X86 instruction listings

Template:Short description Template:Lowercase title Template:X86 instruction listings The x86 instruction set refers to the set of instructions that x86-compatible microprocessors support. The instructions are usually part of an executable program, often stored as a computer file and executed on the processor.

The x86 instruction set has been extended several times, introducing wider registers and datatypes as well as new functionality.<ref name=":0">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

x86 integer instructions

{{#invoke:Labelled list hatnote|labelledList|Main article|Main articles|Main page|Main pages}} Below is the full 8086/8088 instruction set of Intel (81 instructions total).<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> These instructions are also available in 32-bit mode, in which they operate on 32-bit registers (eax, ebx, etc.) and values instead of their 16-bit (ax, bx, etc.) counterparts. The updated instruction set is grouped according to architecture (i186, i286, i386, i486, i586/i686) and is referred to as (32-bit) x86 and (64-bit) x86-64 (also known as AMD64).

Original 8086/8088 instructions

This is the original instruction set. In the 'Notes' column, r means register, m means memory address and imm means immediate (i.e. a value).

Original 8086/8088 instruction set

In- struc- tion	Meaning	Notes	Opcode
Template:Mono	ASCII adjust AL after addition	used with unpacked binary-coded decimal	Template:Mono
Template:Mono	ASCII adjust AX before division	8086/8088 datasheet documents only base 10 version of the AAD instruction (opcode Template:Mono Template:Mono), but any other base will work. Later Intel's documentation has the generic form too. NEC V20 and V30 (and possibly other NEC V-series CPUs) always use base 10, and ignore the argument, causing a number of incompatibilities	Template:Mono
Template:Mono	ASCII adjust AX after multiplication	Only base 10 version (Operand is 0xA) is documented, see notes for AAD	Template:Mono
Template:Mono	ASCII adjust AL after subtraction		Template:Mono
Template:Mono	Add with carry	(1) r += (r/m/imm+CF); (2) m += (r/imm+CF);	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Add	(1) r += r/m/imm; (2) m += r/imm;	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Logical AND	(1) r &= r/m/imm; (2) m &= r/imm;	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Call procedure	<syntaxhighlight lang="nasm" class="" style="" inline="1">push eip; eip points to the instruction directly after the call</syntaxhighlight>	Template:Mono, Template:Mono, Template:Mono, Template:Mono
Template:Mono	Convert byte to word	AX = AL ; sign extended	Template:Mono
Template:Mono	Clear carry flag	CF = 0;	Template:Mono
Template:Mono	Clear direction flag	DF = 0;	Template:Mono
Template:Mono	Clear interrupt flag	IF = 0;	Template:Mono
Template:Mono	Complement carry flag	CF = !CF;	Template:Mono
Template:Mono	Compare operands	(1) r - r/m/imm; (2) m - r/imm;	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Compare bytes in memory. May be used with a Template:Mono or Template:Mono prefix to test and repeat the instruction Template:Mono times.	Template:Sxhl	Template:Mono
Template:Mono	Compare words. May be used with a Template:Mono or Template:Mono prefix to test and repeat the instruction Template:Mono times.	Template:Sxhl	Template:Mono
Template:Mono	Convert word to doubleword		Template:Mono
Template:Mono	Decimal adjust AL after addition	(used with packed binary-coded decimal)	Template:Mono
Template:Mono	Decimal adjust AL after subtraction		Template:Mono
Template:Mono	Decrement by 1		Template:Mono...Template:Mono, Template:Mono, Template:Mono
Template:Mono	Unsigned divide	(1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder	Template:Mono, Template:Mono
Template:Mono	Used with floating-point unit		Template:Mono..Template:Mono
Template:Mono	Enter halt state		Template:Mono
Template:Mono	Signed divide	(1) AX = DX:AX / r/m; resulting DX = remainder (2) AL = AX / r/m; resulting AH = remainder	Template:Mono, Template:Mono
Template:Mono	Signed multiply in One-operand form	(1) DX:AX = AX * r/m; (2) AX = AL * r/m	Template:Mono, Template:Mono
Template:Mono	Input from port	(1) AL = port[imm]; (2) AL = port[DX]; (3) AX = port[imm]; (4) AX = port[DX];	Template:Mono, Template:Mono, Template:Mono, Template:Mono
Template:Mono	Increment by 1		Template:Mono...Template:Mono, Template:Mono, Template:Mono
Template:Mono	Call to interrupt		Template:Mono, Template:Mono
Template:Mono	Call to interrupt if overflow		Template:Mono
Template:Mono	Return from interrupt		Template:Mono
Template:Mono	Jump if condition	Template:Mono<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}.</ref> || Template:Mono...Template:Mono
Template:Mono	Jump if CX is zero	Template:Mono for ECX instead of CX in 32 bit mode (same opcode).	Template:Mono
Template:Mono	Jump		Template:Mono...Template:Mono, Template:Mono, Template:Mono
Template:Mono	Load FLAGS into AH register		Template:Mono
Template:Mono	Load DS:r with far pointer	r = m; DS = 2 + m;	Template:Mono
Template:Mono	Load Effective Address		Template:Mono
Template:Mono	Load ES:r with far pointer	r = m; ES = 2 + m;	Template:Mono
Template:Mono	Assert BUS LOCK# signal	(for multiprocessing)	Template:Mono
Template:Mono	Load string byte. May be used with a Template:Mono prefix to repeat the instruction Template:Mono times.	<syntaxhighlight lang="c" class="" style="" inline="1">if (DF==0) AL = *SI++; else AL = *SI--;</syntaxhighlight>	Template:Mono
Template:Mono	Load string word. May be used with a Template:Mono prefix to repeat the instruction Template:Mono times.	<syntaxhighlight lang="c" class="" style="" inline="1">if (DF==0) AX = *SI++; else AX = *SI--;</syntaxhighlight>	Template:Mono
Template:Mono/ Template:Mono	Loop control	(Template:Mono) <syntaxhighlight lang="c" class="" style="" inline="1">if (x && --CX) goto lbl;</syntaxhighlight>	Template:Mono...Template:Mono
Template:Mono	Move	(1) r = r/m/imm; (2) m = r/imm; (3) r/m = sreg; (4) sreg = r/m;	Template:Mono...Template:Mono, Template:Mono, Template:Mono
Template:Mono	Move byte from string to string. May be used with a Template:Mono prefix to repeat the instruction Template:Mono times.	Template:Sxhl.	Template:Mono
Template:Mono	Move word from string to string. May be used with a Template:Mono prefix to repeat the instruction Template:Mono times.	Template:Sxhl	Template:Mono
Template:Mono	Unsigned multiply	(1) DX:AX = AX * r/m; (2) AX = AL * r/m;	Template:Mono, Template:Mono
Template:Mono	Two's complement negation	<syntaxhighlight lang="c" class="" style="" inline="1">r/m = 0 – r/m;</syntaxhighlight>	Template:Mono...Template:Mono
Template:Mono	No operation	opcode equivalent to <syntaxhighlight lang="text" class="" style="" inline="1">XCHG EAX, EAX</syntaxhighlight>	Template:Mono
Template:Mono	Negate the operand, logical NOT	<syntaxhighlight lang="c" class="" style="" inline="1">r/m ^= -1;</syntaxhighlight>	Template:Mono...Template:Mono
Template:Mono	Logical OR	(1) r ∣= r/m/imm; (2) m ∣= r/imm;	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Output to port	(1) port[imm] = AL; (2) port[DX] = AL; (3) port[imm] = AX; (4) port[DX] = AX;	Template:Mono, Template:Mono, Template:Mono, Template:Mono
Template:Mono	Pop data from stack	r/m/sreg = *SP++;	Template:Mono, Template:Mono, Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Pop FLAGS register from stack	FLAGS = *SP++;	Template:Mono
Template:Mono	Push data onto stack	<syntaxhighlight lang="c" class="" style="" inline="1">*--SP = r/m/sreg;</syntaxhighlight>	Template:Mono, Template:Mono, Template:Mono, Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Push FLAGS onto stack	<syntaxhighlight lang="c" class="" style="" inline="1">*--SP = FLAGS;</syntaxhighlight>	Template:Mono
Template:Mono	Rotate left (with carry)		Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Rotate right (with carry)		Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Repeat MOVS/STOS/CMPS/LODS/SCAS	(Template:Mono)	Template:Mono, Template:Mono
Template:Mono	Return from procedure	Not a real instruction. The assembler will translate these to a RETN or a RETF depending on the memory model of the target system.
Template:Mono	Return from near procedure		Template:Mono, Template:Mono
Template:Mono	Return from far procedure		Template:Mono, Template:Mono
Template:Mono	Rotate left		Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Rotate right		Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Store AH into FLAGS		Template:Mono
Template:Mono	Shift Arithmetically left (signed shift left)	(1) r/m <<= 1; (2) r/m <<= CL;	Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Shift Arithmetically right (signed shift right)	(1) (signed) r/m >>= 1; (2) (signed) r/m >>= CL;	Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Subtraction with borrow	(1) r -= (r/m/imm+CF); (2) m -= (r/imm+CF); alternative 1-byte encoding of Template:Nowrap is available via undocumented SALC instruction	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Compare byte string. May be used with a Template:Mono or Template:Mono prefix to test and repeat the instruction Template:Mono times.	<syntaxhighlight lang="c" class="" style="" inline="1">if (DF==0) AL - *ES:DI++; else AL - *ES:DI--;</syntaxhighlight>	Template:Mono
Template:Mono	Compare word string. May be used with a Template:Mono or Template:Mono prefix to test and repeat the instruction Template:Mono times.	<syntaxhighlight lang="c" class="" style="" inline="1">if (DF==0) AX - *ES:DI++; else AX - *ES:DI--;</syntaxhighlight>	Template:Mono
Template:Mono	Shift left (unsigned shift left)	Same opcode as SAL, since logical left shifts are equal to arithmetical left shifts.	Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Shift right (unsigned shift right)		Template:Mono...Template:Mono (186+), Template:Mono...Template:Mono
Template:Mono	Set carry flag	CF = 1;	Template:Mono
Template:Mono	Set direction flag	DF = 1;	Template:Mono
Template:Mono	Set interrupt flag	IF = 1;	Template:Mono
Template:Mono	Store byte in string. May be used with a Template:Mono prefix to repeat the instruction Template:Mono times.	<syntaxhighlight lang="c" class="" style="" inline="1">if (DF==0) *ES:DI++ = AL; else *ES:DI-- = AL;</syntaxhighlight>	Template:Mono
Template:Mono	Store word in string. May be used with a Template:Mono prefix to repeat the instruction Template:Mono times.	<syntaxhighlight lang="c" class="" style="" inline="1">if (DF==0) *ES:DI++ = AX; else *ES:DI-- = AX;</syntaxhighlight>	Template:Mono
Template:Mono	Subtraction	(1) r -= r/m/imm; (2) m -= r/imm;	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono
Template:Mono	Logical compare (AND)	(1) r & r/m/imm; (2) m & r/imm;	Template:Mono, Template:Mono, Template:Mono, Template:Mono, Template:Mono, Template:Mono
Template:Mono	Wait until not busy	Waits until BUSY# pin is inactive (used with floating-point unit)	Template:Mono
Template:Mono	Exchange data	<syntaxhighlight lang="asm" class="" style="" inline="1">r :=: r/m;</syntaxhighlight> A spinlock typically uses xchg as an atomic operation. (coma bug).	Template:Mono, Template:Mono, Template:Mono...Template:Mono
Template:Mono	Table look-up translation	behaves like <syntaxhighlight lang="text" class="" style="" inline="1">MOV AL, [BX+AL]</syntaxhighlight>	Template:Mono
Template:Mono	Exclusive OR	(1) r ^+= r/m/imm; (2) m ^= r/imm;	Template:Mono...Template:Mono, Template:Mono...Template:Mono, Template:Mono

Added in specific processors

Added with 80186/80188

Instruction	Opcode	Meaning	Notes
Template:Mono	62 /r	Check array index against bounds	raises software interrupt 5 if test fails
Template:Mono	C8 iw ib	Enter stack frame	Modifies stack for entry to procedure for high level language. Takes two operands: the amount of storage to be allocated on the stack and the nesting level of the procedure.
Template:Mono	6C	Input from port to string. May be used with a REP prefix to repeat the instruction CX times.	equivalent to: <syntaxhighlight lang="nasm"> IN AL, DX MOV ES:[DI], AL INC DI ; adjust DI according to operand size and DF </syntaxhighlight>
	6D
Template:Mono	C9	Leave stack frame	Releases the local stack storage created by the previous ENTER instruction.
Template:Mono	6E	Output string to port. May be used with a REP prefix to repeat the instruction CX times.	equivalent to: <syntaxhighlight lang="nasm"> MOV AL, DS:[SI] OUT DX, AL INC SI ; adjust SI according to operand size and DF </syntaxhighlight>
	6F
Template:Mono	61	Pop all general purpose registers from stack	equivalent to: <syntaxhighlight lang="nasm">POP DI POP SI POP BP POP AX ; no POP SP here, all it does is ADD SP, 2 (since AX will be overwritten later) POP BX POP DX POP CX POP AX</syntaxhighlight>
Template:Mono	60	Push all general purpose registers onto stack	equivalent to: <syntaxhighlight lang="nasm">PUSH AX PUSH CX PUSH DX PUSH BX PUSH SP ; The value stored is the initial SP value PUSH BP PUSH SI PUSH DI</syntaxhighlight>
Template:Mono immediate	6A ib	Push an immediate byte/word value onto the stack	example: <syntaxhighlight lang="nasm">PUSH 12h PUSH 1200h</syntaxhighlight>
	68 iw
Template:Mono immediate	6B /r ib	Signed and unsigned multiplication of immediate byte/word value	example: <syntaxhighlight lang="nasm">IMUL BX,12h IMUL DX,1200h IMUL CX, DX, 12h IMUL BX, SI, 1200h IMUL DI, word ptr [BX+SI], 12h IMUL SI, word ptr [BP-4], 1200h </syntaxhighlight> Note that since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well.
	69 /r iw
Template:Mono immediate	C0	Rotate/shift bits with an immediate value greater than 1	example: <syntaxhighlight lang="nasm">ROL AX,3 SHR BL,3</syntaxhighlight>
	C1

Added with 80286

The new instructions added in 80286 add support for x86 protected mode. Some but not all of the instructions are available in real mode as well.

