Loading AI tools
List of x86 microprocessor instructions From Wikipedia, the free encyclopedia
The x86 instruction set refers to the set of instructions that x86-compatible microprocessors support. The instructions are usually part of an executable program, often stored as a computer file and executed on the processor.
The x86 instruction set has been extended several times, introducing wider registers and datatypes as well as new functionality.[1]
Below is the full 8086/8088 instruction set of Intel (81 instructions total).[2] These instructions are also available in 32-bit mode, they operate instead on 32-bit registers (eax, ebx, etc.) and values instead of their 16-bit (ax, bx, etc.) counterparts. The updated instruction set is grouped according to architecture (i186, i286, i386, i486, i586/i686) and is referred to as (32-bit) x86 and (64-bit) x86-64 (also known as AMD64).
This is the original instruction set. In the 'Notes' column, r means register, m means memory address and imm means immediate (i.e. a value).
In- struc- tion | Meaning | Notes | Opcode |
---|---|---|---|
AAA | ASCII adjust AL after addition | used with unpacked binary-coded decimal | 0x37 |
AAD | ASCII adjust AX before division | 8086/8088 datasheet documents only base 10 version of the AAD instruction (opcode 0xD5 0x0A), but any other base will work. Later Intel's documentation has the generic form too. NEC V20 and V30 (and possibly other NEC V-series CPUs) always use base 10, and ignore the argument, causing a number of incompatibilities | 0xD5 |
AAM | ASCII adjust AX after multiplication | Only base 10 version (Operand is 0xA) is documented, see notes for AAD | 0xD4 |
AAS | ASCII adjust AL after subtraction | 0x3F | |
ADC | Add with carry | destination = destination + source + carry_flag | 0x10...0x15, 0x80...0x81/2, 0x82...0x83/2 (186+) |
ADD | Add | (1) r/m += r/imm; (2) r += r/imm; | 0x00...0x05, 0x80/0...0x81/0, 0x82/0...0x83/0 (186+) |
AND | Logical AND | (1) r/m &= r/imm; (2) r &= r/imm; | 0x20...0x25, 0x80...0x81/4, 0x82...0x83/4 (186+) |
CALL | Call procedure | push eip; eip points to the instruction directly after the call | 0x9A, 0xE8, 0xFF/2, 0xFF/3 |
CBW | Convert byte to word | AX = AL ; sign extended | 0x98 |
CLC | Clear carry flag | CF = 0; | 0xF8 |
CLD | Clear direction flag | DF = 0; | 0xFC |
CLI | Clear interrupt flag | IF = 0; | 0xFA |
CMC | Complement carry flag | CF = !CF; | 0xF5 |
CMP | Compare operands | 0x38...0x3D, 0x80...0x81/7, 0x82...0x83/7 (186+) | |
CMPSB | Compare bytes in memory. May be used with a REPE or REPNE prefix to test and repeat the instruction CX times. | 0xA6 | |
CMPSW | Compare words. May be used with a REPE or REPNE prefix to test and repeat the instruction CX times. | 0xA7 | |
CWD | Convert word to doubleword | 0x99 | |
DAA | Decimal adjust AL after addition | (used with packed binary-coded decimal) | 0x27 |
DAS | Decimal adjust AL after subtraction | 0x2F | |
DEC | Decrement by 1 | 0x48...0x4F, 0xFE/1, 0xFF/1 | |
DIV | Unsigned divide | (1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder | 0xF7/6, 0xF6/6 |
ESC | Used with floating-point unit | 0xD8..0xDF | |
HLT | Enter halt state | 0xF4 | |
IDIV | Signed divide | (1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder | 0xF7/7, 0xF6/7 |
IMUL | Signed multiply in One-operand form | (1) DX:AX = AX * r/m; (2) AX = AL * r/m | 0x69, 0x6B (both 186+), 0xF7/5, 0xF6/5, 0x0FAF (386+) |
IN | Input from port | (1) AL = port[imm]; (2) AL = port[DX]; (3) AX = port[imm]; (4) AX = port[DX]; | 0xE4, 0xE5, 0xEC, 0xED |
INC | Increment by 1 | 0x40...0x47, 0xFE/0, 0xFF/0 | |
INT | Call to interrupt | 0xCC, 0xCD | |
INTO | Call to interrupt if overflow | 0xCE | |
IRET | Return from interrupt | 0xCF | |
Jcc | Jump if condition | (JA, JAE, JB, JBE, JC, JE, JG, JGE, JL, JLE, JNA, JNAE, JNB, JNBE, JNC, JNE, JNG, JNGE, JNL, JNLE, JNO, JNP, JNS, JNZ, JO, JP, JPE, JPO, JS, JZ) | 0x70...0x7F, 0x0F80...0x0F8F (386+) |
JCXZ | Jump if CX is zero | 0xE3 | |
JMP | Jump | 0xE9...0xEB, 0xFF/4, 0xFF/5 | |
LAHF | Load FLAGS into AH register | 0x9F | |
LDS | Load DS:r with far pointer | 0xC5 | |
LEA | Load Effective Address | 0x8D | |
LES | Load ES:r with far pointer | 0xC4 | |
LOCK | Assert BUS LOCK# signal | (for multiprocessing) | 0xF0 |
LODSB | Load string byte. May be used with a REP prefix to repeat the instruction CX times. | if (DF==0) AL = *SI++; else AL = *SI--; | 0xAC |
LODSW | Load string word. May be used with a REP prefix to repeat the instruction CX times. | if (DF==0) AX = *SI++; else AX = *SI--; | 0xAD |
LOOP/ LOOPx | Loop control | (LOOPE, LOOPNE, LOOPNZ, LOOPZ) if (x && --CX) goto lbl; | 0xE0...0xE2 |
MOV | Move | copies data from one location to another, (1) r/m = r; (2) r = r/m; | 0xA0...0xA3 |
MOVSB | Move byte from string to string. May be used with a REP prefix to repeat the instruction CX times. | if (DF==0) *(byte*)DI++ = *(byte*)SI++;
else *(byte*)DI-- = *(byte*)SI--;
| 0xA4 |
MOVSW | Move word from string to string. May be used with a REP prefix to repeat the instruction CX times. | if (DF==0) *(word*)DI++ = *(word*)SI++;
else *(word*)DI-- = *(word*)SI--;
| 0xA5 |
MUL | Unsigned multiply | (1) DX:AX = AX * r/m; (2) AX = AL * r/m; | 0xF7/4, 0xF6/4 |
NEG | Two's complement negation | r/m = 0 – r/m; | 0xF6/3...0xF7/3 |
NOP | No operation | opcode equivalent to XCHG EAX, EAX | 0x90 |
NOT | Negate the operand, logical NOT | r/m ^= -1; | 0xF6/2...0xF7/2 |
OR | Logical OR | (1) r/m (2) r | 0x08...0x0D, 0x80...0x81/1, 0x82...0x83/1 (186+) |
OUT | Output to port | (1) port[imm] = AL; (2) port[DX] = AL; (3) port[imm] = AX; (4) port[DX] = AX; | 0xE6, 0xE7, 0xEE, 0xEF |
POP | Pop data from stack | r/m = *SP++; POP CS (opcode 0x0F) works only on 8086/8088. Later CPUs use 0x0F as a prefix for newer instructions. | 0x07, 0x0F(8086/8088 only), 0x17, 0x1F, 0x58...0x5F, 0x8F/0 |
POPF | Pop FLAGS register from stack | FLAGS = *SP++; | 0x9D |
PUSH | Push data onto stack | *--SP = r/m; | 0x06, 0x0E, 0x16, 0x1E, 0x50...0x57, 0x68, 0x6A (both 186+), 0xFF/6 |
PUSHF | Push FLAGS onto stack | *--SP = FLAGS; | 0x9C |
RCL | Rotate left (with carry) | 0xC0...0xC1/2 (186+), 0xD0...0xD3/2 | |
RCR | Rotate right (with carry) | 0xC0...0xC1/3 (186+), 0xD0...0xD3/3 | |
REPxx | Repeat MOVS/STOS/CMPS/LODS/SCAS | (REP, REPE, REPNE, REPNZ, REPZ) | 0xF2, 0xF3 |
RET | Return from procedure | Not a real instruction. The assembler will translate these to a RETN or a RETF depending on the memory model of the target system. | |
RETN | Return from near procedure | 0xC2, 0xC3 | |
RETF | Return from far procedure | 0xCA, 0xCB | |
ROL | Rotate left | 0xC0...0xC1/0 (186+), 0xD0...0xD3/0 | |
ROR | Rotate right | 0xC0...0xC1/1 (186+), 0xD0...0xD3/1 | |
SAHF | Store AH into FLAGS | 0x9E | |
SAL | Shift Arithmetically left (signed shift left) | (1) r/m <<= 1; (2) r/m <<= CL; | 0xC0...0xC1/4 (186+), 0xD0...0xD3/4 |
SAR | Shift Arithmetically right (signed shift right) | (1) (signed) r/m >>= 1; (2) (signed) r/m >>= CL; | 0xC0...0xC1/7 (186+), 0xD0...0xD3/7 |
SBB | Subtraction with borrow | alternative 1-byte encoding of SBB AL, AL is available via undocumented SALC instruction | 0x18...0x1D, 0x80...0x81/3, 0x82...0x83/3 (186+) |
SCASB | Compare byte string. May be used with a REPE or REPNE prefix to test and repeat the instruction CX times. | 0xAE | |
SCASW | Compare word string. May be used with a REPE or REPNE prefix to test and repeat the instruction CX times. | 0xAF | |
SHL | Shift left (unsigned shift left) | 0xC0...0xC1/4 (186+), 0xD0...0xD3/4 | |
SHR | Shift right (unsigned shift right) | 0xC0...0xC1/5 (186+), 0xD0...0xD3/5 | |
STC | Set carry flag | CF = 1; | 0xF9 |
STD | Set direction flag | DF = 1; | 0xFD |
STI | Set interrupt flag | IF = 1; | 0xFB |
STOSB | Store byte in string. May be used with a REP prefix to repeat the instruction CX times. | if (DF==0) *ES:DI++ = AL; else *ES:DI-- = AL; | 0xAA |
STOSW | Store word in string. May be used with a REP prefix to repeat the instruction CX times. | if (DF==0) *ES:DI++ = AX; else *ES:DI-- = AX; | 0xAB |
SUB | Subtraction | (1) r/m -= r/imm; (2) r -= m/imm; | 0x28...0x2D, 0x80...0x81/5, 0x82...0x83/5 (186+) |
TEST | Logical compare (AND) | (1) r/m & r/imm; (2) r & m/imm; | 0x84, 0x85, 0xA8, 0xA9, 0xF6/0, 0xF7/0 |
WAIT | Wait until not busy | Waits until BUSY# pin is inactive (used with floating-point unit) | 0x9B |
XCHG | Exchange data | r :=: r/m; A spinlock typically uses xchg as an atomic operation. (coma bug). | 0x86, 0x87, 0x91...0x97 |
XLAT | Table look-up translation | behaves like MOV AL, [BX+AL] | 0xD7 |
XOR | Exclusive OR | (1) r/m ^= r/imm; (2) r ^= m/imm; | 0x30...0x35, 0x80...0x81/6, 0x82...0x83/6 (186+) |
Instruction | Opcode | Meaning | Notes |
---|---|---|---|
BOUND | 62 /r | Check array index against bounds | raises software interrupt 5 if test fails |
ENTER | C8 iw ib | Enter stack frame | Modifies stack for entry to procedure for high level language. Takes two operands: the amount of storage to be allocated on the stack and the nesting level of the procedure. |
INSB/INSW | 6C | Input from port to string. May be used with a REP prefix to repeat the instruction CX times. | equivalent to:
IN AL, DX
MOV ES:[DI], AL
INC DI ; adjust DI according to operand size and DF
|
6D | |||
LEAVE | C9 | Leave stack frame | Releases the local stack storage created by the previous ENTER instruction. |
OUTSB/OUTSW | 6E | Output string to port. May be used with a REP prefix to repeat the instruction CX times. | equivalent to:
MOV AL, DS:[SI]
OUT DX, AL
INC SI ; adjust SI according to operand size and DF
|
6F | |||
POPA | 61 | Pop all general purpose registers from stack | equivalent to:
POP DI
POP SI
POP BP
POP AX ; no POP SP here, all it does is ADD SP, 2 (since AX will be overwritten later)
POP BX
POP DX
POP CX
POP AX
|
PUSHA | 60 | Push all general purpose registers onto stack | equivalent to:
PUSH AX
PUSH CX
PUSH DX
PUSH BX
PUSH SP ; The value stored is the initial SP value
PUSH BP
PUSH SI
PUSH DI
|
PUSH immediate | 6A ib | Push an immediate byte/word value onto the stack | example:
PUSH 12h
PUSH 1200h
|
68 iw | |||
IMUL immediate | 6B /r ib | Signed and unsigned multiplication of immediate byte/word value | example:
IMUL BX,12h
IMUL DX,1200h
IMUL CX, DX, 12h
IMUL BX, SI, 1200h
IMUL DI, word ptr [BX+SI], 12h
IMUL SI, word ptr [BP-4], 1200h
Note that since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well. |
69 /r iw | |||
SHL/SHR/SAL/SAR/ROL/ROR/RCL/RCR immediate | C0 | Rotate/shift bits with an immediate value greater than 1 | example:
ROL AX,3
SHR BL,3
|
C1 |
The new instructions added in 80286 add support for x86 protected mode. Some but not all of the instructions are available in real mode as well.
