Central Processing Unit (CPU) instructions set
The general-purpose instructions perform basic data movement, arithmetic, logic, program flow, and string operations which programmers commonly use to write application and system software to run on Intel 64 and IA-32 processors. They operate on data contained in memory, in the general-purpose registers (EAX, EBX, ECX, EDX, EDI, ESI, EBP, and ESP) and in the EFLAGS register. They also operate on address information contained in memory, the general-purpose registers, and the segment registers (CS, DS, SS, ES, FS, and GS).
Contents
- Data Transfer Instructions
- Conditional Moves
- Stack Operations
- Exchange Operations
- Compare-Exchange Operations
- Compare-Add Operations
- Misc Operations
- Data Conversion Instructions
- Binary Arithmetic Instructions
- Addition
- Subtraction
- Multiplication
- Division
- Negation
- Comparison
- Decimal Arithmetic Instructions
- Packed BCD
- Unpacked BCD
- Logical Instructions
- Shift and Rotate Instructions
- Shift
- Rotation
- Bit and Byte Instructions
- Bit Test
- Bit Scan
- Set Byte on Condition
- Bit manipulation instructions
- Bit Counting
- Bit Shuffling
- LSB Operations
- Performance Improvement
- String Instructions
- Load From Memory
- Store To Memory
- Move Memory Blocks
- Compare Memory Blocks
- Find In Memory Block
- Repeat String Operation
- I/O Instructions
- Input
- Output
- Enqueue Store Instructions
- Control Transfer Instructions
- Conditional Jumps
- Loops
- Procedure Calls
- Interrupts
- Control Transfer Terminating Instructions
- High Level Procedure Instructions
- Shadow Stack Management Instructions
- Busy Bit
- Shadow Stack Pointer (SSP)
- Writes
- Flag Control Instructions
- Set Flags
- Clear Flags
- Complement Flags
- Load Flags
- Store Flags
- User Interrupt (UINTR) Instructions
- User Level Monitor (ULM) Instructions
- Miscellaneous Instructions
- Random Number Generator Instructions
- Segment Register Instructions
- System Instructions
- Descriptor Table Management
- Segmentation
- Privilege Leveling
- Memory Protection/Synchronization
- Task Management
- State Registers
- Control Registers
- Model-Specific Registers
- Performance Registers
- System Management
- Processor Control
- Cache and TLB Management
- System Calls
Tip: For detailed information about each instruction please read: Intel Architectures Software Developer’s Manual Volume 2: Instruction Set Reference, A-Z
Data Transfer Instructions
The data transfer instructions move data between memory and the general-purpose and segment registers. They also perform specific operations such as conditional moves, stack access, and data conversion.
| Instruction | Meaning |
|---|---|
| MOV | Move data between general-purpose registers, segment registers, memory, and from immediate to general-purpose registers |
| MOVZX | Move and zero extend |
| MOVSX | Move and sign extend |
| MOVSXD | Move and sign extend |
| Conditional Moves | |
| CMOVE | Conditional move if equal |
| CMOVA | Conditional move if above |
| CMOVAE | Conditional move if above or equal |
| CMOVB | Conditional move if below |
| CMOVBE | Conditional move if below or equal |
| CMOVG | Conditional move if greater |
| CMOVGE | Conditional move if greater or equal |
| CMOVL | Conditional move if less |
| CMOVLE | Conditional move if less or equal |
| CMOVZ | Conditional move if zero |
| CMOVC | Conditional move if carry |
| CMOVO | Conditional move if overflow |
| CMOVS | Conditional move if sign (negative) |
| CMOVP | Conditional move if parity |
| CMOVNE | Conditional move if not equal |
| CMOVNA | Conditional move if not above |
| CMOVNAE | Conditional move if not above or equal |
| CMOVNB | Conditional move if not below |
| CMOVNBE | Conditional move if not below or equal |
| CMOVNG | Conditional move if not greater |
| CMOVNGE | Conditional move if not greater or equal |
| CMOVNL | Conditional move if not less |
| CMOVNLE | Conditional move if not less or equal |
| CMOVNZ | Conditional move if not zero |
| CMOVNC | Conditional move if not carry |
| CMOVNO | Conditional move if not overflow |