Instruction	Opcode	Instruction description	Real mode	Ring
LGDT m16&32Template:Efn	0F 01 /2	Load GDTR (Global Descriptor Table Register) from memory.Template:Efn	rowspan="4" Template:Yes	rowspan="6" Template:No
Template:Nowrap	0F 01 /3	Load IDTR (Interrupt Descriptor Table Register) from memory.Template:Efn The IDTR controls not just the address/size of the IDT (interrupt Descriptor Table) in protected mode, but the IVT (Interrupt Vector Table) in real mode as well.
LMSW r/m16	0F 01 /6	Load MSW (Machine Status Word) from 16-bit register or memory.Template:EfnTemplate:Efn
CLTS	0F 06	Clear task-switched flag in the MSW.
LLDT r/m16	0F 00 /2	Load LDTR (Local Descriptor Table Register) from 16-bit register or memory.Template:Efn	rowspan="2" Template:No
LTR r/m16	0F 00 /3	Load TR (Task Register) from 16-bit register or memory.Template:Efn The TSS (Task State Segment) specified by the 16-bit argument is marked busy, but a task switch is not done.
Template:Nowrap	0F 01 /0	Store GDTR to memory.	rowspan="3" Template:Yes	rowspan="5" Template:Yes2
SIDT m16&32Template:Efn	0F 01 /1	Store IDTR to memory.
SMSW r/m16	0F 01 /4	Store MSW to register or 16-bit memory.Template:Efn
SLDT r/m16	0F 00 /0	Store LDTR to register or 16-bit memory.Template:Efn	rowspan="2" Template:No
STR r/m16	0F 00 /1	Store TR to register or 16-bit memory.Template:Efn
Template:Nowrap	63 /rTemplate:Efn	Adjust RPL (Requested Privilege Level) field of selector. The operation performed is: if (dst & 3) < (src & 3) then dst = (dst & 0xFFFC) | (src & 3) eflags.zf = 1 else eflags.zf = 0	Template:No	rowspan="5" Template:Yes
LAR r,r/m16	0F 02 /r	Load access rights byte from the specified segment descriptor. Reads bytes 4-7 of segment descriptor, bitwise-ANDs it with 0x00FxFF00,Template:Efn then stores the bottom 16/32 bits of the result in destination register. Sets EFLAGS.ZF=1 if the descriptor could be loaded, ZF=0 otherwise.Template:Efn	rowspan="4" Template:No
LSL r,r/m16	0F 03 /r	Load segment limit from the specified segment descriptor. Sets ZF=1 if the descriptor could be loaded, ZF=0 otherwise.Template:Efn
VERR r/m16	Template:Nowrap	Verify a segment for reading. Sets ZF=1 if segment can be read, ZF=0 otherwise.
VERW r/m16	0F 00 /5	Verify a segment for writing. Sets ZF=1 if segment can be written, ZF=0 otherwise.Template:Efn
Template:Unofficial2	Template:Unofficial2	Load all CPU registers from a 102-byte data structure starting at physical address 800h, including "hidden" part of segment descriptor registers.	rowspan="2" Template:Yes	rowspan="2" Template:No
Template:Unofficial2	Template:Unofficial2	Store all CPU registers to a 102-byte data structure starting at physical address 800h, then shut down CPU.

Added with 80386

The 80386 added support for 32-bit operation to the x86 instruction set. This was done by widening the general-purpose registers to 32 bits and introducing the concepts of OperandSize and AddressSize – most instruction forms that would previously take 16-bit data arguments were given the ability to take 32-bit arguments by setting their OperandSize to 32 bits, and instructions that could take 16-bit address arguments were given the ability to take 32-bit address arguments by setting their AddressSize to 32 bits. (Instruction forms that work on 8-bit data continue to be 8-bit regardless of OperandSize. Using a data size of 16 bits will cause only the bottom 16 bits of the 32-bit general-purpose registers to be modified – the top 16 bits are left unchanged.)

The default OperandSize and AddressSize to use for each instruction is given by the D bit of the segment descriptor of the current code segment - D=0 makes both 16-bit, D=1 makes both 32-bit. Additionally, they can be overridden on a per-instruction basis with two new instruction prefixes that were introduced in the 80386:

• 66h: OperandSize override. Will change OperandSize from 16-bit to 32-bit if CS.D=0, or from 32-bit to 16-bit if CS.D=1.
• 67h: AddressSize override. Will change AddressSize from 16-bit to 32-bit if CS.D=0, or from 32-bit to 16-bit if CS.D=1.

The 80386 also introduced the two new segment registers FS and GS as well as the x86 control, debug and test registers.

The new instructions introduced in the 80386 can broadly be subdivided into two classes:

• Pre-existing opcodes that needed new mnemonics for their 32-bit OperandSize variants (e.g. CWDE, LODSD)
• New opcodes that introduced new functionality (e.g. SHLD, SETcc)

For instruction forms where the operand size can be inferred from the instruction's arguments (e.g. ADD EAX,EBX can be inferred to have a 32-bit OperandSize due to its use of EAX as an argument), new instruction mnemonics are not needed and not provided.

80386: new instruction mnemonics for 32-bit variants of older opcodes

Type	Instruction mnemonic	Opcode	Description	Mnemonic for older 16-bit variant	Ring
String instructionsTemplate:EfnTemplate:Efn	LODSD	AD	Load string doubleword: EAX := DS:[rSI±±]	LODSW	rowspan="5" Template:Yes
	STOSD	AB	Store string doubleword: ES:[rDI±±] := EAX	STOSW
	MOVSD	A5	Move string doubleword: ES:[rDI±±] := DS:[rSI±±]	MOVSW
	CMPSD	A7	Compare string doubleword: temp1 := DS:[rSI±±] temp2 := ES:[rDI±±] CMP temp1, temp2 /* 32-bit compare and set EFLAGS */	CMPSW
	SCASD	AF	Scan string doubleword: temp1 := ES:[rDI±±] CMP EAX, temp1 /* 32-bit compare and set EFLAGS */	SCASW
	INSD	6D	Input string from doubleword I/O port:ES:[rDI±±] := port[DX]Template:Efn	INSW	rowspan="2" Template:No2
	OUTSD	6F	Output string to doubleword I/O port:port[DX] := DS:[rSI±±]	OUTSW
Other	CWDE	98	Sign-extend 16-bit value in AX to 32-bit value in EAXTemplate:Efn	CBW	rowspan="5" Template:Yes
	CDQ	99	Sign-extend 32-bit value in EAX to 64-bit value in EDX:EAX. Mainly used to prepare a dividend for the 32-bit IDIV (signed divide) instruction.	CWD
	Template:Nowrap	Template:NowrapTemplate:Efn	Jump if ECX is zero	JCXZ
	PUSHAD	60	Push all 32-bit registers onto stackTemplate:Efn	PUSHA
	POPAD	61	Pop all 32-bit general-purpose registers off stackTemplate:Efn	POPA
	PUSHFD	9C	Push 32-bit EFLAGS register onto stack	PUSHF	rowspan="3" Template:Yes2
	POPFD	9D	Pop 32-bit EFLAGS register off stack	POPF
	IRETD	CF	32-bit interrupt return. Differs from the older 16-bit IRET instruction in that it will pop interrupt return items (EIP,CS,EFLAGS; also ESPTemplate:Efn and SS if there is a CPL change; and also ES,DS,FS,GS if returning to virtual 8086 mode) off the stack as 32-bit items instead of 16-bit items. Should be used to return from interrupts when the interrupt handler was entered through a 32-bit IDT interrupt/trap gate. Instruction is serializing.	IRET

80386: new opcodes introduced

Instruction mnemonics	Opcode	Description	Ring
BT r/m, r	0F A3 /r	Bit Test.Template:Efn Second operand specifies which bit of the first operand to test. The bit to test is copied to EFLAGS.CF.	rowspan="8" Template:Yes
BT r/m, imm8	0F BA /4 ib
BTS r/m, r	0F AB /r	Bit Test-and-set.Template:EfnTemplate:Efn Second operand specifies which bit of the first operand to test and set.
BTS r/m, imm8	0F BA /5 ib
BTR r/m, r	0F B3 /r	Bit Test and Reset.Template:EfnTemplate:Efn Second operand specifies which bit of the first operand to test and clear.
BTR r/m, imm8	0F BA /6 ib
BTC r/m, r	0F BB /r	Bit Test and Complement.Template:EfnTemplate:Efn Second operand specifies which bit of the first operand to test and toggle.
BTC r/m, imm8	0F BA /7 ib
BSF r, r/m	Template:Nowrap	Bit scan forward. Returns bit index of lowest set bit in input.Template:Efn	rowspan="6" Template:Yes
BSR r, r/m	Template:Nowrap	Bit scan reverse. Returns bit index of highest set bit in input.Template:Efn
SHLD r/m, r, imm8	0F A4 /r ib	Shift Left Double. The operation of SHLD arg1,arg2,shamt is: arg1 := (arg1<<shamt) | (arg2>>(operand_size - shamt))Template:Efn
SHLD r/m, r, CL	0F A5 /r
Template:Nowrap	Template:Nowrap	Shift Right Double. The operation of SHRD arg1,arg2,shamt is: arg1 := (arg1>>shamt) | (arg2<<(operand_size - shamt))Template:Efn
SHRD r/m, r, CL	0F AD /r
MOVZX reg, r/m8	0F B6 /r	Move from 8/16-bit source to 16/32-bit register with zero-extension.	rowspan="7" Template:Yes
MOVZX reg, r/m16	0F B7 /r
MOVSX reg, r/m8	0F BE /r	Move from 8/16-bit source to 16/32/64-bit register with sign-extension.
MOVSX reg, r/m16	0F BF /r
SETcc r/m8	Template:NowrapTemplate:EfnTemplate:Efn	Set byte to 1 if condition is satisfied, 0 otherwise.
Jcc rel16 Jcc rel32	0F 8x cw 0F 8x cdTemplate:Efn	Conditional jump near. Differs from older variants of conditional jumps in that they accept a 16/32-bit offset rather than just an 8-bit offset.
IMUL r, r/m	0F AF /r	Two-operand non-widening integer multiply.
FS:	64	Segment-override prefixes for FS and GS segment registers.	rowspan="9" Template:Yes
GS:	65
PUSH FS	0F A0	Push/pop FS and GS segment registers.
POP FS	0F A1
PUSH GS	0F A8
POP GS	0F A9
LFS r16, m16&16 LFS r32, m32&16	0F B4 /r	Load far pointer from memory. Offset part is stored in destination register argument, segment part in FS/GS/SS segment register as indicated by the instruction mnemonic.Template:Efn
LGS r16, m16&16 Template:Nowrap	0F B5 /r
LSS r16, m16&16 Template:Nowrap	0F B2 /r
MOV reg,CRx	0F 20 /rTemplate:Efn	Move from control register to general register.Template:Efn	rowspan="6" Template:No
MOV CRx,reg	0F 22 /rTemplate:Efn	Move from general register to control register.Template:Efn Moves to the CR3 control register are serializing and will flush the TLB.Template:Efn On Pentium and later processors, moves to the CR0 and CR4 control registers are also serializing.Template:Efn
MOV reg,DRx	0F 21 /rTemplate:Efn	Move from x86 debug register to general register.Template:Efn
MOV DRx,reg	0F 23 /rTemplate:Efn	Move from general register to x86 debug register.Template:Efn On Pentium and later processors, moves to the DR0-DR7 debug registers are serializing.
MOV reg,TRx	0F 24 /rTemplate:Efn	Move from x86 test register to general register.Template:Efn
MOV TRx,reg	0F 26 /rTemplate:Efn	Move from general register to x86 test register.Template:Efn
Template:Unofficial2	Template:Unofficial2	In-circuit emulation breakpoint. Performs software interrupt #1 if executed when not using in-circuit emulation.Template:Efn	rowspan="7" Template:Yes
Template:Unofficial2	Template:Unofficial2	User Move – perform data moves that can access user memory while in In-circuit emulation HALT mode. Performs same operation as MOV if executed when not doing in-circuit emulation.Template:Efn
Template:Unofficial2	Template:Unofficial2
Template:Unofficial2	Template:Unofficial2
Template:Unofficial2	Template:Unofficial2
Template:Unofficial2	Template:Unofficial2	Bitfield extract (early 386 only).Template:EfnTemplate:Efn
Template:Unofficial2	Template:Unofficial2	Bitfield insert (early 386 only).Template:EfnTemplate:Efn
Template:Unofficial2	Template:Unofficial2	Load all CPU registers from a 296-byte data structure starting at ES:EDI, including "hidden" part of segment descriptor registers.	Template:No