Instruction | Opcode | Instruction description | Real mode | Ring |
---|---|---|---|---|
LGDT m16&32 [lower-alpha 1] |
0F 01 /2 |
Load GDTR (Global Descriptor Table Register) from memory.[lower-alpha 2] | Yes | 0 |
LIDT m16&32 [lower-alpha 1] |
0F 01 /3 |
Load IDTR (Interrupt Descriptor Table Register) from memory.[lower-alpha 2] The IDTR controls not just the address/size of the IDT (interrupt Descriptor Table) in protected mode, but the IVT (Interrupt Vector Table) in real mode as well. | ||
LMSW r/m16 |
0F 01 /6 |
Load MSW (Machine Status Word) from 16-bit register or memory.[lower-alpha 2][lower-alpha 3] | ||
CLTS |
0F 06 |
Clear task-switched flag in the MSW. | ||
LLDT r/m16 |
0F 00 /2 |
Load LDTR (Local Descriptor Table Register) from 16-bit register or memory.[lower-alpha 2] | #UD | |
LTR r/m16 |
0F 00 /3 |
Load TR (Task Register) from 16-bit register or memory.[lower-alpha 2]
The TSS (Task State Segment) specified by the 16-bit argument is marked busy, but a task switch is not done. | ||
SGDT m16&32 [lower-alpha 1] |
0F 01 /0 |
Store GDTR to memory. | Yes | Usually 3[lower-alpha 4] |
SIDT m16&32 [lower-alpha 1] |
0F 01 /1 |
Store IDTR to memory. | ||
SMSW r/m16 |
0F 01 /4 |
Store MSW to register or 16-bit memory.[lower-alpha 5] | ||
SLDT r/m16 |
0F 00 /0 |
Store LDTR to register or 16-bit memory.[lower-alpha 5] | #UD | |
STR r/m16 |
0F 00 /1 |
Store TR to register or 16-bit memory.[lower-alpha 5] | ||
ARPL r/m16,r16 |
63 /r [lower-alpha 6] |
Adjust RPL (Requested Privilege Level) field of selector. The operation performed is:if (dst & 3) < (src & 3) then dst = (dst & 0xFFFC) | (src & 3) eflags.zf = 1 else eflags.zf = 0 |
#UD[lower-alpha 7] | 3 |
LAR r,r/m16 |
0F 02 /r |
Load access rights byte from the specified segment descriptor. Reads bytes 4-7 of segment descriptor, bitwise-ANDs it with 0x00FxFF00 ,[lower-alpha 8] then stores the bottom 16/32 bits of the result in destination register. Sets EFLAGS.ZF=1 if the descriptor could be loaded, ZF=0 otherwise. |
#UD | |
LSL r,r/m16 |
0F 03 /r |
Load segment limit from the specified segment descriptor. Sets ZF=1 if the descriptor could be loaded, ZF=0 otherwise. | ||
VERR r/m16 |
0F 00 /4 |
Verify a segment for reading. Sets ZF=1 if segment can be read, ZF=0 otherwise. | ||
VERW r/m16 |
0F 00 /5 |
Verify a segment for writing. Sets ZF=1 if segment can be written, ZF=0 otherwise.[lower-alpha 9] | ||
LOADALL[lower-alpha 10] | 0F 05 | Load all CPU registers from a 102-byte data structure starting at physical address 800h , including "hidden" part of segment descriptor registers. |
Yes | 0 |
STOREALL[lower-alpha 10] | F1 0F 04 | Store all CPU registers to a 102-byte data structure starting at physical address 800h , then shut down CPU. |
LGDT
, LIDT
, SGDT
and SIDT
instructions consist of a 2-part data structure. The first part is a 16-bit value, specifying table size in bytes minus 1. The second part is a 32-bit value (64-bit value in 64-bit mode), specifying the linear start address of the table.LGDT
and LIDT
with a 16-bit operand size, the address is ANDed with 00FFFFFFh.
On Intel (but not AMD) CPUs, the SGDT
and SIDT
instructions with a 16-bit operand size is – as of Intel SDM revision 079, March 2023 – documented to write a descriptor to memory with the last byte being set to 0. However, observed behavior is that bits 31:24 of the descriptor table address are written instead.[3]LGDT
, LIDT
, LLDT
, LMSW
and LTR
instructions are serializing on Pentium and later processors.LMSW
instruction can only modify the bottom 4 bits of this register and cannot clear bit 0. The inability to clear bit 0 means that LMSW
can be used to enter but not leave x86 Protected Mode.LMSW
nor with LOADALL
[4]) without a CPU reset – on 80386 and later, it is possible to leave Protected Mode, but this requires the use of the 80386-and-later MOV
to CR0
instruction.CR4.UMIP=1
is set, then the SGDT
, SIDT
, SLDT
, SMSW
and STR
instructions can only run in Ring 0.SMSW
, SLDT
and STR
instructions always use an operand size of 16 bits when used with a memory argument. With a register argument on 80386 or later processors, wider destination operand sizes are available and behave as follows:
SMSW
: Stores full CR0 in x86-64 long mode, undefined otherwise.SLDT
: Zero-extends 16-bit argument on Pentium Pro and later processors, undefined on earlier processors.STR
: Zero-extends 16-bit argument.ARPL
instruction is not available – the 63 /r
opcode has been reassigned to the 64-bit-mode-only MOVSXD
instruction.ARPL
instruction causes #UD in Real mode and Virtual 8086 Mode – Windows 95 and OS/2 2.x are known to make extensive use of this #UD to use the 63
opcode as a one-byte breakpoint to transition from Virtual 8086 Mode to kernel mode.[8][9]0x00FFFF00
.VERW
instruction also flushes microarchitectural data buffers. This enables it to be used as part of workarounds for Microarchitectural Data Sampling security vulnerabilities.[11][12]The 80386 added support for 32-bit operation to the x86 instruction set. This was done by widening the general-purpose registers to 32 bits and introducing the concepts of OperandSize and AddressSize – most instruction forms that would previously take 16-bit data arguments were given the ability to take 32-bit arguments by setting their OperandSize to 32 bits, and instructions that could take 16-bit address arguments were given the ability to take 32-bit address arguments by setting their AddressSize to 32 bits. (Instruction forms that work on 8-bit data continue to be 8-bit regardless of OperandSize. Using a data size of 16 bits will cause only the bottom 16 bits of the 32-bit general-purpose registers to be modified – the top 16 bits are left unchanged.)
The default OperandSize and AddressSize to use for each instruction is given by the D bit of the segment descriptor of the current code segment - D=0
makes both 16-bit, D=1
makes both 32-bit. Additionally, they can be overridden on a per-instruction basis with two new instruction prefixes that were introduced in the 80386:
66h
: OperandSize override. Will change OperandSize from 16-bit to 32-bit if CS.D=0
, or from 32-bit to 16-bit if CS.D=1
.67h
: AddressSize override. Will change AddressSize from 16-bit to 32-bit if CS.D=0
, or from 32-bit to 16-bit if CS.D=1
.The 80386 also introduced the two new segment registers FS
and GS
as well as the x86 control, debug and test registers.
The new instructions introduced in the 80386 can broadly be subdivided into two classes:
CWDE
, LODSD
)SHLD
, SETcc
)For instruction forms where the operand size can be inferred from the instruction's arguments (e.g. ADD EAX,EBX
can be inferred to have a 32-bit OperandSize due to its use of EAX as an argument), new instruction mnemonics are not needed and not provided.
Type | Instruction mnemonic | Opcode | Description | Mnemonic for older 16-bit variant | Ring |
---|---|---|---|---|---|
String instructions[lower-alpha 1][lower-alpha 2] | LODSD | AD | Load string doubleword: EAX := DS:[rSI±±] | LODSW |
3 |
STOSD | AB | Store string doubleword: ES:[rDI±±] := EAX | STOSW | ||
MOVSD | A5 | Move string doubleword: ES:[rDI±±] := DS:[rSI±±] | MOVSW | ||
CMPSD | A7 | Compare string doubleword: temp1 := DS:[rSI±±] temp2 := ES:[rDI±±] CMP temp1, temp2 /* 32-bit compare and set EFLAGS */ | CMPSW | ||
SCASD | AF | Scan string doubleword: temp1 := ES:[rDI±±] CMP EAX, temp1 /* 32-bit compare and set EFLAGS */ | SCASW | ||
INSD | 6D | Input string from doubleword I/O port:ES:[rDI±±] := port[DX] [lower-alpha 3] | INSW | Usually 0[lower-alpha 4] | |
OUTSD | 6F | Output string to doubleword I/O port:port[DX] := DS:[rSI±±] | OUTSW | ||
Other | CWDE | 98 | Sign-extend 16-bit value in AX to 32-bit value in EAX[lower-alpha 5] | CBW |
3 |
CDQ | 99 | Sign-extend 32-bit value in EAX to 64-bit value in EDX:EAX.
Mainly used to prepare a dividend for the 32-bit |
CWD | ||
JECXZ rel8 | E3 cb [lower-alpha 6] | Jump if ECX is zero | JCXZ | ||
PUSHAD | 60 | Push all 32-bit registers onto stack[lower-alpha 7] | PUSHA | ||
POPAD | 61 | Pop all 32-bit general-purpose registers off stack[lower-alpha 8] | POPA | ||
PUSHFD | 9C | Push 32-bit EFLAGS register onto stack | PUSHF |
Usually 3[lower-alpha 9] | |
POPFD | 9D | Pop 32-bit EFLAGS register off stack | POPF | ||
IRETD | CF | 32-bit interrupt return. Differs from the older 16-bit IRET instruction in that it will pop interrupt return items (EIP,CS,EFLAGS; also ESP[lower-alpha 10] and SS if there is a CPL change) off the stack as 32-bit items instead of 16-bit items. Should be used to return from interrupts when the interrupt handler was entered through a 32-bit IDT interrupt/trap gate.
Instruction is serializing. |
IRET |
EFLAGS.DF=1
and post-incremented by 4 otherwise.67
prefix.LODSD
, STOSD
, MOVSD
, INSD
and OUTSD
, the REP
prefix (F3
) will repeat the instruction the number of times specified in rCX (CX or ECX, decided by AddressSize), decrementing rCX for each iteration (with rCX=0 resulting in no-op and proceeding to the next instruction).CMPSD
and SCASD
, the REPE
(F3
) and REPNE
(F2
) prefixes are available, which will repeat the instruction but only as long as the flag condition (ZF=1 for REPE
, ZF=0 for REPNE
) holds true.INSB/W/D
instructions, the memory access rights for the ES:[rDI]
memory address might not be checked until after the port access has been performed – if this check fails (e.g. page fault or other memory exception), then the data item read from the port is lost. As such, it is not recommended to use this instruction to access an I/O port that performs any kind of side effect upon read.E3
opcode (JCXZ
/JECXZ
), the choice of whether the instruction will use CX
or ECX
for its comparison (and consequently which mnemonic to use) is based on the AddressSize, not OperandSize. (OperandSize instead controls whether the jump destination should be truncated to 16 bits or not).LOOP
,LOOPE
,LOOPNE
(opcodes E0
,E1
,E2
), however, unlike JCXZ
/JECXZ
, these instructions have not been given new mnemonics for their ECX-using variants.PUSHFD
and POPFD
instructions will cause a #GP exception if executed in virtual 8086 mode if IOPL is not 3.PUSHF
, POPF
, IRET
and IRETD
instructions will cause a #GP exception if executed in Virtual-8086 mode if IOPL is not 3 and VME is not enabled.IRETD
is used to return from kernel mode to user mode (which will entail a CPL change) and the user-mode stack segment indicated by SS is a 16-bit segment, then the IRETD
instruction will only restore the low 16 bits of the stack pointer (ESP/RSP), with the remaining bits keeping whatever value they had in kernel code before the IRETD
. This has necessitated complex workarounds on both Linux ("ESPFIX")[15] and Windows.[16] This issue also affects the later 64-bit IRETQ
instruction.Instruction mnemonics | Opcode | Description | Ring |
---|---|---|---|
BT r/m, r | 0F A3 /r | Bit Test.[lower-alpha 1]
Second operand specifies which bit of the first operand to test. The bit to test is copied to EFLAGS.CF. |
3 |
BT r/m, imm8 | 0F BA /4 ib | ||
BTS r/m, r | 0F AB /r | Bit Test-and-set.[lower-alpha 1][lower-alpha 2]
Second operand specifies which bit of the first operand to test and set. | |
BTS r/m, imm8 | 0F BA /5 ib | ||
BTR r/m, r | 0F B3 /r | Bit Test and Reset.[lower-alpha 1][lower-alpha 2]
Second operand specifies which bit of the first operand to test and clear. | |
BTR r/m, imm8 | 0F BA /6 ib | ||
BTC r/m, r | 0F BB /r | Bit Test and Complement.[lower-alpha 1][lower-alpha 2]
Second operand specifies which bit of the first operand to test and toggle. | |
BTC r/m, imm8 | 0F BA /7 ib | ||
BSF r, r/m | NFx 0F BC /r [lower-alpha 3] | Bit scan forward. Returns bit index of lowest set bit in input.[lower-alpha 4] | 3 |
BSR r, r/m | NFx 0F BD /r [lower-alpha 5] | Bit scan reverse. Returns bit index of highest set bit in input.[lower-alpha 4] | |
SHLD r/m, r, imm8 | 0F A4 /r ib | Shift Left Double. The operation of SHLD arg1,arg2,shamt is:arg1 := (arg1<<shamt) | (arg2>>(operand_size - shamt)) [lower-alpha 6] | |
SHLD r/m, r, CL | 0F A5 /r | ||
SHRD r/m, r, imm8 | 0F AC /r ib | Shift Right Double. The operation of SHRD arg1,arg2,shamt is:arg1 := (arg1>>shamt) | (arg2<<(operand_size - shamt)) [lower-alpha 6] | |
SHRD r/m, r, CL | 0F AD /r | ||
MOVZX reg, r/m8 | 0F B6 /r | Move from 8/16-bit source to 16/32-bit register with zero-extension. | 3 |
MOVZX reg, r/m16 | 0F B7 /r | ||
MOVSX reg, r/m8 | 0F BE /r | Move from 8/16-bit source to 16/32/64-bit register with sign-extension. | |
MOVSX reg, r/m16 | 0F BF /r | ||
SETcc r/m8 |
0F 9x /0 [lower-alpha 7][lower-alpha 8] |
Set byte to 1 if condition is satisfied, 0 otherwise. | |
Jcc rel16 Jcc rel32 |
0F 8x cw 0F 8x cd [lower-alpha 7] |
Conditional jump near.
Differs from older variants of conditional jumps in that they accept a 16/32-bit offset rather than just an 8-bit offset. | |
IMUL r, r/m | 0F AF /r | Two-operand non-widening integer multiply. | |
FS: | 64 | Segment-override prefixes for FS and GS segment registers. | 3 |
GS: | 65 | ||
PUSH FS | 0F A0 | Push/pop FS and GS segment registers. | |
POP FS | 0F A1 | ||
PUSH GS | 0F A8 | ||
POP GS | 0F A9 | ||
LFS r16, m16&16 LFS r32, m32&16 | 0F B4 /r | Load far pointer from memory.
