x86 opcode chart

27
Opcode Mnemonic Parameters Bytes OSZAPC Ref #s General 0F 0F 3DNOWEXT 2 ------ 0F 0, AMD K6-2+ 37 AAA 1 ???*?* 2 D5 ib AAD (imm8) 2 ?**?*? 08 4 D4 ib AAM (imm8) 2 ?**?*? 08 5 3F AAS 1 ???*?* 2 10 /r ADC r/m8, r8 2 ****** 02 1/2 11 /r ADC r/m16/32, r16/32 2 ****** 01,02 1/2 12 /r ADC r8,r/m8 2 ****** 02 1/2 13 /r ADC r16/32, r/m16/32 2 ****** 01,02 1/2 14 ib ADC AL, imm8 2 ****** 1 15 iw/id ADC (E)AX, imm16/32 3/5 ****** 01 1 80 /2 ib ADC r/m8, imm8 3 ****** 02 1/2 81 /2 iw/id ADC r/m16/32, imm16/32 4/6 ****** 01,02 1/2 83 /2 ib ADC r/m16/32, imm8 3 ****** 01,02 1/2 00 /r ADD r/m8, r8 2 ****** 02 1/2 01 /r ADD r/m16/32, r16/32 2 ****** 01,02 1/2 02 /r ADD r8, r/m8 2 ****** 02 1/2 03 /r ADD r16/32, r/m16/32 2 ****** 01,02 1/2 04 ib ADD AL, imm8 2 ****** 1 05 iw/id ADD (E)AX, imm16/32 3/5 ****** 01 1 80 /0 ib ADD r/m8, imm8 3 ****** 02 1/2 81 /0 iw/id ADD r/m16/32, imm16/32 4/6 ****** 01,02 1/2 83 /0 ib ADD r/m16/32, imm8 3 ****** 01,02 1/2 67 ADDSIZE ------ 0F 0, 386+ 20 /r AND r/m8, r8 2 0**?*0 02 1/2 21 /r AND r/m16/32, r16/32 2 0**?*0 01,02 1/2 22 /r AND r8, r/m8 2 0**?*0 02 1/2 23 /r AND r16/32, r/m16/32 2 0**?*0 01,02 1/2 24 ib AND AL, imm8 2 0**?*0 1 25 iw/id AND (E)AX, imm16/32 3/5 0**?*0 01 1 80 /4 ib AND r/m8, imm8 3 0**?*0 02 1/2 81 /4 iw/id AND r/m16/32, imm16/32 4/6 0**?*0 01,02 1/2 83 /4 ib AND r/m16/32, imm8 3 0**?*0 01,02 1/2 63 /r ARPL r/m16, r16 2 --*--- 02 4, 286+ 62 /r BOUND r16/32, m16/32 2 ------ 01,02 4, 186+ 0F BC /r BSF r16/32, r/m16/32 3 --*--- 01,02 3-8, 386+ 0F BD /r BSR r16/32, r/m16/32 3 --*--- 01,02 3-9, 386+ 0F C8 /r BSWAP r32 3 ------ 01 1, 486+ 0F A3 /r BT r/m16/32, r16/32 3 -----* 01,02 3/4, 386+ 0F BA /4 ib BT r/m16/32, imm8 4 -----* 01,02 3, 386+ 0F BA /7 ib BTC r/m16/32, imm8 4 -----* 01,02 4, 386+ 0F BB /r BTC r/m16/32, r16/32 3 -----* 01,02 4/5, 386+ 0F B3 /r BTR r/m16/32, r16/32 3 -----* 01,02 4/5, 386+ 0F BA /6 ib BTR r/m16/32, imm8 4 -----* 01,02 4, 386+ 0F AB /r BTS r/m16/32, r16/32 3 -----* 01,02 4/5, 386+ 0F BA /5 ib BTS r/m16/32, imm8 4 -----* 01,02 4, 386+ 9A far32/48 CALL far16:16/32 5/7 ------ 01 2-9 E8 iw/id CALL rel16/32 3/5 ------ 01 1 FF /2 CALL r/m16/32 2 ------ 01,84 4

Upload: kotz-nidin

Post on 02-Dec-2014

170 views

Category:

