word integers depending on corresponding sign
PSIGND mm1, mm2/m64 0F 38 0A /r Negate/zero/preserve packed doubleword integers depending on corresponding sign
PSHUFB mm1, mm2/m64 0F 38 00 /r Shuffle bytes
PMULHRSW mm1, mm2/m64 0F 38 0B /r Multiply 16-bit signed words, scale and round signed doublewords, pack high 16 bits
PMADDUBSW mm1, mm2/m64 0F 38 04 /r Multiply signed and unsigned bytes, add horizontal pair of signed words, pack saturated signed-words
PHSUBW mm1, mm2/m64 0F 38 05 /r Subtract and pack 16-bit signed integers horizontally
PHSUBSW mm1, mm2/m64 0F 38 07 /r Subtract and pack 16-bit signed integer horizontally with saturation
PHSUBD mm1, mm2/m64 0F 38 06 /r Subtract and pack 32-bit signed integers horizontally
PHADDSW mm1, mm2/m64 0F 38 03 /r Add and pack 16-bit signed integers horizontally, pack saturated integers to mm1.
PHADDW mm1, mm2/m64 0F 38 01 /r Add and pack 16-bit integers horizontally
PHADDD mm1, mm2/m64 0F 38 02 /r Add and pack 32-bit integers horizontally
PALIGNR mm1, mm2/m64, imm8 0F 3A 0F /r ib Concatenate destination and source operands, extract byte-aligned result shifted to the right
PABSB mm1, mm2/m64 0F 38 1C /r Compute the absolute value of bytes and store unsigned result
PABSW mm1, mm2/m64 0F 38 1D /r Compute the absolute value of 16-bit integers and store unsigned result
PABSD mm1, mm2/m64 0F 38 1E /r Compute the absolute value of 32-bit integers and store unsigned result

SSE instructions[edit]

Added with Pentium III

SSE instructions operate on xmm registers, which are 128 bit wide.

SSE consists of the following SSE SIMD floating-point instructions:

Instruction Opcode Meaning
ANDPS* xmm1, xmm2/m128 0F 54 /r Bitwise Logical AND of Packed Single-Precision Floating-Point Values
ANDNPS* xmm1, xmm2/m128 0F 55 /r Bitwise Logical AND NOT of Packed Single-Precision Floating-Point Values
ORPS* xmm1, xmm2/m128 0F 56 /r Bitwise Logical OR of Single-Precision Floating-Point Values
XORPS* xmm1, xmm2/m128 0F 57 /r Bitwise Logical XOR for Single-Precision Floating-Point Values
MOVUPS xmm1, xmm2/m128 0F 10 /r Move Unaligned Packed Single-Precision Floating-Point Values
MOVSS xmm1, xmm2/m32 F3 0F 10 /r Move Scalar Single-Precision Floating-Point Values
MOVUPS xmm2/m128, xmm1 0F 11 /r Move Unaligned Packed Single-Precision Floating-Point Values
MOVSS xmm2/m32, xmm1 F3 0F 11 /r Move Scalar Single-Precision Floating-Point Values
MOVLPS xmm, m64 0F 12 /r Move Low Packed Single-Precision Floating-Point Values
MOVHLPS xmm1, xmm2 0F 12 /r Move Packed Single-Precision Floating-Point Values High to Low
MOVLPS m64, xmm 0F 13 /r Move Low Packed Single-Precision Floating-Point Values
UNPCKLPS xmm1, xmm2/m128 0F 14 /r Unpack and Interleave Low Packed Single-Precision Floating-Point Values
UNPCKHPS xmm1, xmm2/m128 0F 15 /r Unpack and Interleave High Packed Single-Precision Floating-Point Values
MOVHPS xmm, m64 0F 16 /r Move High Packed Single-Precision Floating-Point Values
MOVLHPS xmm1, xmm2 0F 16 /r Move Packed Single-Precision Floating-Point Values Low to High
MOVHPS m64, xmm 0F 17 /r Move High Packed Single-Precision Floating-Point Values
MOVAPS xmm1, xmm2/m128 0F 28 /r Move Aligned Packed Single-Precision Floating-Point Values
MOVAPS xmm2/m128, xmm1 0F 29 /r Move Aligned Packed Single-Precision Floating-Point Values
MOVNTPS m128, xmm1 0F 2B /r Move Aligned Four Packed Single-FP Non Temporal
MOVMSKPS reg, xmm 0F 50 /r Extract Packed Single-Precision Floating-Point 4-bit Sign Mask. The upper bits of the register are filled with zeros.
CVTPI2PS xmm, mm/m64 0F 2A /r Convert Packed Dword Integers to Packed Single-Precision FP Values
CVTSI2SS xmm, r/m32 F3 0F 2A /r Convert Dword Integer to Scalar Single-Precision FP Value
CVTSI2SS xmm, r/m64 F3 REX.W 0F 2A /r Convert Qword Integer to Scalar Single-Precision FP Value
MOVNTPS m128, xmm 0F 2B /r Store Packed Single-Precision Floating-Point Values Using Non-Temporal Hint
CVTTPS2PI mm, xmm/m64 0F 2C /r Convert with Truncation Packed Single-Precision FP Values to Packed Dword Integers
CVTTSS2SI r32, xmm/m32 F3 0F 2C /r Convert with Truncation Scalar Single-Precision FP Value to Dword Integer
CVTTSS2SI r64, xmm1/m32 F3 REX.W 0F 2C /r Convert with Truncation Scalar Single-Precision FP Value to Qword Integer
CVTPS2PI mm, xmm/m64 0F 2D /r Convert Packed Single-Precision FP Values to Packed Dword Integers
CVTSS2SI r32, xmm/m32 F3 0F 2D /r Convert Scalar Single-Precision FP Value to Dword Integer
CVTSS2SI r64, xmm1/m32 F3 REX.W 0F 2D /r Convert Scalar Single-Precision FP Value to Qword Integer
UCOMISS xmm1, xmm2/m32 0F 2E /r Unordered Compare Scalar Single-Precision Floating-Point Values and Set EFLAGS
COMISS xmm1, xmm2/m32 0F 2F /r Compare Scalar Ordered Single-Precision Floating-Point Values and Set EFLAGS
SQRTPS xmm1, xmm2/m128 0F 51 /r Compute Square Roots of Packed Single-Precision Floating-Point Values
SQRTSS xmm1, xmm2/m32 F3 0F 51 /r Compute Square Root of Scalar Single-Precision Floating-Point Value
RSQRTPS xmm1, xmm2/m128 0F 52 /r Compute Reciprocal of Square Root of Packed Single-Precision Floating-Point Value
RSQRTSS xmm1, xmm2/m32 F3 0F 52 /r Compute Reciprocal of Square Root of Scalar Single-Precision Floating-Point Value
RCPPS xmm1, xmm2/m128 0F 53 /r Compute Reciprocal of Packed Single-Precision Floating-Point Values
RCPSS xmm1, xmm2/m32 F3 0F 53 /r Compute Reciprocal of Scalar Single-Precision Floating-Point Values
ADDPS xmm1, xmm2/m128 0F 58 /r Add Packed Single-Precision Floating-Point Values
ADDSS xmm1, xmm2/m32 F3 0F 58 /r Add Scalar Single-Precision Floating-Point Values
MULPS xmm1, xmm2/m128 0F 59 /r Multiply Packed Single-Precision Floating-Point Values
MULSS xmm1, xmm2/m32 F3 0F 59 /r Multiply Scalar Single-Precision Floating-Point Values
SUBPS xmm1, xmm2/m128 0F 5C /r Subtract Packed Single-Precision Floating-Point Values
SUBSS xmm1, xmm2/m32 F3 0F 5C /r Subtract Scalar Single-Precision Floating-Point Values
MINPS xmm1, xmm2/m128 0F 5D /r Return Minimum Packed Single-Precision Floating-Point Values
MINSS xmm1, xmm2/m32 F3 0F 5D /r Return Minimum Scalar Single-Precision Floating-Point Values
DIVPS xmm1, xmm2/m128 0F 5E /r Divide Packed Single-Precision Floating-Point Values
DIVSS xmm1, xmm2/m32 F3 0F 5E /r Divide Scalar Single-Precision Floating-Point Values
MAXPS xmm1, xmm2/m128 0F 5F /r Return Maximum Packed Single-Precision Floating-Point Values
MAXSS xmm1, xmm2/m32 F3 0F 5F /r Return Maximum Scalar Single-Precision Floating-Point Values
LDMXCSR m32 0F AE /2 Load MXCSR Register State
STMXCSR m32 0F AE /3 Store MXCSR Register State
CMPPS xmm1, xmm2/m128, imm8 0F C2 /r ib Compare Packed Single-Precision Floating-Point Values
CMPSS xmm1, xmm2/m32, imm8 F3 0F C2 /r ib Compare Scalar Single-Precision Floating-Point Values
SHUFPS xmm1, xmm2/m128, imm8 0F C6 /r ib Shuffle Packed Single-Precision Floating-Point Values
  • The floating point single bitwise operations ANDPS, ANDNPS, ORPS and XORPS produce the same result as the SSE2 integer (PAND, PANDN, POR, PXOR) and double ones (ANDPD, ANDNPD, ORPD, XORPD), but can introduce extra latency for domain changes when applied values of the wrong type.[43]

SSE2 instructions[edit]

Added with Pentium 4

SSE2 SIMD floating-point instructions[edit]