Offset part is stored in destination register argument, segment part in FS/GS/SS segment register as indicated by the instruction mnemonic.[lower-alpha 9] | |
LGS r16, m16&16 LGS r32, m32&16 | 0F B5 /r | ||
LSS r16, m16&16 LSS r32, m32&16 | 0F B2 /r | ||
MOV reg,CRx | 0F 20 /r [lower-alpha 10] | Move from control register to general register.[lower-alpha 11] | 0 |
MOV CRx,reg | 0F 22 /r [lower-alpha 10] | Move from general register to control register.[lower-alpha 11]
On Pentium and later processors, moves to the | |
MOV reg,DRx | 0F 21 /r [lower-alpha 10] | Move from x86 debug register to general register.[lower-alpha 11] | |
MOV DRx,reg | 0F 23 /r [lower-alpha 10] | Move from general register to x86 debug register.[lower-alpha 11]
On Pentium and later processors, moves to the DR0-DR7 debug registers are serializing. | |
MOV reg,TRx | 0F 24 /r [lower-alpha 10] | Move from x86 test register to general register.[lower-alpha 13] | |
MOV TRx,reg | 0F 26 /r [lower-alpha 10] | Move from general register to x86 test register.[lower-alpha 13] | |
ICEBP, INT01, INT1[lower-alpha 14] |
F1 | In-circuit emulation breakpoint.
Performs software interrupt #1 if executed when not using in-circuit emulation.[lower-alpha 15] |
3 |
UMOV r/m, r8 | 0F 10 /r | User Move – perform data moves that can access user memory while in In-circuit emulation HALT mode.
Performs same operation as | |
UMOV r/m, r16/32 | 0F 11 /r | ||
UMOV r8, r/m | 0F 12 /r | ||
UMOV r16/32, r/m | 0F 13 /r | ||
XBTS reg,r/m | 0F A6 /r | Bitfield extract.[lower-alpha 17][lower-alpha 18] | |
IBTS r/m,reg | 0F A7 /r | Bitfield insert.[lower-alpha 17][lower-alpha 18] | |
LOADALLD, LOADALL386[lower-alpha 19] |
0F 07 | Load all CPU registers from a 296-byte data structure starting at ES:EDI, including "hidden" part of segment descriptor registers. | 0 |
BT
, BTS
, BTR
and BTC
instructions:
F3
prefix is used with the 0F BC /r
opcode, then the instruction will execute as TZCNT
on systems that support the BMI1 extension. TZCNT
differs from BSF
in that TZCNT
but not BSR
is defined to return operand size if the source operand is zero – for other source operand values, they produce the same result.SHLD
and SHRD
, the shift-amount is masked – the bottom 5 bits are used for 16/32-bit operand size and 6 bits for 64-bit operand size.SHLD
and SHRD
with 16-bit arguments and a shift-amount greater than 16 produce undefined results. (Actual results differ between different Intel CPUs, with at least three different behaviors known.[17])SETcc
and Jcc near
instructions (opcodes 0F 9x /0
and 0F 8x
respectively, with the x nibble specifying the condition) are:
x | cc | Condition (EFLAGS) |
---|---|---|
0 | O | OF=1: "Overflow" |
1 | NO | OF=0: "Not Overflow" |
2 | C,B,NAE | CF=1: "Carry", "Below", "Not Above or Equal" |
3 | NC,NB,AE | CF=0: "Not Carry", "Not Below", "Above or Equal" |
4 | Z,E | ZF=1: "Zero", "Equal" |
5 | NZ,NE | ZF=0: "Not Zero", "Not Equal" |
6 | NA,BE | (CF=1 or ZF=1): "Not Above", "Below or Equal" |
7 | A,NBE | (CF=0 and ZF=0): "Above", "Not Below or Equal" |
8 | S | SF=1: "Sign" |
9 | NS | SF=0: "Not Sign" |
A | P,PE | PF=1: "Parity", "Parity Even" |
B | NP,PO | PF=0: "Not Parity", "Parity Odd" |
C | L,NGE | SF≠OF: "Less", "Not Greater Or Equal" |
D | NL,GE | SF=OF: "Not Less", "Greater Or Equal" |
E | LE,NG | (ZF=1 or SF≠OF): "Less or Equal", "Not Greater" |
F | NLE,G | (ZF=0 and SF=OF): "Not Less or Equal", "Greater" |
SETcc
, while the opcode is commonly specified as /0 – implying that bits 5:3 of the instruction's ModR/M byte should be 000 – modern x86 processors (Pentium and later) ignore bits 5:3 and will execute the instruction as SETcc
regardless of the contents of these bits.LFS
, LGS
and LSS
, the size of the offset part of the far pointer is given by operand size – the size of the segment part is always 16 bits. In 64-bit mode, using the REX.W
prefix with these instructions will cause them to load a far pointer with a 64-bit offset on Intel but not AMD processors.MOV
to/from the CRx
, DRx
and TRx
registers, the reg part of the ModR/M byte is used to indicate CRx/DRx/TRx
register and r/m part the general-register.
Uniquely for the MOV CRx/DRx/TRx
opcodes, the top two bits of the ModR/M byte is ignored – these opcodes are decoded and executed as if the top two bits of the ModR/M byte are 11b
.CR0
would not serialize the instruction stream – in part for this reason, it is usually required to perform a far jump immediately after a MOV
to CR0
if such a MOV
is used to enable/disable protected mode and/or memory paging.MOV
to CR2
is architecturally listed as serializing, but has been reported to be non-serializing on at least some Intel Core-i7 processors.[18]MOV
to CR8
(introduced with x86-64) is not serializing.INT1
/ICEBP
(F1
) instruction is present on all known Intel x86 processors from the 80386 onwards,[19] but only fully documented for Intel processors from the May 2018 release of the Intel SDM (rev 067) onwards.[20] Before this release, mention of the instruction in Intel material was sporadic, e.g. AP-526 rev 001.[21]F1
(ICEBP
) opcode differs from the operation of the regular software interrupt opcode CD 01
in several ways:CD 01
will check CPL against the interrupt descriptor's DPL field as an access-rights check, while F1
will not.CD 01
will also check CPL against IOPL as an access-rights check, while F1
will not.CD 01
but not F1
.XBTS
and IBTS
instructions were discontinued with the B1 stepping of 80386.XBTS
instruction as part of its CPU detection if CPUID
is not present, and will refuse to boot if XBTS
is found to be working.[24]XBTS
and IBTS
, the r/m argument represents the data to extract/insert a bitfield from/to, the reg argument the bitfield to be inserted/extracted, AX/EAX a bit-offset and CL a bitfield length.[25]Instruction | Opcode | Description | Ring |
---|---|---|---|
BSWAP r32 |
0F C8+r |
Byte Order Swap. Usually used to convert between big-endian and little-endian data representations. For 32-bit registers, the operation performed is:r = (r << 24) | ((r << 8) & 0x00FF0000) | ((r >> 8) & 0x0000FF00) | (r >> 24); Using |
3 |
CMPXCHG r/m8,r8 |
0F B0 /r [lower-alpha 2] |
Compare and Exchange. If accumulator (AL/AX/EAX/RAX) compares equal to first operand,[lower-alpha 3] then EFLAGS.ZF is set to 1 and the first operand is overwritten with the second operand. Otherwise, EFLAGS.ZF is set to 0, and first operand is copied into the accumulator.
Instruction atomic only if used with | |
CMPXCHG r/m,r16 CMPXCHG r/m,r32 |
0F B1 /r [lower-alpha 2] | ||
XADD r/m,r8 |
0F C0 /r |
eXchange and ADD. Exchanges the first operand with the second operand, then stores the sum of the two values into the destination operand.
Instruction atomic only if used with | |
XADD r/m,r16 XADD r/m,r32 |
0F C1 /r | ||
INVLPG m8 |
0F 01 /7 |
Invalidate the TLB entries that would be used for the 1-byte memory operand.[lower-alpha 4]
Instruction is serializing. |
0 |
INVD |
0F 08 |
Invalidate Internal Caches.[lower-alpha 5] Modified data in the cache are not written back to memory, potentially causing data loss.[lower-alpha 6] | |
WBINVD |
NFx 0F 09 [lower-alpha 7] |
Write Back and Invalidate Cache.[lower-alpha 5] Writes back all modified cache lines in the processor's internal cache to main memory and invalidates the internal caches. |
INVD
instruction is not permitted and will cause a #GP(0) exception. (The PRM is needed for Intel SGX.)[32]Integer/system instructions that were not present in the basic 80486 instruction set, but were added in various x86 processors prior to the introduction of SSE. (Discontinued instructions are not included.)
Instruction | Opcode | Description | Ring | Added in |
---|---|---|---|---|
RDMSR |
0F 32 |
Read Model-specific register. The MSR to read is specified in ECX. The value of the MSR is then returned as a 64-bit value in EDX:EAX. | 0 | IBM 386SLC,[33] Intel Pentium, AMD K5, Cyrix 6x86MX,MediaGXm, IDT WinChip C6, Transmeta Crusoe |
WRMSR |
0F 30 |
Write Model-specific register. The MSR to write is specified in ECX, and the data to write is given in EDX:EAX.[lower-alpha 1]
Instruction is, with some exceptions, serializing.[lower-alpha 2] | ||
RSM [36] |
0F AA |
Resume from System Management Mode.
Instruction is serializing. |
-2 (SMM) |
Intel 386SL,[37][38] 486SL,[lower-alpha 3] Intel Pentium, AMD 5x86, Cyrix 486SLC/e,[39] IDT WinChip C6, Transmeta Crusoe, Rise mP6 |
CPUID |
0F A2 |
CPU Identification and feature information. Takes as input a CPUID leaf index in EAX and, depending on leaf, a sub-index in ECX. Result is returned in EAX,EBX,ECX,EDX.[lower-alpha 4]
Instruction is serializing, and causes a mandatory #VMEXIT under virtualization. Support for |
Usually 3[lower-alpha 5] | Intel Pentium,[lower-alpha 6] AMD 5x86,[lower-alpha 6] Cyrix 5x86,[lower-alpha 7] IDT WinChip C6, Transmeta Crusoe, Rise mP6, NexGen Nx586,[lower-alpha 8] UMC Green CPU |
CMPXCHG8B m64 |
0F C7 /1 |
Compare and Exchange 8 bytes. Compares EDX:EAX with m64. If equal, set ZF[lower-alpha 9] and store ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX. Instruction atomic only if used with LOCK prefix.[lower-alpha 10] |
3 | Intel Pentium, AMD K5, Cyrix 6x86L,MediaGXm, IDT WinChip C6,[lower-alpha 11] Transmeta Crusoe,[lower-alpha 11] Rise mP6[lower-alpha 11] |
RDTSC |
0F 31 |
Read 64-bit Time Stamp Counter (TSC) into EDX:EAX.[lower-alpha 12]
In early processors, the TSC was a cycle counter, incrementing by 1 for each clock cycle (which could cause its rate to vary on processors that could change clock speed at runtime) – in later processors, it increments at a fixed rate that doesn't necessarily match the CPU clock speed.[lower-alpha 13] |
Usually 3[lower-alpha 14] | Intel Pentium, AMD K5, Cyrix 6x86MX,MediaGXm, IDT WinChip C6, Transmeta Crusoe, Rise mP6 |
RDPMC |
0F 33 |
Read Performance Monitoring Counter. The counter to read is specified by ECX and its value is returned in EDX:EAX.[lower-alpha 12] | Usually 3[lower-alpha 15] | Intel Pentium MMX, Intel Pentium Pro, AMD K7, Cyrix 6x86MX, IDT WinChip C6, VIA Nano[lower-alpha 16] |
CMOVcc reg,r/m |
0F 4x /r [lower-alpha 17] |
Conditional move to register. The source operand may be either register or memory.[lower-alpha 18] | 3 | Intel Pentium Pro, AMD K7, Cyrix 6x86MX,MediaGXm, Transmeta Crusoe, VIA C3 "Nehemiah" |
NOP r/m ,NOPL r/m |
NFx 0F 1F /0 |
Official long NOP.
Other than AMD K7/K8, broadly unsupported in non-Intel processors released before 2005.[lower-alpha 19][52] |
3 | Intel Pentium Pro,[lower-alpha 20] AMD K7, x86-64,[lower-alpha 21] VIA C7[56] |
UD2 ,[lower-alpha 22]UD2A [lower-alpha 23] |
0F 0B |
Undefined Instructions – will generate an invalid opcode (#UD) exception in all operating modes.