Documents


1 download

TRANSCRIPT

Page 1: x86 Opcode Chart

Opcode Mnemonic Parameters Bytes OSZAPC Ref #s General

0F 0F 3DNOWEXT 2 ------ 0F 0, AMD K6-2+

37 AAA 1 ???*?* 2

D5 ib AAD (imm8) 2 ?**?*? 08 4

D4 ib AAM (imm8) 2 ?**?*? 08 5

3F AAS 1 ???*?* 2

10 /r ADC r/m8, r8 2 ****** 02 1/2

11 /r ADC r/m16/32, r16/32 2 ****** 01,02 1/2

12 /r ADC r8,r/m8 2 ****** 02 1/2

13 /r ADC r16/32, r/m16/32 2 ****** 01,02 1/2

14 ib ADC AL, imm8 2 ****** 1

15 iw/id ADC (E)AX, imm16/32 3/5 ****** 01 1

80 /2 ib ADC r/m8, imm8 3 ****** 02 1/2

81 /2 iw/id ADC r/m16/32, imm16/32 4/6 ****** 01,02 1/2

83 /2 ib ADC r/m16/32, imm8 3 ****** 01,02 1/2

00 /r ADD r/m8, r8 2 ****** 02 1/2

01 /r ADD r/m16/32, r16/32 2 ****** 01,02 1/2

02 /r ADD r8, r/m8 2 ****** 02 1/2

03 /r ADD r16/32, r/m16/32 2 ****** 01,02 1/2

04 ib ADD AL, imm8 2 ****** 1

05 iw/id ADD (E)AX, imm16/32 3/5 ****** 01 1

80 /0 ib ADD r/m8, imm8 3 ****** 02 1/2

81 /0 iw/id ADD r/m16/32, imm16/32 4/6 ****** 01,02 1/2

83 /0 ib ADD r/m16/32, imm8 3 ****** 01,02 1/2

67 ADDSIZE ------ 0F 0, 386+

20 /r AND r/m8, r8 2 0**?*0 02 1/2

21 /r AND r/m16/32, r16/32 2 0**?*0 01,02 1/2

22 /r AND r8, r/m8 2 0**?*0 02 1/2

23 /r AND r16/32, r/m16/32 2 0**?*0 01,02 1/2

24 ib AND AL, imm8 2 0**?*0 1

25 iw/id AND (E)AX, imm16/32 3/5 0**?*0 01 1

80 /4 ib AND r/m8, imm8 3 0**?*0 02 1/2

81 /4 iw/id AND r/m16/32, imm16/32 4/6 0**?*0 01,02 1/2

83 /4 ib AND r/m16/32, imm8 3 0**?*0 01,02 1/2

63 /r ARPL r/m16, r16 2 --*--- 02 4, 286+

62 /r BOUND r16/32, m16/32 2 ------ 01,02 4, 186+

0F BC /r BSF r16/32, r/m16/32 3 --*--- 01,02 3-8, 386+

0F BD /r BSR r16/32, r/m16/32 3 --*--- 01,02 3-9, 386+

0F C8 /r BSWAP r32 3 ------ 01 1, 486+

0F A3 /r BT r/m16/32, r16/32 3 -----* 01,02 3/4, 386+

0F BA /4 ib BT r/m16/32, imm8 4 -----* 01,02 3, 386+

0F BA /7 ib BTC r/m16/32, imm8 4 -----* 01,02 4, 386+

0F BB /r BTC r/m16/32, r16/32 3 -----* 01,02 4/5, 386+

0F B3 /r BTR r/m16/32, r16/32 3 -----* 01,02 4/5, 386+

0F BA /6 ib BTR r/m16/32, imm8 4 -----* 01,02 4, 386+

0F AB /r BTS r/m16/32, r16/32 3 -----* 01,02 4/5, 386+

0F BA /5 ib BTS r/m16/32, imm8 4 -----* 01,02 4, 386+

9A far32/48 CALL far16:16/32 5/7 ------ 01 2-9

E8 iw/id CALL rel16/32 3/5 ------ 01 1

FF /2 CALL r/m16/32 2 ------ 01,84 4

Page 2: x86 Opcode Chart

FF /3 CALL m16:16/32 2 ------ 01,84 4-9

98 CBW 1 ------ 01 2

99 CDQ 1 ------ 01 2, 386+

F8 CLC 1 -----0 2

FC CLD 1 ------ 2

FA CLI 1 ------ 4

0F 06 CLTS 2 ------ 80 4, 386+

F5 CMC 1 -----* 2

0F 40+cc /r CMOVcc r16/32, r/m16/32 3 ------ 01,02 ?, PPro+

38 /r CMP r/m8, r8 2 ****** 02 1/2

39 /r CMP r/m16/32, r16/32 2 ****** 01,02 1/2

3A /r CMP r8, r/m8 2 ****** 02 1/2

3B /r CMP r16/32, r/m16/32 2 ****** 01,02 1/2

3C ib CMP AL, imm8 2 ****** 1

3D iw/id CMP (E)AX, imm16/32 3/5 ****** 01 1

80 /7 ib CMP r/m8, imm8 3 ****** 02 1/2

81 /7 iw/id CMP r/m16/32, imm16/32 4/6 ****** 01,02 1/2

83 /7 ib CMP r/m16/32, imm8 3 ****** 01,02 1/2

A6 CMPSB 1 ****** 02,11 3/4+

A7 CMPSD 1 ****** 01,02,11 3/4+, 386+

A7 CMPSW 1 ****** 01,02,11 3/4+

0F B0 /r CMPXCHG r/m8, r8 3 ****** 02,12 3, 486+

0F B1 /r CMPXCHG r/m16/32, r16/32 3 ****** 01,02,12 3, 486+

0F C7 /1 CMPXCHG8B m64 3 --*--- 02,12 4, P1+

0F A2 CPUID 2 ------ 5, 486/P1+

2E CS 1 ------ 0F 0

99 CWD 1 ------ 01 2

98 CWDE 1 ------ 01 2, 386+

27 DAA 1 ?***** 2

2F DAS 1 ?***** 2

48+r DEC r16/32 1 *****- 01 1

FE /1 DEC r/m8 2 *****- 02 1/2

FF /1 DEC r/m16/32 2 *****- 01,02 1/2

F6 /6 DIV r/m8 2 ?????? 02 5

F7 /6 DIV r/m16/32 2 ?????? 01,02 6|8

3E DS 1 ------ 0F 0

C8 iw ib ENTER imm16, imm8 4 ------ 01 4+

26 ES 1 ------ 0F 0

0F EXT 1 ------ 0F 0

64 FS 1 ------ 0F 0, 386+

65 GS 1 ------ 0F 0, 386+

F4 HLT 1 ------ 80 3

F6 /7 IDIV r/m8 2 ?????? 02 6

F7 /7 IDIV r/m16/32 2 ?????? 01,02 7|8

0F AF /r IMUL r16/32, r/m16/32 3 *????* 01,02 4, 386+

69 /r iw/id IMUL r16/32, r/m16/32, imm16/32 4/6 *????* 01,02 4, 186+

6B /r ib IMUL r16/32, r/m16/32, imm8 3 *????* 01,02 4, 186+

F6 /5 IMUL r/m8 2 *????* 02 4

F7 /5 IMUL r/m16/32 2 *????* 01,02 4

E4 ib IN AL, imm8 2 ------ 4-6

E5 ib IN (E)AX, imm8 2 ------ 01 4-6

Page 3: x86 Opcode Chart

EC IN AL, DX 1 ------ 4-6

ED IN (E)AX, DX 1 ------ 01 4-6

40+r INC r16/32 1 *****- 01 1

FE /0 INC r/m8 2 *****- 02 1/2

FF /0 INC r/m16/32 2 *****- 01,02 1/2

6C INSB 1 ------ 02,10 4-6/5+, 186+

6D INSD 1 ------ 01,02,10 4-6/5+, 386+

6D INSW 1 ------ 01,02,10 4-6/5+, 186+

CC INT 3 1 ------ 5+

CD ib INT imm8 2 ------ 5+

CE INTO 1 ------ 5+:3

0F 08 INVD 2 ------ 80 5, 486+

0F 01 /7 INVLPG mempnt 3 ------ 02,80 6, 486+

CF IRET 1 ****** 01 4-6+

CF IRETD 1 ****** 01 4-6+

0F 80+cc iw/id Jcc rel16/32 4/6 ------ 01,84 3, 386+

70+cc ib Jcc rel8 2 ------ 84 3

E3 ib JCXZ rel8 2 ------ 01,84 4

E3 ib JECXZ rel8 2 ------ 01,84 4, 386+

E9 iw/id JMP rel16/32 3/5 ------ 01EA far32/48 JMP far16:16/32 5/7 ------ 01EB ib JMP rel8 2 ------

FF /4 JMP r/m16/32 2 ------ 01,02,84FF /5 JMP m16:16/32 2 ------ 01,849F LAHF 1 ------

0F 02 /r LAR r16/32, r/m16/32 3 --*--- 01,020F AE /2 LDMXCSR m32 3 ------ 02,12C5 /r LDS r16/32, m16:16/32 2 ------ 01,028D /r LEA r16/32, mempnt 2 ------ 01,02C9 LEAVE 1 ------ 01C4 /r LES r16/32, m16:16/32 2 ------ 01,020F B4 /r LFS r16/32, m16:16/32 2 ------ 01,020F 01 /2 LGDT mempnt 3 ------ 01,02,800F B5 /r LGS r16/32, m16:16/32 2 ------ 01,020F 01 /3 LIDT mempnt 3 ------ 01,02,800F 00 /2 LLDT r/m16 3 ------ 02,80,830F 01 /6 LMSW r/m16 3 ------ 02,80,82F0 LOCK 1 ------ 0F 1

AC LODSB 1 ------ 02,10 2

AD LODSD 1 ------ 01,02,10 2, 386+

AD LODSW 1 ------ 01,02,10 2

E2 ib LOOP rel8 2 ------ 01,02,84E0 ib LOOPNZ rel8 2 ------ 01,02,84E1 ib LOOPZ rel8 2 ------ 01,02,840F 03 /r LSL r16/32, r/m16/32 3 --*--- 01,02,830F B2 /r LSS r16/32, m16:16/32 2 ------ 01,020F 00 /3 LTR r/m16 3 ------ 02,80,830F 20 /r MOV r32, CRx 3 ?????? 800F 21 /r MOV r32, DRx 3 ?????? 800F 22 /r MOV CRx, r32 3 ?????? 800F 23 /r MOV DRx, r32 3 ?????? 80

Page 4: x86 Opcode Chart

??? MOV r32, TRx 3??? MOV TRx, r32 388 /r MOV r/m8, r8 2 ------ 0289 /r MOV r/m16/32, r16/32 2 ------ 01,028A /r MOV r8, r/m8 2 ------ 028B /r MOV r16/32, r/m16/32 2 ------ 01,028C /r MOV r/m16, Sreg 2 ------ 01,028E /r MOV Sreg, r/m16 2 ------ 01,02A0 offset16/32 MOV AL, m8 3/5 ------ 02A1 offset16/32 MOV (E)AX, m16/32 3/5 ------ 01,02A2 offset16/32 MOV m8, AL 3/5 ------ 02A3 offset16/32 MOV m16/32, (E)AX 3/5 ------ 01,02B0+r ib MOV r8, imm8 2 ------

B8+r iw/id MOV r16/32, imm16/32 3/5 ------ 01C6 /0 ib MOV r/m8, imm8 3 ------ 02C7 /0 iw/id MOV r/m16/32, imm16/32 4/6 ------ 01,02A4 MOVSB 1 ------ 02,10A5 MOVSD 1 ------ 01,02,10A5 MOVSW 1 ------ 01,02,100F BE /r MOVSX r16/32, r/m8 3 ------ 01,020F BF /r MOVSX r32, r/m16 3 ------ 020F B6 /r MOVZX r16/32, r/m8 3 ------ 01,020F B7 /r MOVZX r32, r/m16 3 ------ 02F6 /4 MUL r/m8 2 *????* 02F7 /4 MUL r/m16/32 2 *????* 01,02F6 /3 NEG r/m8 2 ****** 02F7 /3 NEG r/m16/32 2 ****** 01,0290 NOP 1 ------