SSE2 data movement instructions[edit]
Instruction Opcode Meaning
MOVAPD xmm1, xmm2/m128 66 0F 28 /r Move Aligned Packed Double-Precision Floating-Point Values
MOVAPD xmm2/m128, xmm1 66 0F 29 /r Move Aligned Packed Double-Precision Floating-Point Values
MOVNTPD m128, xmm1 66 0F 2B /r Store Packed Double-Precision Floating-Point Values Using Non-Temporal Hint
MOVHPD xmm1, m64 66 0F 16 /r Move High Packed Double-Precision Floating-Point Value
MOVHPD m64, xmm1 66 0F 17 /r Move High Packed Double-Precision Floating-Point Value
MOVLPD xmm1, m64 66 0F 12 /r Move Low Packed Double-Precision Floating-Point Value
MOVLPD m64, xmm1 66 0F 13/r Move Low Packed Double-Precision Floating-Point Value
MOVUPD xmm1, xmm2/m128 66 0F 10 /r Move Unaligned Packed Double-Precision Floating-Point Values
MOVUPD xmm2/m128, xmm1 66 0F 11 /r Move Unaligned Packed Double-Precision Floating-Point Values
MOVMSKPD reg, xmm 66 0F 50 /r Extract Packed Double-Precision Floating-Point Sign Mask
MOVSD* xmm1, xmm2/m64 F2 0F 10 /r Move or Merge Scalar Double-Precision Floating-Point Value
MOVSD xmm1/m64, xmm2 F2 0F 11 /r Move or Merge Scalar Double-Precision Floating-Point Value
SSE2 packed arithmetic instructions[edit]
Instruction Opcode Meaning
ADDPD xmm1, xmm2/m128 66 0F 58 /r Add Packed Double-Precision Floating-Point Values
ADDSD xmm1, xmm2/m64 F2 0F 58 /r Add Low Double-Precision Floating-Point Value
DIVPD xmm1, xmm2/m128 66 0F 5E /r Divide Packed Double-Precision Floating-Point Values
DIVSD xmm1, xmm2/m64 F2 0F 5E /r Divide Scalar Double-Precision Floating-Point Value
MAXPD xmm1, xmm2/m128 66 0F 5F /r Maximum of Packed Double-Precision Floating-Point Values
MAXSD xmm1, xmm2/m64 F2 0F 5F /r Return Maximum Scalar Double-Precision Floating-Point Value
MINPD xmm1, xmm2/m128 66 0F 5D /r Minimum of Packed Double-Precision Floating-Point Values
MINSD xmm1, xmm2/m64 F2 0F 5D /r Return Minimum Scalar Double-Precision Floating-Point Value
MULPD xmm1, xmm2/m128 66 0F 59 /r Multiply Packed Double-Precision Floating-Point Values
MULSD xmm1,xmm2/m64 F2 0F 59 /r Multiply Scalar Double-Precision Floating-Point Value
SQRTPD xmm1, xmm2/m128 66 0F 51 /r Square Root of Double-Precision Floating-Point Values
SQRTSD xmm1,xmm2/m64 F2 0F 51/r Compute Square Root of Scalar Double-Precision Floating-Point Value
SUBPD xmm1, xmm2/m128 66 0F 5C /r Subtract Packed Double-Precision Floating-Point Values
SUBSD xmm1, xmm2/m64 F2 0F 5C /r Subtract Scalar Double-Precision Floating-Point Value
SSE2 logical instructions[edit]
Instruction Opcode Meaning
ANDPD xmm1, xmm2/m128 66 0F 54 /r Bitwise Logical AND of Packed Double Precision Floating-Point Values
ANDNPD xmm1, xmm2/m128 66 0F 55 /r Bitwise Logical AND NOT of Packed Double Precision Floating-Point Values
ORPD xmm1, xmm2/m128 66 0F 56/r Bitwise Logical OR of Packed Double Precision Floating-Point Values
XORPD xmm1, xmm2/m128 66 0F 57/r Bitwise Logical XOR of Packed Double Precision Floating-Point Values
SSE2 compare instructions[edit]
Instruction Opcode Meaning
CMPPD xmm1, xmm2/m128, imm8 66 0F C2 /r ib Compare Packed Double-Precision Floating-Point Values
CMPSD* xmm1, xmm2/m64, imm8 F2 0F C2 /r ib Compare Low Double-Precision Floating-Point Values
COMISD xmm1, xmm2/m64 66 0F 2F /r Compare Scalar Ordered Double-Precision Floating-Point Values and Set EFLAGS
UCOMISD xmm1, xmm2/m64 66 0F 2E /r Unordered Compare Scalar Double-Precision Floating-Point Values and Set EFLAGS
SSE2 shuffle and unpack instructions[edit]
Instruction Opcode Meaning
SHUFPD xmm1, xmm2/m128, imm8 66 0F C6 /r ib Packed Interleave Shuffle of Pairs of Double-Precision Floating-Point Values
UNPCKHPD xmm1, xmm2/m128 66 0F 15 /r Unpack and Interleave High Packed Double-Precision Floating-Point Values
UNPCKLPD xmm1, xmm2/m128 66 0F 14 /r Unpack and Interleave Low Packed Double-Precision Floating-Point Values
SSE2 conversion instructions[edit]
Instruction Opcode Meaning
CVTDQ2PD xmm1, xmm2/m64 F3 0F E6 /r Convert Packed Doubleword Integers to Packed Double-Precision Floating-Point Values
CVTDQ2PS xmm1, xmm2/m128 0F 5B /r Convert Packed Doubleword Integers to Packed Single-Precision Floating-Point Values
CVTPD2DQ xmm1, xmm2/m128 F2 0F E6 /r Convert Packed Double-Precision Floating-Point Values to Packed Doubleword Integers
CVTPD2PI mm, xmm/m128 66 0F 2D /r Convert Packed Double-Precision FP Values to Packed Dword Integers
CVTPD2PS xmm1, xmm2/m128 66 0F 5A /r Convert Packed Double-Precision Floating-Point Values to Packed Single-Precision Floating-Point Values
CVTPI2PD xmm, mm/m64 66 0F 2A /r Convert Packed Dword Integers to Packed Double-Precision FP Values
CVTPS2DQ xmm1, xmm2/m128 66 0F 5B /r Convert Packed Single-Precision Floating-Point Values to Packed Signed Doubleword Integer Values
CVTPS2PD xmm1, xmm2/m64 0F 5A /r Convert Packed Single-Precision Floating-Point Values to Packed Double-Precision Floating-Point Values
CVTSD2SI r32, xmm1/m64 F2 0F 2D /r Convert Scalar Double-Precision Floating-Point Value to Doubleword Integer
CVTSD2SI r64, xmm1/m64 F2 REX.W 0F 2D /r Convert Scalar Double-Precision Floating-Point Value to Quadword Integer With Sign Extension
CVTSD2SS xmm1, xmm2/m64 F2 0F 5A /r Convert Scalar Double-Precision Floating-Point Value to Scalar Single-Precision Floating-Point Value
CVTSI2SD xmm1, r32/m32 F2 0F 2A /r Convert Doubleword Integer to Scalar Double-Precision Floating-Point Value
CVTSI2SD xmm1, r/m64 F2 REX.W 0F 2A /r Convert Quadword Integer to Scalar Double-Precision Floating-Point value
CVTSS2SD xmm1, xmm2/m32 F3 0F 5A /r Convert Scalar Single-Precision Floating-Point Value to Scalar Double-Precision Floating-Point Value
CVTTPD2DQ xmm1, xmm2/m128 66 0F E6 /r Convert with Truncation Packed Double-Precision Floating-Point Values to Packed Doubleword Integers
CVTTPD2PI mm, xmm/m128 66 0F 2C /r Convert with Truncation Packed Double-Precision FP Values to Packed Dword Integers
CVTTPS2DQ xmm1, xmm2/m128 F3 0F 5B /r Convert with Truncation Packed Single-Precision Floating-Point Values to Packed Signed Doubleword Integer Values
CVTTSD2SI r32, xmm1/m64 F2 0F 2C /r Convert with Truncation Scalar Double-Precision Floating-Point Value to Signed Dword Integer
CVTTSD2SI r64, xmm1/m64 F2 REX.W 0F 2C /r Convert with Truncation Scalar Double-Precision Floating-Point Value To Signed Qword Integer

SSE2 SIMD integer instructions[edit]

SSE2 MMX-like instructions extended to SSE registers[edit]

SSE2 allows execution of MMX instructions on SSE registers, processing twice the amount of data at once.