These instructions are provided for software testing to explicitly generate invalid opcodes. The opcodes for these instructions are reserved for this purpose. |
(3) | (80186),[lower-alpha 24] Intel Pentium[60] |
UD1 reg,r/m ,[lower-alpha 25]UD2B reg,r/m [lower-alpha 23] |
0F B9 /r [lower-alpha 26] | |||
OIO ,UD0 ,UD0 reg,r/m [lower-alpha 27] |
0F FF ,0F FF /r [lower-alpha 26] |
(80186),[lower-alpha 24] Cyrix 6x86,[65] AMD K5[67] | ||
SYSCALL |
0F 05 |
Fast System call. | 3 | AMD K6,[lower-alpha 28] x86-64[lower-alpha 29][lower-alpha 30] |
SYSRET |
0F 07 [lower-alpha 31] |
Fast Return from System Call. Designed to be used together with SYSCALL . |
0[lower-alpha 32] | |
SYSENTER |
0F 34 |
Fast System call. | 3[lower-alpha 32] | Intel Pentium II,[lower-alpha 33] AMD K7,[72][lower-alpha 34] Transmeta Crusoe,[lower-alpha 35] NatSemi Geode GX2, VIA C3 "Nehemiah"[lower-alpha 36] |
SYSEXIT |
0F 35 [lower-alpha 31] |
Fast Return from System Call. Designed to be used together with SYSENTER . |
0[lower-alpha 32] |
WRMSR
instruction is also used to update the CPU microcode. This is done by writing the virtual address of the new microcode to upload to MSR 79h
on Intel CPUs and MSR C001_0020h
[34] on AMD CPUs.Number | Name |
---|---|
48h | SPEC_CTRL |
49h | PRED_CMD |
122h | TSX_CTRL |
6E0h | TSC_DEADLINE |
6E1h | PKRS |
774h | HWP_REQUEST (non-serializing only if the FAST_IA32_HWP_REQUEST bit it set) |
802h to 83Fh | (x2APIC MSRs) |
C001_011Bh | Doorbell Register (AMD) |
RSM
instruction were made available on non-SL variants of the Intel 486 only after the initial release of the Intel Pentium in 1993.CPUID
with a leaf index (EAX) greater than 0 may leave EBX and ECX unmodified, keeping their old values. For this reason, it is recommended to zero out EBX and ECX before executing CPUID
.CPUID
will set the top 32 bits of RAX, RBX, RCX and RDX to zero.CPUID
to ring 0. Such MSRs are documented for at least Ivy Bridge[42] and Denverton.[43]CPUID
to ring 0 also exists on AMD processors supporting the "CpuidUserDis" feature (Zen 4 "Raphael" and later).[44]CPUID
is only supported with some system BIOSes. On some NexGen CPUs that do support CPUID
, EFLAGS.ID is not supported but EFLAGS.AC is, complicating CPU detection.[45]CMPXCHG
instruction, the CMPXCHG8B
instruction does not modify any EFLAGS bits other than ZF.LOCK CMPXCHG8B
with a register operand (which is an invalid encoding) can cause hangs on some Intel Pentium CPUs (Pentium F00F bug).CMPXCHG8B
instruction is always supported, however its CPUID bit may be missing. This is a workaround for a bug in Windows NT.[46]RDTSC
and RDPMC
instructions are not ordered with respect to other instructions, and may sample their respective counters before earlier instructions are executed or after later instructions have executed. Invocations of RDPMC
(but not RDTSC
) may be reordered relative to each other even for reads of the same counter.LFENCE
or serializing instructions (e.g. CPUID
) are needed.[47]8000_0007:EDX[8]
).RDPMC
can be run outside Ring 0 only if CR4.PCE=1
.CMOVcc
instruction (opcode 0F 4x /r
, with the x nibble specifying the condition) are:
x | cc | Condition (EFLAGS) |
---|---|---|
0 | O | OF=1: "Overflow" |
1 | NO | OF=0: "Not Overflow" |
2 | C,B,NAE | CF=1: "Carry", "Below", "Not Above or Equal" |
3 | NC,NB,AE | CF=0: "Not Carry", "Not Below", "Above or Equal" |
4 | Z,E | ZF=1: "Zero", "Equal" |
5 | NZ,NE | ZF=0: "Not Zero", "Not Equal" |
6 | NA,BE | (CF=1 or ZF=1): "Not Above", "Below or Equal" |
7 | A,NBE | (CF=0 and ZF=0): "Above", "Not Below or Equal" |
8 | S | SF=1: "Sign" |
9 | NS | SF=0: "Not Sign" |
A | P,PE | PF=1: "Parity", "Parity Even" |
B | NP,PO | PF=0: "Not Parity", "Parity Odd" |
C | L,NGE | SF≠OF: "Less", "Not Greater Or Equal" |
D | NL,GE | SF=OF: "Not Less", "Greater Or Equal" |
E | LE,NG | (ZF=1 or SF≠OF): "Less or Equal", "Not Greater" |
F | NLE,G | (ZF=0 and SF=OF): "Not Less or Equal", "Greater" |
CMOVcc
with a 32-bit operand size will clear the upper 32 bits of the destination register even if the condition is false.CMOVcc
with a memory source operand, the CPU will always read the operand from memory – potentially causing memory exceptions and cache line-fills – even if the condition for the move is not satisfied. (The Intel APX extension defines an EVEX-encoded variant of CMOVcc
that will suppress memory exceptions if the condition is false.)0F 1F /0
as long-NOP was introduced in the Pentium Pro, but remained undocumented until 2006.[53]
The whole 0F 18..1F
opcode range was NOP
in Pentium Pro. However, except for 0F 1F /0
, Intel does not guarantee that these opcodes will remain NOP
in future processors, and have indeed assigned some of these opcodes to other instructions in at least some processors.[54]0F 0B
opcode was officially reserved as an invalid opcode from Pentium onwards, it only got assigned the mnemonic UD2
from Pentium Pro onwards.[57]UD2A
and UD2B
mnemonics for the 0F 0B
and 0F B9
opcodes since version 2.7.[58]UD2A
nor UD2B
originally took any arguments - UD2B
was later modified to accept a ModR/M byte, in Binutils version 2.30.[59]0F 0B
, 0F B9
and 0F FF
- will cause an #UD exception on all x86 processors from the 80186 onwards (except NEC V-series processors), but did not get explicitly reserved for this purpose until P5-class processors.0F FF
opcode, the OIO
mnemonic was introduced by Cyrix,[65] while the UD0
menmonic (without arguments) was introduced by AMD and Intel at the same time as the UD1
mnemonic for 0F B9
.[61][62] Later Intel (but not AMD) documentation modified its description of UD0
to add a ModR/M byte and take two arguments.[66]SYSCALL
/SYSRET
instructions were available on Model 7 (250nm "Little Foot") and later, not on the earlier Model 6.[68]SYSRET
differs slightly between AMD and Intel processors: non-canonical return addresses cause a #GP exception to be thrown in Ring 3 on AMD CPUs but Ring 0 on Intel CPUs. This has been known to cause security issues.[69]SYSRET
and SYSEXIT
instructions under x86-64, it is necessary to add the REX.W
prefix for variants that will return to 64-bit user-mode code.REX.W
prefix are used to return to 32-bit user-mode code. (Neither of these instructions can be used to return to 16-bit user-mode code.)SYSRET
, SYSENTER
and SYSEXIT
instructions are unavailable in Real mode. (SYSENTER
is, however, available in Virtual 8086 mode.)SYSENTER
and SYSEXIT
instructions are not available in x86-64 long mode (#UD).SYSENTER
and SYSEXIT
instructions are only available with version 4.2 or higher of the Transmeta Code Morphing software.[73]SYSENTER
and SYSEXIT
are available only on stepping 8 and later.[74]These instructions can only be encoded in 64 bit mode. They fall in four groups:
MOVSXD
replacing ARPL
)SWAPGS
)JRCXZ
)Most instructions with a 64 bit operand size encode this using a REX.W
prefix; in the absence of the REX.W
prefix,
the corresponding instruction with 32 bit operand size is encoded. This mechanism also applies to most other instructions with 32 bit operand
size. These are not listed here as they do not gain a new mnemonic in Intel syntax when used with a 64 bit operand size.
Instruction | Encoding | Meaning | Ring |
---|---|---|---|
CDQE |
REX.W 98 |
Sign extend EAX into RAX | 3 |
CQO |
REX.W 99 |
Sign extend RAX into RDX:RAX | |
CMPSQ |
REX.W A7 |
CoMPare String Quadword | |
CMPXCHG16B m128 [lower-alpha 1][lower-alpha 2] |
REX.W 0F C7 /1 |
CoMPare and eXCHanGe 16 Bytes. Atomic only if used with LOCK prefix. | |
IRETQ |
REX.W CF |
64-bit Return from Interrupt | |
JRCXZ rel8 |
E3 cb |
Jump if RCX is zero | |
LODSQ |
REX.W AD |
LoaD String Quadword | |
MOVSXD r64,r/m32 |
REX.W 63 /r [lower-alpha 3] |
MOV with Sign Extend 32-bit to 64-bit | |
MOVSQ |
REX.W A5 |
Move String Quadword | |
POPFQ |
9D |
POP RFLAGS Register | |
PUSHFQ |
9C |
PUSH RFLAGS Register | |
SCASQ |
REX.W AF |
SCAn String Quadword | |
STOSQ |
REX.W AB |
STOre String Quadword | |
SWAPGS |
0F 01 F8 |
Exchange GS base with KernelGSBase MSR | 0 |
CMPXCHG16B
instruction was absent from a few of the earliest Intel/AMD x86-64 processors. On Intel processors, the instruction was missing from Xeon "Nocona" stepping D,[75] but added in stepping E.[76] On AMD K8 family processors, it was added in stepping F, at the same time as DDR2 support was introduced.[77]CMPXCHG16B
has its own CPUID flag, separate from the rest of x86-64.MOVSXD
without REX.W prefix are permitted but discouraged[78] – such encodings behave identically to 16/32-bit MOV
(8B /r
).Bit manipulation instructions. For all of the VEX-encoded instructions defined by BMI1 and BMI2, the operand size may be 32 or 64 bits, controlled by the VEX.W bit – none of these instructions are available in 16-bit variants.
Bit Manipulation Extension | Instruction mnemonics | Opcode | Instruction description | Added in |
---|---|---|---|---|
|
POPCNT r16,r/m16 POPCNT r32,r/m32 |
F3 0F B8 /r |
Population Count. Counts the number of bits that are set to 1 in its source argument. | K10, Bobcat, Haswell, ZhangJiang, Gracemont |
POPCNT r64,r/m64 |
F3 REX.W 0F B8 /r | |||
LZCNT r16,r/m16 LZCNT r32,r/m32 |
F3 0F BD /r |
Count Leading zeroes.[lower-alpha 2] If source operand is all-0s, then LZCNT will return operand size in bits (16/32/64) and set CF=1. | ||
LZCNT r64,r/m64 |
F3 REX.W 0F BD /r | |||
|
TZCNT r16,r/m16 TZCNT r32,r/m32 |
F3 0F BC /r |
Count Trailing zeroes.[lower-alpha 3] If source operand is all-0s, then TZCNT will return operand size in bits (16/32/64) and set CF=1. |
Haswell, Piledriver, Jaguar, ZhangJiang, Gracemont |
TZCNT r64,r/m64 |
F3 REX.W 0F BC /r | |||
ANDN ra,rb,r/m |
VEX.LZ.0F38 F2 /r |
Bitwise AND-NOT: ra = r/m AND NOT(rb) | ||
BEXTR ra,r/m,rb |
VEX.LZ.0F38 F7 /r |
Bitfield extract. Bitfield start position is specified in bits [7:0] of rb , length in bits[15:8] of rb . The bitfield is then extracted from the r/m value with zero-extension, then stored in ra . Equivalent to[lower-alpha 4]mask = (1 << rb[15:8]) - 1 ra = (r/m >> rb[7:0]) AND mask | ||
BLSI reg,r/m |
VEX.LZ.0F38 F3 /3 |
Extract lowest set bit in source argument. Returns 0 if source argument is 0. Equivalent todst = (-src) AND src | ||
BLSMSK reg,r/m |
VEX.LZ.0F38 F3 /2 |
Generate a bitmask of all-1s bits up to the lowest bit position with a 1 in the source argument. Returns all-1s if source argument is 0. Equivalent to dst = (src-1) XOR src | ||
BLSR reg,r/m |
VEX.LZ.0F38 F3 /1 |
Copy all bits of the source argument, then clear the lowest set bit. Equivalent todst = (src-1) AND src | ||
|
BZHI ra,r/m,rb |
VEX.LZ.0F38 F5 /r |
Zero out high-order bits in r/m starting from the bit position specified in rb , then write result to rd . Equivalent tora = r/m AND NOT(-1 << rb[7:0]) |
Haswell, Excavator,[lower-alpha 5] ZhangJiang, Gracemont |
MULX ra,rb,r/m |
VEX.LZ.F2.0F38 F6 /r |
Widening unsigned integer multiply without setting flags. Multiplies EDX/RDX with r/m , then stores the low half of the multiplication result in ra and the high half in rb . If ra and rb specify the same register, only the high half of the result is stored. | ||
PDEP ra,rb,r/m |
VEX.LZ.F2.0F38 F5 /r |
Parallel Bit Deposit. Scatters contiguous bits from rb to the bit positions set in r/m , then stores result to ra . Operation performed is:ra=0; k=0; mask=r/m for i=0 to opsize-1 do if (mask[i] == 1) then ra[i]=rb[k]; k=k+1 | ||
PEXT ra,rb,r/m |
VEX.LZ.F3.0F38 F5 /r |
Parallel Bit Extract. Uses r/m argument as a bit mask to select bits in rb , then compacts the selected bits into a contiguous bit-vector. Operation performed is:ra=0; k=0; mask=r/m for i=0 to opsize-1 do if (mask[i] == 1) then ra[k]=rb[i]; k=k+1 | ||
RORX reg,r/m,imm8 |
VEX.LZ.F2.0F3A F0 /r ib |
Rotate right by immediate without affecting flags. | ||
SARX ra,r/m,rb |
VEX.LZ.F3.0F38 F7 /r |
Arithmetic shift right without updating flags. For SARX , SHRX and SHLX , the shift-amount specified in rb is masked to 5 bits for 32-bit operand size and 6 bits for 64-bit operand size. | ||
SHRX ra,r/m,rb |
VEX.LZ.F2.0F38 F7 /r |
Logical shift right without updating flags. | ||
SHLX ra,r/m,rb |
VEX.LZ.66.0F38 F7 /r |
Shift left without updating flags. |
POPCNT
and LZCNT
. On Intel CPUs, however, the CPUID bit for "ABM" is only documented to indicate the presence of the LZCNT
instruction and is listed as "LZCNT", while POPCNT
has its own separate CPUID feature bit.POPCNT
and set the CPUID feature bit for POPCNT, so the distinction is theoretical only.POPCNT
but not ABM, such as Intel Nehalem and VIA Nano 3000.)TZCNT
instruction will execute as BSF
on systems that do not support the BMI1 extension. BSF
produces the same result as TZCNT
for all input operand values except zero – for which TZCNT
returns input operand size, but BSF
produces undefined behavior (leaves destination unmodified on most modern CPUs).PEXT
and PDEP
instructions are quite slow[79] and exhibit data-dependent timing due to the use of a microcoded implementation (about 18 to 300 cycles, depending on the number of bits set in the mask argument). As a result, it is often faster to use other instruction sequences on these processors.[80][81]TSX Subset | Instruction | Opcode | Description | Added in |
---|---|---|---|---|
|
XBEGIN rel16 XBEGIN rel32 |
C7 F8 cw C7 F8 cd |
Start transaction. If transaction fails, perform a branch to the given relative offset. | Haswell (Deprecated on desktop/laptop CPUs from 10th generation (Ice Lake, Comet Lake) onwards, but continues to be available on Xeon-branded server parts (e.g. Ice Lake-SP, Sapphire Rapids)) |
XABORT imm8 |
C6 F8 ib |
Abort transaction with 8-bit immediate as error code. | ||
XEND |
NP 0F 01 D5 |
End transaction. | ||
XTEST |
NP 0F 01 D6 |
Test if in transactional execution. Sets EFLAGS.ZF to 0 if executed inside a transaction (RTM or HLE), 1 otherwise. | ||
|
XACQUIRE |
F2 |
Instruction prefix to indicate start of hardware lock elision, used with memory atomic instructions only (for other instructions, the F2 prefix may have other meanings). When used with such instructions, may start a transaction instead of performing the memory atomic operation. |
Haswell (Discontinued – the last processors to support HLE were Coffee Lake and Cascade Lake) |
XRELEASE |
F3 |
Instruction prefix to indicate end of hardware lock elision, used with memory atomic/store instructions only (for other instructions, the F3 prefix may have other meanings). When used with such instructions during hardware lock elision, will end the associated transaction instead of performing the store/atomic. | ||
|
XSUSLDTRK |
F2 0F 01 E8 |
Suspend Tracking Load Addresses | Sapphire Rapids |
XRESLDTRK |
F2 0F 01 E9 |
Resume Tracking Load Addresses |
Intel CET (Control-Flow Enforcement Technology) adds two distinct features to help protect against security exploits such as return-oriented programming: a shadow stack (CET_SS), and indirect branch tracking (CET_IBT).