F6 /2 NOT r/m8 2 ------ 02F7 /2 NOT r/m16/32 2 ------ 01,0266 OPSIZE 1 ------ 0F08 /r OR r/m8, r8 2 0**?*0 0209 /r OR r/m16/32, r16/32 2 0**?*0 01,020A /r OR r8, r/m8 2 0**?*0 020B /r OR r16/32, r/m16/32 2 0**?*0 01,020C ib OR AL, imm8 2 0**?*0

0D iw/id OR (E)AX, imm16/32 3/5 0**?*0 0180 /1 ib OR r/m8, imm8 3 0**?*0 0281 /1 iw/id OR r/m16/32, imm16/32 4/6 0**?*0 01,0283 /1 ib OR r/m16/32, imm8 3 0**?*0 01,02E6 ib OUT imm8, AL 2 ------

E7 ib OUT imm8, (E)AX 2 ------ 01EE OUT DX, AL 1 ------

EF OUT DX, (E)AX 1 ------ 016E OUTSB 1 ------ 106F OUTSD 1 ------ 01,106F OUTSW 1 ------ 01,1007 POP ES 1 ------ 0117 POP SS 1 ------ 010F A1 POP FS 2 ------ 010F A9 POP GS 2 ------ 01

Page 5: x86 Opcode Chart

1F POP DS 1 ------ 0158+r POP r16/32 1 ------ 018F /0 POP m16/32 2 ------ 01,0261 POPA 1 ------ 0161 POPAD 1 ------ 019D POPF 1 ****** 019D POPFD 1 ****** 010F 18 /0 PREFETCHNTA m8 3 ------ 02,120F 18 /1 PREFETCHT0 m8 3 ------ 02,120F 18 /2 PREFETCHT1 m8 3 ------ 02,120F 18 /3 PREFETCHT2 m8 3 ------ 02,1206 PUSH ES 1 ------ 0116 PUSH SS 1 ------ 010E PUSH CS 1 ------ 010F A0 PUSH FS 2 ------ 010F A8 PUSH GS 2 ------ 011E PUSH DS 1 ------ 0150+r PUSH r16/32 1 ------ 0168 iw/id PUSH imm16/32 3/5 ------ 016A ib PUSH imm8 2 ------ 01FF /6 PUSH r/m16/32 2 ------ 01,0260 PUSHA 1 ------ 0160 PUSHAD 1 ------ 019C PUSHF 1 ------ 019C PUSHFD 1 ------ 01C0 /2 ib RCL r/m8, imm8 3 *----* 02C1 /2 ib RCL r/m16/32, imm8 3 *----* 01,02D0 /2 RCL r/m8, 1 2 *----* 02D1 /2 RCL r/m16/32, 1 2 *----* 01,02D2 /2 RCL r/m8, CL 2 *----* 02D3 /2 RCL r/m16/32, CL 2 *----* 01,02C0 /3 ib RCR r/m8, imm8 3 *----* 02C1 /3 ib RCR r/m16/32, imm8 3 *----* 01,02D0 /3 RCR r/m8, 1 2 *----* 02D1 /3 RCR r/m16/32, 1 2 *----* 01,02D2 /3 RCR r/m8, CL 2 *----* 02D3 /3 RCR r/m16/32, CL 2 *----* 01,020F 32 RDMSR 2 ------ 800F 33 RDPMC 2 ------ 800F 31 RDTSC 2 ------ 80F3 REP 1 ------ 0FF3 REPE 1 ------ 0FF2 REPNE 1 ------ 0FC2 iw RET imm16 3 ------ 01,84C3 RET 1 ------ 84CA iw RETF imm16 3 ------ 01,84CB RETF 1 ------ 84C0 /0 ib ROL r/m8, imm8 3 *----* 02C1 /0 ib ROL r/m16/32, imm8 3 *----* 01,02D0 /0 ROL r/m8, 1 2 *----* 02D1 /0 ROL r/m16/32, 1 2 *----* 01,02

Page 6: x86 Opcode Chart

D2 /0 ROL r/m8, CL 2 *----* 02D3 /0 ROL r/m16/32, CL 2 *----* 01,02C0 /1 ib ROR r/m8, imm8 3 *----* 02C1 /1 ib ROR r/m16/32, imm8 3 *----* 01,02D0 /1 ROR r/m8, 1 2 *----* 02D1 /1 ROR r/m16/32, 1 2 *----* 01,02D2 /1 ROR r/m8, CL 2 *----* 02D3 /1 ROR r/m16/32, CL 2 *----* 01,020F AA RSM 2 ****** 809E SAHF 1 -*****

C0 /7 ib SAR r/m8, imm8 3 ***?** 02C1 /7 ib SAR r/m16/32, imm8 3 ***?** 01,02D0 /7 SAR r/m8, 1 2 ***?** 02D1 /7 SAR r/m16/32, 1 2 ***?** 01,02D2 /7 SAR r/m8, CL 2 ***?** 02D3 /7 SAR r/m16/32, CL 2 ***?** 01,0218 /r SBB r/m8, r8 2 ****** 0219 /r SBB r/m16/32, r16/32 2 ****** 01,021A /r SBB r8, r/m8 2 ****** 021B /r SBB r16/32, r/m16/32 2 ****** 01,021C ib SBB AL, imm8 2 ****** 021D iw/id SBB (E)AX, imm16/32 3/5 ****** 01,0280 /3 ib SBB r/m8, imm8 3 ****** 0281 /3 iw/id SBB r/m16/32, imm16/32 4/6 ****** 01,0283 /3 ib SBB r/m16/32, imm8 3 ****** 01,02AE SCASB 1 ****** 11AF SCASD 1 ****** 01,11AF SCASW 1 ****** 01,110F 90+cc SETcc r/m8 3 ------ 020F AE F8 SFENCE 3 ------

0F 01 /0 SGDT mempnt 3 ------ 80C0 /4 ib SHL r/m8, imm8 3 ***?** 02C1 /4 ib SHL r/m16/32, imm8 3 ***?** 01,02D0 /4 SHL r/m8, 1 2 ***?** 02D1 /4 SHL r/m16/32, 1 2 ***?** 01,02D2 /4 SHL r/m8, CL 2 ***?** 02D3 /4 SHL r/m16/32, CL 2 ***?** 01,020F A4 /r ib SHLD r/m16/32, r16/32, imm8 4 ***?** 01,020F A5 /r SHLD r/m16/32, r16/32, CL 3 ***?** 01,02C0 /5 ib SHR r/m8, imm8 3 ***?** 02C1 /5 ib SHR r/m16/32, imm8 3 ***?** 01,02D0 /5 SHR r/m8, 1 2 ***?** 02D1 /5 SHR r/m16/32, 1 2 ***?** 01,02D2 /5 SHR r/m8, CL 2 ***?** 02D3 /5 SHR r/m16/32, CL 2 ***?** 01,020F AC /r ib SHRD r/m16/32, r16/32, imm8 4 ***?** 01,020F AD /r SHRD r/m16/32, r16/32, CL 3 ***?** 01,020F 01 /1 SIDT mempnt 3 ------ 800F 00 /0 SLDT r/m16/32 3 ------ 01,810F 01 /4 SMSW r16/32 / m16 3 ------ 01,8136 SS 1 ------ 0F

Page 7: x86 Opcode Chart

F3 SSEEXT 1 ------ 0FF9 STC 1 -----1

FD STD 1 ------

FB STI 1 ------

AA STOSB 1 ------ 10AB STOSD 1 ------ 01,10AB STOSW 1 ------ 01,100F 00 /1 STR r/m16 3 ------ 81,8328 /r SUB r/m8, r8 2 ****** 0229 /r SUB r/m16/32, r16/32 3/5 ****** 01,022A /r SUB r8, r/m8 2 ****** 022B /r SUB r16/32, r/m16/32 3/5 ****** 01,022C ib SUB AL, imm8 2 ******

2D iw/id SUB (E)AX, imm16/32 3/5 ****** 0180 /5 ib SUB r/m8, imm8 3 ****** 0281 /5 iw/id SUB r/m16/32, imm16/32 4/6 ****** 01,0283 /5 ib SUB r/m16/32, imm8 3 ****** 01,020F 34 SYSENTER 2 ------ 800F 35 SYSEXIT 2 ------ 8084 /r TEST r/m8, r8 2 0**?*0 0285 /r TEST r/m16/32, r16/32 2 0**?*0 01,02A8 ib TEST AL, imm8 2 0**?*0