Instruction Opcode Meaning
MOVD xmm, r/m32 66 0F 6E /r Move doubleword
MOVD r/m32, xmm 66 0F 7E /r Move doubleword
MOVQ xmm1, xmm2/m64 F3 0F 7E /r Move quadword
MOVQ xmm2/m64, xmm1 66 0F D6 /r Move quadword
MOVQ r/m64, xmm 66 REX.W 0F 7E /r Move quadword
MOVQ xmm, r/m64 66 REX.W 0F 6E /r Move quadword
PMOVMSKB reg, xmm 66 0F D7 /r Move a byte mask, zeroing the upper bits of the register
PEXTRW reg, xmm, imm8 66 0F C5 /r ib Extract specified word and move it to reg, setting bits 15-0 and zeroing the rest
PINSRW xmm, r32/m16, imm8 66 0F C4 /r ib Move low word at the specified word position
PACKSSDW xmm1, xmm2/m128 66 0F 6B /r Converts 4 packed signed doubleword integers into 8 packed signed word integers with saturation
PACKSSWB xmm1, xmm2/m128 66 0F 63 /r Converts 8 packed signed word integers into 16 packed signed byte integers with saturation
PACKUSWB xmm1, xmm2/m128 66 0F 67 /r Converts 8 signed word integers into 16 unsigned byte integers with saturation
PADDB xmm1, xmm2/m128 66 0F FC /r Add packed byte integers
PADDW xmm1, xmm2/m128 66 0F FD /r Add packed word integers
PADDD xmm1, xmm2/m128 66 0F FE /r Add packed doubleword integers
PADDQ xmm1, xmm2/m128 66 0F D4 /r Add packed quadword integers.
PADDSB xmm1, xmm2/m128 66 0F EC /r Add packed signed byte integers with saturation
PADDSW xmm1, xmm2/m128 66 0F ED /r Add packed signed word integers with saturation
PADDUSB xmm1, xmm2/m128 66 0F DC /r Add packed unsigned byte integers with saturation
PADDUSW xmm1, xmm2/m128 66 0F DD /r Add packed unsigned word integers with saturation
PAND xmm1, xmm2/m128 66 0F DB /r Bitwise AND
PANDN xmm1, xmm2/m128 66 0F DF /r Bitwise AND NOT
POR xmm1, xmm2/m128 66 0F EB /r Bitwise OR
PXOR xmm1, xmm2/m128 66 0F EF /r Bitwise XOR
PCMPEQB xmm1, xmm2/m128 66 0F 74 /r Compare packed bytes for equality.
PCMPEQW xmm1, xmm2/m128 66 0F 75 /r Compare packed words for equality.
PCMPEQD xmm1, xmm2/m128 66 0F 76 /r Compare packed doublewords for equality.
PCMPGTB xmm1, xmm2/m128 66 0F 64 /r Compare packed signed byte integers for greater than
PCMPGTW xmm1, xmm2/m128 66 0F 65 /r Compare packed signed word integers for greater than
PCMPGTD xmm1, xmm2/m128 66 0F 66 /r Compare packed signed doubleword integers for greater than
PMULLW xmm1, xmm2/m128 66 0F D5 /r Multiply packed signed word integers with saturation
PMULHW xmm1, xmm2/m128 66 0F E5 /r Multiply the packed signed word integers, store the high 16 bits of the results
PMULHUW xmm1, xmm2/m128 66 0F E4 /r Multiply packed unsigned word integers, store the high 16 bits of the results
PMULUDQ xmm1, xmm2/m128 66 0F F4 /r Multiply packed unsigned doubleword integers
PSLLW xmm1, xmm2/m128 66 0F F1 /r Shift words left while shifting in 0s
PSLLW xmm1, imm8 66 0F 71 /6 ib Shift words left while shifting in 0s
PSLLD xmm1, xmm2/m128 66 0F F2 /r Shift doublewords left while shifting in 0s
PSLLD xmm1, imm8 66 0F 72 /6 ib Shift doublewords left while shifting in 0s
PSLLQ xmm1, xmm2/m128 66 0F F3 /r Shift quadwords left while shifting in 0s
PSLLQ xmm1, imm8 66 0F 73 /6 ib Shift quadwords left while shifting in 0s
PSRAD xmm1, xmm2/m128 66 0F E2 /r Shift doubleword right while shifting in sign bits
PSRAD xmm1, imm8 66 0F 72 /4 ib Shift doublewords right while shifting in sign bits
PSRAW xmm1, xmm2/m128 66 0F E1 /r Shift words right while shifting in sign bits
PSRAW xmm1, imm8 66 0F 71 /4 ib Shift words right while shifting in sign bits
PSRLW xmm1, xmm2/m128 66 0F D1 /r Shift words right while shifting in 0s
PSRLW xmm1, imm8 66 0F 71 /2 ib Shift words right while shifting in 0s
PSRLD xmm1, xmm2/m128 66 0F D2 /r Shift doublewords right while shifting in 0s
PSRLD xmm1, imm8 66 0F 72 /2 ib Shift doublewords right while shifting in 0s
PSRLQ xmm1, xmm2/m128 66 0F D3 /r Shift quadwords right while shifting in 0s
PSRLQ xmm1, imm8 66 0F 73 /2 ib Shift quadwords right while shifting in 0s
PSUBB xmm1, xmm2/m128 66 0F F8 /r Subtract packed byte integers
PSUBW xmm1, xmm2/m128 66 0F F9 /r Subtract packed word integers
PSUBD xmm1, xmm2/m128 66 0F FA /r Subtract packed doubleword integers
PSUBQ xmm1, xmm2/m128 66 0F FB /r Subtract packed quadword integers.
PSUBSB xmm1, xmm2/m128 66 0F E8 /r Subtract packed signed byte integers with saturation
PSUBSW xmm1, xmm2/m128 66 0F E9 /r Subtract packed signed word integers with saturation
PMADDWD xmm1, xmm2/m128 66 0F F5 /r Multiply the packed word integers, add adjacent doubleword results
PSUBUSB xmm1, xmm2/m128 66 0F D8 /r Subtract packed unsigned byte integers with saturation
PSUBUSW xmm1, xmm2/m128 66 0F D9 /r Subtract packed unsigned word integers with saturation
PUNPCKHBW xmm1, xmm2/m128 66 0F 68 /r Unpack and interleave high-order bytes
PUNPCKHWD xmm1, xmm2/m128 66 0F 69 /r Unpack and interleave high-order words
PUNPCKHDQ xmm1, xmm2/m128 66 0F 6A /r Unpack and interleave high-order doublewords
PUNPCKLBW xmm1, xmm2/m128 66 0F 60 /r Interleave low-order bytes
PUNPCKLWD xmm1, xmm2/m128 66 0F 61 /r Interleave low-order words
PUNPCKLDQ xmm1, xmm2/m128 66 0F 62 /r Interleave low-order doublewords
PAVGB xmm1, xmm2/m128 66 0F E0, /r Average packed unsigned byte integers with rounding
PAVGW xmm1, xmm2/m128 66 0F E3 /r Average packed unsigned word integers with rounding
PMINUB xmm1, xmm2/m128 66 0F DA /r Compare packed unsigned byte integers and store packed minimum values
PMINSW xmm1, xmm2/m128 66 0F EA /r Compare packed signed word integers and store packed minimum values
PMAXSW xmm1, xmm2/m128 66 0F EE /r Compare packed signed word integers and store maximum packed values
PMAXUB xmm1, xmm2/m128 66 0F DE /r Compare packed unsigned byte integers and store packed maximum values
PSADBW xmm1, xmm2/m128 66 0F F6 /r Computes the absolute differences of the packed unsigned byte integers; the 8 low differences and 8 high differences are then summed separately to produce two unsigned word integer results
SSE2 integer instructions for SSE registers only[edit]

The following instructions can be used only on SSE registers, since by their nature they do not work on MMX registers

Instruction Opcode Meaning
MASKMOVDQU xmm1, xmm2 66 0F F7 /r Non-Temporal Store of Selected Bytes from an XMM Register into Memory
MOVDQ2Q mm, xmm F2 0F D6 /r Move low quadword from XMM to MMX register.
MOVDQA xmm1, xmm2/m128 66 0F 6F /r Move aligned double quadword
MOVDQA xmm2/m128, xmm1 66 0F 7F /r Move aligned double quadword
MOVDQU xmm1, xmm2/m128 F3 0F 6F /r Move unaligned double quadword
MOVDQU xmm2/m128, xmm1 F3 0F 7F /r Move unaligned double quadword
MOVQ2DQ xmm, mm F3 0F D6 /r Move quadword from MMX register to low quadword of XMM register
MOVNTDQ m128, xmm1 66 0F E7 /r Store Packed Integers Using Non-Temporal Hint
PSHUFHW xmm1, xmm2/m128, imm8 F3 0F 70 /r ib Shuffle packed high words.
PSHUFLW xmm1, xmm2/m128, imm8 F2 0F 70 /r ib Shuffle packed low words.
PSHUFD xmm1, xmm2/m128, imm8 66 0F 70 /r ib Shuffle packed doublewords.
PSLLDQ xmm1, imm8 66 0F 73 /7 ib Packed shift left logical double quadwords.
PSRLDQ xmm1, imm8 66 0F 73 /3 ib Packed shift right logical double quadwords.
PUNPCKHQDQ xmm1, xmm2/m128 66 0F 6D /r Unpack and interleave high-order quadwords,
PUNPCKLQDQ xmm1, xmm2/m128 66 0F 6C /r Interleave low quadwords,

SSE3 instructions[edit]

Added with Pentium 4 supporting SSE3

SSE3 SIMD floating-point instructions[edit]

Instruction Opcode Meaning Notes
ADDSUBPS xmm1, xmm2/m128 F2 0F D0 /r Add/subtract single-precision floating-point values for Complex Arithmetic
ADDSUBPD xmm1, xmm2/m128 66 0F D0 /r Add/subtract double-precision floating-point values
MOVDDUP xmm1, xmm2/m64 F2 0F 12 /r Move double-precision floating-point value and duplicate
MOVSLDUP xmm1, xmm2/m128 F3 0F 12 /r Move and duplicate even index single-precision floating-point values
MOVSHDUP xmm1, xmm2/m128 F3 0F 16 /r Move and duplicate odd index single-precision floating-point values
HADDPS xmm1, xmm2/m128 F2 0F 7C /r Horizontal add packed single-precision floating-point values for Graphics
HADDPD xmm1, xmm2/m128 66 0F 7C /r Horizontal add packed double-precision floating-point values
HSUBPS xmm1, xmm2/m128 F2 0F 7D /r Horizontal subtract packed single-precision floating-point values
HSUBPD xmm1, xmm2/m128 66 0F 7D /r Horizontal subtract packed double-precision floating-point values

SSE3 SIMD integer instructions[edit]

Instruction Opcode Meaning Notes
LDDQU xmm1, mem F2 0F F0 /r Load unaligned data and return double quadword Instructionally equivalent to MOVDQU. For video encoding

SSSE3 instructions[edit]

Added with Xeon 5100 series and initial Core 2

The following MMX-like instructions extended to SSE registers were added with SSSE3

Instruction Opcode Meaning
PSIGNB xmm1, xmm2/m128 66 0F 38 08 /r Negate/zero/preserve packed byte integers depending on corresponding sign
PSIGNW xmm1, xmm2/m128 66 0F 38 09 /r Negate/zero/preserve packed word integers depending on corresponding sign
PSIGND xmm1, xmm2/m128 66 0F 38 0A /r Negate/zero/preserve packed doubleword integers depending on corresponding
PSHUFB xmm1, xmm2/m128 66 0F 38 00 /r Shuffle bytes
PMULHRSW xmm1, xmm2/m128 66 0F 38 0B /r Multiply 16-bit signed words, scale and round signed doublewords, pack high 16 bits
PMADDUBSW xmm1, xmm2/m128 66 0F 38 04 /r Multiply signed and unsigned bytes, add horizontal pair of signed words, pack saturated signed-words
PHSUBW xmm1, xmm2/m128 66 0F 38 05 /r Subtract and pack 16-bit signed integers horizontally
PHSUBSW xmm1, xmm2/m128 66 0F 38 07 /r Subtract and pack 16-bit signed integer horizontally with saturation
PHSUBD xmm1, xmm2/m128 66 0F 38 06 /r Subtract and pack 32-bit signed integers horizontally
PHADDSW xmm1, xmm2/m128 66 0F 38 03 /r Add and pack 16-bit signed integers horizontally with saturation
PHADDW xmm1, xmm2/m128 66 0F 38 01 /r Add and pack 16-bit integers horizontally
PHADDD xmm1, xmm2/m128 66 0F 38 02 /r Add and pack 32-bit integers horizontally
PALIGNR xmm1, xmm2/m128, imm8 66 0F 3A 0F /r ib Concatenate destination and source operands, extract byte-aligned result shifted to the right
PABSB xmm1, xmm2/m128 66 0F 38 1C /r Compute the absolute value of bytes and store unsigned result
PABSW xmm1, xmm2/m128 66 0F 38 1D /r Compute the absolute value of 16-bit integers and store unsigned result
PABSD xmm1, xmm2/m128 66 0F 38 1E /r Compute the absolute value of 32-bit integers and store unsigned result

SSE4 instructions[edit]

SSE4.1[edit]