CET Subset | Instruction | Opcode | Description | Ring | Added in |
---|---|---|---|---|---|
|
INCSSPD r32 |
F3 0F AE /5 |
Increment shadow stack pointer | 3 | Tiger Lake, Zen 3 |
INCSSPQ r64 |
F3 REX.W 0F AE /5 | ||||
RDSSPD r32 |
F3 0F 1E /1 |
Read shadow stack pointer into register (low 32 bits)[lower-alpha 1] | |||
RDSSPQ r64 |
F3 REX.W 0F 1E /1 |
Read shadow stack pointer into register (full 64 bits)[lower-alpha 1] | |||
SAVEPREVSSP |
F3 0F 01 EA |
Save previous shadow stack pointer | |||
RSTORSSP m64 |
F3 0F 01 /5 |
Restore saved shadow stack pointer | |||
WRSSD m32,r32 |
NP 0F 38 F6 /r |
Write 4 bytes to shadow stack | |||
WRSSQ m64,r64 |
NP REX.W 0F 38 F6 /r |
Write 8 bytes to shadow stack | |||
WRUSSD m32,r32 |
66 0F 38 F5 /r |
Write 4 bytes to user shadow stack | 0 | ||
WRUSSQ m64,r64 |
66 REX.W 0F 38 F5 /r |
Write 8 bytes to user shadow stack | |||
SETSSBSY |
F3 0F 01 E8 |
Mark shadow stack busy | |||
CLRSSBSY m64 |
F3 0F AE /6 |
Clear shadow stack busy flag | |||
|
ENDBR32 |
F3 0F 1E FB |
Terminate indirect branch in 32-bit mode[lower-alpha 2] | 3 | Tiger Lake |
ENDBR64 |
F3 0F 1E FA |
Terminate indirect branch in 64-bit mode[lower-alpha 2] | |||
NOTRACK |
3E [lower-alpha 3] |
Prefix used with indirect CALL /JMP near instructions (opcodes FF /2 and FF /4 ) to indicate that the branch target is not required to start with an ENDBR32/64 instruction. Prefix only honored when NO_TRACK_EN flag is set. |
The XSAVE instruction set extensions are designed to save/restore CPU extended state (typically for the purpose of context switching) in a manner that can be extended to cover new instruction set extensions without the OS context-switching code needing to understand the specifics of the new extensions. This is done by defining a series of state-components, each with a size and offset within a given save area, and each corresponding to a subset of the state needed for one CPU extension or another. The EAX=0Dh
CPUID leaf is used to provide information about which state-components the CPU supports and what their sizes/offsets are, so that the OS can reserve the proper amount of space and set the associated enable-bits.
XSAVE Extension | Instruction mnemonics | Opcode[lower-alpha 1] | Instruction description | Ring | Added in |
---|---|---|---|---|---|
|
XSAVE mem XSAVE64 mem |
NP 0F AE /4 NP REX.W 0F AE /4 |
Save state components specified by bitmap in EDX:EAX to memory. | 3 | Penryn,[lower-alpha 2] Bulldozer, Jaguar, Goldmont, ZhangJiang |
XRSTOR mem XRSTOR64 mem |
NP 0F AE /5 NP REX.W 0F AE /5 |
Restore state components specified by EDX:EAX from memory. | |||
XGETBV |
NP 0F 01 D0 |
Get value of Extended Control Register. Reads an XCR specified by ECX into EDX:EAX.[lower-alpha 3] | |||
XSETBV |
NP 0F 01 D1 |
Set Extended Control Register. Write the value in EDX:EAX to the XCR specified by ECX. |
0 | ||
|
XSAVEOPT mem XSAVEOPT64 mem |
NP 0F AE /6 NP REX.W 0F AE /6 |
Save state components specified by EDX:EAX to memory. Unlike the older XSAVE instruction, XSAVEOPT may abstain from writing processor state items to memory when the CPU can determine that they haven't been modified since the most recent corresponding XRSTOR . |
3 | Sandy Bridge, Steamroller, Puma, Goldmont, ZhangJiang |
|
XSAVEC mem XSAVEC64 mem |
NP 0F C7 /4 NP REX.W 0F C7 /4 |
Save processor extended state components specified by EDX:EAX to memory with compaction. | 3 | Skylake, Goldmont, Zen 1 |
|
XSAVES mem XSAVES64 mem |
NP 0F C7 /5 NP REX.W 0F C7 /5 |
Save processor extended state components specified by EDX:EAX to memory with compaction and optimization if possible. | 0 | Skylake, Goldmont, Zen 1 |
XRSTORS mem XRSTORS64 mem |
NP 0F C7 /3 NP REX.W 0F C7 /3 |
Restore state components specified by EDX:EAX from memory. |
XGETBV
with ECX=1 is permitted – this will not return XCR1
(no such register exists) but instead return XCR0
bitwise-ANDed with the current value of the "XINUSE" state-component bitmap (a bitmap of XSAVE state-components that are not known to be in their initial state).XGETBV
is indicated by CPUID.(EAX=0Dh,ECX=1):EAX[bit 2].Instruction Set Extension | Instruction mnemonics | Opcode | Instruction description | Ring | Added in |
---|---|---|---|---|---|
|
PREFETCHNTA m8 |
0F 18 /0 |
Prefetch with Non-Temporal Access. Prefetch data under the assumption that the data will be used only once, and attempt to minimize cache pollution from said data. The methods used to minimize cache pollution are implementation-dependent.[lower-alpha 2] |
3 | Pentium III, (K7),[lower-alpha 1] (Geode GX2),[lower-alpha 1] Nehemiah, Efficeon |
PREFETCHT0 m8 |
0F 18 /1 |
Prefetch data to all levels of the cache hierarchy.[lower-alpha 2] | |||
PREFETCHT1 m8 |
0F 18 /2 |
Prefetch data to all levels of the cache hierarchy except L1 cache.[lower-alpha 2] | |||
PREFETCHT2 m8 |
0F 18 /3 |
Prefetch data to all levels of the cache hierarchy except L1 and L2 caches.[lower-alpha 2] | |||
SFENCE |
NP 0F AE F8+x[lower-alpha 3] |
Store Fence.[lower-alpha 4] | |||
|
LFENCE |
NP 0F AE E8+x[lower-alpha 3] |
Load Fence and Dispatch Serialization.[lower-alpha 5] | 3 | Pentium 4, K8, Efficeon, C7 Esther |
MFENCE |
NP 0F AE F0+x[lower-alpha 3] |
Memory Fence.[lower-alpha 6] | |||
MOVNTI m32,r32 MOVNTI m64,r64 |
NP 0F C3 /r NP REX.W 0F C3 /r |
Non-Temporal Memory Store. | |||
PAUSE |
F3 90 [lower-alpha 7] |
Pauses CPU thread for a short time period.[lower-alpha 8] Intended for use in spinlocks.[lower-alpha 9] | |||
|
CLFLUSH m8 |
NP 0F AE /7 |
Flush one cache line to memory. In a system with multiple cache hierarchy levels and/or multiple processors each with their own caches, the line is flushed from all of them. |
3 | (SSE2), Geode LX |
|
MONITOR [lower-alpha 12]MONITOR EAX,ECX,EDX |
NP 0F 01 C8 |
Start monitoring a memory location for memory writes. The memory address to monitor is given by DS:AX/EAX/RAX.[lower-alpha 13] ECX and EDX are reserved for extra extension and hint flags, respectively.[lower-alpha 14] |
Usually 0[lower-alpha 15] | Prescott, Yonah, Bonnell, K10, Nano |
MWAIT [lower-alpha 12]MWAIT EAX,ECX |
NP 0F 01 C9 |
Wait for a write to a monitored memory location previously specified with MONITOR .[lower-alpha 16]ECX and EAX are used to provide extra extension[lower-alpha 17] and hint[lower-alpha 18] flags, respectively. MWAIT hints are commonly used for CPU power management. | |||
|
GETSEC |
NP 0F 37 [lower-alpha 19] |
Perform an SMX function. The leaf function to perform is given in EAX.[lower-alpha 20] Depending on leaf function, the instruction may take additional arguments in RBX, ECX and EDX. |
Usually 0[lower-alpha 21] | Conroe/Merom, WuDaoKou,[96] Tremont |
|
RDTSCP |
0F 01 F9 |
Read Time Stamp Counter and processor core ID.[lower-alpha 22] The TSC value is placed in EDX:EAX and the core ID in ECX.[lower-alpha 23] |
Usually 3[lower-alpha 24] | K8,[lower-alpha 25] Nehalem, Silvermont, Nano |
POPCNT r16,r/m16 POPCNT r32,r/m32 |
F3 0F B8 /r |
Count the number of bits that are set to 1 in its source argument. | 3 | K10, Nehalem, Nano 3000 | |
POPCNT r64,r/m64 |
F3 REX.W 0F B8 /r | ||||
|
CRC32 r32,r/m8 |
F2 0F 38 F0 /r |
Accumulate CRC value using the CRC-32C (Castagnoli) polynomial 0x11EDC6F41 (normal form 0x1EDC6F41). This is the polynomial used in iSCSI. In contrast to the more popular one used in Ethernet, its parity is even, and it can thus detect any error with an odd number of changed bits. | 3 | Nehalem, Bulldozer, ZhangJiang |
CRC32 r32,r/m16 CRC32 r32,r/m32 |
F2 0F 38 F1 /r | ||||
CRC32 r64,r/m64 |
F2 REX.W 0F 38 F1 /r | ||||
|
RDFSBASE r32 RDFSBASE r64 |
F3 0F AE /0 F3 REX.W 0F AE /0 |
Read base address of FS: segment. | 3 | Ivy Bridge, Steamroller, Goldmont, ZhangJiang |
RDGSBASE r32 RDGSBASE r64 |
F3 0F AE /1 F3 REX.W 0F AE /1 |
Read base address of GS: segment. | |||
WRFSBASE r32 WRFSBASE r64 |
F3 0F AE /2 F3 REX.W 0F AE /2 |
Write base address of FS: segment. | |||
WRGSBASE r32 WRGSBASE r64 |
F3 0F AE /3 F3 REX.W 0F AE /3 |
Write base address of GS: segment. | |||
|
MOVBE r16,m16 MOVBE r32,m32 |
NFx 0F 38 F0 /r |
Load from memory to register with byte-order swap. | 3 | Bonnell, Haswell, Jaguar, Steamroller, ZhangJiang |
MOVBE r64,m64 |
NFx REX.W 0F 38 F0 /r | ||||
MOVBE m16,r16 MOVBE m32,r32 |
NFx 0F 38 F1 /r |
Store to memory from register with byte-order swap. | |||
MOVBE m64,r64 |
NFx REX.W 0F 38 F1 /r | ||||
|
INVPCID reg,m128 |
66 0F 38 82 /r |
Invalidate entries in TLB and paging-structure caches based on invalidation type in register[lower-alpha 27] and descriptor in m128. The descriptor contains a memory address and a PCID.[lower-alpha 28]
Instruction is serializing on AMD but not Intel CPUs. |
0 | Haswell, ZhangJiang, Zen 3, Gracemont |
|
PREFETCHW m8 |
0F 0D /1 |
Prefetch cache line with intent to write.[lower-alpha 2] | 3 | K6-2, (Cedar Mill),[lower-alpha 30] Silvermont, Broadwell, ZhangJiang |
PREFETCH m8 [lower-alpha 31] |
0F 0D /0 |
Prefetch cache line.[lower-alpha 2] | |||
|
ADCX r32,r/m32 ADCX r64,r/m64 |
66 0F 38 F6 /r 66 REX.W 0F 38 F6 /r |
Add-with-carry. Differs from the older ADC instruction in that it leaves flags other than EFLAGS.CF unchanged. |
3 | Broadwell, Zen 1, ZhangJiang, Gracemont |
ADOX r32,r/m32 ADOX r64,r/m64 |
F3 0F 38 F6 /r F3 REX.W 0F 38 F6 /r |
Add-with-carry, with the overflow-flag EFLAGS.OF serving as carry input and output, with other flags left unchanged. | |||
|
CLAC |
NP 0F 01 CA |
Clear EFLAGS.AC . |
0 | Broadwell, Goldmont, Zen 1, LuJiaZui[lower-alpha 32] |
STAC |
NP 0F 01 CB |
Set EFLAGS.AC . | |||
|
CLFLUSHOPT m8 |
NFx 66 0F AE /7 |
Flush cache line. Differs from the older CLFLUSH instruction in that it has more relaxed ordering rules with respect to memory stores and other cache line flushes, enabling improved performance. |
3 | Skylake, Goldmont, Zen 1 |
|
PREFETCHWT1 m8 |
0F 0D /2 |
Prefetch data with T1 locality hint (fetch into L2 cache, but not L1 cache) and intent-to-write hint.[lower-alpha 2] | 3 | Knights Landing, YongFeng |
|
RDPKRU |
NP 0F 01 EE |
Read User Page Key register into EAX. | 3 | Skylake-X, Comet Lake, Gracemont, Zen 3, LuJiaZui[lower-alpha 32] |
WRPKRU |
NP 0F 01 EF |
Write data from EAX into User Page Key Register, and perform a Memory Fence. | |||
|
CLWB m8 |
NFx 66 0F AE /6 |
Write one cache line back to memory without invalidating the cache line. | 3 | Skylake-X, Zen 2, Tiger Lake, Tremont |
|
RDPID r32 |
F3 0F C7 /7 |
Read processor core ID into register.[lower-alpha 22] | 3[lower-alpha 33] | Goldmont Plus, Zen 2, Ice Lake, LuJiaZui[lower-alpha 32] |
|
MOVDIRI m32,r32 MOVDIRI m64,r64 |
NP 0F 38 F9 /r NP REX.W 0F 38 F9 /r |
Store to memory using Direct Store (memory store that is not cached or write-combined with other stores). | 3 | Tiger Lake, Tremont, Zen 5 |
|
MOVDIR64B reg,m512 |
66 0F 38 F8 /r |
Move 64 bytes of data from m512 to address given by ES:reg. The 64-byte write is done atomically with Direct Store.[lower-alpha 34] | 3 | Tiger Lake, Tremont, Zen 5 |
|
WBNOINVD |
F3 0F 09 |