A9 iw/id TEST (E)AX, imm16/32 3/5 0**?*0 01F6 /0 ib TEST r/m8, imm8 3 0**?*0 02F7 /0 iw/id TEST r/m16/32, imm16/32 4/6 0**?*0 01,020F 0B UD2 2 ------

0F 00 /4 VERR r/m16 3 --*---

0F 00 /5 VERW r/m16 3 --*---

9B WAIT 1 ------ 1-2

0F 09 WBINVD 2 ------ 80,820F 30 WRMSR 2 ------ 80,820F C0 /r XADD r/m8, r8 3 ****** 02,120F C1 /r XADD r/m16/32, r16/32 3 ****** 02,1286 /r XCHG r/m8, r8 2 ------ 02,1387 /r XCHG r/m16/32, r16/32 2 ------ 01,02,1390+r XCHG (E)AX, r16/32 1 ------ 01D7 XLATB 1 ------ 0230 /r XOR r/m8, r8 2 0**?*0 0231 /r XOR r/m16/32, r16/32 2 0**?*0 01,0232 /r XOR r8, r/m8 2 0**?*0 0233 /r XOR r16/32, r/m16/32 2 0**?*0 01,0234 ib XOR AL, imm8 2 0**?*0

35 iw/id XOR (E)AX, imm16/32 3/5 0**?*0 0180 /6 ib XOR r/m8, imm8 3 0**?*0 0281 /6 iw/id XOR r/m16/32, imm16/32 4/6 0**?*0 01,0283 /6 ib XOR r/m16/32, imm8 3 0**?*0 01,02

Timing Notes:- - Times separated by a dash/hyphen (-) are ranges.

Page 8: x86 Opcode Chart

# - This instruction's execution time is dependent on the following instruction.

n - n represents the number of iterations

pm= - In protected mode, this instruction uses this separate set of timing

Pentium and Pentium w/ MMX Specials for piping:NP - This instruction may not pipe with other instructions

PU - This instruction may pipe, but only in the U pipe

UV - This instruction may pipe in either pipe

The "General" Column

| - In a few rare cases, the timing for 16bit vs 32bit access differs (eg, DIV and IDIV). In these cases, the timing is separated by pipes (|), in "16bit|32bit" order.

/ - Times separated by a slash for processors before the Pentium Pro for instructions that support either a memory or a register operand (eg, r/m8, r/m16/32, etc), then the slash separates the timing by "reg/mem" timing. On instructions supporting REP or REPE/REPNE, the values show timing without the prefix and then the timing with the prefix (eg, "MOVSB / REP MOVSB")

: - Separates a True condition from a False condition (eg, "TRUE time : FALSE time"). This is similar to the C++ ternary notation of (A ? B : C), where A is the condition, B is what happens if it's true, C if it is false

+EA - On the 8086/8088 computers, all memory accesses required an EA calculation to determine the effective address of the operation. The amount of time required for this relies on the type of memory access used. Please refer to the "Clocks Details" tab for a list of the EA times required. And yes, the 8086/8088s were really that slow.

m - A special count of "pieces" that added time to the execution of some instructions on the 80286 and 80386. See the "Clocks Details" tab for further details.

! - This instruction's timing is far too complicated to show in the chart. Listed are the most common cases. Refer to the Clocks Details tab for full details

PV - This instruction may pipe, but only in the V pipe. If it cannot pipe with an instruction in the U pipe, it takes up both pipes

* - This instruction may pipe as shown, so long as there is not an immediate value AND an immediate displacement in the instruction. If there is an immediate value and a displacement, then the instruction may pipe in the U pipe only, on the Pentium w/ MMX (not the non-MMX Pentium)

Timing is a very complicated matter on the x86 processors, especially with how many versions of the processor there have been. The General column is an attempt to try to generalize the speeds of various instructions. There is no way to do this perfectly, but with a little tweaking it can be made fairly accurate. The numbers are on a semi-exponential scale from 0 (practically free) to 10 (a "why does a modern processor still go so slow" opcode). 0 is generally used for prefixes which really are free on the latest processors, 1 for the quickest arithmetic and move operations (the ones that the processor creators like using for MIPS calculations), 2 for slightly slower, etc. Any timing ending with a + means it can go up to 10 and often well beyond (like a rep movsd)

If the instruction is not available to every processor, the psuedo-timing is followed by what processor(s) first supported the specific instruction.