Added with Core 2 manufactured in 45nm

SSE4.1 SIMD floating-point instructions[edit]
Instruction Opcode Meaning
DPPS xmm1, xmm2/m128, imm8 66 0F 3A 40 /r ib Selectively multiply packed SP floating-point values, add and selectively store
DPPD xmm1, xmm2/m128, imm8 66 0F 3A 41 /r ib Selectively multiply packed DP floating-point values, add and selectively store
BLENDPS xmm1, xmm2/m128, imm8 66 0F 3A 0C /r ib Select packed single precision floating-point values from specified mask
BLENDVPS xmm1, xmm2/m128, <XMM0> 66 0F 38 14 /r Select packed single precision floating-point values from specified mask
BLENDPD xmm1, xmm2/m128, imm8 66 0F 3A 0D /r ib Select packed DP-FP values from specified mask
BLENDVPD xmm1, xmm2/m128, <XMM0> 66 0F 38 15 /r Select packed DP FP values from specified mask
ROUNDPS xmm1, xmm2/m128, imm8 66 0F 3A 08 /r ib Round packed single precision floating-point values
ROUNDSS xmm1, xmm2/m32, imm8 66 0F 3A 0A /r ib Round the low packed single precision floating-point value
ROUNDPD xmm1, xmm2/m128, imm8 66 0F 3A 09 /r ib Round packed double precision floating-point values
ROUNDSD xmm1, xmm2/m64, imm8 66 0F 3A 0B /r ib Round the low packed double precision floating-point value
INSERTPS xmm1, xmm2/m32, imm8 66 0F 3A 21 /r ib Insert a selected single-precision floating-point value at the specified destination element and zero out destination elements
EXTRACTPS reg/m32, xmm1, imm8 66 0F 3A 17 /r ib Extract one single-precision floating-point value at specified offset and store the result (zero-extended, if applicable)
SSE4.1 SIMD integer instructions[edit]
Instruction Opcode Meaning
MPSADBW xmm1, xmm2/m128, imm8 66 0F 3A 42 /r ib Sums absolute 8-bit integer difference of adjacent groups of 4 byte integers with starting offset
PHMINPOSUW xmm1, xmm2/m128 66 0F 38 41 /r Find the minimum unsigned word
PMULLD xmm1, xmm2/m128 66 0F 38 40 /r Multiply the packed dword signed integers and store the low 32 bits
PMULDQ xmm1, xmm2/m128 66 0F 38 28 /r Multiply packed signed doubleword integers and store quadword result
PBLENDVB xmm1, xmm2/m128, <XMM0> 66 0F 38 10 /r Select byte values from specified mask
PBLENDW xmm1, xmm2/m128, imm8 66 0F 3A 0E /r ib Select words from specified mask
PMINSB xmm1, xmm2/m128 66 0F 38 38 /r Compare packed signed byte integers
PMINUW xmm1, xmm2/m128 66 0F 38 3A/r Compare packed unsigned word integers
PMINSD xmm1, xmm2/m128 66 0F 38 39 /r Compare packed signed dword integers
PMINUD xmm1, xmm2/m128 66 0F 38 3B /r Compare packed unsigned dword integers
PMAXSB xmm1, xmm2/m128 66 0F 38 3C /r Compare packed signed byte integers
PMAXUW xmm1, xmm2/m128 66 0F 38 3E/r Compare packed unsigned word integers
PMAXSD xmm1, xmm2/m128 66 0F 38 3D /r Compare packed signed dword integers
PMAXUD xmm1, xmm2/m128 66 0F 38 3F /r Compare packed unsigned dword integers
PINSRB xmm1, r32/m8, imm8 66 0F 3A 20 /r ib Insert a byte integer value at specified destination element
PINSRD xmm1, r/m32, imm8 66 0F 3A 22 /r ib Insert a dword integer value at specified destination element
PINSRQ xmm1, r/m64, imm8 66 REX.W 0F 3A 22 /r ib Insert a qword integer value at specified destination element
PEXTRB reg/m8, xmm2, imm8 66 0F 3A 14 /r ib Extract a byte integer value at source byte offset, upper bits are zeroed.
PEXTRW reg/m16, xmm, imm8 66 0F 3A 15 /r ib Extract word and copy to lowest 16 bits, zero-extended
PEXTRD r/m32, xmm2, imm8 66 0F 3A 16 /r ib Extract a dword integer value at source dword offset
PEXTRQ r/m64, xmm2, imm8 66 REX.W 0F 3A 16 /r ib Extract a qword integer value at source qword offset
PMOVSXBW xmm1, xmm2/m64 66 0f 38 20 /r Sign extend 8 packed 8-bit integers to 8 packed 16-bit integers
PMOVZXBW xmm1, xmm2/m64 66 0f 38 30 /r Zero extend 8 packed 8-bit integers to 8 packed 16-bit integers
PMOVSXBD xmm1, xmm2/m32 66 0f 38 21 /r Sign extend 4 packed 8-bit integers to 4 packed 32-bit integers
PMOVZXBD xmm1, xmm2/m32 66 0f 38 31 /r Zero extend 4 packed 8-bit integers to 4 packed 32-bit integers
PMOVSXBQ xmm1, xmm2/m16 66 0f 38 22 /r Sign extend 2 packed 8-bit integers to 2 packed 64-bit integers
PMOVZXBQ xmm1, xmm2/m16 66 0f 38 32 /r Zero extend 2 packed 8-bit integers to 2 packed 64-bit integers
PMOVSXWD xmm1, xmm2/m64 66 0f 38 23/r Sign extend 4 packed 16-bit integers to 4 packed 32-bit integers
PMOVZXWD xmm1, xmm2/m64 66 0f 38 33 /r Zero extend 4 packed 16-bit integers to 4 packed 32-bit integers
PMOVSXWQ xmm1, xmm2/m32 66 0f 38 24 /r Sign extend 2 packed 16-bit integers to 2 packed 64-bit integers
PMOVZXWQ xmm1, xmm2/m32 66 0f 38 34 /r Zero extend 2 packed 16-bit integers to 2 packed 64-bit integers
PMOVSXDQ xmm1, xmm2/m64 66 0f 38 25 /r Sign extend 2 packed 32-bit integers to 2 packed 64-bit integers
PMOVZXDQ xmm1, xmm2/m64 66 0f 38 35 /r Zero extend 2 packed 32-bit integers to 2 packed 64-bit integers
PTEST xmm1, xmm2/m128 66 0F 38 17 /r Set ZF if AND result is all 0s, set CF if AND NOT result is all 0s
PCMPEQQ xmm1, xmm2/m128 66 0F 38 29 /r Compare packed qwords for equality
PACKUSDW xmm1, xmm2/m128 66 0F 38 2B /r Convert 2 × 4 packed signed doubleword integers into 8 packed unsigned word integers with saturation
MOVNTDQA xmm1, m128 66 0F 38 2A /r Move double quadword using non-temporal hint if WC memory type

SSE4a[edit]

Added with Phenom processors

Instruction Opcode Meaning
EXTRQ 66 0F 78 /0 ib ib Extract Field From Register
66 0F 79 /r
INSERTQ F2 0F 78 /r ib ib Insert Field
F2 0F 79 /r
MOVNTSD F2 0F 2B /r Move Non-Temporal Scalar Double-Precision Floating-Point
MOVNTSS F3 0F 2B /r Move Non-Temporal Scalar Single-Precision Floating-Point

SSE4.2[edit]

Added with Nehalem processors

Instruction Opcode Meaning
PCMPESTRI xmm1, xmm2/m128, imm8 66 0F 3A 61 /r imm8 Packed comparison of string data with explicit lengths, generating an index
PCMPESTRM xmm1, xmm2/m128, imm8 66 0F 3A 60 /r imm8 Packed comparison of string data with explicit lengths, generating a mask
PCMPISTRI xmm1, xmm2/m128, imm8 66 0F 3A 63 /r imm8 Packed comparison of string data with implicit lengths, generating an index
PCMPISTRM xmm1, xmm2/m128, imm8 66 0F 3A 62 /r imm8 Packed comparison of string data with implicit lengths, generating a mask
PCMPGTQ xmm1,xmm2/m128 66 0F 38 37 /r Compare packed signed qwords for greater than.

F16C[edit]

Half-precision floating-point conversion.

Instruction Meaning
VCVTPH2PS xmmreg,xmmrm64 Convert four half-precision floating point values in memory or the bottom half of an XMM register to four single-precision floating-point values in an XMM register
VCVTPH2PS ymmreg,xmmrm128 Convert eight half-precision floating point values in memory or an XMM register (the bottom half of a YMM register) to eight single-precision floating-point values in a YMM register
VCVTPS2PH xmmrm64,xmmreg,imm8 Convert four single-precision floating point values in an XMM register to half-precision floating-point values in memory or the bottom half an XMM register
VCVTPS2PH xmmrm128,ymmreg,imm8 Convert eight single-precision floating point values in a YMM register to half-precision floating-point values in memory or an XMM register

FMA3[edit]

Supported in AMD processors starting with the Piledriver architecture and Intel starting with Haswell processors and Broadwell processors since 2014.

Fused multiply-add (floating-point vector multiply–accumulate) with three operands.