Write back all dirty cache lines to memory without invalidation.[lower-alpha 35] Instruction is serializing. | 0 | Zen 2, Ice Lake-SP |
SFENCE
instruction ensures that all memory stores after the SFENCE
instruction are made globally observable after all memory stores before the SFENCE
. This imposes ordering on stores that can otherwise be reordered, such as non-temporal stores and stores to WC (Write-Combining) memory regions.[86]SFENCE
also acts as a reordering barrier on cache flushes/writebacks performed with the CLFLUSH
, CLFLUSHOPT
and CLWB
instructions. (Older AMD CPUs require MFENCE
to order CLFLUSH
.)SFENCE
is not ordered with respect to LFENCE
, and an SFENCE+LFENCE
sequence is not sufficient to prevent a load from being reordered past a previous store.[87] To prevent such reordering, it is necessary to execute an MFENCE
, LOCK
or a serializing instruction.LFENCE
instruction ensures that all memory loads after the LFENCE
instruction are made globally observable after all memory loads before the LFENCE
.LFENCE
instruction provides a stronger ordering guarantee:[88] it is dispatch-serializing, meaning that instructions after the LFENCE
instruction are allowed to start executing only after all instructions before it have retired (which will ensure that all preceding loads but not necessarily stores have completed). The effect of dispatch-serialization is that LFENCE
also acts as a speculation barrier and a reordering barrier for accesses to non-memory resources such as performance counters (accessed through e.g. RDTSC
or RDPMC
) and x2apic MSRs.LFENCE
is not necessarily dispatch-serializing by default – however, on all AMD CPUs that support any form of non-dispatch-serializing LFENCE
, it can be made dispatch-serializing by setting bit 1 of MSR C001_1029
.[89]MFENCE
instruction ensures that all memory loads, stores and cacheline-flushes after the MFENCE
instruction are made globally observable after all memory loads, stores and cacheline-flushes before the MFENCE
.MFENCE
is not dispatch-serializing, and therefore cannot be used to enforce ordering on accesses to non-memory resources such as performance counters and x2apic MSRs. MFENCE
is still ordered with respect to LFENCE
, so if a memory barrier with dispatch serialization is needed, then it can be obtained by issuing an MFENCE
followed by an LFENCE
.[47]MFENCE
is serializing.PAUSE
instruction in 64-bit mode is, unlike NOP
, unaffected by the presence of the REX.R
prefix. Neither NOP
nor PAUSE
are affected by the other bits of the REX
prefix. A few examples of opcode 90
with various prefixes in 64-bit mode are:90
is NOP
41 90
is XCHG R8D,EAX
4E 90
is NOP
49 90
is XCHG R8,RAX
F3 90
is PAUSE
F3 41 90
is PAUSE
F3 4F 90
is PAUSE
CLFLUSH
instruction was introduced together with SSE2, it has its own CPUID flag and may be present on processors not otherwise implementing SSE2 and/or absent from processors that otherwise implement SSE2. (E.g. AMD Geode LX supports CLFLUSH
but not SSE2.)MONITOR
and MWAIT
instructions were introduced at the same time as SSE3, they have their own CPUID flag that needs to be checked separately from the SSE3 CPUID flag (e.g. Athlon 64 X2 and VIA C7 supported SSE3 but not MONITOR.)MONITOR
, the DS: segment can be overridden with a segment prefix.MWAIT
may be ended by system events other than a memory write (e.g. cacheline evictions, interrupts) – the exact set of events that can cause the wait to end is implementation-specific.MONITOR
before using MWAIT
to wait for memory writes again.MWAIT
in the ECX register are:
Bits | MWAIT Extension |
---|---|
0 | Treat interrupts as break events, even when masked (EFLAGS.IF=0). (Available on all non-NetBurst implementations of MWAIT .) |
1 | Timed MWAIT: end the wait when the TSC reaches or exceeds the value in EDX:EBX. (Undocumented, reportedly present in Intel Skylake and later Intel processors)[94] |
2 | Monitorless MWAIT[95] |
31:3 | Not used, must be set to zero. |
MWAIT
in the EAX register are:
The C-states are processor-specific power states, which do not necessarily correspond 1:1 to ACPI C-states.Bits | MWAIT Hint |
---|---|
3:0 | Sub-state within a C-state (see bits 7:4) (Intel processors only) |
7:4 | Target CPU power C-state during wait, minus 1. (E.g. 0000b for C1, 0001b for C2, 1111b for C0) |
31:8 | Not used. |
GETSEC
(selected by EAX) are:
Any unsupported value in EAX causes an #UD exception.EAX | Function |
---|---|
0 (CAPABILITIES) | Report SMX capabilities |
2 (ENTERACCES) | Enter execution of authenticated code module |
3 (EXITAC) | Exit execution of authenticated code module |
4 (SENTER) | Enter measured environment |
5 (SEXIT) | Exit measured environment |
6 (PARAMETERS) | Report SMX parameters |
7 (SMCTRL) | SMX Mode Control |
8 (WAKEUP) | Wake up sleeping processors in measured environment |
RDTSCP
can be run outside Ring 0 only if CR4.TSD=0
.INVPCID
(selected by register argument) are:
Any unsupported value in the register argument causes a #GP exception.Value | Function |
---|---|
0 | Invalidate TLB entries matching PCID and virtual memory address in descriptor, excluding global entries |
1 | Invalidate TLB entries matching PCID in descriptor, excluding global entries |
2 | Invalidate all TLB entries, including global entries |
3 | Invalidate all TLB entries, excluding global entries |
INVLPG
instruction, INVPCID
will cause a #GP exception if the provided memory address is non-canonical. This discrepancy has been known to cause security issues.[97]PREFETCH
and PREFETCHW
instructions are mandatory parts of the 3DNow! instruction set extension, but are also available as a standalone extension on systems that do not support 3DNow!PREFETCH
and PREFETCHW
(0F 0D /r
) execute as NOPs on Intel CPUs from Cedar Mill (65nm Pentium 4) onwards, with PREFETCHW
gaining prefetch functionality from Broadwell onwards.PREFETCH
(0F 0D /0
) instruction is a 3DNow! instruction, present on all processors with 3DNow! but not necessarily on processors with the PREFETCHW extension.0F 0D /0
as well as opcodes 0F 0D /2../7
are all documented to be performing prefetch.0F 0D /2
being PREFETCHWT1 m8
on Xeon Phi only) – third party testing[99] indicates that some or all of these opcodes may be performing prefetch on at least some Intel Core CPUs.RDTSCP
instruction which can also be used to read the processor ID, user-mode RDPID
is not disabled by CR4.TSD=1
.MOVDIR64
, the destination address given by ES:reg must be 64-byte aligned.67h
prefix.Instruction Set Extension | Instruction mnemonics | Opcode | Instruction description | Ring | Added in |
---|---|---|---|---|---|
|
(HWNT )[lower-alpha 1] |
2E [lower-alpha 2] |
Instruction prefix: branch hint weakly not taken. | 3 | Pentium 4,[lower-alpha 3] Meteor Lake[103] |
(HST )[lower-alpha 1] |
3E [lower-alpha 2] |
Instruction prefix: branch hint strongly taken. | |||
|
ENCLS |
NP 0F 01 CF |
Perform an SGX Supervisor function. The function to perform is given in EAX[lower-alpha 4] - depending on function, the instruction may take additional input operands in RBX, RCX and RDX.
Depending on function, the instruction may return data in RBX and/or an error code in EAX. |
0 | |
ENCLU |
NP 0F 01 D7 |
Perform an SGX User function. The function to perform is given in EAX[lower-alpha 6] - depending on function, the instruction may take additional input operands in RBX, RCX and RDX.
Depending on function, the instruction may return data/status information in EAX and/or RCX. |
3[lower-alpha 7] | ||
ENCLV |
NP 0F 01 C0 |
Perform an SGX Virtualization function. The function to perform is given in EAX[lower-alpha 8] - depending on function, the instruction may take additional input operands in RBX, RCX and RDX.
Instruction returns status information in EAX. |
0[lower-alpha 9] | ||
|
PTWRITE r/m32 PTWRITE r/m64 |
F3 0F AE /4 F3 REX.W 0F AE /4 |
Read data from register or memory to encode into a PTW packet.[lower-alpha 10] | 3 | Kaby Lake, Goldmont Plus |
|
PCONFIG |
NP 0F 01 C5 |
Perform a platform feature configuration function. The function to perform is specified in EAX[lower-alpha 11] - depending on function, the instruction may take additional input operands in RBX, RCX and RDX.
If the instruction fails, it will set EFLAGS.ZF=1 and return an error code in EAX. If it is successful, it sets EFLAGS.ZF=0 and EAX=0. |
0 | Ice Lake-SP |
|
CLDEMOTE m8 |
NP 0F 1C /0 |
Move cache line containing m8 from CPU L1 cache to a more distant level of the cache hierarchy.[lower-alpha 12] | 3 | (Tremont), (Alder Lake), Sapphire Rapids[lower-alpha 13] |
|
UMONITOR r16/32/64 |
F3 0F AE /6 |
Start monitoring a memory location for memory writes. The memory address to monitor is given by the register argument.[lower-alpha 14] | 3 | Tremont, Alder Lake |
UMWAIT r32 UMWAIT r32,EDX,EAX |
F2 0F AE /6 |
Timed wait for a write to a monitored memory location previously specified with UMONITOR . In the absence of a memory write, the wait will end when either the TSC reaches the value specified by EDX:EAX or the wait has been going on for an OS-controlled maximum amount of time.[lower-alpha 15] |
Usually 3[lower-alpha 16] | ||
TPAUSE r32 TPAUSE r32,EDX,EAX |
66 0F AE /6 |
Wait until the Time Stamp Counter reaches the value specified in EDX:EAX.[lower-alpha 15]
The register argument to the | |||
|
SERIALIZE |
NP 0F 01 E8 |
Serialize instruction fetch and execution.[lower-alpha 18] | 3 | Alder Lake |
|
HRESET imm8 |
F3 0F 3A F0 C0 ib |
Request that the processor reset selected components of hardware-maintained prediction history. A bitmap of which components of the CPU's prediction history to reset is given in EAX (the imm8 argument is ignored).[lower-alpha 19] | 0 | Alder Lake |
|
SENDUIPI reg |
F3 0F C7 /6 |
Send Interprocessor User Interrupt.[lower-alpha 20] | 3 | Sapphire Rapids |
UIRET |
F3 0F 01 EC |
User Interrupt Return.
Pops RIP, RFLAGS and RSP off the stack, in that order.[lower-alpha 21] | |||
TESTUI |
F3 0F 01 ED |
Test User Interrupt Flag. Copies UIF to EFLAGS.CF . | |||
CLUI |
F3 0F 01 EE |
Clear User Interrupt Flag. | |||
STUI |
F3 0F 01 EF |
Set User Interrupt Flag. | |||
|
ENQCMD r32/64,m512 |
F2 0F 38 F8 /r |
Enqueue Command. Reads a 64-byte "command data" structure from memory (m512 argument) and writes atomically to a memory-mapped Enqueue Store device (register argument provides the memory address of this device, using ES segment and requiring 64-byte alignment.) Sets ZF=0 to indicate that device accepted the command, or ZF=1 to indicate that command was not accepted (e.g. queue full or the memory location was not an Enqueue Store device.) | 3 | Sapphire Rapids |
ENQCMDS r32/64,m512 |
F3 0F 38 F8 /r |
Enqueue Command Supervisor. Differs from ENQCMD in that it can place an arbitrary PASID (process address-space identifier) and a privilege-bit in the "command data" to enqueue. |
0 | ||
|
WRMSRNS |
NP 0F 01 C6 |
Write Model-specific register. The MSR to write is specified in ECX, and the data to write is given in EDX:EAX.