Page 9: x86 Opcode Chart
Page 10: x86 Opcode Chart

Opcode Mnemonic Parameters Bytes OSZAPC Ref #s 8087 80287 80387

D9 F0 F2XM1 2 ------ ??*? 20 310-630 310-630 211-476

D9 E1 FABS 2 ------ ??*? 20 10-17 10-17 22

D8 /0 FADD m32real 2 ------ ??*? 20 (90-120)+EA 90-120 24-32

D8 C0+i FADD ST(0), ST(i) 2 ------ ??*? 20 70-100 70-100 23-34

DC /0 FADD m64real 2 ------ ??*? 20 (95-125)+EA 95-125 29-37

DC C0+i FADD ST(i), ST(0) 2 ------ ??*? 20 70-100 70-100 23-34

DE C0+i FADDP ST(i), ST(0) 2 ------ ??*? 20 75-105 75-105 23-31

DF /4 FBLD m80dec 2 ------ ??*? 20 (290-310)+EA 290-310 266-275

DF /6 FBSTP m80bcd 2 ------ ??*? 20 (520-540)+EA 520-540 512-534

D9 E0 FCHS 2 ------ ??*? 20 10-17 10-17 24-25

9B DB E2 FCLEX 3 ------ ???? 20 2-8 2-8 11

DA C0+i FCMOVB ST(0), ST(i) 2 ------ ??*? 20 - - -DA D0+i FCMOVBE ST(0), ST(i) 2 ------ ??*? 20 - - -

DA C8+i FCMOVE ST(0), ST(i) 2 ------ ??*? 20 - - -

DB C0+i FCMOVNB ST(0), ST(i) 2 ------ ??*? 20 - - -

DB D0+i FCMOVNBE ST(0), ST(i) 2 ------ ??*? 20 - - -

DB C8+i FCMOVNE ST(0), ST(i) 2 ------ ??*? 20 - - -

DB D8+i FCMOVNU ST(0), ST(i) 2 ------ ??*? 20 - - -

DA D8+i FCMOVU ST(0), ST(i) 2 ------ ??*? 20 - - -

D8 /2 FCOM m32real 2 ------ **** 20 (60-70)+EA 60-70 26

D8 D0+i FCOM ST(i) 2 ------ **** 20 40-50 40-50 24

DC /2 FCOM m64real 2 ------ **** 20 (65-75)+EA 65-75 31

DB F0+i FCOMI ST(0), ST(i) 2 --*-** --*- 20 - - -

DF F0+i FCOMIP ST(0), ST(i) 2 --*-** --*- 20 - - -

D8 /3 FCOMP m32real 2 ------ **** 20 63-73+EA 63-73 26

D8 D8+i FCOMP ST(i) 2 ------ **** 20 42-52 42-52 26

DC /3 FCOMP m64real 2 ------ **** 20 67-77+EA 67-77 31

DE D9 FCOMPP 2 ------ **** 20 45-55 45-55 26

D9 FF FCOS 2 ------ ?**? 20 - - 123-772*

D9 F6 FDECSTP 2 ------ ??*? 20 6-12 6-12 22

FDISI 2 ------ 20 2-8 2 2

D8 /6 FDIV m32real 2 ------ ??*? 20 (215-225)+EA 215-225 89

D8 F0+i FDIV ST(0), ST(i) 2 ------ ??*? 20 193-203 193-203 88-91

DC /6 FDIV m64real 2 ------ ??*? 20 (220-230)+EA 220-230 94

DC F8+i FDIV ST(i), ST(0) 2 ------ ??*? 20 193-203 193-203 88-91

DE F8+i FDIVP ST(i), ST(0) 2 ------ ??*? 20 197-207 197-207 91

D8 /7 FDIVR m32real 2 ------ ??*? 20 (216-226)+EA 216-226 89

D8 F8+i FDIVR ST(0), ST(i) 2 ------ ??*? 20 194-204 194-204 88-91

DC /7 FDIVR m64real 2 ------ ??*? 20 (221-231)+EA 221-231 94

DC F0+i FDIVR ST(i), ST(0) 2 ------ ??*? 20 194-204 194-204 88-91

DE F0+i FDIVRP ST(i), ST(0) 2 ------ ??*? 20 198-208 198-208 91

FENI 2 ------ 20 2-8 2 2

DD C0+i FFREE ST(i) 2 ------ ???? 20 9-16 9-16 18

DA /0 FIADD m32 2 ------ ??*? 20 (108-137)+EA 108-143 57-72

DE /0 FIADD m16 2 ------ ??*? 20 (102-137)+EA 102-137 71-85

DA /2 FICOM m32 2 ------ **** 20 (78-91)+EA 78-91 56-63

DE /2 FICOM m16 2 ------ **** 20 (72-86)+EA 72-86 71-75

DA /3 FICOMP m32 2 ------ **** 20 (80-93)+EA 80-93 56-63

DE /3 FICOMP m16 2 ------ **** 20 (74-88)+EA 74-88 71-75

DA /6 FIDIV m32 2 ------ ??*? 20 (230-243)+EA 230-243 120-127

DE /6 FIDIV m16 2 ------ ??*? 20 (224-238)+EA 224-238 136-140

DA /7 FIDIVR m32 2 ------ ??*? 20 (231-245)+EA 231-245 121-128

DE /7 FIDIVR m16 2 ------ ??*? 20 (225-239)+EA 225-239 135-141

CCCC3210

Page 11: x86 Opcode Chart

DB /0 FILD m32 2 ------ ??*? 20 (52-60)+EA 52-60 45-52

DF /0 FILD m16 2 ------ ??*? 20 (46-54)+EA 46-54 61-65

DF /5 FILD m64 2 ------ ??*? 20 (60-68)+EA 60-68 56-67

DA /1 FIMUL m32 2 ------ ??*? 20 (130-144)+EA 130-144 61-82

DE /1 FIMUL m16 2 ------ ??*? 20 (124-138)+EA 124-138 76-87

D9 F7 FINCSTP 2 ------ ??0? 20 6-12 6-12 21

9B DB E3 FINIT 3 ------ 0000 20 2-8 2-8 33

DB /2 FIST m32 2 ------ ??*? 20 (82-92)+EA 82-92 79-93

DF /2 FIST m16 2 ------ ??*? 20 (80-90)+EA 80-90 82-95

DB /3 FISTP m32 2 ------ ??*? 20 (84-94)+EA 84-94 79-93

DF /3 FISTP m16 2 ------ ??*? 20 (82-92)+EA 82-92 82-95

DF /7 FISTP m64 2 ------ ??*? 20 (94-105)+EA 94-105 80-97

DA /4 FISUB m32 2 ------ ??*? 20 (108-143)+EA 108-143 57-82

DE /4 FISUB m16 2 ------ ??*? 20 (102-137)+EA 102-137 71-83

DA /5 FISUBR m32 2 ------ ??*? 20 (109-144)+EA 108-143 58-83

DE /5 FISUBR m16 2 ------ ??*? 20 (103-139)+EA 102-137 72-84

D9 /0 FLD m32real 2 ------ ??*? 20 (38-56)+EA 38-56 20

D9 C0+i FLD ST(i) 2 ------ ??*? 20 17-22 17-22 14

DB /5 FLD m80real 2 ------ ??*? 20 (53-65)+EA 53-65 44

DD /0 FLD m64real 2 ------ ??*? 20 (40-60)+EA 40-60 25

D9 E8 FLD1 2 ------ ??*? 20 15-21 15-21 24

D9 /5 FLDCW m16 2 ------ ???? 20 (7-14)+EA 7-14 19

D9 /4 FLDENV mempnt 2 ------ **** 20 (35-45)+EA 35-45 71

D9 EA FLDL2E 2 ------ ??*? 20 15-21 15-21 40

D9 E9 FLDL2T 2 ------ ??*? 20 16-22 16-22 40

D9 EC FLDLG2 2 ------ ??*? 20 18-24 18-24 41

D9 ED FLDLN2 2 ------ ??*? 20 17-23 17-23 41

D9 EB FLDPI 2 ------ ??*? 20 16-22 16-22 40

D9 EE FLDZ 2 ------ ??*? 20 11-17 11-17 20

D8 /1 FMUL m32 2 ------ ??*? 20 (110-125)+EA 110-125 27-35

D8 C8+i FMUL ST(0), ST(i) 2 ------ ??*? 20 90-145 90-145 29-57

DC /1 FMUL m64 2 ------ ??*? 20 (154-168)+EA 154-168 32-57

DC C8+i FMUL ST(i), ST(0) 2 ------ ??*? 20 90-145 90-145 29-57

DE C8+i FMULP ST(i), ST(0) 2 ------ ??*? 20 94-148 94-148 29-57

DB E2 FNCLEX 2 ------ ???? 20 2-8 2-8 11

FNDISI 2 ------ 20 2-8 2 2

FNENI 2 ------ 20 2-8 2 2

DB E3 FNINIT 2 ------ 0000 20 2-8 2-8 33

D9 D0 FNOP 2 ------ ???? 20 10-16 10-16 12

DD /6 FNSAVE mempnt 2 ------ 0000 20 (197-207)+EA 197-207 375-376

D9 /7 FNSTCW m16 2 ------ ???? 20 12-18 12-18 15

D9 /6 FNSTENV mempnt 2 ------ ???? 20 (40-50)+EA 40-50 103-104

DD /7 FNSTSW m16 2 ------ ???? 20 12-18 12-18 15

DF E0 FNSTSW AX 2 ------ ???? 20 - 10-16 13

D9 F3 FPATAN 2 ------ ??*? 20 250-800 250-800 314-487

D9 F8 FPREM 2 ------ **** 20 15-190 15-190 74-155

D9 F5 FPREM1 2 ------ **** 20 - - 95-185

D9 F2 FPTAN 2 ------ ?**? 20 30-540* 30-540* 191-497*

D9 FC FRNDINT 2 ------ ??*? 20 16-50 16-50 66-80

DD /4 FRSTOR mempnt 2 ------ **** 20 (197-207)+EA 197-207 308

9B DD /6 FSAVE mempnt 3 ------ 0000 20 (197-207)+EA 197-207 375-376

D9 FD FSCALE 2 ------ ??*? 20 32-38 32-38 67-86

FSETPM ------ 20 - 2-8 12

D9 FE FSIN 2 ------ ?**? 20 - - 122-771*

Page 12: x86 Opcode Chart

D9 FB FSINCOS 2 ------ ?**? 20 - - 194-809*