Instruction Meaning
VFMADD132PD Fused Multiply-Add of Packed Double-Precision Floating-Point Values
VFMADD213PD
VFMADD231PD
VFMADD132PS Fused Multiply-Add of Packed Single-Precision Floating-Point Values
VFMADD213PS
VFMADD231PS
VFMADD132SD Fused Multiply-Add of Scalar Double-Precision Floating-Point Values
VFMADD213SD
VFMADD231SD
VFMADD132SS Fused Multiply-Add of Scalar Single-Precision Floating-Point Values
VFMADD213SS
VFMADD231SS
VFMADDSUB132PD Fused Multiply-Alternating Add/Subtract of Packed Double-Precision Floating-Point Values
VFMADDSUB213PD
VFMADDSUB231PD
VFMADDSUB132PS Fused Multiply-Alternating Add/Subtract of Packed Single-Precision Floating-Point Values
VFMADDSUB213PS
VFMADDSUB231PS
VFMSUB132PD Fused Multiply-Subtract of Packed Double-Precision Floating-Point Values
VFMSUB213PD
VFMSUB231PD
VFMSUB132PS Fused Multiply-Subtract of Packed Single-Precision Floating-Point Values
VFMSUB213PS
VFMSUB231PS
VFMSUB132SD Fused Multiply-Subtract of Scalar Double-Precision Floating-Point Values
VFMSUB213SD
VFMSUB231SD
VFMSUB132SS Fused Multiply-Subtract of Scalar Single-Precision Floating-Point Values
VFMSUB213SS
VFMSUB231SS
VFMSUBADD132PD Fused Multiply-Alternating Subtract/Add of Packed Double-Precision Floating-Point Values
VFMSUBADD213PD
VFMSUBADD231PD
VFMSUBADD132PS Fused Multiply-Alternating Subtract/Add of Packed Single-Precision Floating-Point Values
VFMSUBADD213PS
VFMSUBADD231PS
VFNMADD132PD Fused Negative Multiply-Add of Packed Double-Precision Floating-Point Values
VFNMADD213PD
VFNMADD231PD
VFNMADD132PS Fused Negative Multiply-Add of Packed Single-Precision Floating-Point Values
VFNMADD213PS
VFNMADD231PS
VFNMADD132SD Fused Negative Multiply-Add of Scalar Double-Precision Floating-Point Values
VFNMADD213SD
VFNMADD231SD
VFNMADD132SS Fused Negative Multiply-Add of Scalar Single-Precision Floating-Point Values
VFNMADD213SS
VFNMADD231SS
VFNMSUB132PD Fused Negative Multiply-Subtract of Packed Double-Precision Floating-Point Values
VFNMSUB213PD
VFNMSUB231PD
VFNMSUB132PS Fused Negative Multiply-Subtract of Packed Single-Precision Floating-Point Values
VFNMSUB213PS
VFNMSUB231PS
VFNMSUB132SD Fused Negative Multiply-Subtract of Scalar Double-Precision Floating-Point Values
VFNMSUB213SD
VFNMSUB231SD
VFNMSUB132SS Fused Negative Multiply-Subtract of Scalar Single-Precision Floating-Point Values
VFNMSUB213SS
VFNMSUB231SS

AVX[edit]

AVX were first supported by Intel with Sandy Bridge and by AMD with Bulldozer.

Vector operations on 256 bit registers.

Instruction Description
VBROADCASTSS Copy a 32-bit, 64-bit or 128-bit memory operand to all elements of a XMM or YMM vector register.
VBROADCASTSD
VBROADCASTF128
VINSERTF128 Replaces either the lower half or the upper half of a 256-bit YMM register with the value of a 128-bit source operand. The other half of the destination is unchanged.
VEXTRACTF128 Extracts either the lower half or the upper half of a 256-bit YMM register and copies the value to a 128-bit destination operand.
VMASKMOVPS Conditionally reads any number of elements from a SIMD vector memory operand into a destination register, leaving the remaining vector elements unread and setting the corresponding elements in the destination register to zero. Alternatively, conditionally writes any number of elements from a SIMD vector register operand to a vector memory operand, leaving the remaining elements of the memory operand unchanged. On the AMD Jaguar processor architecture, this instruction with a memory source operand takes more than 300 clock cycles when the mask is zero, in which case the instruction should do nothing. This appears to be a design flaw.[44]
VMASKMOVPD
VPERMILPS Permute In-Lane. Shuffle the 32-bit or 64-bit vector elements of one input operand. These are in-lane 256-bit instructions, meaning that they operate on all 256 bits with two separate 128-bit shuffles, so they can not shuffle across the 128-bit lanes.[45]
VPERMILPD
VPERM2F128 Shuffle the four 128-bit vector elements of two 256-bit source operands into a 256-bit destination operand, with an immediate constant as selector.
VZEROALL Set all YMM registers to zero and tag them as unused. Used when switching between 128-bit use and 256-bit use.
VZEROUPPER Set the upper half of all YMM registers to zero. Used when switching between 128-bit use and 256-bit use.

AVX2[edit]

Introduced in Intel's Haswell microarchitecture and AMD's Excavator.

Expansion of most vector integer SSE and AVX instructions to 256 bits

Instruction Description
VBROADCASTSS Copy a 32-bit or 64-bit register operand to all elements of a XMM or YMM vector register. These are register versions of the same instructions in AVX1. There is no 128-bit version however, but the same effect can be simply achieved using VINSERTF128.
VBROADCASTSD
VPBROADCASTB Copy an 8, 16, 32 or 64-bit integer register or memory operand to all elements of a XMM or YMM vector register.
VPBROADCASTW
VPBROADCASTD
VPBROADCASTQ
VBROADCASTI128 Copy a 128-bit memory operand to all elements of a YMM vector register.
VINSERTI128 Replaces either the lower half or the upper half of a 256-bit YMM register with the value of a 128-bit source operand. The other half of the destination is unchanged.
VEXTRACTI128 Extracts either the lower half or the upper half of a 256-bit YMM register and copies the value to a 128-bit destination operand.
VGATHERDPD Gathers single or double precision floating point values using either 32 or 64-bit indices and scale.
VGATHERQPD
VGATHERDPS
VGATHERQPS
VPGATHERDD Gathers 32 or 64-bit integer values using either 32 or 64-bit indices and scale.
VPGATHERDQ
VPGATHERQD
VPGATHERQQ
VPMASKMOVD Conditionally reads any number of elements from a SIMD vector memory operand into a destination register, leaving the remaining vector elements unread and setting the corresponding elements in the destination register to zero. Alternatively, conditionally writes any number of elements from a SIMD vector register operand to a vector memory operand, leaving the remaining elements of the memory operand unchanged.
VPMASKMOVQ
VPERMPS Shuffle the eight 32-bit vector elements of one 256-bit source operand into a 256-bit destination operand, with a register or memory operand as selector.
VPERMD
VPERMPD Shuffle the four 64-bit vector elements of one 256-bit source operand into a 256-bit destination operand, with a register or memory operand as selector.
VPERMQ
VPERM2I128 Shuffle (two of) the four 128-bit vector elements of two 256-bit source operands into a 256-bit destination operand, with an immediate constant as selector.
VPBLENDD Doubleword immediate version of the PBLEND instructions from SSE4.
VPSLLVD Shift left logical. Allows variable shifts where each element is shifted according to the packed input.
VPSLLVQ
VPSRLVD Shift right logical. Allows variable shifts where each element is shifted according to the packed input.
VPSRLVQ
VPSRAVD Shift right arithmetically. Allows variable shifts where each element is shifted according to the packed input.

AVX-512[edit]

AVX-512, introduced in 2014, adds 512-bit wide vector registers (extending the 256-bit registers, which become the new registers' lower halves) and doubles their count to 32; the new registers are thus named zmm0 through zmm31. It adds eight mask registers, named k0 through k7, which may be used to restrict operations to specific parts of a vector register. Unlike previous instruction set extensions, AVX-512 is implemented in several groups; only the foundation ("AVX-512F") extension is mandatory.[46] Most of the added instructions may also be used with the 256- and 128-bit registers.

Cryptographic instructions[edit]

Intel AES instructions[edit]

6 new instructions.

Instruction Encoding Description
AESENC 66 0F 38 DC /r Perform one round of an AES encryption flow
AESENCLAST 66 0F 38 DD /r Perform the last round of an AES encryption flow
AESDEC 66 0F 38 DE /r Perform one round of an AES decryption flow
AESDECLAST 66 0F 38 DF /r Perform the last round of an AES decryption flow
AESKEYGENASSIST 66 0F 3A DF /r ib Assist in AES round key generation
AESIMC 66 0F 38 DB /r Assist in AES Inverse Mix Columns

RDRAND and RDSEED[edit]

Instruction Encoding Description
RDRAND 0F C7 /6 Read Random Number
RDSEED 0F C7 /7 Read Random Seed

Intel SHA instructions[edit]

7 new instructions.

Instruction Encoding Description
SHA1RNDS4 0F 3A CC /r ib Perform Four Rounds of SHA1 Operation
SHA1NEXTE 0F 38 C8 /r Calculate SHA1 State Variable E after Four Rounds
SHA1MSG1 0F 38 C9 /r Perform an Intermediate Calculation for the Next Four SHA1 Message Dwords
SHA1MSG2 0F 38 CA /r Perform a Final Calculation for the Next Four SHA1 Message Dwords
SHA256RNDS2 0F 38 CB /r Perform Two Rounds of SHA256 Operation
SHA256MSG1 0F 38 CC /r Perform an Intermediate Calculation for the Next Four SHA256 Message Dwords
SHA256MSG2 0F 38 CD /r Perform a Final Calculation for the Next Four SHA256 Message Dwords

Intel AES Key Locker instructions[edit]

These instructions, available in Tiger Lake and later Intel processors, are designed to enable encryption/decryption with an AES key without having access to any unencrypted copies of the key during the actual encryption/decryption process.

Instruction Encoding Description Notes
LOADIWKEY xmm1,xmm2 F3 0F 38 DC /r Load internal wrapping key ("IWKey") from xmm1, xmm2 and XMM0. The two explicit operands (which must be register operands) specify a 256-bit encryption key.
The implicit operand in XMM0 specifies a 128-bit integrity key. EAX contains flags controlling operation of instruction.
After being loaded, the IWKey cannot be directly read from software, but is used for the key wrapping done by
ENCODEKEY128/256 and checked by the Key Locker encode/decode instructions.
LOADIWKEY is privileged and can run in Ring 0 only.
ENCODEKEY128 r32,r32 F3 0F 38 FA /r Wrap a 128-bit AES key from XMM0 into a 384-bit key handle and output handle in XMM0-2. Source operand specifies handle restrictions to build into the handle.
Destination operand is initialized with information about the source and attributes of the key.
The instruction also modifies XMM4-6 (zeroed out in existing implementations, but this should not be relied on).
ENCODEKEY256 r32,32 F3 0F 3A FB /r Wrap a 256-bit AES key from XMM1:XMM0 into a 512-bit key handle and output handle in XMM0-3.
AESENC128KL xmm,m384 F3 0F 38 DC /r Encrypt xmm using 128-bit AES key indicated by handle at m384 and store result in xmm. All of the Key Locker encode/decode instructions will check whether the handle is valid for the current IWKey
and encode/decode data only if the handle is valid.
The ZF flag is used to indicate whether the provided handle was valid (ZF=0) or not (ZF=1).
AESDEC128KL xmm,m384 F3 0F 38 DD /r Decrypt xmm using 128-bit AES key indicated by handle at m384 and store result in xmm.
AESENC256KL xmm,m512 F3 0F 38 DE /r Encrypt xmm using 256-bit AES key indicated by handle at m512 and store result in xmm.
AESDEC256KL xmm,m512 F3 0F 38 DF /r Decrypt xmm using 256-bit AES key indicated by handle at m512 and store result in xmm.
AESENCWIDE128KL m384 F3 0F 38 D8 /0 Encrypt XMM0-7 using 128-bit AES key indicated by handle at m384 and store each resultant block back to its corresponding register.
AESDECWIDE128KL m384 F3 0F 38 D8 /1 Decrypt XMM0-7 using 128-bit AES key indicated by handle at m384 and store each resultant block back to its corresponding register.
AESENCWIDE256KL m512 F3 0F 38 D8 /2 Encrypt XMM0-7 using 256-bit AES key indicated by handle at m512 and store each resultant block back to its corresponding register.
AESDECWIDE256KL m512 F3 0F 38 D8 /3 Decrypt XMM0-7 using 256-bit AES key indicated by handle at m512 and store each resultant block back to its corresponding register.