| CMOVNS | Conditional move if not sign (non-negative) |
| CMOVNP | Conditional move if not parity |
| CMOVPE | Conditional move if parity even |
| CMOVPO | Conditional move if parity odd |
| Stack Operations | |
| PUSH | Push onto the stack |
| PUSHA | Push general-purpose registers: AX, CX, DX, BX, SP, BP, SI, DI onto stack |
| PUSHAD | Push general-purpose registers: EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI onto stack |
| POP | Pop off the stack |
| POPA | Pop general-purpose registers: DI, SI, BP, BX, DX, CX, AX from stack |
| POPAD | Pop general-purpose registers: EDI, ESI, EBP, EBX, EDX, ECX, EAX from stack |
| Exchange Operations | |
| XCHG | Exchange |
| XADD | Exchange and add |
| Compare-Exchange Operations | |
| CMPXCHG | Compare and exchange |
| CMPXCHG8B | Compare and exchange 8 bytes |
| CMPXCHG16B | Compare and exchange 16 bytes |
| Compare-Add Operations | |
| CMPBXADD | Compare the in-memory value with the second value. If the second value is below, then add the third value to the in-memory value |
| CMPBEXADD | Compare the in-memory value with the second value. If the second value is below or equal, then add the third value to the in-memory value |
| CMPLXADD | Compare the in-memory value with the second value. If the second value is less, then add the third value to the in-memory value |
| CMPLEXADD | Compare the in-memory value with the second value. If the second value is less or equal, then add the third value to the in-memory value |
| CMPZXADD | Compare the in-memory value with the second value. If the second value is zero, then add the third value to the in-memory value |
| CMPOXADD | Compare the in-memory value with the second value. If the second value is overflow, then add the third value to the in-memory value |
| CMPSXADD | Compare the in-memory value with the second value. If the second value is sign, then add the third value to the in-memory value |
| CMPPXADD | Compare the in-memory value with the second value. If the second value is parity, then add the third value to the in-memory value |
| CMPNBXADD | Compare the in-memory value with the second value. If the second value is not below, then add the third value to the in-memory value |
| CMPNBEXADD | Compare the in-memory value with the second value. If the second value is not below or equal, then add the third value to the in-memory value |
| CMPNLXADD | Compare the in-memory value with the second value. If the second value is not less, then add the third value to the in-memory value |
| CMPNLEXADD | Compare the in-memory value with the second value. If the second value is not less or equal, then add the third value to the in-memory value |
| CMPNZXADD | Compare the in-memory value with the second value. If the second value is not zero, then add the third value to the in-memory value |
| CMPNOXADD | Compare the in-memory value with the second value. If the second value is not overflow, then add the third value to the in-memory value |
| CMPNSXADD | Compare the in-memory value with the second value. If the second value is not sign, then add the third value to the in-memory value |
| CMPNPXADD | Compare the in-memory value with the second value. If the second value is not parity, then add the third value to the in-memory value |
| Misc Operations | |
| BSWAP | Byte swap |
| MOVBE | Move data after swapping data bytes |
| XLATB | Table lookup translation |
Data Conversion Instructions
Convert integer values from/two different integer types.
| Instruction | Meaning |
|---|---|
| CBW | Convert byte to word (sign-extend of AL to AX) |
| CWD | Convert word to double word (sign-extend of AX to DX:AX) |
| CDQ | Convert double word to quad word (sign-extend of EAX to EDX:EAX) |
| CQO | Convert quad word to octal word (sign-extend of RAX to RDX:RAX) |
| CWDE | Convert word to double word (sign-extend of AX to EAX) |
| CDQE | Convert double word to quad word (sign-extend of EAX to RAX) |
Binary Arithmetic Instructions
The binary arithmetic instructions perform basic binary integer computations on integers located in memory and/or the general purpose registers.