D9 FA FSQRT 2 ------ ??*? 20 180-186 180-186 122-129

D9 /2 FST m32real 2 ------ ??*? 20 (84-90)+EA 84-90 44

DD /2 FST m64real 2 ------ ??*? 20 (96-104)+EA 96-104 45

DD D0+i FST ST(i) 2 ------ ??*? 20 15-22 15-22 11

9B D9 /7 FSTCW m16 3 ------ ???? 20 12-18 12-18 15

9B D9 /6 FSTENV mempnt 3 ------ ???? 20 (40-50)+EA 40-50 103-104

D9 /3 FSTP m32real 2 ------ ??*? 20 (86-92)+EA 86-92 44

DB /7 FSTP m80real 2 ------ ??*? 20 (52-58)+EA 52-58 53

DD /3 FSTP m64real 2 ------ ??*? 20 (98-106)+EA 98-106 45

DD D8+i FSTP ST(i) 2 ------ ??*? 20 17-24 17-24 12

9B DD /7 FSTSW m16 3 ------ ???? 20 12-18 12-18 15

9B DD E0 FSTSW AX 3 ------ ???? 20 - 10-16 13

D8 /4 FSUB m32real 2 ------ ??*? 20 (90-120)+EA 90-120 24-32

D8 E0+i FSUB ST(0), ST(i) 2 ------ ??*? 20 70-100 70-100 26-38

DC /4 FSUB m64real 2 ------ ??*? 20 (95-125)+EA 95-125 28-36

DC E8+i FSUB ST(i), ST(0) 2 ------ ??*? 20 70-100 70-100 26-38

DE E8+i FSUBP ST(i), ST(0) 2 ------ ??*? 20 75-105 75-105 26-34

D8 /5 FSUBR m32real 2 ------ ??*? 20 (90-120)+EA 90-120 24-32

D8 E8+i FSUBR ST(0), ST(i) 2 ------ ??*? 20 70-100 70-100 26-37

DC /5 FSUBR m64real 2 ------ ??*? 20 (95-125)+EA 95-125 28-36

DC E0+i FSUBR ST(i), ST(0) 2 ------ ??*? 20 70-100 70-100 26-37

DE E0+i FSUBRP ST(i), ST(0) 2 ------ ??*? 20 75-105 75-105 26-34

D9 E4 FTST 2 ------ **** 20 38-48 38-48 28

DD E0+i FUCOM ST(i) 2 ------ **** 20 - - 24

D8 E8+i FUCOMI ST(0), ST(i) 2 --*-** --*- 20 - - -

DF E8+i FUCOMIP ST(0), ST(i) 2 --*-** --*- 20 - - -

DD E8+i FUCOMP ST(i) 2 ------ **** 20 - - 26

DA E9 FUCOMPP 2 ------ **** 20 - - 26

9B FWAIT 1 ------ ???? 4 3 6

D9 E5 FXAM 2 ------ **** 20 12-23 12-23 30-38

D9 C8+i FXCH ST(i) 2 ------ ??*? 20 10-15 10-15 18

0F AE /1 FXRSTOR mempnt 3 ------ **** 20,22 - - -

0F AE /0 FXSAVE mempnt 3 ------ ---- 20,22 - - -

D9 F4 FXTRACT 2 ------ ??*? 20 27-55 27-55 70-76

D9 F1 FYL2X 2 ------ ??*? 20 900-1100 900-1100 120-538

D9 F9 FYL2XP1 2 ------ ??*? 20 700-1000 700-1000 257-547

Timing Notes:Times separated by a dash/hyphen (-) are ranges.

Pentium and Pentium w/ MMX Specials for Piping:

Times with a * mean that values outside of a specific range take more cycles. See the full opcode description for details.

Times separated by a slash for processors before the Pentium are for "real mode/protected mode"Times separated by a slash for the Pentium mean Latency/Throughput. Latency is the actual amount of time the processor needs to fully execute the instruction, whereas throughput is how long the instruction takes before the next non-conflicting instruction may execute. In practice, it is possible to get the most common FPU instructions to only use 1 noticable clock each by properly staggering the instructions and using FXCH to switch register values around as needed. Note that instructions that do not have a slash cannot be used in this fashion.

Page 13: x86 Opcode Chart

NP - Means that this instruction does not support pipelining with FXCH.

FX - Means that an FXCH instruction may be used after this instruction with no CPU time wasted. (0 clocks)

Page 14: x86 Opcode Chart

80486 Pentium General

140-279 13-57NP 4-8

3 1FX 1

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

70-103 48-58NP 8

172-176 148-154NP 10

6 1FX 1

7 9NP 4

- -- -

- -

- -

- -

- -

- -

- -

4 4/1FX 2

4 4/1FX 2

4 4/1FX 2

- -

- -

4 4/1FX 2

4 4/1FX 2

4 4/1FX 2

5 4/1FX 2

257-354* 18-124*NP 5-10, 387+

3 1NP 1

3 1NP 1

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

73 39FX 7

3 1NP 1

3 1NP 1

19-32 7/4NP 3

20-35 7/4NP 3

15-17 8/4NP 3

16-20 8/4NP 3

15-17 8/4NP 3

16-20 8/4NP 3

84-86 42NP 8

85-89 42NP 8

84-86 42NP 8

85-89 42NP 8

Page 15: x86 Opcode Chart

9-12 3/1NP 2

13-16 3/1NP 2

10-18 3/1NP 2

22-24 7/4NP 3

23-27 7/4NP 3

3 1NP 1

17 16NP 5

28-34 6NP 3

29-34 6NP 3

28-34 6NP 3

29-34 6NP 3

28-34 6NP 3

20-35 7/4NP 3

19-32 7/4NP 3

20-35 7/4NP 3

19-32 7/4NP 3

3 1FX 1

4 1FX 1

6 3NP 2

3 1FX 1

4 2NP 2

4 7NP 3

44/34 37/32-33NP 7

8 5/3NP 3

8 5/3NP 3

8 5/3NP 3

8 5/3NP 3

8 5/3NP 3

4 2NP 2

11 3/1FX 2

16 3/1FX 2

14 3/1FX 2

16 3/1FX 2

16 3/1FX 2

7 9NP 4

3 1NP 1

3 1NP 1

17 12NP 4

3 1NP 1

154/143 127-151/124NP 10

3 2NP 2

67/56 48-50NP 8

3 2NP 2

3 2NP 2, 287+

218-303 17-173NP 5-10+

70-138 16-64NP 5-9

72-167 20-70NP 5-9, 387+

200-273* 17-173*NP 5-10+

21-30 9-20NP 4-5

131/120 75-95/70NP 9

154/143 127-151/124NP 10

30-32 20-31NP 5-6

3 1NP 1, 287+

257-354* 16-126*NP 5-10, 387+

Page 16: x86 Opcode Chart

292-365* 17-137*NP 5-10, 387+

83-87 70NP 9

7 2NP 2

8 2NP 2

3 1NP 1

3 2NP 2

67/56 48-50NP 8

7 2NP 2

6 3NP 3

8 2NP 2

3 1NP 1

3 2NP 2

3 2NP 2, 287+

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

8-20 3/1FX 2

4 4/1FX 2

4 4/1FX 2, 387+

- -

- -

4 4/1FX 2, 387+

5 4/1FX 2, 387+

1-3 1-3NP 1-2

8 21NP 5

4 0-1 0

- -

- -

16-20 13NP 4

196-329 22-111NP 5-10

171-326 22-103NP 5-10

Page 17: x86 Opcode Chart

Opcode Mnemonic Parameters Bytes OSZAPC Ref #s P1 MMX P2

0F 55 /r ANDNPS xmm1, xmm2/m128 3 ------ 22 - -0F 54 /r ANDPS xmm1, xmm2/m128 3 ------ 2 - -0F 77 EMMS 2 ------ 21 1

0F F7 /r MASKMOVQ mm1, mm2 3 ------ 210F 28 /r MOVAPS xmm1, xmm2/m128 3 ------ 22 -

0F 29 /r MOVAPS xmm2/m128, xmm1 3 ------ 22 -

0F 6E /r MOVD mm, r/m32 3 ------ 21 1

0F 7E /r MOVD r/m32, mm 3 ------ 21 1

0F 12 /r MOVHLPS xmm1, xmm2 3 ------ 22 -

0F 16 /r MOVHPS xmm, m64 3 ------ 22 -

0F 17 /r MOVHPS m64, xmm 3 ------ 22 -

0F 16 /r MOVLHPS xmm1, xmm2 3 ------ 22 -

0F 12 /r MOVLPS xmm, m64 3 ------ 22 -

0F 13 /r MOVLPS m64, xmm 3 ------ 22 -

0F 50 /r MOVMSKPS r32, xmm 3 ------ 22 -

0F 2B /r MOVNTPS m128, xmm 3 ------ 22 -

0F E7 /r MOVNTQ m64, mm 3 ------ 21,22 -

0F 6F /r MOVQ mm, mm/m64 3 ------ 21 1

0F 7F /r MOVQ mm/m64, mm 3 ------ 21 1

F3 0F 10 /r MOVSS xmm1, xmm2/m32 4 ------ 22 -

F3 0F 11 /r MOVSS xmm2/m32, xmm1 4 ------ 22 -

0F 10 /r MOVUPS xmm1, xmm2/m128 3 ------ 22 - -0F 11 /r MOVUPS xmm2/m32, xmm1 3 ------ 22 - -0F 56 /r ORPS xmm1, xmm2/m128 3 ------ 22 - -0F 6B /r PACKSSDW mm, mm/m64 3 ------ 21 1

