x86 instruction listings

IMUL BX,12h
IMUL DX,1200h
IMUL CX, DX, 12h
IMUL BX, SI, 1200h
IMUL DI, word ptr [BX+SI], 12h
IMUL SI, word ptr [BP-4], 1200h

Note that since the lower half is the same for unsigned and signed multiplication, this version of the instruction can be used for unsigned multiplication as well.

First argument specifies an 8/16-bit register or memory location.

Second argument specifies which bit to test.

Performs a string addition of integers in packed BCD format (2 BCD digits per byte). DS:SI points to a source integer, ES:DI to a destination integer, and CL provides the number of digits to add. The operation is then: destination <- destination + source

destination <- destination - source

Concatenates its 8-bit argument with the bottom 4 bits of AL to form a 12-bit bitvector, then left-rotates this bitvector by 4 bits, then writes this bitvector back to its argument and the bottom 4 bits of AL.

Perform a bitfield read from memory. DS:SI (DS0:IX in NEC nomenclature) points to memory location to read from, first argument specifies bit-offset to read from, and second argument specifies the number of bits to read minus 1. The result is placed in AX. After the bitfield read, SI and the first argument are updated to point just beyond the just-read bitfield.

Perform a bitfield write to memory. ES:DI (DS1:IY in NEC nomenclature) points to memory location to write to, AX contains data to write, first argument specifies bit-offset to write to, and second argument specifies the number of bits to write minus 1. After the bitfield write, DI and the first argument are updated to point just beyond the just-written bitfield.

67 /r

Escape opcodes for floating-point coprocessor. No coprocessor using these opcodes is known to have been built.^[3]

Jump to an address picked from the Interrupt Vector Table using the imm8 argument, similar to the INT instruction, but start executing as Intel 8080 code rather than x86 code.

Jump to an address picked from the Interrupt Vector Table using the imm8 argument. Enables a simple memory paging mechanism after reading the IVT but before executing the jump. The paging mechanism uses an on-chip page table with 16Kbyte pages and no access rights checking.^[4]

Jump to an address picked from the Interrupt Vector Table using the imm8 argument. Disables paging after reading the IVT but before executing the jump.

The first argument specifies a V25/V35 Special Function Register to test a bit in. The second argument specifies a bit position in that register. The third argument specifies a short branch offset. If the bit was set to 1, then it is cleared and a short branch is taken, else the branch is not taken.

Jump to an address picked from the Interrupt Vector Table using the imm8 argument, and then continue execution with "Software Guard" enabled. The "Software Guard" is an 8-bit Substitution cipher that, during instruction fetch/decode, translates opcode bytes using a 256-entry lookup table stored in an on-chip Mask ROM.

SHLD and SHRD with 16-bit arguments and a shift-amount greater than 16 produce undefined results. (Actual results differ between different Intel CPUs, with at least three different behaviors known^[8].)

Used by software mainly for detection of the buggy^[9] B0 stepping of the 80386. Microsoft Windows (v2.01 and later) will attempt to run the XBTS instruction as part of its CPU detection if CPUID is not present, and will refuse to boot if XBTS is found to be working.^[10]

0F B0/B1 encodings available on 80486 stepping B and later x86 CPUs.

Instruction atomic only if used with LOCK prefix.

Instruction atomic only if used with LOCK prefix.

CMOVcc r32,r/m

The whole 0F 18..1F opcode range was NOP in Pentium Pro. However, except for 0F 1F /0, Intel does not guarantee that these opcodes will remain NOP in future processors, and have indeed assigned some of these opcodes to other instructions in at least some processors.^[18]

On the Pentium Pro, the CPUID instruction reports these instructions as available. This is considered incorrect, as the instructions are not officially supported on the Pentium Pro. (Third party testing indicates that the instructions are present but too defective to be usable on the Pentium Pro^[19].)

${\displaystyle 2^{x}}$

On 8087, only supported for ${\displaystyle 0\leq x\leq {\frac {1}{2}}}$.

On 80387 and later, supported for ${\displaystyle -1\leq x\leq 1}$.

Performing rounding based on rounding control on 80387 and later.

${\displaystyle \arctan {\frac {st(1)}{st(0)}}}$

On 8087, only supported for ${\displaystyle |st(0)|\leq |st(1)|}$. This restriction was removed on the 80387.

May compute a partial remainder, in which case it must be run again (signalled by C2 flag register).

${\displaystyle |x|\leq {\frac {\pi }{4}}}$

On 80387 and later, supported for ${\displaystyle |x|<2^{63}}$

Only supported for ${\displaystyle |x|\leq \left(1-{\sqrt {\frac {1}{2}}}\right)\approx 0.2929}$

or

DB E5^[3]

Instruction to signal to the FPU that the main CPU is exiting protected mode, similar to how the FSETPM instruction is used to signal to the FPU that the CPU is entering protected mode.

Different sources provide different encodings for this instruction.

FMUL4X4

SETALC

F7 /1

Unavailable on some 80486 steppings.^[38][39]

SAL

(C0..C1) /6

REPNZ STOS

F2 (AA..AB)

INT1

Introduced in the Pentium Pro in 1995, but remained undocumented until March 2006.^[17][42][43]

Unavailable on AMD K6, AMD Geode LX, VIA Nehemiah.^[45]

UD0

0F FF

Microsoft Windows 95 Setup is known to depend on 0F FF being invalid^[48][49] - it is used as a self check to test that its #UD exception handler is working properly.

Other invalid opcodes that are being relied on by commercial software to produce #UD exceptions include FF FF (DIF-2,^[50] LaserLok^[51]) and C4 C4 ("BOP"^[52][53]), however as of January 2022 they are not published as intentionally invalid opcodes.

In some implementations, emulated through BIOS as a halting sequence.^[55]

In a forum post at the Vintage Computing Federation, this instruction is explained as SAVEALL. It interacts with ICE mode.

Opcode reused for SYSCALL in AMD K6-2 and later CPUs.

Opcode reused for SYSRET in AMD K6-2 and later CPUs.

Opcodes reused for SSE instructions in later CPUs.

The NexGen Nx586 CPU uses "hyper code"^[61] (x86 code sequences unpacked at boot time and only accessible in a special "hyper mode" operation mode, similar to DEC Alpha's PALcode) for many complicated operations that are implemented with microcode in most other x86 CPUs. The Nx586 provides a large number of undocumented instructions to assist hyper mode operation.

64 0F (80..8F) rel16/32

Segment prefixes on conditional branches are accepted but ignored by non-NetBurst CPUs.

Supported by OpenSSL ^[64] as part of its VIA PadLock support, but not documented by the VIA PadLock Programming Guide.

Unknown operation, may be related to the documented XSTORE (0F A7 C0) instruction.

MONTMUL2

Available on most AMD x87 FPUs. Unavailable on AMD Geode GX/LX, DM&P Vortex86^[69] and NexGen 586PF.^[70]

Documented for the Intel 80287^[71] but then omitted from later manuals until the October 2017 update of the Intel SDM.^[72]

DE D0+i

DF C8+i

DF D8+i

Present on all Intel x87 FPUs from 80287 onwards. For FPUs other than the ones where they were introduced on (8087 for FENI/FDISI and 80287 for FSETPM), they act as NOPs.

These instructions and their operation on modern CPUs are commonly mentioned in later Intel documentation, but with opcodes omitted and opcode table entries left blank (e.g. Intel SDM 325462-076, december 2021 mentions them twice without opcodes).