| Instruction | Meaning |
|---|---|
| Addition | |
| INC | Increment |
| ADD | Add |
| ADC | Add with carry |
| ADCX | Unsigned integer add with carry |
| ADOX | Unsigned integer add with overflow |
| Subtraction | |
| DEC | Decrement |
| SUB | Subtract |
| SBB | Subtract with borrow |
| Multiplication | |
| MUL | Unsigned multiply |
| IMUL | Signed multiply |
| Division | |
| DIV | Unsigned divide |
| IDIV | Signed divide |
| Negation | |
| NEG | Negate |
| Comparison | |
| CMP | Compare |
Decimal Arithmetic Instructions
The decimal arithmetic instructions perform decimal arithmetic on Binary Coded Decimal (BCD) data.
| Instruction | Meaning |
|---|---|
| Packed BCD | |
| DAA | Decimal adjust after addition |
| DAS | Decimal adjust after subtraction |
| Unpacked BCD | |
| AAA | ASCII adjust after addition |
| AAS | ASCII adjust after subtraction |
| AAM | ASCII adjust after multiplication |
| AAD | ASCII adjust before division |
Logical Instructions
The logical instructions perform basic AND, OR, XOR, and NOT logical operations on byte, word, and doubleword values.
| Instruction | Meaning |
|---|---|
| AND | Perform bitwise logical AND |
| OR | Perform bitwise logical OR |
| XOR | Perform bitwise logical exclusive OR |
| NOT | Perform bitwise logical NOT |
Shift and Rotate Instructions
The shift and rotate instructions shift and rotate the bits in word and doubleword operands.
| Instruction | Meaning |
|---|---|
| Shift | |
| SHL | Shift logical left |
| SHLD | Shift left double |
| SHR | Shift logical right |
| SHRD | Shift right double |
| SAL | Shift arithmetic left |
| SAR | Shift arithmetic right |
| Rotation | |
| ROL | Rotate left |
| ROR | Rotate right |
| RCL | Rotate through carry left |
| RCR | Rotate through carry right |
Bit and Byte Instructions
Bit instructions test and modify individual bits in word and doubleword operands. Byte instructions set the value of a byte operand to indicate the status of flags in the EFLAGS register.
| Instruction | Meaning |
|---|---|
| POPCNT | Compute the number of bits set to 1 |
| TEST | Logical compare |
| Bit Test | |
| BT | Bit test |
| BTS | Bit test and set |
| BTR | Bit test and reset |
| BTC | Bit test and complement |
| Bit Scan | |
| BSF | Bit scan forward |
| BSR | Bit scan reverse |
| Set Byte on Condition | |
| SETE | Set byte if equal |
| SETA | Set byte if above |
| SETAE | Set byte if above or equal |
| SETB | Set byte if below |
| SETBE | Set byte if below or equal |
| SETG | Set byte if greater |
| SETGE | Set byte if greater or equal |
| SETL | Set byte if less |
| SETLE | Set byte if less or equal |
| SETZ | Set byte if zero |
| SETC | Set byte if carry |
| SETO | Set byte if overflow |
| SETS | Set byte if sign (negative) |
| SETP | Set byte if parity |
| SETNE | Set byte if not equal |
| SETNA | Set byte if not above |
| SETNAE | Set byte if not above or equal |
| SETNB | Set byte if not below |
| SETNBE | Set byte if not below or equal |
| SETNG | Set byte if not greater |
| SETNGE | Set byte if not greater or equal |
| SETNL | Set byte if not less |
| SETNLE | Set byte if not less or equal |
| SETNZ | Set byte if not zero |
| SETNC | Set byte if not carry |
| SETNO | Set byte if not overflow |
| SETNS | Set byte if not sign (non-negative) |
| SETNP | Set byte if not parity |
| SETPE | Set byte if parity even |
| SETPO | Set byte if parity odd |
Bit manipulation instructions
A collection of instructions to manipulate integer data at bit-granularity. Most of the bit-manipulation instructions employ VEX-prefix encoding to support three-operand syntax with non-destructive source operands.