0F 63 /r PACKSSWB mm, mm/m64 3 ------ 21 1

0F 67 /r PACKUSWB mm, mm/m64 3 ------ 21 1

0F FC /r PADDB mm, mm/m64 3 ------ 21 1

0F FE /r PADDD mm, mm/m64 3 ------ 21 1

0F EC /r PADDSB mm, mm/m64 3 ------ 21 1

0F ED /r PADDSW mm, mm/m64 3 ------ 21 1

0F DC /r PADDUSB mm, mm/m64 3 ------ 21 1

0F DD /r PADDUSW mm, mm/m64 3 ------ 21 1

0F FD /r PADDW mm, mm/m64 3 ------ 21 1

0F DB /r PAND mm, mm/m64 3 ------ 21 1

0F DF /r PANDN mm, mm/m64 3 ------ 21 1

0F E0 /r PAVGB mm, mm/m64 3 ------ 21,22 -

0F E3 /r PAVGW mm, mm/m64 3 ------ 21,22 -

0F 74 /r PCMPEQB mm, mm/m64 3 ------ 21 1

0F 76 /r PCMPEQD mm, mm/m64 3 ------ 21 1

0F 75 /r PCMPEQW mm, mm/m64 3 ------ 21 1

0F 64 /r PCMPGTB mm, mm/m64 3 ------ 21 1

0F 66 /r PCMPGTD mm, mm/m64 3 ------ 21 1

0F 65 /r PCMPGTW mm, mm/m64 3 ------ 21 1

0F C5 /r ib PEXTRW r32, mm, imm8 4 ------ 21,22 -

0F C4 /r ib PINSRW mm, r32/m16, imm8 4 ------ 21,22 -

0F F5 /r PMADDWD mm, mm/m64 3 ------ 21 3/1

0F EE /r PMAXSW mm, mm/m64 3 ------ 21,22 -

0F DE /r PMAXUB mm, mm/m64 3 ------ 21,22 -

0F EA /r PMINSW mm, mm/m64 3 ------ 21,22 -

0F DA /r PMINUB mm, mm/m64 3 ------ 21,22 -

0F D7 /r PMOVMSKB r32, mm 3 ------ 21,22 -

0F E4 /r PMULHUW mm, mm/m64 3 ------ 21,22 -

Page 18: x86 Opcode Chart

0F E5 /r PMULHW mm, mm/m64 3 ------ 21 3/1

0F D5 /r PMULLW mm, mm/m64 3 ------ 21 3/1

0F EB /r POR mm, mm/m64 3 ------ 21 1

0F F6 /r PSADBW mm, mm/m64 3 ------ 21,22 -

0F 70 /r ib PSHUFW mm, mm/m64, imm8 4 ------ 21,22 -

0F 72 /6 ib PSLLD mm, imm8 4 ------ 21 1

0F F2 /r PSLLD mm, mm/m64 3 ------ 21 1

0F 73 /6 ib PSLLQ mm, imm8 4 ------ 21 1

0F F3 /r PSLLQ mm, mm/m64 3 ------ 21 1

0F 71 /6 ib PSLLW mm, imm8 4 ------ 21 1

0F F1 /r PSLLW mm, mm/m64 3 ------ 21 1

0F 72 /4 ib PSRAD mm, imm8 4 ------ 21 1

0F E2 /r PSRAD mm, mm/m64 3 ------ 21 1

0F 71 /4 ib PSRAW mm, imm8 4 ------ 21 1

0F E1 /r PSRAW mm, mm/m64 3 ------ 21 1

0F 72 /2 ib PSRLD mm, imm8 4 ------ 21 1

0F D2 /r PSRLD mm, mm/m64 3 ------ 21 1

0F 73 /2 ib PSRLQ mm, imm8 4 ------ 21 1

0F D3 /r PSRLQ mm, mm/m64 3 ------ 21 1

0F 71 /2 ib PSRLW mm, imm8 4 ------ 21 1

0F D1 /r PSRLW mm, mm/m64 3 ------ 21 1

0F F8 /r PSUBB mm, mm/m64 3 ------ 21 1

0F FA /r PSUBD mm, mm/m64 3 ------ 21 1

0F E8 /r PSUBSB mm, mm/m64 3 ------ 21 1

0F E9 /r PSUBSW mm, mm/m64 3 ------ 21 1

0F D8 /r PSUBUSB mm, mm/m64 3 ------ 21 1

0F D9 /r PSUBUSW mm, mm/m64 3 ------ 21 1

0F F9 /r PSUBW mm, mm/m64 3 ------ 21 1

0F 68 /r PUNPCKHBW mm, mm/m64 3 ------ 21 1

0F 6A /r PUNPCKHDQ mm, mm/m64 3 ------ 21 1

0F 69 /r PUNPCKHWD mm, mm/m64 3 ------ 21 1

0F 60 /r PUNPCKLBW mm, mm/m32 3 ------ 21 1

0F 62 /r PUNPCKLDQ mm, mm/m32 3 ------ 21 1

0F 61 /r PUNPCKLWD mm, mm/m32 3 ------ 21 1

0F EF /r PXOR mm, mm/mm64 3 ------ 21 1

0F C6 /r ib SHUFPS xmm1, xmm2/m128, imm8 4 ------ 22 - -0F AE /3 STMXCSR m32 3 ------ 22 - -0F 15 /r UNPCKHPS xmm1, xmm2/m128 3 ------ 22 - -0F 14 /r UNPCKLPS xmm1, xmm2/m128 3 ------ 22 - -0F 57 /r XORPS xmm1, xmm2/m128 3 ------ 22 - -

Page 19: x86 Opcode Chart

P3 P4 General

Page 20: x86 Opcode Chart
Page 21: x86 Opcode Chart

Opcode Mnemonic Parameters Bytes OSZAPC Ref #s P3 P4

F3 0F C2 /r ib CMPSS xmm1, xmm2/m32, imm8 5 ------ 220F 2F /r COMISS xmm1, xmm2/m32 3 00*0** 220F 2A /r CVTPI2PS xmm, mm/m64 3 ------ 220F 2D /r CVTPS2PI mm, xmm/m64 3 ------ 22F3 0F 2A /r CVTSI2SS xmm, r/m32 4 ------ 22F3 0F 2D /r CVTSS2SI r32, xmm/m32 4 ------ 220F 2C /R CVTTPS2PI mm, xmm/m64 3 ------ 22F3 0F 2C /r CVTTSS2SI r32, xmm/m32 4 ------ 220F 5E /r DIVPS xmm1, xmm2/m128 3 ------ 22F3 0F 5E /r DIVSS xmm1, xmm2/m32 4 ------ 220F 5F /r MAXPS xmm1, xmm2/m128 3 ------ 22F3 0F 5F /r MAXSS xmm1, xmm2/m32 4 ------ 220F 5D /r MINPS xmm1, xmm2/m128 3 ------ 22F3 0F 5D /r MINSS xmm1, xmm2/m32 4 ------ 220F 28 /r MOVAPS xmm1, xmm2/m128 3 ------ 220F 29 /r MOVAPS xmm2/m128, xmm1 3 ------ 220F 12 /r MOVHLPS xmm1, xmm2 3 ------ 220F 16 /r MOVHPS xmm, m64 3 ------ 220F 17 /r MOVHPS m64, xmm 3 ------ 220F 16 /r MOVLHPS xmm1, xmm2 3 ------ 220F 12 /r MOVLPS xmm, m64 3 ------ 220F 13 /r MOVLPS m64, xmm 3 ------ 220F 50 /r MOVMSKPS r32, xmm 3 ------ 220F 2B /r MOVNTPS m128, xmm 3 ------ 22F3 0F 10 /r MOVSS xmm1, xmm2/m32 4 ------ 22F3 0F 11 /r MOVSS xmm2/m32, xmm1 4 ------ 220F 10 /r MOVUPS xmm1, xmm2/m128 3 ------ 220F 11 /r MOVUPS xmm2/m32, xmm1 3 ------ 220F 59 /r MULPS xmm1, xmm2/m128 3 ------ 22F3 0F 59 /r MULSS xmm1, xmm2/m32 4 ------ 220F 53 /r RCPPS xmm1, xmm2/m128 3 ------ 22F3 0F 53 /r RCPSS xmm1, xmm2/m32 4 ------ 220F 52 /r RSQRTPS xmm1, xmm2/m128 3 ------ 22F3 0F 52 /r RSQRTSS xmm1, xmm2/m128 4 ------ 220F C6 /r ib SHUFPS xmm1, xmm2/m128, imm8 4 ------ 220F 51 /r SQRTPS xmm1, xmm2/m128 3 ------ 22F3 0F 51 /r SQRTSS xmm1, xmm2/m32 4 ------ 220F AE /3 STMXCSR m32 3 ------ 220F 5C /r SUBPS xmm1, xmm2/m128 3 ------ 22F3 0F 5C /r SUBSS xmm1, xmm2/m32 4 ------ 220F 2E /r UCOMISS xmm1, xmm2/m32 3 00*0** 220F 15 /r UNPCKHPS xmm1, xmm2/m128 3 ------ 220F 14 /r UNPCKLPS xmm1, xmm2/m128 3 ------ 22

Page 22: x86 Opcode Chart

General

Page 23: x86 Opcode Chart

Ref #

01

02

08

09

0F

10

11

12

13

2021222324252627303132333480

81

828384

Page 24: x86 Opcode Chart

Description

This instruction has undocumented behavior. See the detailed opcode descriptions for further details.