The instruction differs from the older |
0 | Sierra Forest |
|
RDMSRLIST |
F2 0F 01 C6 |
Read multiple MSRs. RSI points to a table of up to 64 MSR indexes to read (64 bits each), RDI points to a table of up to 64 data items that the MSR read-results will be written to (also 64 bits each), and RCX provides a 64-entry bitmap of which of the table entries to actually perform an MSR read for. | 0 | Sierra Forest |
WRMSRLIST |
F3 0F 01 C6 |
Write multiple MSRs. RSI points to a table of up to 64 MSR indexes to write (64 bits each), RDI points to a table of up to 64 data items to write into the MSRs (also 64 bits each), and RCX provides a 64-entry bitmap of which of the table entries to actually perform an MSR write for. The instruction is not serializing. | |||
|
CMPccXADD m32,r32,r32 CMPccXADD m64,r64,r64 |
VEX.128.66.0F38.W0 Ex /r VEX.128.66.0F38.W1 Ex /r [lower-alpha 22][lower-alpha 23] |
Read value from memory, then compare to first register operand. If the comparison passes, then add the second register operand to the memory value. The instruction as a whole is performed atomically. Memory argument is required to be aligned. The operation of CMPccXADD [mem],reg1,reg2 is:temp1 := [mem] EFLAGS := CMP temp1, reg1 // sets EFLAGS like regular compare reg1 := temp1 if( condition ) [mem] := temp1 + reg2 |
3 | Sierra Forest |
HWNT
and HST
are listed in early Willamette documentation only[101] - later Intel documentation lists the branch hint prefixes without assigning them a mnemonic.[102]2E
and 3E
prefixes are interpreted as branch hints only when used with the Jcc
conditional branch instructions (opcodes 70..7F
and 0F 80..8F
) - when used with other opcodes, they may take other meanings (e.g. for instructions with memory operands outside 64-bit mode, they will work as segment-override prefixes CS:
and DS:
, respectively). On processors that don't support branch hints, these prefixes are accepted but ignored when used with Jcc
.ENCLS
(selected by EAX) are:
Any unsupported value in EAX causes a #GP exception.EAX | Function |
---|---|
0 (ECREATE) | Create an enclave |
1 (EADD) | Add a page |
2 (EINIT) | Initialize an enclave |
3 (EREMOVE) | Remove a page from EPC (Enclave Page Cache) |
4 (EDBGRD) | Read data by debugger |
5 (EDBGWR) | Write data by debugger |
6 (EEXTEND) | Extend EPC page measurement |
7 (ELDB) | Load an EPC page as blocked |
8 (ELDU) | Load an EPC page as unblocked |
9 (EBLOCK) | Block an EPC page |
A (EPA) | Add version array |
B (EWB) | Writeback/invalidate EPC page |
C (ETRACK) | Activate EBLOCK checks |
Added with SGX2 | |
D (EAUG) | Add page to initialized enclave |
E (EMODPTR) | Restrict permissions of EPC page |
F (EMODT) | Change type of EPC page |
Added with OVERSUB[104] | |
10 (ERDINFO) | Read EPC page type/status info |
11 (ETRACKC) | Activate EBLOCK checks |
12 (ELDBC) | Load EPC page as blocked with enhanced error reporting |
13 (ELDUC) | Load EPC page as unblocked with enhanced error reporting |
Other | |
18 (EUPDATESVN) | Update SVN (Security Version Number) after live microcode update[105] |
ENCLU
(selected by EAX) are:
Any unsupported value in EAX causes a #GP exception.EAX | Function |
---|---|
0 (EREPORT) | Create a cryptographic report |
1 (EGETKEY) | Create a cryptographic key |
2 (EENTER) | Enter an Enclave |
3 (ERESUME) | Re-enter an Enclave |
4 (EEXIT) | Exit an Enclave |
Added with SGX2 | |
5 (EACCEPT) | Accept changes to EPC page |
6 (EMODPE) | Extend EPC page permissions |
7 (EACCEPTCOPY) | Initialize pending page |
Added with TDX[108] | |
8 (EVERIFYREPORT2) | Verify a cryptographic report of a trust domain |
Added with AEX-Notify | |
9 (EDECCSSA) | Decrement TCS.CSSA |
ENCLV
(selected by EAX) are:
Any unsupported value in EAX causes a #GP exception.ENCLV
instruction is only present on systems that support the EPC Oversubscription Extensions to SGX ("OVERSUB").EAX | Function |
---|---|
Added with OVERSUB[104] | |
0 (EDECVIRTCHILD) | Decrement VIRTCHILDCNT in SECS |
1 (EINCVIRTCHILD) | Increment VIRTCHILDCNT in SECS |
2 (ESETCONTEXT) | Set ENCLAVECONTEXT field in SECS |
PTWRITE
, the write to the Processor Trace Packet will only happen if a set of enable-bits (the "TriggerEn", "ContextEn", "FilterEn" bits of the RTIT_STATUS
MSR and the "PTWEn" bit of the RTIT_CTL
MSR) are all set to 1.PTWRITE
instruction is indicated in the SDM to cause an #UD exception if the 66h instruction prefix is used, regardless of other prefixes.PCONFIG
(selected by EAX) are:
Any unsupported value in EAX causes a #GP(0) exception.EAX | Function |
---|---|
0 | MKTME_KEY_PROGRAM: Program key and encryption mode to use with an TME-MK Key ID. |
Added with TSE | |
1 | TSE_KEY_PROGRAM: Direct key programming for TSE. |
2 | TSE_KEY_PROGRAM_WRAPPED: Wrapped key programming for TSE. |
CLDEMOTE
, the cache level that it will demote a cache line to is implementation-dependent.UMWAIT
and TPAUSE
instructions, the operating system can use the IA32_UMWAIT_CONTROL
MSR to limit the maximum amount of time that a single UMWAIT
/TPAUSE
invocation is permitted to wait. The UMWAIT
and TPAUSE
instructions will set RFLAGS.CF
to 1 if they reached the IA32_UMWAIT_CONTROL
-defined time limit and 0 otherwise.TPAUSE
and UMWAIT
can be run outside Ring 0 only if CR4.TSD=0
.CPUID
and IRET
, these instructions perform additional functions, causing side-effects and reduced performance when stand-alone instruction serialization is needed. (CPUID
additionally has the issue that it causes a mandatory #VMEXIT when executed under virtualization, which causes a very large overhead.) The SERIALIZE
instruction performs serialization only, avoiding these added costs.SENDUIPI
is an index to pick an entry from the UITT (User-Interrupt Target Table, a table specified by the new UINTR_TT
and UINT_MISC
MSRs.)UIRET
instruction always sets UIF (User Interrupt Flag) to 1. On Sierra Forest and later processors, UIRET
will set UIF to the value of bit 1 of the value popped off the stack for RFLAGS - this functionality is indicated by CPUID.(EAX=7,ECX=1):EDX[17]
.CMPccXADD
instructions (opcode VEX.128.66.0F38 Ex /r
with the x nibble specifying the condition) are:
x | cc | Condition (EFLAGS) |
---|---|---|
0 | O | OF=1: "Overflow" |
1 | NO | OF=0: "Not Overflow" |
2 | B | CF=1: "Below" |
3 | NB | CF=0: "Not Below" |
4 | Z | ZF=1: "Zero" |
5 | NZ | ZF=0: "Not Zero" |
6 | BE | (CF=1 or ZF=1): "Below or Equal" |
7 | NBE | (CF=0 and ZF=0): "Not Below or Equal" |
8 | S | SF=1: "Sign" |
9 | NS | SF=0: "Not Sign" |
A | P | PF=1: "Parity" |
B | NP | PF=0: "Not Parity" |
C | L | SF≠OF: "Less" |
D | NL | SF=OF: "Not Less" |
E | LE | (ZF=1 or SF≠OF): "Less or Equal" |
F | NLE | (ZF=0 and SF=OF): "Not Less or Equal" |
Instruction Set Extension | Instruction mnemonics | Opcode | Instruction description | Ring | Added in |
---|---|---|---|---|---|
|
MOV reg,CR8 |
F0 0F 20 /0 [lower-alpha 2] |
Read the CR8 register. | 0 | K8[lower-alpha 3] |
MOV CR8,reg |
F0 0F 22 /0 [lower-alpha 2] |
Write to the CR8 register. | |||
|
MONITORX |
NP 0F 01 FA |
Start monitoring a memory location for memory writes. Similar to older MONITOR , except available in user mode. |
3 | Excavator |
MWAITX |
NP 0F 01 FB |
Wait for a write to a monitored memory location previously specified with MONITORX .MWAITX differs from the older MWAIT instruction mainly in that it runs in user mode and that it can accept an optional timeout argument (given in TSC time units) in EBX (enabled by setting bit[1] of ECX to 1.) | |||
|
CLZERO rAX |
NP 0F 01 FC |
Write zeroes to all bytes in a memory region that has the size and alignment of a CPU cache line and contains the byte addressed by DS:rAX.[lower-alpha 4] | 3 | Zen 1 |
|
RDPRU |
NP 0F 01 FD |
Read selected MSRs (mainly performance counters) in user mode. ECX specifies which register to read.[lower-alpha 5]
The value of the MSR is returned in EDX:EAX. |
Usually 3[lower-alpha 6] | Zen 2 |
|
MCOMMIT |
F3 0F 01 FA |
Ensure that all preceding stores in thread have been committed to memory, and that any errors encountered by these stores have been signalled to any associated error logging resources. The set of errors that can be reported and the logging mechanism are platform-specific. Sets EFLAGS.CF to 0 if any errors occurred, 1 otherwise. |
3 | Zen 2 |
|
INVLPGB |
NP 0F 01 FE |
Invalidate TLB Entries for a range of pages, with broadcast. The invalidation is performed on the processor executing the instruction, and also broadcast to all other processors in the system. rAX takes the virtual address to invalidate and some additional flags, ECX takes the number of pages to invalidate, and EDX specifies ASID and PCID to perform TLB invalidation for. |
0 | Zen 3 |
TLBSYNC |
NP 0F 01 FF |
Synchronize TLB invalidations. Wait until all TLB invalidations signalled by preceding invocations of the INVLPGB instruction on the same logical processor have been responded to by all processors in the system. Instruction is serializing. |
REX.R
prefix, e.g. 44 0F 20 07
(MOV RDI,CR8
). However, the REX.R
prefix is only available in 64-bit mode.F0
(LOCK
) prefix instead of REX.R
– this provides access to CR8 outside 64-bit mode.11b
.LOCK
prefix with the REX.R
prefix is not permitted and will cause an #UD exception.CLZERO
, the address size and 67h prefix control whether to use AX, EAX or RAX as address. The default segment DS: can be overridden by a segment-override prefix. The provided address does not need to be aligned – hardware will align it as necessary.CLZERO
instruction is intended for recovery from otherwise-fatal Machine Check errors. It is non-cacheable, cannot be used to allocate a cache line without a memory access, and should not be used for fast memory clears.[111]RDPRU
does not necessarily match that of RDMSR
/WRMSR
.RDPRU
as of December 2022 are:
Unsupported values in ECX return 0.ECX | Register |
---|---|
0 | MPERF (MSR 0E7h: Maximum Performance Frequency Clock Count) |
1 | APERF (MSR 0E8h: Actual Performance Frequency Clock Count) |
CR4.TSD=1
, then the RDPRU
instruction can only run in ring 0.The x87 coprocessor, if present, provides support for floating-point arithmetic. The coprocessor provides eight data registers, each holding one 80-bit floating-point value (1 sign bit, 15 exponent bits, 64 mantissa bits) – these registers are organized as a stack, with the top-of-stack register referred to as "st" or "st(0)", and the other registers referred to as st(1),st(2),...st(7). It additionally provides a number of control and status registers, including "PC" (precision control, to control whether floating-point operations should be rounded to 24, 53 or 64 mantissa bits) and "RC" (rounding control, to pick rounding-mode: round-to-zero, round-to-positive-infinity, round-to-negative-infinity, round-to-nearest-even) and a 4-bit condition code register "CC", whose four bits are individually referred to as C0,C1,C2 and C3). Not all of the arithmetic instructions provided by x87 obey PC and RC.
Instruction description | Mnemonic | Opcode | Additional items | |
---|---|---|---|---|
x87 Non-Waiting[lower-alpha 1] FPU Control Instructions | Waiting mnemonic[lower-alpha 2] | |||
Initialize x87 FPU | FNINIT |
DB E3 | FINIT | |
Load x87 Control Word | FLDCW m16 | D9 /5 | (none) | |
Store x87 Control Word | FNSTCW m16 | D9 /7 | FSTCW | |
Store x87 Status Word | FNSTSW m16 |
DD /7 | FSTSW | |
Clear x87 Exception Flags | FNCLEX |
DB E2 | FCLEX | |
Load x87 FPU Environment | FLDENV m112/m224 [lower-alpha 3] |
D9 /4 | (none) | |
Store x87 FPU Environment | FNSTENV m112/m224 [lower-alpha 3] |
D9 /6 | FSTENV | |
Save x87 FPU State, then initialize x87 FPU | FNSAVE m752/m864 [lower-alpha 3] |
DD /6 | FSAVE | |
Restore x87 FPU State | FRSTOR m752/m864 [lower-alpha 3] |
DD /4 | (none) | |
Enable Interrupts (8087 only)[lower-alpha 4] | FNENI | DB E0 | FENI | |
Disable Interrupts (8087 only)[lower-alpha 4] | FNDISI | DB E1 | FDISI | |
x87 Floating-point Load/Store/Move Instructions | precision control | rounding control | ||
Load floating-point value onto stack | FLD m32 | D9 /0 | No | — |
FLD m64 | DD /0 | |||
FLD m80 | DB /5 | |||
FLD st(i) | D9 C0+i | |||
Store top-of-stack floating-point value to memory or stack register | FST m32 | D9 /2 | No | Yes |
FST m64 | DD /2 | |||
FST st(i) [lower-alpha 5] |
DD D0+i | No | — | |
Store top-of-stack floating-point value to memory or stack register, then pop | FSTP m32 | D9 /3 | No | Yes |
FSTP m64 | DD /3 | |||
FSTP m80 [lower-alpha 5] |
DB /7 | No | — | |
FSTP st(i) [lower-alpha 5][lower-alpha 6] |
DD D8+i | |||
DF D0+i[lower-alpha 7] | ||||
DF D8+i[lower-alpha 7] | ||||
Push +0.0 onto stack | FLDZ | D9 EE | No | — |
Push +1.0 onto stack | FLD1 | D9 E8 | ||
Push π (approximately 3.14159) onto stack | FLDPI | D9 EB | No | 387[lower-alpha 8] |
Push (approximately 3.32193) onto stack | FLDL2T | D9 E9 | ||
Push (approximately 1.44269) onto stack | FLDL2E | D9 EA | ||
Push (approximately 0.30103) onto stack | FLDLG2 | D9 EC | ||
Push (approximately 0.69315) onto stack | FLDLN2 | D9 ED | ||
Exchange top-of-stack register with other stack register | FXCH st(i) [lower-alpha 9][lower-alpha 10] |
D9 C8+i |
No | — |
DD C8+i[lower-alpha 7] | ||||
DF C8+i[lower-alpha 7] | ||||
x87 Integer Load/Store Instructions | precision control | rounding control | ||
Load signed integer value onto stack from memory, with conversion to floating-point | FILD m16 | DF /0 | No | — |
FILD m32 | DB /0 | |||
FILD m64 | DF /5 | |||