| Instruction | Meaning |
|---|---|
| ANDN | Bitwise AND of first source with inverted second source operands |
| Bit Counting | |
| LZCNT | Count the number leading zero bits |
| TZCNT | Count the number trailing zero bits |
| Bit Shuffling | |
| PEXT | Parallel extraction of bits using a mask |
| PDEP | Parallel deposit of bits using a mask |
| BEXTR | Contiguous bitwise extract |
| BZHI | Zero high bits starting from specified bit position |
| LSB Operations | |
| BLSI | Extract lowest set bit |
| BLSR | Reset lowest set bit |
| BLSMSK | Set all lower bits below first set bit to 1 |
| Performance Improvement | |
| MULX | Unsigned multiply without affecting flags |
| SHLX | Shift logic left without affecting flags |
| SHRX | Shift logic right without affecting flags |
| SARX | Shift arithmetic right without affecting flags |
| RORX | Rotate right without affecting flags |
String Instructions
The string instructions operate on strings of bytes, allowing them to be moved to and from memory.
| Instruction | Meaning |
|---|---|
| Load From Memory | |
| LODSB | Load byte string |
| LODSW | Load word string |
| LODSD | Load double word string |
| LODSQ | Load quad word string |
| Store To Memory | |
| STOSB | Store byte string |
| STOSW | Store word string |
| STOSD | Store double word string |
| STOSQ | Store quad word string |
| Move Memory Blocks | |
| MOVSB | Move byte string |
| MOVSW | Move word string |
| MOVSD | Move double word string |
| MOVSQ | Move quad word string |
| Compare Memory Blocks | |
| CMPSB | Compare byte string |
| CMPSW | Compare word string |
| CMPSD | Compare double word string |
| CMPSQ | Compare quad word string |
| Find In Memory Block | |
| SCASB | Scan byte string |
| SCASW | Scan word string |
| SCASD | Scan double word string |
| SCASQ | Scan quad word string |
| Repeat String Operation | |
| REP | Repeat while ECX not zero |
| REPE | Repeat while equal |
| REPZ | Repeat while zero |
| REPNE | Repeat while not equal |
| REPNZ | Repeat while not zero |
I/O Instructions
These instructions move data between the processor’s I/O ports and a register or memory.
| Instruction | Meaning |
|---|---|
| Input | |
| IN | Read from a port |
| INSB | Input byte string from port |
| INSW | Input word string from port |
| INSD | Input double word string from port |
| Output | |
| OUT | Write to a port |
| OUTSB | Output byte string to port |
| OUTSW | Output word string to port |
| OUTSD | Output double word string to port |
Enqueue Store Instructions
These instructions enable the CPU to send commands directly to input/output (I/O) devices, bypassing typical memory hierarchy steps like caches. This improves efficiency for asynchronous I/O operations.
| Instruction | Meaning |
|---|---|
| ENQCMD | Enqueue command |
| ENQCMDS | Enqueue command supervisor |
Control Transfer Instructions
The control transfer instructions provide jump, conditional jump, loop, and call and return operations to control program flow.
| Instruction | Meaning |
|---|---|
| JMP | Jump |
| Conditional Jumps | |
| JE | Jump if equal |
| JA | Jump if above |
| JAE | Jump if above or equal |
| JB | Jump if below |
| JBE | Jump if below or equal |
| JG | Jump if greater |
| JGE | Jump if greater or equal |
| JL | Jump if less |
| JLE | Jump if less or equal |
| JZ | Jump if zero |
| JC | Jump if carry |
| JO | Jump if overflow |
| JS | Jump if sign (negative) |
| JP | Jump if parity |
| JNE | Jump if not equal |
| JNA | Jump if not above |
| JNAE | Jump if not above or equal |
| JNB | Jump if not below |
| JNBE | Jump if not below or equal |
| JNG | Jump if not greater |
| JNGE | Jump if not greater or equal |
| JNL | Jump if not less |
| JNLE | Jump if not less or equal |
| JNZ | Jump if not zero |
| JNC | Jump if not carry |
| JNO | Jump if not overflow |
| JNS | Jump if not sign (non-negative) |
| JNP | Jump if not parity |
| JPE | Jump if parity even |
| JPO | Jump if parity odd |
| JCXZ | Jump register CX zero |
| JECXZ | Jump register ECX zero |
| JRCXZ | Jump register RCX zero |
| Loops | |
| LOOP | Loop with ECX counter |
| LOOPE | Loop with ECX and equal |
| LOOPZ | Loop with ECX and zero |
| LOOPNE | Loop with ECX and not equal |
| LOOPNZ | Loop with ECX and not zero |
| Procedure Calls | |
| CALL | Call procedure |
| RET | Return |
| Interrupts | |
| INT | Software interrupt with a vector specified by immediate byte |
| INTO | Interrupt on overflow |
| INT1 | Interrupt for hardware debug |
| INT3 | Interrupt for software breakpoints |
| IRET | Return from interrupt |
| BOUND | Detect value out of range |
Control Transfer Terminating Instructions
Intel Control-flow Enforcement Technology (CET) is a hardware-assisted security feature designed to protect against control-flow hijacking attacks, uses specific instructions related to terminating indirect branches. The "terminating" instructions in this context signal the end of an indirect branch at the target location.
