x86 instruction listings

IMUL BX,12h
IMUL DX,1200h
IMUL CX, DX, 12h
IMUL BX, SI, 1200h
IMUL DI, word ptr [BX+SI], 12h
IMUL SI, word ptr [BP-4], 1200h

Note that since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well.

First argument specifies an 8/16-bit register or memory location.

Second argument specifies which bit to test.

Performs a string addition of integers in packed BCD format (2 BCD digits per byte). DS:SI points to a source integer, ES:DI to a destination integer, and CL provides the number of digits to add. The operation is then: destination <- destination + source

destination <- destination - source

Concatenates its 8-bit argument with the bottom 4 bits of AL to form a 12-bit bitvector, then left-rotates this bitvector by 4 bits, then writes this bitvector back to its argument and the bottom 4 bits of AL.

Perform a bitfield read from memory. DS:SI (DS0:IX in NEC nomenclature) points to memory location to read from, first argument specifies bit-offset to read from, and second argument specifies the number of bits to read minus 1. The result is placed in AX. After the bitfield read, SI and the first argument are updated to point just beyond the just-read bitfield.

Perform a bitfield write to memory. ES:DI (DS1:IY in NEC nomenclature) points to memory location to write to, AX contains data to write, first argument specifies bit-offset to write to, and second argument specifies the number of bits to write minus 1. After the bitfield write, DI and the first argument are updated to point just beyond the just-written bitfield.

67 /r

Used by the NEC 72291 floating-point coprocessor. A listing of the opcodes/instructions supported by the 72291 is available.[4]

Jump to an address picked from the Interrupt Vector Table using the imm8 argument, similar to the INT instruction, but start executing as Intel 8080 code rather than x86 code.

Jump to an address picked from the Interrupt Vector Table using the imm8 argument. Enables a simple memory paging mechanism after reading the IVT but before executing the jump. The paging mechanism uses an on-chip page table with 16Kbyte pages and no access rights checking.[5]

Jump to an address picked from the Interrupt Vector Table using the imm8 argument. Disables paging after reading the IVT but before executing the jump.

The first argument specifies a V25/V35 Special Function Register to test a bit in. The second argument specifies a bit position in that register. The third argument specifies a short branch offset. If the bit was set to 1, then it is cleared and a short branch is taken, else the branch is not taken.

Jump to an address picked from the Interrupt Vector Table using the imm8 argument, and then continue execution with "Software Guard" enabled. The "Software Guard" is an 8-bit Substitution cipher that, during instruction fetch/decode, translates opcode bytes using a 256-entry lookup table stored in an on-chip Mask ROM.

Causes #UD in Real mode and Virtual 8086 Mode - Windows 95 and OS/2 2.x are known to make extensive use of this #UD to use the 63 opcode as a one-byte breakpoint to transition from Virtual 8086 Mode to kernel mode.[12][13]

32-bit variant of LAR instruction is documented to load undefined data into bits 19:16 of destination register on Intel CPUs.

LIDT can relocate the Interrupt Vector Table in Real Mode as well.

LGDT and LIDT are serializing instructions.

LMSW can be used to enter but not leave x86 Protected Mode. On the 80286, it is not possible to leave Protected Mode at all without a CPU reset - on 80386 and later, it is possible to leave Protected Mode, but this requires the use of the 80386-and-later MOV to CR0 instruction.

LMSW is a serializing instruction.

This has been a significant security problem for software-based virtualization, since it enables these instructions to be used by a VM guest to detect that it is running inside a VM.[15][16]

The 16-bit variants of the SGDT and SIDT instructions also show a difference between Intel documentation and actual behavior observed on Intel CPUs: as of Intel SDM revision 076, december 2021, the last 8 bits of the descriptor is documented as being written as 0, however observed behavior is that bits 31:24 of the descriptor table address are written instead.[17]

SLDT and SMSW (but not STR) with a 32-bit register argument are documented to set the top 16 bits of the specified register to an undefined value on Intel CPUs.