Added with 80486

Instruction	Opcode	Description	Ring
BSWAP r32	Template:Nowrap	Byte Order Swap. Usually used to convert between big-endian and little-endian data representations. For 32-bit registers, the operation performed is: r = (r << 24) | ((r << 8) & 0x00FF0000) | ((r >> 8) & 0x0000FF00) | (r >> 24); Using BSWAP with a 16-bit register argument produces an undefined result.Template:Efn	rowspan="5" Template:Yes
CMPXCHG r/m8,r8	Template:Nowrap	Compare and Exchange. If accumulator (AL/AX/EAX/RAX) compares equal to first operand,Template:Efn then EFLAGS.ZF is set to 1 and the first operand is overwritten with the second operand. Otherwise, EFLAGS.ZF is set to 0, and first operand is copied into the accumulator. Instruction atomic only if used with LOCK prefix.
Template:Nowrap Template:Nowrap	Template:Nowrap
XADD r/m,r8	Template:Nowrap	eXchange and ADD. Exchanges the first operand with the second operand, then stores the sum of the two values into the destination operand. Instruction atomic only if used with LOCK prefix.
XADD r/m,r16 XADD r/m,r32	0F C1 /r
INVLPG m8	Template:Nowrap	Invalidate the TLB entries that would be used for the 1-byte memory operand.Template:Efn Instruction is serializing.	rowspan="3" Template:No
INVD	0F 08	Invalidate Internal Caches.Template:Efn Modified data in the cache are not written back to memory, potentially causing data loss.Template:Efn
WBINVD	Template:Nowrap	Write Back and Invalidate Cache.Template:Efn Writes back all modified cache lines in the processor's internal cache to main memory and invalidates the internal caches.

Added in P5/P6-class processors

Integer/system instructions that were not present in the basic 80486 instruction set, but were added in various x86 processors prior to the introduction of SSE. (Discontinued instructions are not included.)

Instruction	Opcode	Description	Ring	Added in
RDMSR	0F 32	Read Model-specific register. The MSR to read is specified in ECX. The value of the MSR is then returned as a 64-bit value in EDX:EAX.Template:Efn	rowspan="2" Template:No	IBM 386SLC,<ref>Frank van Gilluwe, "The Undocumented PC, second edition", 1997, Template:ISBN, page 55</ref> Intel Pentium, AMD K5, Template:Nowrap IDT WinChip C6, Transmeta Crusoe, DM&P Vortex86DX3
WRMSR	0F 30	Write Model-specific register. The MSR to write is specified in ECX, and the data to write is given in EDX:EAX.Template:Efn Instruction is, with some exceptions, serializing.Template:Efn
citation	CitationClass=web }}</ref>	0F AA	Resume from System Management Mode. Instruction is serializing.	Template:N/a	Template:Nowrap Intel Pentium, AMD 5x86, Cyrix 486SLC/e,<ref name="cx486slce">Cyrix 486SLC/e Data Sheet (1992), section 2.6.4</ref> IDT WinChip C6, Transmeta Crusoe, Rise mP6
CPUID	0F A2	CPU Identification and feature information. Takes as input a CPUID leaf index in EAX and, depending on leaf, a sub-index in ECX. Result is returned in EAX,EBX,ECX,EDX.Template:Efn Instruction is serializing, and causes a mandatory #VMEXIT under virtualization. Support for CPUID can be checked by toggling bit 21 of EFLAGS (EFLAGS.ID) – if this bit can be toggled, CPUID is present.	Template:Yes2	Intel Pentium,Template:Efn AMD 5x86,Template:Efn Cyrix 5x86,Template:Efn IDT WinChip C6, Transmeta Crusoe, Rise mP6, NexGen Nx586,Template:Efn UMC Green CPU
Template:Nowrap	Template:Nowrap	Compare and Exchange 8 bytes. Compares EDX:EAX with m64. If equal, set ZFTemplate:Efn and store ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX. Instruction atomic only if used with LOCK prefix.Template:Efn	Template:Yes	Intel Pentium, AMD K5, Cyrix Template:Nowrap IDT WinChip C6,Template:Efn Transmeta Crusoe,Template:Efn Rise mP6Template:Efn
RDTSC	0F 31	Read 64-bit Time Stamp Counter (TSC) into EDX:EAX.Template:EfnTemplate:Efn In early processors, the TSC was a cycle counter, incrementing by 1 for each clock cycle (which could cause its rate to vary on processors that could change clock speed at runtime) – in later processors, it increments at a fixed rate that doesn't necessarily match the CPU clock speed.Template:Efn	Template:Yes2	Intel Pentium, AMD K5, Cyrix Template:Nowrap IDT WinChip C6, Transmeta Crusoe, Rise mP6
RDPMC	0F 33	Read Performance Monitoring Counter. The counter to read is specified by ECX and its value is returned in EDX:EAX.Template:EfnTemplate:Efn	Template:Yes2	Template:Nowrap Intel Pentium Pro, AMD K7, Cyrix 6x86MX, IDT WinChip C6, AMD Geode LX, VIA NanoTemplate:Efn
Template:Nowrap	Template:NowrapTemplate:Efn	Conditional move to register. The source operand may be either register or memory.Template:Efn	Template:Yes	Intel Pentium Pro, AMD K7, Template:Nowrap Transmeta Crusoe, VIA C3 "Nehemiah",Template:Efn DM&P Vortex86DX3
NOP r/m, NOPL r/m	Template:NowrapTemplate:Efn	Official long NOP. Other than AMD K7/K8, broadly unsupported in non-Intel processors released before 2005.Template:Efn<ref>JookWiki, "nopl", sep 24, 2022 – provides a lengthy account of the history of the long NOP and the issues around it. Archived on oct 28, 2022.</ref>	Template:Yes	Intel Pentium Pro,Template:Efn Template:Nowrap VIA C7<ref>Debian bug report logs, -686 build uses long noops, that are unsupported by Transmeta Crusoe, immediate crash on boot, see messages 148 and 158 for NOPL on VIA C7. Archived on 1 Aug 2019</ref>
UD2,Template:Efn UD2ATemplate:Efn	0F 0B	Undefined Instructions – will generate an invalid opcode (#UD) exception in all operating modes.Template:Efn These instructions are provided for software testing to explicitly generate invalid opcodes. The opcodes for these instructions are reserved for this purpose.	rowspan="3" Template:Yes	(80186),Template:Efn Intel Pentium<ref>Intel, Pentium® Processor Family Developer's Manual Volume 3, 1995. order no. 241430-004, appendix A, page 943 – reserves the opcodes Template:Nowrap and Template:Nowrap.</ref>
UD1 reg,r/m,Template:Efn Template:Nowrap	0F B9, 0F B9 /rTemplate:Efn
OIO, UD0, UD0 reg,r/mTemplate:Efn	0F FF, 0F FF /rTemplate:Efn		(80186),Template:Efn Cyrix 6x86,<ref name="cyrix_oio">Cyrix, 6x86 processor data book, 1996, order no. 94175-01, table 6-20, page 209 – uses the mnemonic OIO ("Official invalid opcode") for the Template:Nowrap opcode.</ref> AMD K5<ref>AMD, AMD-K5 Processor Technical Reference Manual, Nov 1996, order no. 18524C/0, section 3.3.7, page 90 – reserves the Template:Nowrap opcode without assigning it a mnemonic.</ref>
SYSCALL	0F 05	Fast System call.	Template:Yes	AMD K6,Template:Efn x86-64Template:EfnTemplate:Efn
SYSRET	0F 07Template:Efn	Fast Return from System Call. Designed to be used together with SYSCALL.	Template:No
SYSENTER	0F 34	Fast System call.	Template:Yes	Intel Pentium II,Template:Efn AMD K7,<ref>AMD, Athlon Processor x86 Code Optimization Guide, publication no. 22007, rev K, feb 2002, appendix F, page 284. Archived on 13 Apr 2017.</ref>Template:Efn Transmeta Crusoe,Template:Efn Template:Nowrap VIA C3 "Nehemiah",Template:Efn DM&P Vortex86DX3
SYSEXIT	0F 35Template:Efn	Fast Return from System Call. Designed to be used together with SYSENTER.	Template:No

Added as instruction set extensions

Added with x86-64

These instructions can only be encoded in 64 bit mode. They fall in four groups:

• original instructions that reuse existing opcodes for a different purpose (MOVSXD replacing ARPL)
• original instructions with new opcodes (SWAPGS)
• existing instructions extended to a 64 bit address size (JRCXZ)
• existing instructions extended to a 64 bit operand size (remaining instructions)

Most instructions with a 64 bit operand size encode this using a REX.W prefix; in the absence of the REX.W prefix, the corresponding instruction with 32 bit operand size is encoded. This mechanism also applies to most other instructions with 32 bit operand size. These are not listed here as they do not gain a new mnemonic in Intel syntax when used with a 64 bit operand size.

Instruction	Encoding	Meaning	Ring
CDQE	REX.W 98	Sign extend EAX into RAX	rowspan="13" Template:Yes
CQO	REX.W 99	Sign extend RAX into RDX:RAX
CMPSQ	REX.W A7	CoMPare String Quadword
Template:NowrapTemplate:EfnTemplate:Efn	Template:Nowrap	CoMPare and eXCHanGe 16 Bytes. Atomic only if used with LOCK prefix.
IRETQ	REX.W CF	64-bit Return from Interrupt
JRCXZ rel8	E3 cb	Jump if RCX is zero
LODSQ	REX.W AD	LoaD String Quadword
Template:Nowrap	REX.W 63 /rTemplate:Efn	MOV with Sign Extend 32-bit to 64-bit
MOVSQ	REX.W A5	Move String Quadword
POPFQ	9D	POP RFLAGS Register
PUSHFQ	9C	PUSH RFLAGS Register
SCASQ	REX.W AF	SCAn String Quadword
STOSQ	REX.W AB	STOre String Quadword
SWAPGS	0F 01 F8	Exchange GS base with KernelGSBase MSR	Template:No

Bit manipulation extensions

{{#invoke:Labelled list hatnote|labelledList|Main article|Main articles|Main page|Main pages}}

Bit manipulation instructions. For all of the VEX-encoded instructions defined by BMI1 and BMI2, the operand size may be 32 or 64 bits, controlled by the VEX.W bit – none of these instructions are available in 16-bit variants. The VEX-encoded instructions are not available in Real Mode and Virtual-8086 mode - other than that, the bit manipulation instructions are available in all operating modes on supported CPUs.