VIA PadLock instructions[edit]

Instruction Encoding Description
REP MONTMUL F3 0F A6 C0 Perform Montgomery Multiplication
REP XSHA1 F3 0F A6 C8 Compute SHA-1 hash for ECX bytes
REP XSHA256 F3 0F A6 D0 Compute SHA-256 hash for ECX bytes
CCS_HASH[47][48] F3 0F A6 E8 Compute SM3 hash for ECX units (bytes or 64-byte blocks) (Zhaoxin CPUs only)
XSTORE 0F A7 C0 Store Available Random Bytes (0 to 8 bytes)
REP XSTORE F3 0F A7 C0 Store ECX Random Bytes
REP XCRYPTECB F3 0F A7 C8 Encrypt/Decrypt ECX 128-bit blocks, using AES in ECB block mode
REP XCRYPTCBC F3 0F A7 D0 Encrypt/Decrypt ECX 128-bit blocks, using AES in CBC block mode
REP XCRYPTCTR F3 0F A7 D8 Encrypt/Decrypt ECX 128-bit blocks, using AES in CTR block mode
REP XCRYPTCFB F3 0F A7 E0  Encrypt/Decrypt ECX 128-bit blocks, using AES in CFB block mode
REP XCRYPTOFB F3 0F A7 E8 Encrypt/Decrypt ECX 128-bit blocks, using AES in OFB block mode
CCS_ENCRYPT[47][48] F3 0F A7 F0 Encrypt/Decrypt ECX 128-bit blocks, using SM4 encryption (Zhaoxin CPUs only)

Other instructions[edit]

x86 also includes discontinued instruction sets which are no longer supported by Intel and AMD, and undocumented instructions which execute but are not officially documented.

Virtualization instructions[edit]

AMD-V instructions[edit]

Instruction Opcode Meaning Notes
Basic SVM instructions
VMRUN 0F 01 D8 Run virtual machine Performs a switch to the guest OS.
VMMCALL 0F 01 D9 Call VMM Used exclusively to communicate with VMM.
VMLOAD 0F 01 DA Load state From VMCB Loads a subset of processor state from the VMCB specified by the physical address in the RAX register.
VMSAVE 0F 01 DB Save state To VMCB Saves additional guest state to VMCB.
STGI 0F 01 DC Set Global Interrupt Flag Normally used by the VMM.

Available to the VM guest if VGIF feature is supported.

CLGI 0F 01 DD Clear Global Interrupt Flag
SKINIT 0F 01 DE Secure Init and Jump with Attestation Verifiable startup of trusted software based on secure hash comparison
INVLPGA 0F 01 DF Invalidate TLB entry in a specified ASID Invalidates the TLB mapping for the virtual page specified in RAX and the ASID specified in ECX.
Virtualization Encrypted State (SEV-ES) instructions
VMGEXIT F2/F3 0F 01 D9
SEV-ES Exit to VMM Explicit communication with the VMM for SEV-ES VMs.

Executed as VMMCALL if not executed by a SEV-ES guest.

Secure Nested Paging (SEV-SNP) Reverse-Map Table instructions
PSMASH F3 0F 01 FF Page Smash Expands a 2MB-page RMP entry into a corresponding set of contiguous 4KB-page RMP entries. The 2MB page's system physical address is specified in the RAX register.
PVALIDATE F2 0F 01 FF Page Validate Validates or rescinds validation of a guest page's RMP entry. The guest virtual address is specified in the register operand rAX.
RMPADJUST F3 0F 01 FE Adjust RMP Permissions Modifies RMP permissions for a guest page. The guest virtual address is specified in the RAX register. The page size is specified in RCX[0]. The target VMPL and its permissions are specified in the RDX register.
RMPUPDATE F2 0F 01 FE Write RMP Entry Writes a new RMP entry. The system physical address of a page whose RMP entry is modified is specified in the RAX register. The RCX register provides the effective address of a 16-byte data structure which contains the new RMP state.
RMPQUERY F3 0F 01 FD Read RMP Permissions Reads an RMP permission mask for a guest page. The guest virtual address is specified in the RAX register. The target VMPL is specified in RDX[7:0]. RMP permissions for the specified VMPL are returned in RDX[63:8] and the RCX register.

Intel VT-x instructions[edit]

Instruction Meaning Notes Opcode
INVEPT Invalidate Translations Derived from EPT Invalidates EPT-derived entries in the TLBs and paging-structure caches. 66 0F 38 80
INVVPID Invalidate Translations Based on VPID Invalidates entries in the TLBs and paging-structure caches based on VPID. 66 0F 38 80
VMFUNC Invoke VM function Invoke VM function specified in EAX. 0F 01 D4
VMPTRLD Load Pointer to Virtual-Machine Control Structure Loads the current VMCS pointer from memory. 0F C7 /6
VMPTRST Store Pointer to Virtual-Machine Control Structure Stores the current-VMCS pointer into a specified memory address.
The operand of this instruction is always 64 bits and is always in memory.
0F C7 /7
VMCLEAR Clear Virtual-Machine Control Structure Writes any cached data to the VMCS 66 0F C7 /6
VMREAD Read Field from Virtual-Machine Control Structure Reads out a field in the VMCS 0F 78 /r
VMWRITE Write Field to Virtual-Machine Control Structure Modifies a field in the VMCS 0F 79 /r
VMCALL Call to VM Monitor Calls VM Monitor function from Guest System 0F 01 C1
VMLAUNCH Launch Virtual Machine Launch virtual machine managed by current VMCS 0F 01 C2
VMRESUME Resume Virtual Machine Resume virtual machine managed by current VMCS 0F 01 C3
VMXOFF Leave VMX Operation Stops hardware supported virtualisation environment 0F 01 C4
VMXON Enter VMX Operation Enters hardware supported virtualisation environment F3 0F C7 /6

Undocumented instructions[edit]

Undocumented x86 instructions[edit]

The x86 CPUs contain undocumented instructions which are implemented on the chips but not listed in some official documents. They can be found in various sources across the Internet, such as Ralf Brown's Interrupt List and at sandpile.org

Some of these instructions are widely available across many/most x86 CPUs, while others are specific to a narrow range of CPUs.

Undocumented instructions that are widely available across many x86 CPUs include[edit]

Mnemonics Opcodes Description Status
AAM imm8 D4 imm8 ASCII-Adjust-after-Multiply. On the 8086, documented for imm8=0Ah only, which is used to convert a binary multiplication result to BCD.

The actual operation is AH ← AL/imm8; AL ← AL mod imm8 for any imm8 value (except zero, which produces a divide-by-zero exception).[49]

Available beginning with 8086, documented for imm8 values other than 0Ah since Pentium (earlier documentation lists no arguments).
AAD imm8 D5 imm8 ASCII-Adjust-Before-Division. On the 8086, documented for imm8=0Ah only, which is used to convert a BCD value to binary for a following division instruction.

The actual operation is AL ← (AL+(AH*imm8)) & 0FFh; AH ← 0 for any imm8 value.

SALC,

SETALC

D6 Set AL depending on the value of the Carry Flag (a 1-byte alternative of SBB AL, AL) Available beginning with 8086, but only documented since Pentium Pro.
TEST F6 /1 imm8,

F7 /1 imm16/32

Undocumented variants of the TEST instruction.[50] Performs the same operation as the documented F6 /0 and F7 /0 variants, respectively. Available since the 8086.

Unavailable on some 80486 steppings.[51][52]

SHL,

SAL

(D0..D3) /6,

(C0..C1) /6 imm8

Undocumented variants of the SHL instruction.[50] Performs the same operation as the documented (D0..D3) /4 and (C0..C1) /4 variants, respectively. Available since the 80186 (performs different operation on the 8086)[53]
 (multiple) 82 /(0..7) imm8 Alias of opcode 80, which provides variants of 8-bit integer instructions (ADD, OR, ADC, SBB, AND, SUB, XOR, CMP) with an 8-bit immediate argument.[54] Available since the 8086.[54] Explicitly unavailable in 64-bit mode but kept and reserved for compatibility.[55]
OR,AND,XOR 83 /(1,4,6) imm8 16-bit OR/AND/XOR with a sign-extended 8-bit immediate. Available on 8086, but only documented from 80386 onwards.[56][57]
REPNZ MOVS F2 (A4..A5) The behavior of the F2 prefix (REPNZ, REPNE) when used with string instructions other than CMPS/SCAS is officially undefined, but there exists commercial software (e.g. the version of FDISK distributed with MS-DOS versions 3.30 to 6.22[58]) that rely on it to behave in the same way as the documented F3 (REP) prefix. Available since the 8086.
REPNZ STOS F2 (AA..AB)
REP RET F3 C3 The use of the REP prefix with the RET instruction is not listed as supported in either the Intel SDM or the AMD APM. However, AMD's optimization guide for the AMD-K8 describes the F3 C3 encoding as a way to encode a two-byte RET instruction - this is the recommended workaround for an issue in the AMD-K8's branch predictor that can cause branch prediction to fail for some 1-byte RET instructions.[59] At least some versions of gcc are known to use this encoding.[60] Executes as RET on all known x86 CPUs.
NOP 67 90 NOP with address-size override prefix. The use of the 67 prefix for instructions without memory operands is listed by the Intel SDM (vol 2, section 2.1.1) as "reserved", but it is used in Microsoft Windows 95 as a workaround for a bug in the B1 stepping of Intel 80386.[61][62] Executes as NOP on 80386 and later.
ICEBP,

INT1

F1 Single byte single-step exception / Invoke ICE Available beginning with 80386, documented (as INT1) since Pentium Pro. Treated as undocumented instruction prefix on 8086 and 80286.[63]
NOP r/m 0F 1F /0 Official long NOP.

Introduced in the Pentium Pro in 1995, but remained undocumented until March 2006.[20][64][65]

Available on Pentium Pro and AMD K7[66] and later.

