Summary: Increments the operand by 1.

Increments operand by 1 and stores result in operand. Sets OF, SF, ZF, AF, PF; does not affect CF. Supports 8/16/32/64-bit operand sizes in all modes. Useful for loop counters and pointer arithmetic.

result ← dest + 1; dest ← result; OF ← overflow; ZF ← (result == 0); SF ← (result < 0); AF ← (result & 0xF); PF ← parity(result)


Summary: Decrements the operand by 1.

Decrements operand by 1 and stores result in operand. Sets OF, SF, ZF, AF, PF; does not affect CF. Supports 8/16/32/64-bit operand sizes in all modes. Commonly used in loop control.

result ← dest - 1; dest ← result; OF ← overflow; ZF ← (result == 0); SF ← (result < 0); AF ← (result & 0xF); PF ← parity(result)


Summary: Unsigned multiply (AX = AL * src).

Performs unsigned multiplication of accumulator (AL/AX/EAX/RAX) by operand, storing result in AX/DX:AX/EDX:EAX/RDX:RAX respectively. Sets CF and OF if product overflows accumulator width; other flags undefined. High byte/word/dword/qword of result goes into AH/DX/EDX/RDX.

if (operand_width == 8) { product ← AL * src; AX ← product; CF ← OF ← (AH != 0); } else if (operand_width == 16) { product ← AX * src; DX:AX ← product; CF ← OF ← (DX != 0); } else if (operand_width == 32) { product ← EAX * src; EDX:EAX ← product; CF ← OF ← (EDX != 0); } else { product ← RAX * src; RDX:RAX ← product; CF ← OF ← (RDX != 0); }


Summary: Signed multiply.

Performs signed multiplication of destination register by source operand, storing result in destination. Sets OF and CF if result overflows destination width; SF, ZF, AF, PF undefined. Two-operand form (dest ← dest * src) is commonly used for scalar multiplies; one-operand form multiplies into EDX:EAX.

result ← dest * src; dest ← result; if (result overflows dest width) { CF ← 1; OF ← 1; } else { CF ← 0; OF ← 0; }


Summary: Unsigned divide (AX / src).

Performs unsigned division of accumulator (AX/DX:AX/EDX:EAX/RDX:RAX) by operand, storing quotient in AL/AX/EAX/RAX and remainder in AH/DX/EDX/RDX respectively. All flags undefined after division. Raises #DE exception if divisor is zero or quotient overflows.

if (operand_width == 8) { quotient ← AX / src; remainder ← AX mod src; AL ← quotient; AH ← remainder; } else if (operand_width == 16) { quotient ← DX:AX / src; remainder ← DX:AX mod src; AX ← quotient; DX ← remainder; } else if (operand_width == 32) { quotient ← EDX:EAX / src; remainder ← EDX:EAX mod src; EAX ← quotient; EDX ← remainder; } else { quotient ← RDX:RAX / src; remainder ← RDX:RAX mod src; RAX ← quotient; RDX ← remainder; }


Summary: Signed divide (AX / src).

Performs signed division of the implicit accumulator (EDX:EAX for 32-bit or RDX:RAX for 64-bit) by the specified operand; quotient is stored in EAX/RAX and remainder in EDX/RDX. Sets OF, SF, ZF, AF, CF, and PF to undefined values; raises #DE exception if divisor is zero or quotient overflows. Available in 8-bit (AX/AL:AH), 16-bit (DX:AX), 32-bit, and 64-bit variants.

if (src == 0) raise #DE;
temp_dividend = (src_size == 8) ? AX : ((src_size == 16) ? (DX:AX) : ((src_size == 32) ? (EDX:EAX) : (RDX:RAX)));
if ((temp_dividend / src) > max_signed || (temp_dividend / src) < min_signed) raise #DE;
quotient = temp_dividend / src;
remainder = temp_dividend % src;
if (src_size == 8) { AL ← quotient; AH ← remainder; }
else if (src_size == 16) { AX ← quotient; DX ← remainder; }
else if (src_size == 32) { EAX ← quotient; EDX ← remainder; }
else { RAX ← quotient; RDX ← remainder; }
OF ← undefined; SF ← undefined; ZF ← undefined; AF ← undefined; CF ← undefined; PF ← undefined;


Summary: Reverses bits of operand.

Performs one's complement (bitwise negation) on the operand, inverting all bits and storing the result back. Does not affect any flags. Available in 8/16/32/64-bit variants.


Summary: Negates value (0 - operand).

Performs two's complement negation (0 - operand), storing the result back in the operand. Sets/clears CF, OF, ZF, SF, AF, PF based on result; CF is set unless operand was zero. Available in 8/16/32/64-bit variants.

old_operand ← dest;
result ← 0 - dest;
dest ← result;
CF ← (old_operand != 0);
OF ← (old_operand == (1 << (operand_size * 8 - 1)));
ZF ← (result == 0);
SF ← (result & sign_bit) != 0;
PF ← popcount(result & 0xFF) % 2 == 0;
AF ← ((0 - old_operand) & 0x10) != (old_operand & 0x10);


Summary: Shifts bits left (same as SAL).