Bit Manipulation Extension	Instruction mnemonics	Opcode	Instruction description	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	POPCNT r16,r/m16 Template:Nowrap	F3 0F B8 /r	Population Count. Counts the number of bits that are set to 1 in its source argument.	K10, Bobcat, Haswell, ZhangJiang, Gracemont
	POPCNT r64,r/m64	F3 REX.W 0F B8 /r
	LZCNT r16,r/m16 LZCNT r32,r/m32	F3 0F BD /r	Count Leading zeroes.Template:Efn If source operand is all-0s, then LZCNT will return operand size in bits (16/32/64) and set CF=1.
	LZCNT r64,r/m64	Template:Nowrap
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	TZCNT r16,r/m16 TZCNT r32,r/m32	F3 0F BC /r	Count Trailing zeroes.Template:Efn If source operand is all-0s, then TZCNT will return operand size in bits (16/32/64) and set CF=1.	Haswell, Piledriver, Jaguar, ZhangJiang, Gracemont
	TZCNT r64,r/m64	Template:Nowrap
	ANDN ra,rb,r/m	VEX.LZ.0F38 F2 /r	Bitwise AND-NOT: ra = r/m AND NOT(rb)
	BEXTR ra,r/m,rb	VEX.LZ.0F38 F7 /r	Bitfield extract. Bitfield start position is specified in bits [7:0] of rb, length in bits[15:8] of rb. The bitfield is then extracted from the r/m value with zero-extension, then stored in ra. Equivalent toTemplate:Efn mask = (1 << rb[15:8]) - 1 ra = (r/m >> rb[7:0]) AND mask
	BLSI reg,r/m	VEX.LZ.0F38 F3 /3	Extract lowest set bit in source argument. Returns 0 if source argument is 0. Equivalent to dst = (-src) AND src
	BLSMSK reg,r/m	VEX.LZ.0F38 F3 /2	Generate a bitmask of all-1s bits up to the lowest bit position with a 1 in the source argument. Returns all-1s if source argument is 0. Equivalent to dst = (src-1) XOR src
	BLSR reg,r/m	VEX.LZ.0F38 F3 /1	Copy all bits of the source argument, then clear the lowest set bit. Equivalent to dst = (src-1) AND src
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	BZHI ra,r/m,rb	Template:Small	Zero out high-order bits in r/m starting from the bit position specified in rb, then write result to rd. Equivalent to ra = r/m AND NOT(-1 << rb[7:0])	Haswell, Template:Nowrap ZhangJiang, Gracemont
	MULX ra,rb,r/m	Template:Small	Widening unsigned integer multiply without setting flags. Multiplies EDX/RDX with r/m, then stores the low half of the multiplication result in ra and the high half in rb. If ra and rb specify the same register, only the high half of the result is stored.
	PDEP ra,rb,r/m	Template:Small	Parallel Bit Deposit. Scatters contiguous bits from rb to the bit positions set in r/m, then stores result to ra. Operation performed is: ra=0; k=0; mask=r/m for i=0 to opsize-1 do if (mask[i] == 1) then ra[i]=rb[k]; k=k+1
	PEXT ra,rb,r/m	Template:Small	Parallel Bit Extract. Uses r/m argument as a bit mask to select bits in rb, then compacts the selected bits into a contiguous bit-vector. Operation performed is: ra=0; k=0; mask=r/m for i=0 to opsize-1 do if (mask[i] == 1) then ra[k]=rb[i]; k=k+1
	Template:Nowrap	Template:Small	Rotate right by immediate without affecting flags.
	SARX ra,r/m,rb	Template:Small	Arithmetic shift right without updating flags. For SARX, SHRX and SHLX, the shift-amount specified in rb is masked to 5 bits for 32-bit operand size and 6 bits for 64-bit operand size.
	SHRX ra,r/m,rb	Template:Small	Logical shift right without updating flags.
	SHLX ra,r/m,rb	Template:Small	Shift left without updating flags.

Added with Intel TSX

{{#invoke:Labelled list hatnote|labelledList|Main article|Main articles|Main page|Main pages}}

TSX Subset	Instruction	Opcode	Description	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XBEGIN rel16 Template:Nowrap	C7 F8 cw Template:Nowrap	Start transaction. If transaction fails, perform a branch to the given relative offset.	Haswell (Deprecated on desktop/laptop CPUs from 10th generation (Ice Lake, Comet Lake) onwards, but continues to be available on Xeon-branded server parts (e.g. Ice Lake-SP, Sapphire Rapids))
	XABORT imm8	C6 F8 ib	Abort transaction with 8-bit immediate as error code.
	XEND	Template:Nowrap	End transaction.
	XTEST	Template:Nowrap	Test if in transactional execution. Sets EFLAGS.ZF to 0 if executed inside a transaction (RTM or HLE), 1 otherwise.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XACQUIRE	F2	Instruction prefix to indicate start of hardware lock elision, used with memory atomic instructions only (for other instructions, the F2 prefix may have other meanings). When used with such instructions, may start a transaction instead of performing the memory atomic operation.	Haswell (Discontinued – the last processors to support HLE were Template:Nowrap and Template:Nowrap
	XRELEASE	F3	Instruction prefix to indicate end of hardware lock elision, used with memory atomic/store instructions only (for other instructions, the F3 prefix may have other meanings). When used with such instructions during hardware lock elision, will end the associated transaction instead of performing the store/atomic.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XSUSLDTRK	Template:Nowrap	Suspend Tracking Load Addresses	Template:Nowrap
	XRESLDTRK	Template:Nowrap	Resume Tracking Load Addresses

Added with Intel CET

Intel CET (Control-Flow Enforcement Technology) adds two distinct features to help protect against security exploits such as return-oriented programming: a shadow stack (CET_SS), and indirect branch tracking (CET_IBT).

CET Subset	Instruction	Opcode	Description	Ring	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	INCSSPD r32	F3 0F AE /5	Increment shadow stack pointer	rowspan="8" Template:Yes	Template:Nowrap Zen 3
	INCSSPQ r64	F3 REX.W 0F AE /5
	RDSSPD r32	F3 0F 1E /1	Read shadow stack pointer into register (low 32 bits)Template:Efn
	RDSSPQ r64	F3 REX.W 0F 1E /1	Read shadow stack pointer into register (full 64 bits)Template:Efn
	SAVEPREVSSP	F3 0F 01 EA	Save previous shadow stack pointer
	RSTORSSP m64	F3 0F 01 /5	Restore saved shadow stack pointer
	WRSSD m32,r32	NP 0F 38 F6 /r	Write 4 bytes to shadow stack
	WRSSQ m64,r64	Template:Nowrap	Write 8 bytes to shadow stack
	WRUSSD m32,r32	66 0F 38 F5 /r	Write 4 bytes to user shadow stack	rowspan="4" Template:No
	Template:Nowrap	Template:Nowrap	Write 8 bytes to user shadow stack
	SETSSBSY	F3 0F 01 E8	Mark shadow stack busy
	CLRSSBSY m64	F3 0F AE /6	Clear shadow stack busy flag
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	ENDBR32	F3 0F 1E FB	Terminate indirect branch in 32-bit modeTemplate:Efn	rowspan="3" Template:Yes	Tiger Lake
	ENDBR64	F3 0F 1E FA	Terminate indirect branch in 64-bit modeTemplate:Efn
	NOTRACK	3ETemplate:Efn	Prefix used with indirect CALL/JMP near instructions (opcodes Template:Nowrap and Template:Nowrap) to indicate that the branch target is not required to start with an ENDBR32/64 instruction. Prefix only honored when NO_TRACK_EN flag is set.

Added with XSAVE

The XSAVE instruction set extensions are designed to save/restore CPU extended state (typically for the purpose of context switching) in a manner that can be extended to cover new instruction set extensions without the OS context-switching code needing to understand the specifics of the new extensions. This is done by defining a series of state-components, each with a size and offset within a given save area, and each corresponding to a subset of the state needed for one CPU extension or another. The EAX=0Dh CPUID leaf is used to provide information about which state-components the CPU supports and what their sizes/offsets are, so that the OS can reserve the proper amount of space and set the associated enable-bits.

XSAVE Extension	Instruction mnemonics	OpcodeTemplate:Efn	Instruction description	Ring	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XSAVE mem XSAVE64 mem	NP 0F AE /4 NP REX.W 0F AE /4	Save state components specified by bitmap in EDX:EAX to memory.	rowspan="3" Template:Yes	Penryn,Template:Efn Bulldozer, Jaguar, Goldmont, ZhangJiang
	XRSTOR mem XRSTOR64 mem	NP 0F AE /5 Template:Nowrap	Restore state components specified by EDX:EAX from memory.
	XGETBV	NP 0F 01 D0	Get value of Extended Control Register. Reads an XCR specified by ECX into EDX:EAX.Template:Efn
	XSETBV	NP 0F 01 D1	Set Extended Control Register.Template:Efn Write the value in EDX:EAX to the XCR specified by ECX.	Template:No
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XSAVEOPT mem Template:Nowrap	NP 0F AE /6 NP REX.W 0F AE /6	Save state components specified by EDX:EAX to memory. Unlike the older XSAVE instruction, XSAVEOPT may abstain from writing processor state items to memory when the CPU can determine that they haven't been modified since the most recent corresponding XRSTOR.	Template:Yes	Template:Nowrap Steamroller, Puma, Goldmont, ZhangJiang
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XSAVEC mem XSAVEC64 mem	NP 0F C7 /4 NP REX.W 0F C7 /4	Save processor extended state components specified by EDX:EAX to memory with compaction.	Template:Yes	Skylake, Goldmont, Zen 1
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	XSAVES mem XSAVES64 mem	NP 0F C7 /5 NP REX.W 0F C7 /5	Save processor extended state components specified by EDX:EAX to memory with compaction and optimization if possible.	rowspan="2" Template:No	Skylake, Goldmont, Zen 1
	XRSTORS mem XRSTORS64 mem	NP 0F C7 /3 Template:Nowrap	Restore state components specified by EDX:EAX from memory.

Added with other cross-vendor extensions

Instruction Set Extension	Instruction mnemonics	Opcode	Instruction description	Ring	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	PREFETCHNTA m8	0F 18 /0	Prefetch with Non-Temporal Access. Prefetch data under the assumption that the data will be used only once, and attempt to minimize cache pollution from said data. The methods used to minimize cache pollution are implementation-dependent.Template:Efn	rowspan="5" Template:Yes	Pentium III, (K7),Template:Efn Template:Nowrap Nehemiah, Efficeon
	PREFETCHT0 m8	0F 18 /1	Prefetch data to all levels of the cache hierarchy.Template:Efn
	PREFETCHT1 m8	0F 18 /2	Prefetch data to all levels of the cache hierarchy except L1 cache.Template:Efn
	PREFETCHT2 m8	0F 18 /3	Prefetch data to all levels of the cache hierarchy except L1 and L2 caches.Template:Efn
	SFENCE	NP 0F AE F8+xTemplate:Efn	Store Fence.Template:Efn
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	LFENCE	NP 0F AE E8+xTemplate:Efn	Load Fence and Dispatch Serialization.Template:Efn	rowspan="4" Template:Yes	Pentium 4, K8, Efficeon, C7 Esther
	MFENCE	NP 0F AE F0+xTemplate:Efn	Memory Fence.Template:Efn
	MOVNTI m32,r32 MOVNTI m64,r64	NP 0F C3 /r NP REX.W 0F C3 /r	Non-Temporal Memory Store.
	PAUSE	F3 90Template:Efn	Pauses CPU thread for a short time period.Template:Efn Intended for use in spinlocks.Template:Efn
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap	NP 0F AE /7	Flush one cache line to memory. In a system with multiple cache hierarchy levels and/or multiple processors each with their own caches, the line is flushed from all of them.	Template:Yes	(SSE2), Geode LX
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	MONITORTemplate:Efn Template:Nowrap	NP 0F 01 C8	Start monitoring a memory location for memory writes. The memory address to monitor is given by DS:AX/EAX/RAX.Template:Efn ECX and EDX are reserved for extra extension and hint flags, respectively.Template:Efn	rowspan="2" Template:No2	Prescott, Yonah, Bonnell, K10, Nano
	MWAITTemplate:Efn MWAIT EAX,ECX	NP 0F 01 C9	Wait for a write to a monitored memory location previously specified with MONITOR.Template:Efn ECX and EAX are used to provide extra extensionTemplate:Efn and hintTemplate:Efn flags, respectively. MWAIT hints are commonly used for CPU power management.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	GETSEC	Template:Nowrap	Perform an SMX function. The leaf function to perform is given in EAX.Template:Efn Depending on leaf function, the instruction may take additional arguments in RBX, ECX and EDX.	Template:No2	Template:Nowrap WuDaoKou,<ref>Guru3D, VIA Zhaoxin x86 4 and 8-core SoC processors launch, Jan 22, 2018</ref> Tremont
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	RDTSCP	0F 01 F9	Read Time Stamp Counter and processor core ID.Template:Efn The TSC value is placed in EDX:EAX and the core ID in ECX.Template:Efn	Template:Yes2	K8,Template:Efn Nehalem, Silvermont, Nano
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	POPCNT r16,r/m16 POPCNT r32,r/m32	F3 0F B8 /r	Count the number of bits that are set to 1 in its source argument.	rowspan="2" Template:Yes	K10, Nehalem, Nano 3000
	POPCNT r64,r/m64	F3 REX.W 0F B8 /r
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	CRC32 r32,r/m8	F2 0F 38 F0 /r	Accumulate CRC value using the CRC-32C (Castagnoli) polynomial 0x11EDC6F41 (normal form 0x1EDC6F41). This is the polynomial used in iSCSI. In contrast to the more popular one used in Ethernet, its parity is even, and it can thus detect any error with an odd number of changed bits.	rowspan="3" Template:Yes	Nehalem, Bulldozer, ZhangJiang
	CRC32 r32,r/m16 CRC32 r32,r/m32	F2 0F 38 F1 /r
	CRC32 r64,r/m64	F2 REX.W 0F 38 F1 /r
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	RDFSBASE r32 RDFSBASE r64	F3 0F AE /0 F3 REX.W 0F AE /0	Read base address of FS: segment.	rowspan="4" Template:Yes	Ivy Bridge, Steamroller, Goldmont, ZhangJiang
	RDGSBASE r32 RDGSBASE r64	F3 0F AE /1 F3 REX.W 0F AE /1	Read base address of GS: segment.
	WRFSBASE r32 WRFSBASE r64	F3 0F AE /2 F3 REX.W 0F AE /2	Write base address of FS: segment.
	WRGSBASE r32 WRGSBASE r64	F3 0F AE /3 F3 REX.W 0F AE /3	Write base address of GS: segment.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	MOVBE r16,m16 MOVBE r32,m32	NFx 0F 38 F0 /r	Load from memory to register with byte-order swap.	rowspan="4" Template:Yes	Bonnell, Haswell, Jaguar, Steamroller, ZhangJiang
	MOVBE r64,m64	Template:Nowrap
	MOVBE m16,r16 MOVBE m32,r32	NFx 0F 38 F1 /r	Store to memory from register with byte-order swap.
	MOVBE m64,r64	Template:Nowrap
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	INVPCID reg,m128	66 0F 38 82 /r	Invalidate entries in TLB and paging-structure caches based on invalidation type in registerTemplate:Efn and descriptor in m128. The descriptor contains a memory address and a PCID.Template:Efn Instruction is serializing on AMD but not Intel CPUs.	Template:No	Haswell, ZhangJiang, Zen 3, Gracemont
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap	0F 0D /1	Prefetch cache line with intent to write.Template:Efn	rowspan="2" Template:Yes	K6-2, Template:Nowrap Silvermont, Broadwell, ZhangJiang
	Template:NowrapTemplate:Efn	0F 0D /0	Prefetch cache line.Template:Efn
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap ADCX r64,r/m64	66 0F 38 F6 /r Template:Nowrap	Add-with-carry. Differs from the older ADC instruction in that it leaves flags other than EFLAGS.CF unchanged.	rowspan="2" Template:Yes	Broadwell, Zen 1, ZhangJiang, Gracemont
	Template:Nowrap ADOX r64,r/m64	F3 0F 38 F6 /r Template:Nowrap	Add-with-carry, with the overflow-flag EFLAGS.OF serving as carry input and output, with other flags left unchanged.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	CLAC	NP 0F 01 CA	Clear EFLAGS.AC.	rowspan="2" Template:No	Broadwell, Goldmont, Zen 1, LuJiaZuiTemplate:Efn
	STAC	NP 0F 01 CB	Set EFLAGS.AC.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap	NFx 66 0F AE /7	Flush cache line. Differs from the older CLFLUSH instruction in that it has more relaxed ordering rules with respect to memory stores and other cache line flushes, enabling improved performance.	Template:Yes	Skylake, Goldmont, Zen 1
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	PREFETCHWT1 m8	0F 0D /2	Prefetch data with T1 locality hint (fetch into L2 cache, but not L1 cache) and intent-to-write hint.Template:Efn	Template:Yes	Template:Nowrap YongFeng
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	RDPKRU	NP 0F 01 EE	Read User Page Key register into EAX.	rowspan="2" Template:Yes	Skylake-X, Comet Lake, Gracemont, Zen 3, LuJiaZuiTemplate:Efn
	WRPKRU	NP 0F 01 EF	Write data from EAX into User Page Key Register, and perform a Memory Fence.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	CLWB m8	Template:Nowrap	Write one cache line back to memory without invalidating the cache line.	Template:Yes	Skylake-X, Zen 2, Tiger Lake, Tremont
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	RDPID r32	F3 0F C7 /7	Read processor core ID into register.Template:Efn	Template:Yes	Template:Nowrap Zen 2, Ice Lake, LuJiaZuiTemplate:Efn
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	MOVDIRI m32,r32 MOVDIRI m64,r64	NP 0F 38 F9 /r Template:Nowrap	Store to memory using Direct Store (memory store that is not cached or write-combined with other stores).	Template:Yes	Tiger Lake, Tremont, Zen 5
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap	66 0F 38 F8 /r	Move 64 bytes of data from m512 to address given by ES:reg. The 64-byte write is done atomically with Direct Store.Template:Efn	Template:Yes	Tiger Lake, Tremont, Zen 5
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	WBNOINVD	F3 0F 09	Write back all dirty cache lines to memory without invalidation.Template:Efn Instruction is serializing.	Template:No	Zen 2, Ice Lake-SP
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	PREFETCHIT0 m8	0F 18 /7	Prefetch code to all levels of the cache hierarchy.Template:Efn	rowspan="2" Template:Yes	Zen 5, Template:Nowrap
	PREFETCHIT1 m8	0F 18 /6	Prefetch code to all levels of the cache hierarchy except first-level cache.Template:Efn