This instruction is undocumented. See the detailed opcode descriptions for further details.

This instruction is an extension or a prefix and is not designed to be used on it's own

This instruction permits use of the REP prefix.

This instruction permits use of the REPE and REPNE prefixes.

This instruction permits use of the LOCK prefix

This is a floating point (x87) instruction.This is an MMX InstructionThis is an SSE InstructionThis is an SSE2 InstructionThis is an SSE3 InstructionThis is an SSSE3 InstructionThis is an SSE4.1 InstructionThis is an SSE4.2 InstructionThis is a 3DNow! InstructionThis is a 3DNow! Enhanced InstructionThis is a 3DNow! Professional InstructionThis is an SSE4a InstructionThis is an SSE5 Instruction

This instruction is designed for use in operating systems only, but normal user programs may still use it.

This is a serializing instructionThis instruction only exists in protected mode

Note for 386+ Only: This opcode supports both 16bit and 32 bit operand sizes. In real mode and SMM mode, it uses 16bit operands by default. In protected mode and virtual-86 mode, the selector used controls whether it is 16bit or 32bit by default. The 66 opcode reverses the operand size. For some instructions, this changes the name of the opcode (either adding a D [meaning DWORD] to the end, such as IRET to IRETD, or changing the final W [meaning word] to D, such as MOVSW to MOVSD), and the following special cases: JCXZ vs JECXZ, CBW to CWDE, and CWD to CDQ. If there are multiple ways to spell the same instruction because of this, both versions will be listed.

Note for 386+ Only: This opcode supports both 16bit and 32bit addressing. In real mode and SMM, it always uses 16bit addressing by default. In protected mode and virtual-86 mode, the selector used controls whether it uses 16bit or 32bit by default. The 67 opcode reverses the addressing size.

This instruction acts as if the LOCK prefix was used in all cases, regardless of whether LOCK is used with it or not

This instruction is designed for use in operating systems only. Normal user programs can not use this instruction as it throws a #GP exception if used outside of a CPL of 0.

This is a conditional or unknown target jump-type instruction. Use of it may incur huge cycle penalties on all processors that are Pentium and higher.

Page 25: x86 Opcode Chart

SpecialsEA 8088 - 8086 Only:

Description ClocksDisplacement 6Base or Index 5Displacement + (Base or Index) 9Base + Index (BP+DI, BX+SI) 7Base + Index (BP+SI, BX+DI) 8Base + Index + Disp (BP+DI+disp,BX+SI+disp) 11Base + Index + Disp (BP+SI+disp,BX+DI+disp) 12Add 4 cycles for word operands at odd addresses

m 286 - 386 Only:286: m represents the number of bytes in the next instruction

! Complex Timing:CALL far16:16/32 (9A far32/48)

KERBLUH - TO DO - Get info on the call gates and all that fun stuffm16:16/32 (FF /3)KERBLUH - TO DO - Get info on the call gates and all that fun stuff

ENTER imm16, 0 (C8 iw 00)This is the time shown in the chart. Refer to the chart for details.imm16, 1 (C8 iw 01)80186: 2580286: 1580386: 1280486: 17Pentium: 15NPimm16, imm8 (2 or more) (C8 iw ib)i = imm8 (the second operand)80186: 6+16i80286: 8+4i80386: 11+4i80486: 17+3iPentium: 15+2iNP

IN

AL/(E)AX, imm8 (E4 ib / E5 ib)386: 6/26/26486: 9/29/27Pentium: 4/21/19NPAL/(E)AX, DX (EC / ED)

386: 7/27/27

486: 8/28/27

Pentium: 4/21/19NP

INS*

386: m represents the number of bytes in the next instruction plus the number of components, or pieces of that instruction. Each displacement (AX + BX + 1 counts as one), immediate value and prefix (such as opcode 66) add one

The timings below are for protected mode. The values in the chart are for real mode. Each value shows three times separated by a /. These are "CPL <= IOPL / CPL > IOPL / V86"

The timings below are for protected mode. The values in the chart are for real mode. Each item shows three values separated by a /. These are "CPL <= IOPL / CPL > IOPL / V86"

Page 26: x86 Opcode Chart

INSB (6C), INSW/INSD (6D)386: 9/29/29486: 10/32/30Pentium: 6/24/22NPREP INSB (F3 6C), REP INSW/INSD (F3 6D)386: 7+6n/27+6n/27+6n486: 10+8n/30+8n/29+8nPentium: ???

INT

INT 3 (CC)KERBLUH - TO DO - Get info on the call gates and all that fun stuffINT imm8 (CD ib)KERBLUH - TO DO - Get info on the call gates and all that fun stuff

INTO

KERBLUH - TO DO - Get info on the call gates and all that fun stuffIRET

KERBLUH - TO DO - Get info on the call gates and all that fun stuffJMP

far 16:16/32 (EA far32/48)KERBLUH - TO DO - Get info on the call gates and all that fun stuffm16:16/32 (FF /5)KERBLUH - TO DO - Get info on the call gates and all that fun stuff

MOV The timings below are for protected mode on the Pentium only.

Sreg, r/m16 (8E /r)Add 8 cycles if the segment becomes a new descriptor, 6 if it's SS.

MOVS* The timings below are just extras for the 486 in REP mode.REP MOVSB (F3 A4), REP MOVSW/MOVSD (F3 A5)If n is 0, 5 cycles are takenIf n is 1, 13 cycles are taken

OUT

imm8, AL/(E)AX (E6 ib / E7 ib)386: 4/24/24486: 11/31/29Pentium: 9/26/24NPDX, AL/(E)AX (EE / EF)386: 5/25/25486: 10/30/29Pentium: 9/26/24NP

OUTS*

OUTSB (6E), OUTSW/OUTSD (6F)386: 8/28/28486: 10/32/30

The timings below are for special gates and task switch interrupts in protected mode. Real mode and same-task interrupts are listed in the chart

The timings below are for special gates and task switch interrupts in protected mode, and only if overflow causes the interrupt. Real mode, same-task interrupts and failed conditions are all listed in the chart.

The timings below are for returning from special gates and task switch interrupts in protected mode. Real mode and same task interrupts are listed in the chart.

The timings below are for jumping through call gates. Real mode and same task jumps are listed in the chart

The timings below are for protected mode. The values in the chart are for real mode. Each item shows three values separated by a /. These are "CPL <= IOPL / CPL > IOPL / V86"

The timings below are for protected mode. The values in the chart are for real mode. Each item shows three values separated by a /. These are "CPL <= IOPL / CPL > IOPL / V86"

Page 27: x86 Opcode Chart

Pentium: 10/27/25NPREP OUTSB (F3 6E), REP OUTSW/OUTSD (F3 6F)386: 6+5n/26+5n/26+5n486: 11+5n/31+5n/31+5nPentium: ???NP

RET

RETF (CB)286: 25+m/55386: 32+m/62486: 18/33Pentium: 4-13/23NPRETF imm16 (CA iw)286: 25+m/55386: 32+m/68486: 17/33Pentium: 4-13/23NP

SCAS* The timings below are just extras for the 486 in REPE/REPNE mode.REPE/REPNE SCASB (F3/F2 AE), REPE/REPNE SCASW/SCASD (F3/F2 AF)If n is 0, 5 cycles are taken

STOS* The timings below are just extras for the 486 in REP mode.REP STOSB (F3 AA), REP STOSW/STOSD (F3 AB)If n is 0, 5 cycles are takenIf n is 1, 13 cycles are taken

The timings below are for protected mode. The values in the chart are for real mode. Each item shows three values separated by a /. These are "Same Privilege/Lower Privilege"