Shifts the bits of the destination operand left by the count specified in the immediate operand, filling vacated bits with zeros; leftmost bit is shifted into CF. Sets CF and OF based on shift; ZF, SF, PF reflect the result. Available in 8/16/32/64-bit variants; count is typically 1 or specified by imm8.

if (count == 0) return;
temp ← dest;
CF ← (dest >> (operand_size * 8 - count)) & 1;
result ← dest << count;
OF ← (result & sign_bit) != (temp & sign_bit);
ZF ← (result == 0);
SF ← (result & sign_bit) != 0;
PF ← popcount(result & 0xFF) % 2 == 0;
dest ← result;


Summary: Shifts bits right, filling with zeros.

Shifts the bits of the destination operand right by the count specified in the immediate operand, filling vacated bits with zeros; rightmost bit is shifted into CF. Sets CF and OF based on shift; ZF, SF, PF reflect the result. Available in 8/16/32/64-bit variants; count is typically 1 or specified by imm8.

if (count == 0) return;
temp ← dest;
CF ← (dest >> (count - 1)) & 1;
result ← dest >> count;
OF ← (temp & sign_bit);
ZF ← (result == 0);
SF ← 0;
PF ← popcount(result & 0xFF) % 2 == 0;
dest ← result;


Summary: Shifts bits right, preserving sign bit.

Shifts the bits of the destination operand right by the number of bits specified in the source operand, with the sign bit (MSB) replicated into vacated positions, preserving the sign of the value. The Carry Flag is set to the last bit shifted out. Available in 8/16/32/64-bit variants; OF is undefined when count > 1.

shift_count ← src
temp ← dest
for i ← 0 to shift_count - 1 do
  CF ← temp[0]
  temp ← (sign_extend(temp[width-1]) << (width-1)) | (temp >> 1)
dest ← temp
if shift_count == 1 then
  OF ← 0
else if shift_count > 1 then
  OF ← undefined
ZF ← (dest == 0)
SF ← dest[width-1]
PF ← parity(dest)


Summary: Unconditional jump to target.

Performs an unconditional jump by adding the sign-extended relative offset to the instruction pointer (EIP/RIP). Available in 8-bit relative (EB opcode, -128 to +127) and 32-bit relative (E9 opcode) variants. No flags are affected.

if operand_size == 8 then
  RIP ← RIP + sign_extend_8(rel8)
else if operand_size == 32 then
  RIP ← RIP + sign_extend_32(rel32)
// In 64-bit mode, RIP is the canonical form of EIP

JMP 0x401000  ; Jump to address
JMP label     ; Jump to label


Summary: Jump if ZF=1 (Same as JZ).

Jumps to the target if the Zero Flag is set (ZF=1), indicating the result of a prior comparison or arithmetic operation was zero. Available in 8-bit relative form (opcode 74). No flags are affected by the jump itself; the jump condition is determined by previously set flags.

if ZF == 1 then
  RIP ← RIP + sign_extend_8(rel8)
else
  RIP ← RIP + 1  // no jump, continue to next instruction


Summary: Jump if ZF=0 (Same as JNZ).

Jumps to the target if the Zero Flag is clear (ZF=0), indicating the result of a prior comparison or arithmetic operation was non-zero. Available in 8-bit relative form (opcode 75). No flags are affected by the jump itself; the jump condition is determined by previously set flags.

if ZF == 0 then
  RIP ← RIP + sign_extend_8(rel8)
else
  RIP ← RIP + 1  // no jump, continue to next instruction


Summary: Jump if ZF=0 and SF=OF (Signed >).

Jumps to the target if the Zero Flag is clear and Sign Flag equals Overflow Flag (ZF=0 AND SF=OF), indicating a signed arithmetic result is greater than zero. Available in 8-bit relative form (opcode 7F). No flags are affected by the jump itself; the jump condition depends on previously set flags.

if (ZF == 0) AND (SF == OF) then
  RIP ← RIP + sign_extend_8(rel8)
else
  RIP ← RIP + 1  // no jump, continue to next instruction


Summary: Jump if SF!=OF (Signed <).

Jumps to the target if Sign Flag does not equal Overflow Flag (SF≠OF), indicating a signed arithmetic result is less than zero. Available in 8-bit relative form (opcode 7C). No flags are affected by the jump itself; the jump condition depends on previously set flags.

if SF != OF then
  RIP ← RIP + sign_extend_8(rel8)
else
  RIP ← RIP + 1  // no jump, continue to next instruction


Summary: Jump if CF=0 and ZF=0 (Unsigned >).

Performs a conditional jump to the target address if the previous comparison or arithmetic operation resulted in an unsigned greater-than condition (CF=0 AND ZF=0). This instruction is commonly used after unsigned comparisons (CMP) to branch based on the above condition. No flags are modified by this instruction; it only reads CF and ZF to determine the jump condition.

if (CF == 0 && ZF == 0) { RIP ← RIP + sign_extend(rel); }


Summary: Jump if CF=1 (Unsigned <).