Store top-of-stack value to memory, with conversion to signed integer | FIST m16 | DF /2 | No | Yes |
FIST m32 | DB /2 | |||
Store top-of-stack value to memory, with conversion to signed integer, then pop stack | FISTP m16 | DF /3 | No | Yes |
FISTP m32 | DB /3 | |||
FISTP m64 | DF /7 | |||
Load 18-digit Binary-Coded-Decimal integer value onto stack from memory, with conversion to floating-point | FBLD m80 [lower-alpha 11] |
DF /4 | No | — |
Store top-of-stack value to memory, with conversion to 18-digit Binary-Coded-Decimal integer, then pop stack | FBSTP m80 | DF /6 | No | 387[lower-alpha 8] |
x87 Basic Arithmetic Instructions | precision control | rounding control | ||
Floating-point add
|
FADD m32 | D8 /0 | Yes | Yes |
FADD m64 | DC /0 | |||
FADD st,st(i) | D8 C0+i | |||
FADD st(i),st | DC C0+i | |||
Floating-point multiply
|
FMUL m32 | D8 /1 | Yes | Yes |
FMUL m64 | DC /1 | |||
FMUL st,st(i) | D8 C8+i | |||
FMUL st(i),st | DC C8+i | |||
Floating-point subtract
|
FSUB m32 | D8 /4 | Yes | Yes |
FSUB m64 | DC /4 | |||
FSUB st,st(i) | D8 E0+i | |||
FSUB st(i),st | DC E8+i | |||
Floating-point reverse subtract
|
FSUBR m32 | D8 /5 | Yes | Yes |
FSUBR m64 | DC /5 | |||
FSUBR st,st(i) | D8 E8+i | |||
FSUBR st(i),st | DC E0+i | |||
Floating-point divide[lower-alpha 12]
|
FDIV m32 | D8 /6 | Yes | Yes |
FDIV m64 | DC /6 | |||
FDIV st,st(i) | D8 F0+i | |||
FDIV st(i),st | DC F8+i | |||
Floating-point reverse divide
|
FDIVR m32 | D8 /7 | Yes | Yes |
FDIVR m64 | DC /7 | |||
FDIVR st,st(i) | D8 F8+i | |||
FDIVR st(i),st | DC F0+i | |||
Floating-point compare
|
FCOM m32 | D8 /2 | No | — |
FCOM m64 | DC /2 | |||
FCOM st(i) [lower-alpha 9] |
D8 D0+i | |||
DC D0+i[lower-alpha 7] | ||||
x87 Basic Arithmetic Instructions with Stack Pop | precision control | rounding control | ||
Floating-point add and pop | FADDP st(i),st [lower-alpha 9] | DE C0+i | Yes | Yes |
Floating-point multiply and pop | FMULP st(i),st [lower-alpha 9] | DE C8+i | Yes | Yes |
Floating-point subtract and pop | FSUBP st(i),st [lower-alpha 9] | DE E8+i | Yes | Yes |
Floating-point reverse-subtract and pop | FSUBRP st(i),st [lower-alpha 9] | DE E0+i | Yes | Yes |
Floating-point divide and pop | FDIVP st(i),st [lower-alpha 9] | DE F8+i | Yes | Yes |
Floating-point reverse-divide and pop | FDIVRP st(i),st [lower-alpha 9] | DE F0+i | Yes | Yes |
Floating-point compare and pop | FCOMP m32 | D8 /3 | No | — |
FCOMP m64 | DC /3 | |||
FCOMP st(i) [lower-alpha 9] |
D8 D8+i | |||
DC D8+i[lower-alpha 7] | ||||
DE D0+i[lower-alpha 7] | ||||
Floating-point compare to st(1), then pop twice | FCOMPP | DE D9 | No | — |
x87 Basic Arithmetic Instructions with Integer Source Argument | precision control | rounding control | ||
Floating-point add by integer | FIADD m16 | DA /0 | Yes | Yes |
FIADD m32 | DE /0 | |||
Floating-point multiply by integer | FIMUL m16 | DA /1 | Yes | Yes |
FIMUL m32 | DE /1 | |||
Floating-point subtract by integer | FISUB m16 | DA /4 | Yes | Yes |
FISUB m32 | DE /4 | |||
Floating-point reverse-subtract by integer | FISUBR m16 | DA /5 | Yes | Yes |
FISUBR m32 | DE /5 | |||
Floating-point divide by integer | FIDIV m16 | DA /6 | Yes | Yes |
FIDIV m32 | DE /6 | |||
Floating-point reverse-divide by integer | FIDIVR m16 | DA /7 | Yes | Yes |
FIDIVR m32 | DE /7 | |||
Floating-point compare to integer | FICOM m16 | DA /2 | No | — |
FICOM m32 | DE /2 | |||
Floating-point compare to integer, and stack pop | FICOMP m16 |
DA /3 | No | — |
FICOMP m32 |
DE /3 | |||
x87 Additional Arithmetic Instructions | precision control | rounding control | ||
Floating-point change sign | FCHS | D9 E0 | No | — |
Floating-point absolute value | FABS | D9 E1 | No | — |
Floating-point compare top-of-stack value to 0 | FTST | D9 E4 | No | — |
Classify top-of-stack st(0) register value. The classification result is stored in the x87 CC register.[lower-alpha 13] |
FXAM | D9 E5 | No | — |
Split the st(0) value into two values E and M representing the exponent and mantissa of st(0). The split is done such that , where E is an integer and M is a number whose absolute value is within the range . [lower-alpha 14] st(0) is then replaced with E, after which M is pushed onto the stack. |
FXTRACT | D9 F4 | No | — |
Floating-point partial[lower-alpha 15] remainder (not IEEE 754 compliant): | FPREM | D9 F8 | No | —[lower-alpha 16] |
Floating-point square root | FSQRT | D9 FA | Yes | Yes |
Floating-point round to integer | FRNDINT | D9 FC | No | Yes |
Floating-point power-of-2 scaling. Rounds the value of st(1) to integer with round-to-zero, then uses it as a scale factor for st(0):[lower-alpha 17] | FSCALE | D9 FD | No | Yes[lower-alpha 18] |
x87 Transcendental Instructions[lower-alpha 19] | Source operand range restriction | |||
Base-2 exponential minus 1, with extra precision for st(0) close to 0: | F2XM1 | D9 F0 |
8087: 80387: | |
Base-2 Logarithm:followed by stack pop | FYL2X [lower-alpha 20] |
D9 F1 | no restrictions | |
Partial Tangent: Computes from st(0) a pair of values X and Y, such thatThe Y value replaces the top-of-stack value, and then X is pushed onto the stack. On 80387 and later x87, but not original 8087, X is always 1.0 |
FPTAN | D9 F2 |
8087: 80387: | |
Two-argument arctangent with quadrant adjustment:[lower-alpha 21] followed by stack pop | FPATAN | D9 F3 |
8087: 80387: no restrictions | |
Base-2 Logarithm plus 1, with extra precision for st(0) close to 0:followed by stack pop | FYL2XP1 [lower-alpha 20] | D9 F9 |
Intel: AMD: | |
Other x87 Instructions | ||||
No operation[lower-alpha 22] | FNOP | D9 D0 | ||
Decrement x87 FPU Register Stack Pointer | FDECSTP | D9 F6 | ||
Increment x87 FPU Register Stack Pointer | FINCSTP | D9 F7 | ||
Free x87 FPU Register | FFREE st(i) |
DD C0+i | ||
Check and handle pending unmasked x87 FPU exceptions | WAIT ,FWAIT | 9B | ||
Floating-point store and pop, without stack underflow exception | FSTPNCE st(i) | D9 D8+i[lower-alpha 7] | ||
Free x87 register, then stack pop | FFREEP st(i) | DF C0+i[lower-alpha 7] |
WAIT
instruction is executed.FN
, there exists a pseudo-instruction that has the same mnemonic except without the N. These pseudo-instructions consist of a WAIT
instruction (opcode 9B
) followed by the corresponding non-waiting x87 instruction. For example:FNCLEX
is an instruction with the opcode DB E2
. The corresponding pseudo-instruction FCLEX
is then encoded as 9B DB E2
.FNSAVE ES:[BX+6]
is an instruction with the opcode 26 DD 77 06
. The corresponding pseudo-instruction FSAVE ES:[BX+6]
is then encoded as 9B 26 DD 77 06
FLDENV
, F(N)STENV
, FRSTOR
and F(N)SAVE
exist in 16-bit and 32-bit variants. The 16-bit variants will load/store a 14-byte floating-point environment data structure to/from memory – the 32-bit variants will load/store a 28-byte data structure instead. (F(N)SAVE
/FRSTOR
will additionally load/store an additional 80 bytes of FPU data register content after the FPU environment, for a total of 94 or 108 bytes). The choice between the 16-bit and 32-bit variants is based on the CS.D
bit and the presence of the 66h
instruction prefix. On 8087 and 80287, only the 16-bit variants are available.REX.W
under x86-64 will cause the 32-bit variants to be used. Since these can only load/store the bottom 32 bits of FIP and FDP, it is recommended to use FXSAVE64
/FXRSTOR64
instead if 64-bit operation is desired.F(N)DISI
and F(N)ENI
instructions to set/clear the Interrupt Mask bit (bit 7) of the x87 Control Word,[114] to control the interrupt.F(N)ENI
and F(N)DISI
instructions were kept for backwards compatibility, executing as NOPs that do not modify any x87 state.FXCH
is implemented as a register renaming rather than a true data move. This has no semantic effect, but enables zero-cycle-latency operation. It also allows the instruction to break data dependencies for the x87 top-of-stack value, improving attainable performance for code optimized for these processors.FPREM
and FPATAN
.[121]FXAM
instruction will set C0, C2 and C3 based on value type in st(0) as follows:
C1 is set to the sign-bit of st(0), regardless of whether st(0) is Empty or not.FPREM
, if the quotient Q is larger than , then the remainder calculation may have been done only partially – in this case, the FPREM
instruction will need to be run again in order to complete the remainder calculation. This is indicated by the instruction setting C2
to 1.C2
to 0 and set the three bits {C0,C3,C1}
to the bottom three bits of the quotient Q.FPATAN
, the following adjustments are done as compared to just computing a one-argument arctangent of the ratio :Instruction description | Mnemonic | Opcode | Additional items |
---|---|---|---|
x87 Non-Waiting Control Instructions added in 80287 | Waiting mnemonic | ||
Notify FPU of entry into Protected Mode[lower-alpha 1] | FNSETPM | DB E4 | FSETPM |
Store x87 Status Word to AX | FNSTSW AX | DF E0 | FSTSW AX |
x87 Instructions added in 80387[lower-alpha 2] | Source operand range restriction | ||
Floating-point unordered compare. Similar to the regular floating-point compare instruction FCOM , except will not produce an exception in response to any qNaN operands. | FUCOM st(i) [lower-alpha 3] | DD E0+i | no restrictions |
Floating-point unordered compare and pop | FUCOMP st(i) [lower-alpha 3] | DD E8+i | |
Floating-point unordered compare to st(1), then pop twice | FUCOMPP | DA E9 | |
IEEE 754 compliant floating-point partial remainder.[lower-alpha 4] | FPREM1 | D9 F5 | |
Floating-point sine and cosine. Computes two values and [lower-alpha 5] Top-of-stack st(0) is replaced with S, after which C is pushed onto the stack. | FSINCOS | D9 FB | |
Floating-point sine.[lower-alpha 5] | FSIN | D9 FE | |
Floating-point cosine.[lower-alpha 5] | FCOS | D9 FF | |
x87 Instructions added in Pentium Pro | Condition for conditional moves | ||
Floating-point conditional move to st(0) based on EFLAGS | FCMOVB st(0),st(i) | DA C0+i | below (CF=1) |
FCMOVE st(0),st(i) | DA C8+i | equal (ZF=1) | |
FCMOVBE st(0),st(i) | DA D0+i | below or equal (CF=1 or ZF=1) | |
FCMOVU st(0),st(i) | DA D8+i | unordered (PF=1) | |
FCMOVNB st(0),st(i) | DB C0+i | not below (CF=0) | |
FCMOVNE st(0),st(i) | DB C8+i | not equal (ZF=0) | |
FCMOVNBE st(0),st(i) | DB D0+i | not below or equal (CF=0 and ZF=0) | |
FCMOVNU st(0),st(i) | DB D8+i | not unordered (PF=0) | |
Floating-point compare and set EFLAGS .Differs from the older FCOM floating-point compare instruction in that it puts its result in the integer EFLAGS register rather than the x87 CC register.[lower-alpha 6] | FCOMI st(0),st(i) | DB F0+i | |
Floating-point compare and set EFLAGS , then pop | FCOMIP st(0),st(i) | DF F0+i | |
Floating-point unordered compare and set EFLAGS | FUCOMI st(0),st(i) | DB E8+i | |
Floating-point unordered compare and set EFLAGS , then pop | FUCOMIP st(0),st(i) | DF E8+i | |
x87 Non-Waiting Instructions added in Pentium II, AMD K7 and SSE[lower-alpha 7] | 64-bit mnemonic ( REX.W prefix) | ||
Save x87, MMX and SSE state to 512-byte data structure[lower-alpha 8][lower-alpha 9][lower-alpha 10] | FXSAVE m512byte | NP 0F AE /0 | FXSAVE64 m512byte |
Restore x87, MMX and SSE state from 512-byte data structure[lower-alpha 8][lower-alpha 9] | FXRSTOR m512byte | NP 0F AE /1 | FXRSTOR64 m512byte |
x87 Instructions added as part of SSE3 | |||
Floating-point store integer and pop, with round-to-zero | FISTTP m16 | DF /1 | |
FISTTP m32 | DB /1 | ||
FISTTP m64 | DD /1 |
F(N)SAVE
, FRSTOR
, FLDENV
and F(N)STENV
instructions has different formats in Real Mode and Protected Mode. On 80287, the F(N)SETPM
instruction is required to communicate the real-to-protected mode transition to the FPU. On 80387 and later x87 FPUs, real↔protected mode transitions are communicated automatically to the FPU without the need for any dedicated instructions – therefore, on these FPUs, FNSETPM
executes as a NOP that does not modify any FPU state.FPREM1
instruction differs from the older FPREM
(D9 F8
) instruction in that the quotient Q is rounded to integer with round-to-nearest-even rounding rather than the round-to-zero rounding used by FPREM
. Like FPREM
, FPREM1
always computes an exact result with no roundoff errors. Like FPREM
, it may also perform a partial computation if the quotient is too large, in which case it must be run again.FXSAVE
and FXRSTOR
instructions will save/restore SSE state only on processors that support SSE. Otherwise, they will only save/restore x87 and MMX state.FXSAVE
/FXRSTOR
has a completely different layout than the data structure of the older F(N)SAVE
/FRSTOR
instructions, enabling faster save/restore by avoiding misaligned loads and stores.CR0.EM=1
, FXSAVE(64)
and FXRSTOR(64)
are considered to be x87 instructions and will accordingly produce an #NM (device-not-available) exception. Other than WAIT
, these are the only opcodes outside the D8..DF
ESC opcode space that exhibit this behavior. (All opcodes in D8..DF
will produce #NM if CR0.EM=1
, even for undefined opcodes that would produce #UD otherwise.)x86 also includes discontinued instruction sets which are no longer supported by Intel and AMD, and undocumented instructions which execute but are not officially documented.
Seamless Wikipedia browsing. On steroids.
Every time you click a link to Wikipedia, Wiktionary or Wikiquote in your browser's search results, it will show the modern Wikiwand interface.
Wikiwand extension is a five stars, simple, with minimum permission required to keep your browsing private, safe and transparent.