Unavailable on AMD K6, AMD Geode LX, VIA Nehemiah.[67]

NOP r/m 0F 0D /r Reserved-NOP. Introduced in 65 nm Pentium 4. Intel documentation lists this opcode as NOP in opcode tables but not instruction listings since June 2005.[68][69] From Broadwell onwards, 0F 0D /1 has been documented as PREFETCHW.

On AMD CPUs, 0F 0D with a memory argument is documented as PREFETCH/PREFETCHW since K6-2 - originally as part of 3dnow!, but has been kept in later AMD CPUs even after the rest of 3dnow! was dropped.

Available on Intel CPUs since 65 nm Pentium 4.

UD1 0F B9 /r Intentionally undefined instructions, but unlike UD2 (0F 0B) these instructions were left unpublished until December 2016.[70][71]

Microsoft Windows 95 Setup is known to depend on 0F FF being invalid[72][73] - it is used as a self check to test that its #UD exception handler is working properly.

Other invalid opcodes that are being relied on by commercial software to produce #UD exceptions include FF FF (DIF-2,[74] LaserLok[75]) and C4 C4 ("BOP"[76][77]), however as of January 2022 they are not published as intentionally invalid opcodes.

All of these opcodes produce #UD exceptions on 80186 and later (except on NEC V20/V30, which assign at least 0F FF to the BRKEM instruction.)
UD0 0F FF

Undocumented instructions that appear only in a limited subset of x86 CPUs include[edit]

Mnemonics Opcodes Description Status
REP IMUL F3 F6 /5, F3 F7 /5 A REP or REPNZ prefix on an IMUL instruction causes the result to be negated. This is due to the microcode using the “REP prefix present” bit to store the sign of the result. 8086/8088 only.[78]
REP IDIV F3 F6 /7, F3 F7 /7 A REP or REPNZ prefix on an IDIV instruction causes the quotient to be negated. This is due to the microcode using the “REP prefix present” bit to store the sign of the quotient. 8086/8088 only.[78]
SAVEALL,

STOREALL

0F 04 Exact purpose unknown, causes CPU hang (HCF). The only way out is CPU reset.[79]

In some implementations, emulated through BIOS as a halting sequence.[80]

In a forum post at the Vintage Computing Federation, this instruction is explained as SAVEALL. It interacts with ICE mode.

Only available on 80286
LOADALL 0F 05 Loads All Registers from Memory Address 0x000800H Only available on 80286.

Opcode reused for SYSCALL in AMD K6-2 and later CPUs.

LOADALLD 0F 07 Loads All Registers from Memory Address ES:EDI Only available on 80386.

Opcode reused for SYSRET in AMD K6-2 and later CPUs.

CL1INVMB 0F 0A[81] On the Intel SCC (Single-chip Cloud Computer), invalidate all message buffers. The menmonic and operation of the instruction, but not its opcode, are described in Intel's SCC architecture specification.[82] Available on the SCC only.
PATCH2 0F 0E On AMD K6 and later maps to FEMMS operation (fast clear of MMX state) but on Intel identified as uarch data read on Intel[83] Only available in Red unlock state (0F 0F too)
PATCH3 0F 0F Write uarch Can change RAM part of microcode on Intel
UMOV r,r/m

UMOV r/m,r

0F (10..13) /r Moves data to/from user memory when operating in ICE HALT mode.[84] Acts as regular MOV otherwise. Available on some 386 and 486 processors only.

Opcodes reused for SSE instructions in later CPUs.

NXOP 0F 55 NexGen hypercode interface.[85] Available on NexGen Nx586 only.
(multiple) 0F (E0..FB)[86] NexGen Nx586 "hyper mode" instructions.

The NexGen Nx586 CPU uses "hyper code"[87] (x86 code sequences unpacked at boot time and only accessible in a special "hyper mode" operation mode, similar to DEC Alpha's PALcode) for many complicated operations that are implemented with microcode in most other x86 CPUs. The Nx586 provides a large number of undocumented instructions to assist hyper mode operation.

Available in Nx586 hyper mode only.
PSWAPW mm,mm/m64 0F 0F /r BB Undocumented AMD 3DNow! instruction on K6-2 and K6-3. Swaps 16-bit words within 64-bit MMX register.[88][89]

Instruction known to be recognized by MASM 6.13 and 6.14.

Available on K6-2 and K6-3 only.

Opcode reused for documented PSWAPD instruction from AMD K7 onwards.

Un­known mnemonic 64 D6 Using the 64h (FS: segment) prefix with the undocumented D6 (SALC/SETALC) instruction will, on UMC CPUs only, cause EAX to be set to 0xAB6B1B07.[90][91] Available on the UMC Green CPU only. Executes as SALC on non-UMC CPUs.
FS: Jcc 64 (70..7F) rel8,

64 0F (80..8F) rel16/32

On Intel "NetBurst" (Pentium 4) CPUs, the 64h (FS: segment) instruction prefix will, when used with conditional branch instructions, act as a branch hint to indicate that the branch will be alternating between taken and not-taken.[92] Unlike other NetBurst branch hints (CS: and DS: segment prefixes), this hint is not documented. Available on NetBurst CPUs only.

Segment prefixes on conditional branches are accepted but ignored by non-NetBurst CPUs.

ALTINST 0F 3F Jump and execute instructions in the undocumented Alternate Instruction Set. Only available on some x86 processors made by VIA Technologies.
(FMA4) VEX.66.0F38 (5C..5F,68..6F,78..7F) /r imm8 On AMD Zen1, FMA4 instructions are present but undocumented (missing CPUID flag). The reason for leaving the feature undocumented may or may not have been due to a buggy implementation.[93] Removed from Zen2 onwards.
REP XSHA512 F3 0F A6 E0 Perform SHA-512 hashing.

Supported by OpenSSL [94] as part of its VIA PadLock support, but not documented by the VIA PadLock Programming Guide.

Only available on some x86 processors made by VIA Technologies and Zhaoxin.
REP XMODEXP F3 0F A6 F8 Instructions to perform modular exponentiation and random number generation, respectively.

Listed in a VIA-supplied patch to add support for VIA Nano-specific PadLock instructions to OpenSSL,[95] but not documented by the VIA PadLock Programming Guide.

XRNG2 F3 0F A7 F8
Un­known mnemonic 0F A7 (C1..C7) Detected by CPU fuzzing tools such as SandSifter[96] and UISFuzz[97] as executing without causing #UD on several different VIA and Zhaoxin CPUs.

Unknown operation, may be related to the documented XSTORE (0F A7 C0) instruction.

(unknown, multiple) 0F 0F /r ?? The whitepapers for SandSifter[96] and UISFuzz[97] report the detection of large numbers of undocumented instructions in the 3DNow! opcode range on several different AMD CPUs (at least Geode NX and C-50). Their operation is not known.

On at least AMD K6-2, all of the unassigned 3DNow! opcodes (other than the undocumented PF2IW, PI2FW and PSWAPW instructions) execute as equivalents of POR (MMX bitwise-OR instruction).[89]

Present on some AMD CPUs with 3DNow!.
MONTMUL2 Un­known Zhaoxin RSA/"xmodx" instructions. Mnemonics and CPUID flags are listed in a Linux kernel patch for OpenEuler,[98] but opcodes and instruction descriptions are not available. Un­known. Some Zhaoxin CPUs[99] have the CPUID flags for these instructions set.
MOVDB,

GP2MEM

Un­known Microprocessor Report's article "MediaGX Targets Low-Cost PCs" from 1997, covering the introduction of the Cyrix MediaGX processor, lists several new instructions that are said to have been added to this processor in order to support its new "Virtual System Architecture" features, including MOVDB and GP2MEM - and also mentions that Cyrix did not intend to publish specifications for these instructions.[100] Un­known.

No specification known to have been published.

Undocumented x87 instructions[edit]

Mnemonics Opcodes Description Status
FENI,

FENI8087_NOP

DB E0 FPU Enable Interrupts (8087) Documented for the Intel 80287.[36]

Present on all Intel x87 FPUs from 80287 onwards. For FPUs other than the ones where they were introduced on (8087 for FENI/FDISI and 80287 for FSETPM), they act as NOPs.

These instructions and their operation on modern CPUs are commonly mentioned in later Intel documentation, but with opcodes omitted and opcode table entries left blank (e.g. Intel SDM 325462-077, April 2022 mentions them twice without opcodes).

The opcodes are, however, recognized by Intel XED.[101]

FDISI,

FDISI8087_NOP

DB E1 FPU Disable Interrupts (8087)
FSETPM,

FSETPM287_NOP

DB E4 FPU Set Protected Mode (80287)
(no mnemonic) D9 D7,  D9 E2,
D9 E7,  DD FC,
DE D8,  DE DA,
DE DC,  DE DD,
DE DE,  DF FC
"Reserved by Cyrix" opcodes These opcodes are listed as reserved opcodes that will produce "unpredictable results" without generating exceptions on at least Cyrix 6x86,[102] 6x86MX, MII, MediaGX, and AMD Geode GX/LX.[103] (The documentation for these CPUs all list the same ten opcodes.)

Their actual operation is not known, nor is it known whether their operation is the same on all of these CPUs.