Added with other Intel-specific extensions

Instruction Set Extension	Instruction mnemonics	Opcode	Instruction description	Ring	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	HWNT, hint-not-takenTemplate:Efn	2ETemplate:Efn	Instruction prefix: branch hint weakly not taken.	rowspan="2" Template:Yes	Pentium 4,Template:Efn Meteor Lake<ref>Intel, Intel 64 and IA-32 Architectures Optimization Reference Manual: Volume 1, order no. 248966-050US, April 2024, chapter 2.1.1.1, page 46. Archived on 25 Jan 2025.</ref>
	HST, hint-takenTemplate:Efn	3ETemplate:Efn	Instruction prefix: branch hint strongly taken.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	ENCLS	Template:Nowrap	Perform an SGX Supervisor function. The function to perform is given in EAXTemplate:Efn — depending on function, the instruction may take additional input operands in RBX, RCX and RDX. Depending on function, the instruction may return data in RBX and/or an error code in EAX.	Template:No	Template:GlossaryTemplate:TermTemplate:DefnTemplate:TermTemplate:DefnTemplate:TermTemplate:DefnTemplate:Glossary end
	ENCLU	Template:Nowrap	Perform an SGX User function. The function to perform is given in EAXTemplate:Efn — depending on function, the instruction may take additional input operands in RBX, RCX and RDX. Depending on function, the instruction may return data/status information in EAX and/or RCX.	Template:Yes
	ENCLV	Template:Nowrap	Perform an SGX Virtualization function. The function to perform is given in EAXTemplate:Efn — depending on function, the instruction may take additional input operands in RBX, RCX and RDX. Instruction returns status information in EAX.	Template:No
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	PTWRITE r/m32 PTWRITE r/m64	F3 0F AE /4 Template:Nowrap	Read data from register or memory to encode into a PTW packet.Template:Efn	Template:Yes	Kaby Lake, Template:Nowrap
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	PCONFIG	NP 0F 01 C5	Perform a platform feature configuration function. The function to perform is specified in EAXTemplate:Efn - depending on function, the instruction may take additional input operands in RBX, RCX and RDX. If the instruction fails, it will set EFLAGS.ZF=1 and return an error code in EAX. If it is successful, it sets EFLAGS.ZF=0 and EAX=0.	Template:No	Ice Lake-SP
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	CLDEMOTE m8	NP 0F 1C /0	Move cache line containing m8 from CPU L1 cache to a more distant level of the cache hierarchy.Template:Efn	Template:Yes	(Tremont), (Alder Lake), Template:Nowrap
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	UMONITOR r16/32/64	F3 0F AE /6	Start monitoring a memory location for memory writes. The memory address to monitor is given by the register argument.Template:Efn	Template:Yes	Tremont, Alder Lake
	UMWAIT r32 UMWAIT r32,EDX,EAX	F2 0F AE /6	Timed wait for a write to a monitored memory location previously specified with UMONITOR. In the absence of a memory write, the wait will end when either the TSC reaches the value specified by EDX:EAX or the wait has been going on for an OS-controlled maximum amount of time.Template:Efn	rowspan="2" Template:Yes2
	TPAUSE r32 TPAUSE r32,EDX,EAX	66 0F AE /6	Wait until the Time Stamp Counter reaches the value specified in EDX:EAX.Template:Efn The register argument to the UMWAIT and TPAUSE instructions specifies extra flags to control the operation of the instruction.Template:Efn
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	SERIALIZE	NP 0F 01 E8	Serialize instruction fetch and execution.Template:Efn	Template:Yes	Alder Lake
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	HRESET imm8	Template:Nowrap	Request that the processor reset selected components of hardware-maintained prediction history. A bitmap of which components of the CPU's prediction history to reset is given in EAX (the imm8 argument is ignored).Template:Efn	Template:No	Alder Lake
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	SENDUIPI reg	F3 0F C7 /6	Send Interprocessor User Interrupt.Template:Efn	rowspan="5" Template:Yes	Sapphire Rapids
	UIRET	F3 0F 01 EC	User Interrupt Return. Pops RIP, RFLAGS and RSP off the stack, in that order.Template:Efn
	TESTUI	F3 0F 01 ED	Test User Interrupt Flag. Copies UIF to EFLAGS.CF .
	CLUI	F3 0F 01 EE	Clear User Interrupt Flag.
	STUI	F3 0F 01 EF	Set User Interrupt Flag.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	ENQCMD reg,m512	F2 0F 38 F8 /r	Enqueue Command. Reads a 64-byte "command data" structure from memory (m512 argument) and writes atomically to a memory-mapped Enqueue Store device (register argument provides the memory address of this device, using ES segment and requiring 64-byte alignment.Template:Efn) Sets ZF=0 to indicate that device accepted the command, or ZF=1 to indicate that command was not accepted (e.g. queue full or the memory location was not an Enqueue Store device.)	Template:Yes	Template:Nowrap
	Template:Nowrap	F3 0F 38 F8 /r	Enqueue Command Supervisor. Differs from ENQCMD in that it can place an arbitrary PASID (process address-space identifier) and a privilege-bit in the "command data" to enqueue.	Template:No
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	WRMSRNS	NP 0F 01 C6	Write Model-specific register. The MSR to write is specified in ECX, and the data to write is given in EDX:EAX. The instruction differs from the older WRMSR instruction in that it is not serializing.	Template:No	Template:Nowrap
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	RDMSRLIST	F2 0F 01 C6	Read multiple MSRs. RSI points to a table of up to 64 MSR indexes to read (64 bits each), RDI points to a table of up to 64 data items that the MSR read-results will be written to (also 64 bits each), and RCX provides a 64-entry bitmap of which of the table entries to actually perform an MSR read for.Template:Efn	rowspan="2" Template:No	Template:Nowrap
	WRMSRLIST	F3 0F 01 C6	Write multiple MSRs. RSI points to a table of up to 64 MSR indexes to write (64 bits each), RDI points to a table of up to 64 data items to write into the MSRs (also 64 bits each), and RCX provides a 64-entry bitmap of which of the table entries to actually perform an MSR write for.Template:Efn The MSRs are written in table order. The instruction is not serializing.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap Template:Nowrap	Template:Small Template:EfnTemplate:Efn	Read value from memory, then compare to first register operand. If the comparison passes, then add the second register operand to the memory value. The instruction as a whole is performed atomically. The operation of Template:Nowrap is: temp1 := [mem] EFLAGS := CMP temp1, reg1 // sets EFLAGS like regular compare reg1 := temp1 if( condition ) [mem] := temp1 + reg2	Template:Yes	Template:Nowrap Lunar Lake
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	PBNDKB	NP 0F 01 C7	Bind information to a platform by encrypting it with a platform-specific wrapping key. The instruction takes as input the addresses to two 256-byte-aligned "bind structures" in RBX and RCX, reads the structure pointed to by RBX and writes a modified structure to the address given in RCX. If the instruction fails, it will set EFLAGS.ZF=1 and return an error code in EAX. If it is successful, it sets EFLAGS.ZF=0 and EAX=0.	Template:No	Lunar Lake

Added with other AMD-specific extensions

Instruction Set Extension	Instruction mnemonics	Opcode	Instruction description	Ring	Added in
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	MOV reg,CR8	F0 0F 20 /0Template:Efn	Read the CR8 register.	rowspan="2" Template:No	K8Template:Efn
	Template:Nowrap	Template:NowrapTemplate:Efn	Write to the CR8 register.
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	MONITORX	NP 0F 01 FA	Start monitoring a memory location for memory writes. Similar to older MONITOR, except available in user mode.	rowspan="2" Template:Yes	Excavator
	MWAITX	NP 0F 01 FB	Wait for a write to a monitored memory location previously specified with MONITORX. MWAITX differs from the older MWAIT instruction mainly in that it runs in user mode and that it can accept an optional timeout argument (given in TSC time units) in EBX (enabled by setting bit[1] of ECX to 1.)
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	Template:Nowrap	NP 0F 01 FC	Write zeroes to all bytes in a memory region that has the size and alignment of a CPU cache line and contains the byte addressed by DS:rAX.Template:Efn	Template:Yes	Zen 1
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	RDPRU	NP 0F 01 FD	Read selected MSRs (mainly performance counters) in user mode. ECX specifies which register to read.Template:Efn The value of the MSR is returned in EDX:EAX.	Template:Yes2	Zen 2
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	MCOMMIT	F3 0F 01 FA	Ensure that all preceding stores in thread have been committed to memory, and that any errors encountered by these stores have been signalled to any associated error logging resources. The set of errors that can be reported and the logging mechanism are platform-specific. Sets EFLAGS.CF to 0 if any errors occurred, 1 otherwise.	Template:Yes	Zen 2
Template:GlossaryTemplate:TermTemplate:DefnTemplate:Glossary end	INVLPGB	NP 0F 01 FE	Invalidate TLB Entries for a range of pages, with broadcast. The invalidation is performed on the processor executing the instruction, and also broadcast to all other processors in the system. rAX takes the virtual address to invalidate and some additional flags, ECX takes the number of pages to invalidate, and EDX specifies ASID and PCID to perform TLB invalidation for.	rowspan="2" Template:No	Zen 3
	TLBSYNC	NP 0F 01 FF	Synchronize TLB invalidations. Wait until all TLB invalidations signalled by preceding invocations of the INVLPGB instruction on the same logical processor have been responded to by all processors in the system. Instruction is serializing.

x87 floating-point instructions

The x87 coprocessor, if present, provides support for floating-point arithmetic. The coprocessor provides eight data registers, each holding one 80-bit floating-point value (1 sign bit, 15 exponent bits, 64 mantissa bits) – these registers are organized as a stack, with the top-of-stack register referred to as "st" or "st(0)", and the other registers referred to as st(1), st(2), ...st(7). It additionally provides a number of control and status registers, including "PC" (precision control, to control whether floating-point operations should be rounded to 24, 53 or 64 mantissa bits) and "RC" (rounding control, to pick rounding-mode: round-to-zero, round-to-positive-infinity, round-to-negative-infinity, round-to-nearest-even) and a 4-bit condition code register "CC", whose four bits are individually referred to as C0, C1, C2 and C3). Not all of the arithmetic instructions provided by x87 obey PC and RC.