| Instruction | Meaning |
|---|---|
| ENDBR32 | Terminate an indirect branch in 32-bit and compatibility mode |
| ENDBR64 | Terminate an indirect branch in 64-bit mode |
High Level Procedure Instructions
These instructions provide machine-language support for procedure calls in block-structured languages.
| Instruction | Meaning |
|---|---|
| ENTER | High-level procedure entry |
| LEAVE | High-level procedure exit |
Shadow Stack Management Instructions
Shadow stack management instructions allow the program and run-time to perform operations like recovering from control protection faults, shadow stack switching, etc.
| Instruction | Meaning |
|---|---|
| Busy Bit | |
| SETSSBSY | Set busy bit in a supervisor shadow stack token |
| CLRSSBSY | Clear busy bit in a supervisor shadow stack token |
| Shadow Stack Pointer (SSP) | |
| INCSSP | Increment the Shadow Stack Pointer (SSP) |
| RDSSP | Read Shadow Stack Point (SSP) |
| RSTORSSP | Restore a Shadow Stack Pointer (SSP) |
| SAVEPREVSSP | Save previous Shadow Stack Pointer (SSP) |
| Writes | |
| WRSS | Write to a shadow stack |
| WRUSS | Write to a user mode shadow stack |
Flag Control Instructions
The flag control instructions operate on the flags in the EFLAGS register.
| Instruction | Meaning |
|---|---|
| Set Flags | |
| STI | Set interrupt flag |
| STD | Set direction flag |
| STC | Set carry flag |
| STAC | Set AC flag in EFLAGS register |
| Clear Flags | |
| CLI | Clear the interrupt flag |
| CLD | Clear the direction flag |
| CLC | Clear the carry flag |
| CLAC | Clear AC flag in EFLAGS register |
| Complement Flags | |
| CMC | Complement the carry flag |
| Load Flags | |
| LAHF | Load flags into AH register |
| POPF | Pop lower 16 bits of EFLAGS from stack |
| POPFD | Pop EFLAGS from stack |
| POPFQ | Pop RFLAGS from stack |
| Store Flags | |
| SAHF | Store AH register into flags |
| PUSHF | Push lower 16 bits of EFLAGS onto stack |
| PUSHFD | Push EFLAGS onto stack |
| PUSHFQ | Push RFLAGS onto stack |
User Interrupt (UINTR) Instructions
User Interrupts (Uintr) is a hardware technology that enables delivering interrupts directly to user space.
| Instruction | Meaning |
|---|---|
| STUI | Set user interrupt flag |
| CLUI | Clear user interrupt flag |
| TESTUI | Determine user interrupt flag |
| SENDUIPI | Send user interprocessor interrupt |
| UIRET | User-interrupt return |
User Level Monitor (ULM) Instructions
| Instruction | Meaning |
|---|---|
| UMONITOR | User level set up monitor address |
| UMWAIT | User level monitor wait |
Miscellaneous Instructions
The miscellaneous instructions provide such functions as loading an effective address, executing a "no-operation," and retrieving processor identification information.