On some Intel CPU/microcode combinations from 2019 onwards, the VERW instruction also flushes microarchitectural data buffers. This enables it to be used as part of workarounds for Microarchitectural Data Sampling security vulnerabilities.[18][19]

SHLD and SHRD with 16-bit arguments and a shift-amount greater than 16 produce undefined results. (Actual results differ between different Intel CPUs, with at least three different behaviors known.[20])

Used by software mainly for detection of the buggy[21] B0 stepping of the 80386. Microsoft Windows (v2.01 and later) will attempt to run the XBTS instruction as part of its CPU detection if CPUID is not present, and will refuse to boot if XBTS is found to be working.[22]

0F B0/B1 encodings available on 80486 stepping B and later x86 CPUs.

Instruction atomic only if used with LOCK prefix.

Instruction atomic only if used with LOCK prefix.

Instruction atomic only if used with LOCK prefix.

LOCK CMPXCHG8B with a register operand (which is an invalid encoding) can cause hangs on some Intel Pentium CPUs (Pentium F00F bug).

CMOVcc r32,r/m

The whole 0F 18..1F opcode range was NOP in Pentium Pro. However, except for 0F 1F /0, Intel does not guarantee that these opcodes will remain NOP in future processors, and have indeed assigned some of these opcodes to other instructions in at least some processors.[31]

On the Pentium Pro, the CPUID instruction reports these instructions as available. This is considered incorrect, as the instructions are not officially supported on the Pentium Pro. (Third party testing indicates that the instructions are present but too defective to be usable on the Pentium Pro.[32])

The first 8 bytes are the descriptor, the last two bytes are the selector.[35]

Not present on stepping A of Cx486SLC and Cx486DLC.[36]

Present on Cx486SLC/e[29] and all later Cyrix CPUs.

Present on all Cyrix-derived Geode CPUs.

Uses 0F 7E encoding on Cyrix 486, 5x86, 6x86 and ZFx86.

Uses 0F 38 encoding on Cyrix 6x86MX, MII, MediaGX and Geode.

NatSemi Geode GXm, GXLV, GX1

AMD Geode GX, LX[39]

Produces a #BR exception if bounds directory entry is not valid (which prevents address translation).

When shadow stacks are enabled, return addresses are pushed on both the regular stack and the shadow stack when a function call is made. They are then both popped on return from the function call - if they do not match, then the stack is assumed to be corrupted, and a #CP exception is issued.

The shadow stack is additionally required to be stored in specially marked memory pages which cannot be modified by normal memory store instructions.

When IBT is enabled, an indirect branch (jump, call, return) to any instruction that is not an ENDBR32/64 instruction will cause a #CP exception.

This prefix has the same encoding as the DS: segment override prefix - as of April 2022, Intel documentation does not appear to specify whether this prefix also retains its old segment-override function when used as a no-track prefix, nor does it provide an official mnemonic for this prefix.[47][48] (GNU binutils use "notrack"[49])

${\displaystyle 2^{x}}$

On 8087, only supported for ${\displaystyle 0\leq x\leq {\frac {1}{2}}}$.

On 80387 and later, supported for ${\displaystyle -1\leq x\leq 1}$.

Performing rounding based on rounding control on 80387 and later.

${\displaystyle \arctan {\frac {st(1)}{st(0)}}}$

On 8087, only supported for ${\displaystyle |st(0)|\leq |st(1)|}$. This restriction was removed on the 80387.

May compute a partial remainder, in which case it must be run again (signalled by C2 flag register).