Original 8087 instructions

Instruction description	Mnemonic	Opcode	Additional items
x87 Non-WaitingTemplate:Efn FPU Control Instructions			Waiting mnemonicTemplate:Efn
Initialize x87 FPU	FNINIT	DB E3	FINIT
Load x87 Control Word	FLDCW m16	D9 /5	colspan="2" Template:CNone
Store x87 Control Word	FNSTCW m16	D9 /7	FSTCW
Store x87 Status Word	FNSTSW m16Template:Efn	DD /7	FSTSW
Clear x87 Exception Flags	FNCLEX	DB E2	FCLEX
Load x87 FPU Environment	FLDENV m112/m224Template:Efn	D9 /4	colspan="2" Template:CNone
Store x87 FPU Environment	Template:Nowrap	D9 /6	FSTENV
Save x87 FPU State, then initialize x87 FPU	Template:Nowrap	DD /6	FSAVE
Restore x87 FPU State	FRSTOR m752/m864Template:Efn	DD /4	colspan="2" Template:CNone
Enable Interrupts (8087 only)Template:Efn	FNENI	DB E0	FENI
Disable Interrupts (8087 only)Template:Efn	FNDISI	DB E1	FDISI
x87 Floating-point Load/Store/Move Instructions			precision control	rounding control
Load floating-point value onto stack	FLD m32	D9 /0	rowspan="4"Template:No	rowspan="4"Template:N/a
	FLD m64	DD /0
	FLD m80	DB /5
	FLD st(i)	D9 C0+i
Store top-of-stack floating-point value to memory or stack register	FST m32	D9 /2	rowspan="2" Template:No	rowspan="2" Template:Yes
	FST m64	DD /2
	FST st(i)Template:Efn	DD D0+i	Template:No	Template:N/a
Store top-of-stack floating-point value to memory or stack register, then pop	FSTP m32	D9 /3	rowspan="2" Template:No	rowspan="2" Template:Yes
	FSTP m64	DD /3
	FSTP m80Template:Efn	DB /7	rowspan="4" Template:No	rowspan="4"Template:N/a
	FSTP st(i)Template:EfnTemplate:Efn	Template:Nowrap
		Template:Unofficial2
		Template:Unofficial2
Push +0.0 onto stack	FLDZ	D9 EE	rowspan="2" Template:No	rowspan="2"Template:N/a
Push +1.0 onto stack	FLD1	D9 E8
Push [[Pi|Template:Pi]] (approximately 3.14159) onto stack	FLDPI	D9 EB	rowspan="5" Template:No	rowspan="5" Template:Yes2
Push <math>\log_{2}\left(10\right)</math> (approximately 3.32193) onto stack	FLDL2T	D9 E9
Push <math>\log_{2}\left(e\right)</math> (approximately 1.44269) onto stack	FLDL2E	D9 EA
Push <math>\log_{10}\left(2\right)</math> (approximately 0.30103) onto stack	FLDLG2	D9 EC
Push <math>\ln\left(2\right)</math> (approximately 0.69315) onto stack	FLDLN2	D9 ED
Exchange top-of-stack register with other stack register	FXCH st(i)Template:EfnTemplate:Efn	D9 C8+i	rowspan=3 Template:No	rowspan=3 Template:N/a
		Template:Unofficial2
		Template:Unofficial2
x87 Integer Load/Store Instructions			precision control	rounding control
Load signed integer value onto stack from memory, with conversion to floating-point	FILD m16	DF /0	rowspan="3" Template:No	rowspan="3"Template:N/a
	FILD m32	DB /0
	FILD m64	DF /5
Store top-of-stack value to memory, with conversion to signed integer	FIST m16	DF /2	rowspan="2" Template:No	rowspan="2" Template:Yes
	FIST m32	DB /2
Store top-of-stack value to memory, with conversion to signed integer, then pop stack	FISTP m16	DF /3	rowspan="3" Template:No	rowspan="3" Template:Yes
	FISTP m32	DB /3
	FISTP m64	DF /7
Load 18-digit Binary-Coded-Decimal integer value onto stack from memory, with conversion to floating-pointTemplate:Efn	FBLD m80	DF /4	Template:No	Template:N/a
Store top-of-stack value to memory, with conversion to 18-digit Binary-Coded-Decimal integer, then pop stack	FBSTP m80	DF /6	Template:No	Template:Yes2
x87 Basic Arithmetic Instructions			precision control	rounding control
Floating-point add <syntaxhighlight lang="text" class="" style="" inline="1">dst <- dst + src</syntaxhighlight>	FADD m32	D8 /0	rowspan="4" Template:Yes	rowspan="4" Template:Yes
	FADD m64	DC /0
	FADD st,st(i)	D8 C0+i
	FADD st(i),st	DC C0+i
Floating-point multiply <syntaxhighlight lang="text" class="" style="" inline="1">dst <- dst * src</syntaxhighlight>	FMUL m32	D8 /1	rowspan="4" Template:Yes	rowspan="4" Template:Yes
	FMUL m64	DC /1
	FMUL st,st(i)	D8 C8+i
	FMUL st(i),st	DC C8+i
Floating-point subtract <syntaxhighlight lang="text" class="" style="" inline="1">dst <- dst – src</syntaxhighlight>	FSUB m32	D8 /4	rowspan="4" Template:Yes	rowspan="4" Template:Yes
	FSUB m64	DC /4
	FSUB st,st(i)	D8 E0+i
	FSUB st(i),st	DC E8+i
Floating-point reverse subtract <syntaxhighlight lang="text" class="" style="" inline="1">dst <- src – dst</syntaxhighlight>	FSUBR m32	D8 /5	rowspan="4" Template:Yes	rowspan="4" Template:Yes
	FSUBR m64	DC /5
	FSUBR st,st(i)	D8 E8+i
	FSUBR st(i),st	DC E0+i
Floating-point divideTemplate:Efn <syntaxhighlight lang="text" class="" style="" inline="1">dst <- dst / src</syntaxhighlight>	FDIV m32	D8 /6	rowspan="4" Template:Yes	rowspan="4" Template:Yes
	FDIV m64	DC /6
	FDIV st,st(i)	D8 F0+i
	FDIV st(i),st	DC F8+i
Floating-point reverse divide <syntaxhighlight lang="text" class="" style="" inline="1">dst <- src / dst</syntaxhighlight>	FDIVR m32	D8 /7	rowspan="4" Template:Yes	rowspan="4" Template:Yes
	FDIVR m64	DC /7
	FDIVR st,st(i)	D8 F8+i
	FDIVR st(i),st	DC F0+i
Floating-point compare <syntaxhighlight lang="text" class="" style="" inline="1">CC <- result_of( st(0) – src )</syntaxhighlight> Same operation as subtract, except that it updates the x87 CC status register instead of any of the FPU stack registers	FCOM m32	D8 /2	rowspan="4" Template:No	rowspan="4"Template:N/a
	FCOM m64	DC /2
	FCOM st(i)Template:Efn	D8 D0+i
		Template:Unofficial2
x87 Basic Arithmetic Instructions with Stack Pop			precision control	rounding control
Floating-point add and pop	FADDP st(i),stTemplate:Efn	DE C0+i	Template:Yes	Template:Yes
Floating-point multiply and pop	FMULP st(i),stTemplate:Efn	DE C8+i	Template:Yes	Template:Yes
Floating-point subtract and pop	FSUBP st(i),stTemplate:Efn	DE E8+i	Template:Yes	Template:Yes
Floating-point reverse-subtract and pop	FSUBRP st(i),stTemplate:Efn	DE E0+i	Template:Yes	Template:Yes
Floating-point divide and pop	FDIVP st(i),stTemplate:Efn	DE F8+i	Template:Yes	Template:Yes
Floating-point reverse-divide and pop	FDIVRP st(i),stTemplate:Efn	DE F0+i	Template:Yes	Template:Yes
Floating-point compare and pop	FCOMP m32	D8 /3	rowspan="5" Template:No	rowspan="5"Template:N/a
	FCOMP m64	DC /3
	FCOMP st(i)Template:Efn	D8 D8+i
		Template:Unofficial2
		Template:Unofficial2
Floating-point compare to st(1), then pop twice	FCOMPP	DE D9	Template:No	Template:N/a
x87 Basic Arithmetic Instructions with Integer Source Argument			precision control	rounding control
Floating-point add by integer	FIADD m16	DA /0	rowspan="2" Template:Yes	rowspan="2" Template:Yes
	FIADD m32	DE /0
Floating-point multiply by integer	FIMUL m16	DA /1	rowspan="2" Template:Yes	rowspan="2" Template:Yes
	FIMUL m32	DE /1
Floating-point subtract by integer	FISUB m16	DA /4	rowspan="2" Template:Yes	rowspan="2" Template:Yes
	FISUB m32	DE /4
Floating-point reverse-subtract by integer	FISUBR m16	DA /5	rowspan="2" Template:Yes	rowspan="2" Template:Yes
	FISUBR m32	DE /5
Floating-point divide by integer	FIDIV m16	DA /6	rowspan="2" Template:Yes	rowspan="2" Template:Yes
	FIDIV m32	DE /6
Floating-point reverse-divide by integer	FIDIVR m16	DA /7	rowspan="2" Template:Yes	rowspan="2" Template:Yes
	FIDIVR m32	DE /7
Floating-point compare to integer	FICOM m16	DA /2	rowspan="2" Template:No	rowspan="2"Template:N/a
	FICOM m32	DE /2
Floating-point compare to integer, and stack pop	FICOMP m16	DA /3	rowspan="2" Template:No	rowspan="2"Template:N/a
	FICOMP m32	DE /3
x87 Additional Arithmetic Instructions			precision control	rounding control
Floating-point change sign	FCHS	D9 E0	Template:No	Template:N/a
Floating-point absolute value	FABS	D9 E1	Template:No	Template:N/a
Floating-point compare top-of-stack value to 0	FTST	D9 E4	Template:No	Template:N/a
Classify top-of-stack st(0) register value. The classification result is stored in the x87 CC register.Template:Efn	FXAM	D9 E5	Template:No	Template:N/a
Split the st(0) value into two values Template:Mvar and Template:Mvar representing the exponent and mantissa of st(0). The split is done such that <math>M*2^Template:E=st(0)</math>, where Template:Mvar is an integer and Template:Mvar is a number whose absolute value is within the range <math>1\leq\left|M\right|<2</math>.  Template:Efn st(0) is then replaced with Template:Mvar, after which Template:Mvar is pushed onto the stack.	FXTRACT	D9 F4	Template:No	Template:N/a
Floating-point partialTemplate:Efn remainder (not IEEE 754 compliant):<math display="block">Q \leftarrow \mathtt{IntegerRoundToZero}\left(\frac{st(0)}{st(1)}\right)</math><math display="block">st(0) \leftarrow st(0) - st(1)*Q</math>	FPREM	D9 F8	Template:No	Template:N/aTemplate:Efn
Floating-point square root	FSQRT	D9 FA	Template:Yes	Template:Yes
Floating-point round to integer	FRNDINT	D9 FC	Template:No	Template:Yes
Floating-point power-of-2 scaling. Rounds the value of st(1) to integer with round-to-zero, then uses it as a scale factor for st(0):Template:Efn<math display="block">st(0) \leftarrow st(0)*2^{\mathtt{IntegerRoundToZero}\left(st(1)\right)}</math>	FSCALE	D9 FD	Template:No	Template:Yes
x87 Transcendental InstructionsTemplate:Efn			Source operand range restriction
Base-2 exponential minus 1, with extra precision for st(0) close to 0:<math display="block">st(0) \leftarrow 2^{st(0)} - 1</math>	F2XM1	D9 F0	8087: <math>0\leq st(0)\leq\frac{1}{2}</math> 80387: <math>-1\leq st(0)\leq1</math>
Base-2 Logarithm and multiply:Template:Efn <math display="block">st(1) \leftarrow st(1)*\log_{2}\left(st(0)\right)</math>followed by stack pop	FYL2X	D9 F1	no restrictions
Partial Tangent: Computes from st(0) a pair of values Template:Mvar and Template:Mvar, such that<math display="block">\tan\left(st(0)\right)=\frac{Y}{X}</math>The Template:Mvar value replaces the top-of-stack value, and then Template:Mvar is pushed onto the stack. On 80387 and later x87, but not original 8087, Template:Mvar is always 1.0	FPTAN	D9 F2	8087: <math>0\leq\left|st(0)\right|\leq\frac{\pi}{4}</math> 80387: <math>0\leq\left|st(0)\right|<2^{63}</math>
Two-argument arctangent with quadrant adjustment:Template:Efn<math display="block">st(1) \leftarrow \arctan\left(\frac{st(1)}{st(0)}\right)</math> followed by stack pop	FPATAN	D9 F3	8087: <math>\left|st(1)\right|\leq\left|st(0)\right|<\infty</math> 80387: no restrictions
Base-2 Logarithm plus 1 with extra precision for st(0) close to 0, followed by multiply:Template:Efn <math display="block">st(1) \leftarrow st(1)*\log_{2}\left(st(0)+1\right)</math>followed by stack pop	FYL2XP1	D9 F9	Intel: <math>\left|st(0)\right|<\left(1-\sqrt{\frac{1}{2}}\right)</math> AMD: <math>\left(\sqrt{\frac{1}{2}}-1\right)<st(0)<\left(\sqrt{2}-1\right)</math>
Other x87 Instructions
No operationTemplate:Efn	FNOP	D9 D0
Decrement x87 FPU Register Stack Pointer	FDECSTP	D9 F6
Increment x87 FPU Register Stack Pointer	FINCSTP	D9 F7
Free x87 FPU Register	FFREE st(i)	Template:Nowrap
Check and handle pending unmasked x87 FPU exceptions	WAIT, FWAIT	9B
Floating-point store and pop, without stack underflow exceptionTemplate:Efn	Template:Unofficial2	Template:Unofficial2
Free x87 register, then stack pop	Template:Unofficial2	Template:Unofficial2