See also[edit]

References[edit]

  1. ^ a b "Re: Intel Processor Identification and the CPUID Instruction". Retrieved 2013-04-21.
  2. ^ Andrew Schulman, "Unauthorized Windows 95" (ISBN 1-56884-169-8), chapter 8, p.249,257.
  3. ^ US Patent 4974159, "Method of transferring control in a multitasking computer system" mentions 63h/ARPL.
  4. ^ WikiChip, UMIP - x86
  5. ^ Oracle Corp, Oracle® VM VirtualBox Administrator's Guide for Release 6.0, section 3.5: Details About Software Virtualization
  6. ^ MBC Project,Virtual Machine Detection
  7. ^ Michal Necasek, SGDT/SIDT Fiction and Reality
  8. ^ Intel, How Microarchitectural Data Sampling works, see mitigations section. Archived on Apr 22,2022
  9. ^ Linux kernel documentation, Microarchitectural Data Sampling (MDS) mitigation
  10. ^ sandpile.org, x86 architecture rFLAGS register, see note #7
  11. ^ "Intel 80386 CPU Information | PCJS Machines".
  12. ^ Geoff Chappell, CPU Identification before CPUID
  13. ^ Toth, Ervin (1998-03-16). "BSWAP with 16-bit registers". Archived from the original on 1999-11-03. The instruction brings down the upper word of the doubleword register without affecting its upper 16 bits.
  14. ^ Coldwin, Gynvael (2009-12-29). "BSWAP + 66h prefix". Retrieved 2018-10-03. internal (zero-)extending the value of a smaller (16-bit) register … applying the bswap to a 32-bit value "00 00 AH AL", … truncated to lower 16-bits, which are "00 00". … Bochs … bswap reg16 acts just like the bswap reg32 … QEMU … ignores the 66h prefix
  15. ^ Intel "i486 Microprocessor" (April 1989, order no. 240440-001) p.142 lists CMPXCHG with 0F A6/A7 encodings.
  16. ^ "Intel 486 & 486 POD CPUID, S-spec, & Steppings".
  17. ^ Intel "i486 Microprocessor" (November 1989, order no. 240440-002) p.135 lists CMPXCHG with 0F B0/B1 encodings.
  18. ^ "RSM—Resume from System Management Mode". Archived from the original on 2012-03-12.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
  19. ^ Cyrix 486SLC/e Data Sheet (1992), section 2.6.4
  20. ^ a b Intel Community: Multibyte NOP Made Official. Archived on 7 Apr 2022.
  21. ^ Intel Software Developers Manual, vol 3B (order no 253669-076us, December 2021), section 22.15 "Reserved NOP"
  22. ^ Michal Necasek, "SYSENTER, Where Are You?"
  23. ^ Intel 64 and IA-32 Architectures Optimization Reference Manual, section 7.3.2
  24. ^ Intel 64 and IA-32 Architectures Software Developer's Manual, section 4.3, subsection "PREFETCHh—Prefetch Data Into Caches"
  25. ^ CPU-World, CPUID for Intel Xeon 3.40 GHz - Nocona stepping D CPUID without CMPXCHG16B
  26. ^ CPU-World, CPUID for Intel Xeon 3.60 GHz - Nocona stepping E CPUID with CMPXCHG16B
  27. ^ SuperUser StackExchange, How prevalent are old x64 processors lacking the cmpxchg16b instruction?
  28. ^ Intel SDM order no. 325462-077, apr 2022, vol 2B, p.4-130 "MOVSX/MOVSXD-Move with Sign-Extension" lists MOVSXD without REX.W as "discouraged"
  29. ^ Intel, Control-flow Enforcement Technology Specification (v3.0, order no. 334525-003, March 2019)
  30. ^ Intel SDM, rev 076, December 2021, volume 1, section 18.3.1
  31. ^ Binutils mailing list: x86: CET v2.0: Update NOTRACK prefix
  32. ^ Intel, Application Note AP-113: Getting Started With The Numeric Data Processor, feb 1981, pages 24-25
  33. ^ Intel, 8087 Math Coprocessor, oct 1989, order no. 285385-007, page 3-100, fig 9
  34. ^ Intel, 80287 80-bit HMOS Numeric Processor Extension, feb 1983, order no. 201920-001, page 14
  35. ^ Intel, iAPX86, 88 User's Manual, 1981 (order no. 210201-001), p. 797
  36. ^ a b Intel 80286 and 80287 Programmers Reference Manual, 1987 (order no. 210498-005), p. 485
  37. ^ Intel Software Developer's Manual volume 3B, revision 064, section 22.18.9
  38. ^ "GCC Bugzilla – 37179 – GCC emits bad opcode 'ffreep'".
  39. ^ Michael Steil, FFREEP – the assembly instruction that never existed
  40. ^ Dusko Koncaliev, Pentium FDIV Bug
  41. ^ Bruce Dawson, Intel Underestimates Error Bounds by 1.3 quintillion
  42. ^ Intel SDM, rev 053 and later, describes the exact argument reduction procedure used for FSIN, FCOS, FSINCOS and FPTAN in volume 1, section 8.3.8
  43. ^ Intel, Intel® 64 and IA-32 Architectures Optimization Reference Manual (order no. 248966-044, June 2021) section 3.5.2.3
  44. ^ "The microarchitecture of Intel, AMD and VIA CPUs: An optimization guide for assembly programmers and compiler makers" (PDF). Retrieved October 17, 2016.
  45. ^ "Chess programming AVX2". Retrieved October 17, 2016.
  46. ^ "Intel AVX-512 Instructions". Intel. Retrieved 21 June 2022.
  47. ^ a b Zhaoxin, Core Technology | Instructions for the use of accelerated instructions for national encryption algorithm based on Zhaoxin processor (in Chinese). Archived on Jan 5, 2022
  48. ^ a b Zhaoxin, GMI User Manual v1.0 (in Chinese). Archived on Feb 28, 2022
  49. ^ Robert Collins, Undocumented OpCodes: AAM
  50. ^ a b Frank van Gilluwe, "The Undocumented PC - Second Edition", p. 93-95
  51. ^ Michal Necasek, Intel 486 Errata?
  52. ^ Robert Hummel, "PC Magazine Programmer's Technical Reference" (ISBN 1-56276-016-5) p.728
  53. ^ Raúl Gutiérrez Sanz, Undocumented 8086 Opcodes, Part I
  54. ^ a b "Asm, opcode 82h".
  55. ^ Intel Corporation 2022, p. 3698.
  56. ^ Intel, The 8086 Family User's Manual, October 1979, opcodes omitted on pages 4-25 and 4-31
  57. ^ Retrocomputing StackExchange, Undocumented instructions in x86 CPU prior to 80386?
  58. ^ Daniel B. Sedory, An Examination of the Standard MBR
  59. ^ AMD, Software Optimization Guide for AMD64 Processors (publication 25112, revision 3.06, sep 2005), section 6.2, p.128
  60. ^ Bug 48227 - "rep ret" generated for -march=core2
  61. ^ Raymond Chen, My, what strange NOPs you have!
  62. ^ Jeff Parsons, Intel 80386 CPU information (B1 errata section, item #7)
  63. ^ Retrocomputing StackExchange, 0F1h opcode-prefix on i80286
  64. ^ Intel Software Developers Manual, volume 2B (Jan 2006, order no 235667-018, does not have long NOP)
  65. ^ Intel Software Developers Manual, volume 2B (March 2006, order no 235667-019, has long NOP)
  66. ^ Agner Fog, Instruction Tables, AMD K7 section.
  67. ^ "579838 – glibc not compatible with AMD Geode LX".
  68. ^ Intel Software Developers Manual, volume 2B (April 2005, order no 235667-015, does not list 0F0D-nop)
  69. ^ Intel Software Developers Manual, volume 2B (June 2005, order no 235667-016, lists 0F0D-nop in opcode table but not under NOP instruction description.)
  70. ^ Intel Software Developers Manual, volume 2B (order no. 253667-060, September 2016) does not list UD0 and UD1.
  71. ^ Intel Software Developers Manual, volume 2B (order no. 253667-061, December 2016) lists UD0 and UD1.
  72. ^ "PCJS : pcjs/x86op0F.js (two-byte x86 opcode handlers), lines 1647-1651". GitHub. 17 April 2022.
  73. ^ "80486 paging protection faults? \ VOGONS". Archived from the original on 9 Apr 2022.
  74. ^ "Invalid opcode handling \ VOGONS". Archived from the original on 9 Apr 2022.
  75. ^ "Invalid instructions cause exit even if Int 6 is hooked \ VOGONS". Archived from the original on 9 Apr 2022.
  76. ^ "Tutorial - Calling Win32 from DOS". Ragestorm. 17 Sep 2005. Archived from the original on 4 Apr 2022.
  77. ^ "Accessing Windows device drivers from DOS programs".
  78. ^ a b "8086 microcode disassembled". Reengine blog. 2020-09-03. Retrieved 2022-07-26. Using the REP or REPNE prefix with a MUL or IMUL instruction negates the product. Using the REP or REPNE prefix with an IDIV instruction negates the quotient.
  79. ^ "Re: Undocumented opcodes (HINT_NOP)". Archived from the original on 2004-11-06. Retrieved 2010-11-07.
  80. ^ "Re: Also some undocumented 0Fh opcodes". Archived from the original on 2003-06-26. Retrieved 2010-11-07.
  81. ^ Intel's RCCE library for the SCC uses opcode 0F 0A for SCC's message invalidation instruction.
  82. ^ Intel Labs, SCC External Architecture Specification (EAS), Revision 0.94, p.29
  83. ^ "Undocumented x86 instructions to control the CPU at the microarchitecture level in modern Intel processors" (PDF). 9 July 2021.{{cite web}}: CS1 maint: url-status (link)
  84. ^ Robert R. Collins, Undocumented OpCodes: UMOV
  85. ^ Herbert Oppmann, NXOP (Opcode 0Fh 55h)
  86. ^ Herbert Oppmann, NexGen Nx586 Hypercode Source, see COMMON.INC
  87. ^ Herbert Oppmann, Inside the NexGen Nx586 System BIOS
  88. ^ Grzegorz Mazur, AMD 3DNow! undocumented instructions
  89. ^ a b "Undocumented 3DNow! Instructions". grafi.ii.pw.edu.pl. Archived from the original on 30 January 2003. Retrieved 22 February 2022.
  90. ^ Potemkin's Hacker Group's OPCODE.LST, v4.51
  91. ^ "[UCA CPU Analysis] Prototype UMC Green CPU U5S-SUPER33". 25 May 2020.
  92. ^ Agner Fog, The Microarchitecture of Intel, AMD and VIA CPUs, section 3.4 "Branch Prediction in P4 and P4E".
  93. ^ Reddit /r/Amd discussion thread: Ryzen has undocumented support for FMA4
  94. ^ "Welcome to the OpenSSL Project". GitHub. 21 April 2022.
  95. ^ PATCH: Update PadLock engine for VIA C7 and Nano CPUs
  96. ^ a b Christopher Domas, Breaking the x86 ISA
  97. ^ a b Xixing Li et al, UISFuzz: An Efficient Fuzzing Method for CPU Undocumented Instruction Searching
  98. ^ OpenEuler mailing list, PATCH kernel-4.19 v2 5/6 : x86/cpufeatures: Add Zhaoxin feature bits. Archived on 9 Apr 2022.
  99. ^ CPUID dump for Zhaoxin KaiXian-U6870, see C0000001 line. Archived on 9 Apr 2022.
  100. ^ Microprocessor Report, MediaGX Targets Low-Cost PCs (vol 11, no. 3, mar 10, 1997)
  101. ^ ISA datafile for Intel XED (April 17, 2022), lines 916-944
  102. ^ Cyrix 6x86 processor data book, page 6-34
  103. ^ AMD Geode LX Processors Data Book, publication 33234H, p.670

External links[edit]