| Instruction | Meaning |
|---|---|
| LEA | Load effective address |
| NOP | No operation |
| UD | Undefined instruction |
| RDPID | Read processor ID |
| CPUID | Processor identification |
| CRC32 | Provides hardware acceleration to calculate cyclic redundancy checks for fast and efficient implementation of data integrity protocols |
| PTWRITE | Write data to a processor trace packet |
Random Number Generator Instructions
The instructions for generating random numbers to comply with NIST SP800-90A, SP800-90B, and SP800-90C standards.
| Instruction | Meaning |
|---|---|
| RDRAND | Retrieves a random number generated from hardware |
| RDSEED | Read random SEED |
Segment Register Instructions
The segment register instructions allow far pointers (segment addresses) to be loaded into the segment registers.
| Instruction | Meaning |
|---|---|
| LDS | Load far pointer using DS |
| LES | Load far pointer using ES |
| LFS | Load far pointer using FS |
| LGS | Load far pointer using GS |
| LSS | Load far pointer using SS |
System Instructions
The following system instructions are used to control those functions of the processor that are provided to support for operating systems and executives.
| Instruction | Meaning |
|---|---|
| Descriptor Table Management | |
| LLDT | Load local descriptor table (LDT) register |
| SLDT | Store local descriptor table (LDT) register |
| LGDT | Load global descriptor table (GDT) register |
| SGDT | Store global descriptor table (GDT) register |
| LIDT | Load interrupt descriptor table (IDT) register |
| SIDT | Store interrupt descriptor table (IDT) register |
| Segmentation | |
| RDFSBASE | Reads from FS base address at any privilege level |
| WRFSBASE | Writes to FS base address at any privilege level |
| RDGSBASE | Reads from GS base address at any privilege level |
| WRGSBASE | Writes to GS base address at any privilege level |
| SWAPGS | Exchanges current GS base register value with value in MSR address 0xC0000102 |
| Privilege Leveling | |
| VERR | Verify segment for reading |
| VERW | Verify segment for writing |
| LAR | Load access rights |
| LSL | Load segment limit |
| ARPL | Adjust requested privilege level |
| Memory Protection/Synchronization | |
| RDPKRU | Read protection key rights for user pages |
| WRPKRU | Write data to user page key register |
| LOCK | Lock bus (prefix) |
| Task Management | |
| LTR | Load task register |
| STR | Store task register |
| CLTS | Clear the task-switched flag |
| State Registers | |
| XSAVE | Save processor extended states to memory |
| XSAVES | Save processor extended states supervisor |
| XSAVEC | Save processor extended states with compaction |
| XSAVEOPT | Save processor extended states to memory, optimized |
| XRSTOR | Restore processor extended states from memory |
| XRSTORS | Restore processor extended states supervisor |
| Control Registers | |
| XGETBV | Reads the state of an extended control register |
| XSETBV | Writes the state of an extended control register |
| LMSW | Load machine status word |
| SMSW | Store machine status word |
| Model-Specific Registers | |
| RDMSR | Read model-specific register |
| WRMSR | Write model-specific register |
| RDMSRLIST | Read list of model-specific registers |
| WRMSRLIST | Write list of model-specific registers |
| Performance Registers | |
| RDPMC | Read performance monitoring counter |
| RDTSC | Read time stamp counter |
| RDTSCP | Read time stamp counter and processor ID |
| System Management | |
| RSM | Return from system management mode (SMM) |
| HRESET | Requests the processor to selectively reset selected components of hardware history maintained by the current logical processor |
| PCONFIG | Allows software to configure certain platform features |
| Processor Control | |
| HLT | Halt processor |
| Cache and TLB Management | |
| INVD | Invalidate cache, no write back |
| WBINVD | Write back and invalidate cache |
| WBNOINVD | Write back and do not invalidate cache |
| INVLPG | Invalidate TLB entry |
| INVPCID | Invalidate process-context identifier |
| System Calls | |
| SYSENTER | Fast system call, transfers to a flat protected mode kernel at CPL = 0 |
| SYSEXIT | Fast system call, transfers to a flat protected mode kernel at CPL = 3 |
| SYSCALL | Fast call to privilege level 0 system procedures |
| SYSRET | Return from fast system call |