x87 instructions added in later processors

Instruction description	Mnemonic	Opcode	Additional items
x87 Non-Waiting Control Instructions added in 80287			Waiting mnemonic
Notify FPU of entry into Protected ModeTemplate:Efn	FNSETPM	DB E4	FSETPM
Store x87 Status Word to AX	FNSTSW AX	DF E0	FSTSW AX
x87 Instructions added in 80387Template:Efn			Template:Nowrap Template:Nowrap
Floating-point unordered compare. Similar to the regular floating-point compare instruction FCOM, except will not produce an exception in response to any qNaN operands.	FUCOM st(i)Template:Efn	DD E0+i	no restrictions
Floating-point unordered compare and pop	FUCOMP st(i)Template:Efn	DD E8+i
Floating-point unordered compare to st(1), then pop twice	FUCOMPP	DA E9
IEEE 754 compliant floating-point partial remainder.Template:Efn	FPREM1	D9 F5
Floating-point sine and cosine. Computes two values <math>S=\sin\left(k*st(0)\right)</math> and <math>C=\cos\left(k*st(0)\right)</math> Template:Efn Top-of-stack st(0) is replaced with Template:Mvar, after which Template:Mvar is pushed onto the stack.	FSINCOS	D9 FB	<math>\left|st(0)\right|<2^{63}</math>Template:Efn
Floating-point sine.Template:Efn<math display="block">st(0) \leftarrow \sin\left(k*st(0)\right)</math>	FSIN	D9 FE
Floating-point cosine.Template:Efn<math display="block">st(0) \leftarrow \cos\left(k*st(0)\right)</math>	FCOS	D9 FF
x87 Instructions added in Pentium Pro			Template:Nowrap Template:Nowrap
Floating-point conditional move to st(0) based on EFLAGS	FCMOVB st(0),st(i)	DA C0+i	below (CF=1)
	FCMOVE st(0),st(i)	DA C8+i	equal (ZF=1)
	FCMOVBE st(0),st(i)	DA D0+i	below or equal (CF=1 or ZF=1)
	FCMOVU st(0),st(i)	DA D8+i	unordered (PF=1)
	FCMOVNB st(0),st(i)	DB C0+i	not below (CF=0)
	FCMOVNE st(0),st(i)	DB C8+i	not equal (ZF=0)
	Template:Nowrap	DB D0+i	not below or equal (CF=0 and ZF=0)
	FCMOVNU st(0),st(i)	DB D8+i	not unordered (PF=0)
Floating-point compare and set EFLAGS. Differs from the older FCOM floating-point compare instruction in that it puts its result in the integer EFLAGS register rather than the x87 CC register.Template:Efn	FCOMI st(0),st(i)	DB F0+i
Floating-point compare and set EFLAGS, then pop	FCOMIP st(0),st(i)	DF F0+i
Floating-point unordered compare and set EFLAGS	FUCOMI st(0),st(i)	DB E8+i
Floating-point unordered compare and set EFLAGS, then pop	Template:Nowrap	DF E8+i
x87 Non-Waiting Instructions added in Pentium II, AMD K7 and SSETemplate:Efn			64-bit mnemonic (REX.W prefix)
Save x87, MMX and SSE state to a 464-byte data structureTemplate:EfnTemplate:EfnTemplate:Efn	FXSAVE m464byte	Template:Nowrap	Template:NowrapTemplate:Efn
Restore x87, MMX and SSE state from 464-byte data structureTemplate:EfnTemplate:Efn	Template:Nowrap	Template:Nowrap	Template:NowrapTemplate:Efn
x87 Instructions added as part of SSE3
Floating-point store integer and pop, with round-to-zero	FISTTP m16	DF /1
	FISTTP m32	DB /1
	FISTTP m64	DD /1

SIMD instructions

{{#invoke:Labelled list hatnote|labelledList|Main article|Main articles|Main page|Main pages}}

Cryptographic instructions

{{#invoke:Labelled list hatnote|labelledList|Main article|Main articles|Main page|Main pages}}

Virtualization instructions

{{#invoke:Labelled list hatnote|labelledList|Main article|Main articles|Main page|Main pages}}

Other instructions

x86 also includes discontinued instruction sets which are no longer supported by Intel and AMD, and undocumented instructions which execute but are not officially documented.

Undocumented x86 instructions

The x86 CPUs contain undocumented instructions which are implemented on the chips but not listed in some official documents. They can be found in various sources across the Internet, such as Ralf Brown's Interrupt List and at sandpile.org

Some of these instructions are widely available across many/most x86 CPUs, while others are specific to a narrow range of CPUs.

Undocumented instructions that are widely available across many x86 CPUs include

Mnemonics	Opcodes	Description	Status
AAM imm8	D4 ib	ASCII-Adjust-after-Multiply. On the 8086, documented for imm8=0Ah only, which is used to convert a binary multiplication result to BCD. The actual operation is <syntaxhighlight lang="text" class="" style="" inline="1">AH ← AL/imm8; AL ← AL mod imm8</syntaxhighlight> for any imm8 value (except zero, which produces a divide-by-zero exception).<ref>Robert Collins, Undocumented OpCodes: AAM. Archived on 21 Feb 2001</ref>	Available beginning with 8086, documented for imm8 values other than 0Ah since Pentium (earlier documentation lists no arguments).
AAD imm8	D5 ib	ASCII-Adjust-Before-Division. On the 8086, documented for imm8=0Ah only, which is used to convert a BCD value to binary for a following division instruction. The actual operation is <syntaxhighlight lang="text" class="" style="" inline="1">AL ← (AL+(AH*imm8)) & 0FFh; AH ← 0</syntaxhighlight> for any imm8 value.
SALC, SETALC	D6	Set AL depending on the value of the Carry Flag (a 1-byte alternative of Template:Nowrap)	Available beginning with 8086, but only documented since Pentium Pro.
ICEBP, INT1	F1	Single byte single-step exception / Invoke ICE	Available beginning with 80386, documented (as INT1) since Pentium Pro. Executes as undocumented instruction prefix on 8086 and 80286.<ref>Retrocomputing StackExchange, 0F1h opcode-prefix on i80286. Archived on 13 Apr 2023.</ref>
TEST r/m8,imm8	F6 /1 ib	Undocumented variants of the TEST instruction.<ref name="test_and_sal">Frank van Gilluwe, "The Undocumented PC – Second Edition", p. 93-95</ref> Performs the same operation as the documented Template:Nowrap and Template:Nowrap variants, respectively.	Available since the 8086. Unavailable on some 80486 steppings.<ref>Michal Necasek, Intel 486 Errata?, 6 Dec 2015. Archived on 29 Nov 2023.</ref><ref name="hummel">Robert Hummel, "PC Magazine Programmer's Technical Reference" (Template:ISBN) p.728</ref>
Template:Nowrap Template:Nowrap	Template:Nowrap, Template:Nowrap
SHL, SAL	Template:Nowrap, Template:Nowrap	Undocumented variants of the SHL instruction.<ref name="test_and_sal" /> Performs the same operation as the documented Template:Nowrap and Template:Nowrap variants, respectively.	Available since the 80186 (performs different operation on the 8086)<ref>Raúl Gutiérrez Sanz, Undocumented 8086 Opcodes, Part I, 27 Dec 2017. Archived on 29 Nov 2023.</ref>
(multiple)	Template:Nowrap	Alias of opcode 80h, which provides variants of 8-bit integer instructions (ADD, OR, ADC, SBB, AND, SUB, XOR, CMP) with an 8-bit immediate argument.<ref name="asm-opcode-82h" />	citation	CitationClass=web }}</ref> Explicitly unavailable in 64-bit mode but kept and reserved for compatibility.Template:Sfn
OR/AND/XOR r/m16,imm8	Template:Nowrap	16-bit OR/AND/XOR with a sign-extended 8-bit immediate.	Available on 8086, but only documented from 80386 onwards.<ref>Intel, The 8086 Family User's Manual, October 1979, opcodes omitted on pages 4-25 and 4-31</ref><ref>Retrocomputing StackExchange, Undocumented instructions in x86 CPU prior to 80386?, 4 Jun 2021. Archived on 18 Jul 2023.</ref>
Template:Nowrap	F2 (A4..A5)	The behavior of the F2 prefix (REPNZ, REPNE) when used with string instructions other than CMPS/SCAS is officially undefined, but there exists commercial software (e.g. the version of FDISK distributed with MS-DOS versions 3.30 to 6.22<ref>Daniel B. Sedory, An Examination of the Standard MBR, 2000. Archived on 6 Oct 2023.</ref>) that rely on it to behave in the same way as the documented F3 (REP) prefix.	Available since the 8086.
Template:Nowrap	F2 (AA..AB)
REP RET	F3 C3	The use of the REP prefix with the RET instruction is not listed as supported in either the Intel SDM or the AMD APM. However, AMD's optimization guide for the AMD-K8 describes the Template:Nowrap encoding as a way to encode a two-byte RET instruction – this is the recommended workaround for an issue in the AMD-K8's branch predictor that can cause branch prediction to fail for some 1-byte RET instructions.<ref>AMD, Software Optimization Guide for AMD64 Processors (publication 25112, revision 3.06, sep 2005), section 6.2, p.128</ref> At least some versions of gcc are known to use this encoding.<ref>GCC bugzilla, Bug 48227 – "rep ret" generated for -march=core2. Archived on 9 Apr 2023.</ref>	Executes as RET on all known x86 CPUs.
NOP	67 90	NOP with address-size override prefix. The use of the 67h prefix for instructions without memory operands is listed by the Intel SDM (vol 2, section 2.1.1) as "reserved", but it is used in Microsoft Windows 95 as a workaround for a bug in the B1 stepping of Intel 80386.<ref>Raymond Chen, My, what strange NOPs you have!, 12 Jan 2011. Archived on 20 May 2023.</ref><ref>Jeff Parsons, Intel 80386 CPU information (B1 errata section, item #7). Archived on 13 Nov 2023.</ref>	Executes as NOP on 80386 and later.
NOP r/m	0F 1F /0	Official long NOP. Introduced in the Pentium Pro in 1995, but remained undocumented until March 2006.<ref name="longnop2006" /><ref>Intel Software Developers Manual, volume 2B (Jan 2006, order no 235667-018, does not have long NOP)</ref><ref>Intel Software Developers Manual, volume 2B (March 2006, order no 235667-019, has long NOP)</ref>	Available on Pentium Pro and AMD K7<ref>Agner Fog, Instruction Tables, AMD K7 section.</ref> and later. Unavailable on AMD K6, AMD Geode LX, VIA Nehemiah.<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref>
NOP r/m	0F 0D /r	Reserved-NOP. Introduced in Template:Nowrap Pentium 4. Intel documentation lists this opcode as NOP in opcode tables but not instruction listings since June 2005.<ref>Intel Software Developers Manual, volume 2B (April 2005, order no 235667-015, does not list 0F0D-nop)</ref><ref>Intel Software Developers Manual, volume 2B (June 2005, order no 235667-016, lists 0F0D-nop in opcode table but not under NOP instruction description.)</ref> From Broadwell onwards, Template:Nowrap has been documented as PREFETCHW, while Template:Nowrap have been reported to exhibit undocumented prefetch functionality.<ref name="cattius_0f0d" /> On AMD CPUs, Template:Nowrap with a memory argument is documented as PREFETCH/PREFETCHW since K6-2 – originally as part of 3Dnow!, but has been kept in later AMD CPUs even after the rest of 3Dnow! was dropped.	Available on Intel CPUs since Template:Nowrap Template:Nowrap.
UD1	0F B9 /r	Intentionally undefined instructions, but unlike UD2 (Template:Nowrap) these instructions were left unpublished until December 2016.<ref>Intel Software Developers Manual, volume 2B (order no. 253667-060, September 2016) does not list UD0 and UD1.</ref><ref name="intel_ud0_ud1" /> Microsoft Windows 95 Setup is known to depend on Template:Nowrap being invalid<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref><ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref> – it is used as a self check to test that its #UD exception handler is working properly. Other invalid opcodes that are being relied on by commercial software to produce #UD exceptions include Template:Nowrap (DIF-2,<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref> LaserLok<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref>) and Template:Nowrap ("BOP"<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref><ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref>), however as of January 2022 they are not published as intentionally invalid opcodes.	All of these opcodes produce #UD exceptions on 80186 and later (except on NEC V20/V30, which assign at least Template:Nowrap to the NEC-specific BRKEM instruction.)
UD0	0F FF