${\displaystyle |x|\leq {\frac {\pi }{4}}}$

On 80387 and later, supported for ${\displaystyle |x|<2^{63}}$

Only supported for ${\displaystyle |x|\leq \left(1-{\sqrt {\frac {1}{2}}}\right)\approx 0.2929}$

${\displaystyle \sin \left(k*st(0)\right)}$

${\displaystyle \cos \left(k*st(0)\right)}$

Due to argument reduction being done with only about 68 bits of precision, ${\displaystyle k}$ is not precisely 1.0, but instead given by

${\displaystyle k={\frac {2^{66}*\pi }{\lfloor 2^{66}*\pi \rfloor }}\approx 1.0000000000000000000012874}$.[50][51] This argument reduction inaccuracy also affects the FPTAN instruction.

or

DB E5[53]

Instruction to signal to the FPU that the main CPU is exiting protected mode, similar to how the FSETPM instruction is used to signal to the FPU that the CPU is entering protected mode.

Different sources provide different encodings for this instruction.

FMUL4X4

The PREFETCHW instruction is also supported on Intel CPUs starting with 65nm Pentium 4,[58] albeit executed as NOP until Broadwell.

SETALC

F7 /1

Unavailable on some 80486 steppings.[66][67]

SAL

(C0..C1) /6

REPNZ STOS

F2 (AA..AB)

INT1

Introduced in the Pentium Pro in 1995, but remained undocumented until March 2006.[30][72][73]

Unavailable on AMD K6, AMD Geode LX, VIA Nehemiah.[75]

On AMD CPUs, 0F 0D with a memory argument is documented as PREFETCH/PREFETCHW since K6-2 - originally as part of 3dnow!, but has been kept in later AMD CPUs even after the rest of 3dnow! was dropped.

Available on Intel CPUs since 65 nm Pentium 4.

UD0

0F FF

Microsoft Windows 95 Setup is known to depend on 0F FF being invalid[80][81] - it is used as a self check to test that its #UD exception handler is working properly.

Other invalid opcodes that are being relied on by commercial software to produce #UD exceptions include FF FF (DIF-2,[82] LaserLok[83]) and C4 C4 ("BOP"[84][85]), however as of January 2022 they are not published as intentionally invalid opcodes.

STOREALL

In some implementations, emulated through BIOS as a halting sequence.[87]

In a forum post at the Vintage Computing Federation, this instruction is explained as SAVEALL. It interacts with ICE mode.

Opcode reused for SYSCALL in AMD K6-2 and later CPUs.

Opcode reused for SYSRET in AMD K6-2 and later CPUs.

UMOV r/m,r

Opcodes reused for SSE instructions in later CPUs.

The NexGen Nx586 CPU uses "hyper code"[95] (x86 code sequences unpacked at boot time and only accessible in a special "hyper mode" operation mode, similar to DEC Alpha's PALcode) for many complicated operations that are implemented with microcode in most other x86 CPUs. The Nx586 provides a large number of undocumented instructions to assist hyper mode operation.

Instruction known to be recognized by MASM 6.13 and 6.14.

Opcode reused for documented PSWAPD instruction from AMD K7 onwards.

64 0F (80..8F) rel16/32

Segment prefixes on conditional branches are accepted but ignored by non-NetBurst CPUs.

Supported by OpenSSL [100] as part of its VIA PadLock support, but not documented by the VIA PadLock Programming Guide.

Listed in a VIA-supplied patch to add support for VIA Nano-specific PadLock instructions to OpenSSL,[101] but not documented by the VIA PadLock Programming Guide.

Unknown operation, may be related to the documented XSTORE (0F A7 C0) instruction.

On at least AMD K6-2, all of the unassigned 3dnow! opcodes (other than the undocumented PF2IW, PI2FW and PSWAPW instructions) execute as equivalents of POR (MMX bitwise-OR instruction).[59]

Available on most AMD x87 FPUs. Unavailable on AMD Geode GX/LX, DM&P Vortex86[106] and NexGen 586PF.[107]

Documented for the Intel 80287[108] but then omitted from later manuals until the October 2017 update of the Intel SDM.[109]

DE D0+i

DF C8+i