Undocumented instructions that appear only in a limited subset of x86 CPUs include

Mnemonics	Opcodes	Description	Status
REP MUL	F3 F6 /4, F3 F7 /4	On 8086/8088, a REP or REPNZ prefix on a MUL or IMUL instruction causes the result to be negated. This is due to the microcode using the “REP prefix present” bit to store the sign of the result.	8086/8088 only.<ref name="rep imul">{{#invoke:citation/CS1|citation	CitationClass=web }}</ref>
REP IMUL	F3 F6 /5, F3 F7 /5
REP IDIV	F3 F6 /7, F3 F7 /7	On 8086/8088, a REP or REPNZ prefix on an IDIV (but not DIV) instruction causes the quotient to be negated. This is due to the microcode using the “REP prefix present” bit to store the sign of the quotient.	8086/8088 only.<ref name="rep imul" />
SAVEALL, STOREALL	(F1) 0F 04	Exact purpose unknown, causes CPU hang (HCF). The only way out is CPU reset.<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref> In some implementations, emulated through BIOS as a halting sequence.<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref> In a forum post at the Vintage Computing Federation, this instruction (with F1 prefix) is explained as SAVEALL. It interacts with ICE mode.	Only available on 80286.
LOADALL	0F 05	Loads All Registers from Memory Address 0x000800H	Only available on 80286. Opcode reused for SYSCALL in AMD K6 and later CPUs.
LOADALLD	0F 07	Loads All Registers from Memory Address ES:EDI	Only available on 80386. Opcode reused for SYSRET in AMD K6 and later CPUs.
CL1INVMB	0F 0A<ref>Intel's RCCE library for the SCC used opcode 0F 0A for SCC's message invalidation instruction.</ref>	On the Intel SCC (Single-chip Cloud Computer), invalidate all message buffers. The mnemonic and operation of the instruction, but not its opcode, are described in Intel's SCC architecture specification.<ref>Intel Labs, SCC External Architecture Specification (EAS), Revision 0.94, p.29. Archived on May 22, 2022.</ref>	Available on the SCC only.
PATCH2	0F 0E	On AMD K6 and later maps to FEMMS operation (fast clear of MMX state) but on Intel identified as uarch data read on Intel<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref>	Only available in Red unlock state (0F 0F too)
PATCH3	0F 0F	Write uarch	Can change RAM part of microcode on Intel
UMOV r,r/m, UMOV r/m,r	0F (10..13) /r	Moves data to/from user memory when operating in ICE HALT mode.<ref>Robert R. Collins, Undocumented OpCodes: UMOV. Archived on Feb 21, 2001.</ref> Acts as regular MOV otherwise.	Available on some 386 and 486 processors only. Opcodes reused for SSE instructions in later CPUs.
NXOP	0F 55	NexGen hypercode interface.<ref>Herbert Oppmann, NXOP (Opcode 0Fh 55h)</ref>	Available on NexGen Nx586 only.
(multiple)	Template:Nowrap<ref>Herbert Oppmann, NexGen Nx586 Hypercode Source, see COMMON.INC. Archived on 9 Apr 2023.</ref>	NexGen Nx586 "hyper mode" instructions. The NexGen Nx586 CPU uses "hyper code"<ref>Herbert Oppmann, Inside the NexGen Nx586 System BIOS. Archived on 29 Dec 2023.</ref> (x86 code sequences unpacked at boot time and only accessible in a special "hyper mode" operation mode, similar to DEC Alpha's PALcode and Intel's XuCode<ref>Intel, XuCode: An Innovative Technology for Implementing Complex Instruction Flows, May 6, 2021. Archived on Jul 19, 2022.</ref>) for many complicated operations that are implemented with microcode in most other x86 CPUs. The Nx586 provides a large number of undocumented instructions to assist hyper mode operation.	Available in Nx586 hyper mode only.
Template:Nowrap	0F 0F /r BB	citation	CitationClass=web }}</ref> Instruction known to be recognized by MASM 6.13 and 6.14.	Available on K6-2 and K6-3 only. Opcode reused for documented PSWAPD instruction from AMD K7 onwards.
Template:Unknown mnemonic	64 D6	citation	CitationClass=web }}</ref>	Available on the UMC Green CPU only. Executes as SALC on non-UMC CPUs.
FS: Jcc	64 (70..7F) rel8,	On Intel NetBurst (Pentium 4) CPUs, the 64h (FS: segment) instruction prefix will, when used with conditional branch instructions, act as a branch hint to indicate that the branch will be alternating between taken and not-taken.<ref>Agner Fog, The Microarchitecture of Intel, AMD and VIA CPUs, section 3.4 "Branch Prediction in P4 and P4E". Archived on 7 Jan 2024.</ref> Unlike other NetBurst branch hints (CS: and DS: segment prefixes), this hint is not documented.	Available on NetBurst CPUs only. Segment prefixes on conditional branches are accepted but ignored by non-NetBurst CPUs.
JMPAI	0F 3F	Jump and execute instructions in the undocumented Alternate Instruction Set.	Only available on some x86 processors made by VIA Technologies.
(FMA4)	VEX.66.0F38 (5C..5F,68..6F,78..7F) /r imm8	On AMD Zen1, FMA4 instructions are present but undocumented (missing CPUID flag). The reason for leaving the feature undocumented may or may not have been due to a buggy implementation.<ref>Reddit /r/Amd discussion thread: Ryzen has undocumented support for FMA4</ref>	Removed from Zen2 onwards.
Template:Unknown	0F 0F /r ??	The whitepapers for SandSifter<ref name="sandsifter" /> and UISFuzz<ref name="uisfuzz" /> report the detection of large numbers of undocumented instructions in the 3DNow! opcode range on several different AMD CPUs (at least Geode NX and C-50). Their operation is not known. On at least AMD K6-2, all of the unassigned 3DNow! opcodes (other than the undocumented PF2IW, PI2FW and PSWAPW instructions) are reported to execute as equivalents of POR (MMX bitwise-OR instruction).<ref name="mazur_3dnow" />	Present on some AMD CPUs with 3DNow!.
MOVDB, GP2MEM	Template:Unknown	Microprocessor Report's article "MediaGX Targets Low-Cost PCs" from 1997, covering the introduction of the Cyrix MediaGX processor, lists several new instructions that are said to have been added to this processor in order to support its new "Virtual System Architecture" features, including MOVDB and GP2MEM – and also mentions that Cyrix did not intend to publish specifications for these instructions.<ref>Microprocessor Report, MediaGX Targets Low-Cost PCs (vol 11, no. 3, mar 10, 1997). Archived on 6 Jun 2022.</ref>	Template:Unknown
REP XSHA512	Template:Nowrap	Perform SHA-512 hashing. Supported by OpenSSL<ref>{{#invoke:citation/CS1|citation	CitationClass=web }}</ref> as part of its VIA PadLock support, and listed in a Zhaoxin-supplied Linux kernel patch,<ref>https://lkml.iu.edu/2308.0/02183.html</ref> but not documented by the VIA PadLock Programming Guide.	Only available on some x86 processors made by VIA Technologies and Zhaoxin.
REP XMODEXP	F3 0F A6 F8	Instructions to perform modular exponentiation and random number generation, respectively. Listed in a VIA-supplied patch to add support for VIA Nano-specific PadLock instructions to OpenSSL,<ref>Kary Jin, PATCH: Update PadLock engine for VIA C7 and Nano CPUs, openssl-dev mailing list, 10 Jun 2011. Archived on 11 Feb 2022.</ref> but not documented by the VIA PadLock Programming Guide.
XRNG2	F3 0F A7 F8
Template:Unknown mnemonic	Template:Nowrap	Template:Unknown
Template:Unknown mnemonic	F2 0F A6 C0	Zhaoxin SM2 instruction. CPUID flags listed in a Linux kernel patch for OpenEuler,<ref name="openeuler_zx_cpuid" /> description and opcode (but no instruction mnemonic) provided in a Zhaoxin patent application<ref>USPTO/Zhaoxin, Patent application US2023/006718: Processor with a hash cryptographic algorithm and data processing thereof, pages 13 and 45, Mar 2, 2023. Archived on Sep 12, 2023.</ref> and a Zhaoxin-provided Linux kernel patch.<ref>https://lwn.net/Articles/950884/</ref>	Present in Zhaoxin KX-6000G.<ref name="zx6000g_cpuid" />
ZXPAUSE	F2 0F A6 D0	Pause the processor until the Time Stamp Counter reaches or exceeds the value specified in EDX:EAX. Low-power processor C-state can be requested in ECX. Listed in OpenEuler kernel patch.<ref>OpenEuler kernel pull request 2602: x86/delay: add support for Zhaoxin ZXPAUSE instruction. Gitee. 26 Oct 2023. Archived on 22 Jan 2024.</ref>	Present in Zhaoxin KX-7000.
MONTMUL2	Template:Unknown	Zhaoxin RSA/"xmodx" instructions. Mnemonics and CPUID flags are listed in a Linux kernel patch for OpenEuler,<ref name="openeuler_zx_cpuid">https://gitee.com/openeuler/kernel/pulls/85</ref> but opcodes and instruction descriptions are not available.	Template:Unknown

Undocumented x87 instructions

Mnemonics	Opcodes	Description	Status
FENI, FENI8087_NOP	DB E0	FPU Enable Interrupts (8087)	Documented for the Intel 80287.<ref name="i80287" /> Present on all Intel x87 FPUs from 80287 onwards. For FPUs other than the ones where they were introduced on (8087 for FENI/FDISI and 80287 for FSETPM), they act as NOPs. These instructions and their operation on modern CPUs are commonly mentioned in later Intel documentation, but with opcodes omitted and opcode table entries left blank (e.g. Intel SDM 325462-077, April 2022 mentions them twice without opcodes). The opcodes are, however, recognized by Intel XED.<ref>ISA datafile for Intel XED (April 17, 2022), lines 916-944</ref>
FDISI, FDISI8087_NOP	DB E1	FPU Disable Interrupts (8087)
FSETPM, FSETPM287_NOP	DB E4	FPU Set Protected Mode (80287)
(no mnemonic)	Template:Nowrap Template:Nowrap Template:Nowrap Template:Nowrap Template:Nowrap	"Reserved by Cyrix" opcodes	These opcodes are listed as reserved opcodes that will produce "unpredictable results" without generating exceptions on at least Cyrix 6x86,<ref>Cyrix 6x86 processor data book, page 6-34</ref> 6x86MX, MII, MediaGX, and AMD Geode GX/LX.<ref>AMD Geode LX Processors Data Book, publication 33234H, p.670</ref> (The documentation for these CPUs all list the same ten opcodes.) Their actual operation is not known, nor is it known whether their operation is the same on all of these CPUs.

See also

• CLMUL
• RDRAND
• Advanced Vector Extensions 2
• AVX-512
• x86 Bit manipulation instruction set
• CPUID
• List of discontinued x86 instructions

References

• {{#invoke:citation/CS1|citation

|CitationClass=web }}

External links

• Free IA-32 and x86-64 documentation, provided by Intel
• AMD64 Architecture Programmer's Manual, Volumes 1-5, provided by AMD
• x86 Opcode and Instruction Reference
• x86 and amd64 instruction reference
• Instruction tables: Lists of instruction latencies, throughputs and micro-operation breakdowns for Intel, AMD and VIA CPUs
• Netwide Assembler Instruction List (from Netwide Assembler)