Performs a conditional jump to the target address if the carry flag is set (CF=1), indicating an unsigned less-than condition from the previous operation. Commonly used after unsigned CMP or arithmetic operations to branch on the below condition. No flags are modified; the instruction only reads CF.

if (CF == 1) { RIP ← RIP + sign_extend(rel); }


Summary: Push EIP/RIP and jump to target.

Pushes the return address (next instruction pointer) onto the stack and jumps to the target procedure. In 32-bit mode, EIP is pushed; in 64-bit mode, RIP is pushed. This instruction does not modify any arithmetic flags but causes implicit stack manipulation and memory writes. Control flow changes to the called procedure.

if (64-bit mode) { RSP ← RSP - 8; [RSP] ← RIP + instruction_length; RIP ← RIP + sign_extend(rel); } else { ESP ← ESP - 4; [ESP] ← EIP + instruction_length; EIP ← EIP + sign_extend(rel); }


Summary: Pop EIP/RIP and resume execution.

Pops the return address from the stack and resumes execution at that address, effectively returning from a procedure called with CALL. In 32-bit mode, EIP is popped; in 64-bit mode, RIP is popped. No flags are modified. This instruction performs implicit stack manipulation and a memory read.

if (64-bit mode) { RIP ← [RSP]; RSP ← RSP + 8; } else { EIP ← [ESP]; ESP ← ESP + 4; }


Push Word/Doubleword/Quadword Onto Stack

Summary: Decrements SP and stores operand on stack.

Decrements the stack pointer (ESP in 32-bit mode, RSP in 64-bit mode) by the operand size and stores the operand value at the new stack pointer. The operand can be a register or memory location. No flags are modified; this instruction performs implicit stack pointer decrement and a memory write.

if (64-bit mode) { RSP ← RSP - 8; [RSP] ← src_value; } else { ESP ← ESP - 4; [ESP] ← src_value; }


Summary: Loads operand from stack and increments SP.

Loads a value from the top of the stack into the destination operand and increments the stack pointer (ESP in 32-bit mode, RSP in 64-bit mode) by the operand size. The destination can be a register or memory location. No flags are modified; this instruction performs implicit stack pointer increment and a memory read.

if (64-bit mode) { dest_value ← [RSP]; RSP ← RSP + 8; } else { dest_value ← [ESP]; ESP ← ESP + 4; }


Summary: Computes effective address and stores in register.

Computes the effective address of the memory operand and stores it in the destination register without performing a memory access. This instruction is useful for address arithmetic and pointer calculations. No flags are modified by this instruction.


Summary: Does nothing (alias for XCHG EAX, EAX).

Performs no operation and consumes one clock cycle. The one-byte NOP (0x90) is functionally equivalent to XCHG EAX, EAX. Longer NOP sequences (multi-byte) are available on newer processors for code padding without pipeline stalls. No flags are modified.


Summary: Exchanges content of two operands.

Atomically exchanges the contents of two operands (register and register/memory or vice versa). The operation is performed with implicit locking semantics when one operand is memory, ensuring atomic behavior on multiprocessor systems. No flags are affected by this instruction.


Summary: Returns processor information based on EAX value.

Executes CPU identification, returning processor feature information and capabilities into EAX, EBX, ECX, and EDX based on the input value in EAX (and sometimes ECX). This is a privileged instruction in some contexts and causes a serializing event; it clears the pipeline and blocks out-of-order execution until completion. The exact output depends on the EAX input leaf and subleaf (ECX) values.

EAX, EBX, ECX, EDX ← cpuid_data[EAX, ECX];


Summary: Reads the time-stamp counter into EDX:EAX.

Reads the 64-bit time-stamp counter (TSC) and places the result in EDX:EAX, with EDX holding bits 63-32 and EAX holding bits 31-0. No flags are modified. This instruction is a serializing operation in some CPU implementations and may have variable latency; it is commonly used for performance measurement and requires appropriate privilege level or user-space access controls (managed by CR4.TSD).


Summary: Copies and sign-extends a smaller value to a larger register.

Moves a value from a smaller source operand (8, 16, or 32 bits) to a larger destination register, sign-extending the value to fill the destination width. The sign bit of the source is copied to all high-order bits of the destination. No flags are affected by this instruction. Supported size combinations: r16 ← r/m8, r32 ← r/m8, r32 ← r/m16, r64 ← r/m8, r64 ← r/m16, r64 ← r/m32.

sign_bit ← src[source_width - 1]; dest ← (source_width < dest_width) ? (sign_extend(src, sign_bit, dest_width)) : src;


Summary: Copies and zero-extends a smaller value to a larger register.

Moves a value from a smaller source operand (8 or 16 bits) to a larger destination register, zero-extending the value to fill the destination width. All high-order bits of the destination beyond the source width are cleared to zero. No flags are affected by this instruction. Supported size combinations: r16 ← r/m8, r32 ← r/m8, r32 ← r/m16, r64 ← r/m8, r64 ← r/m16.

dest ← (source_width < dest_width) ? (zero_extend(src, dest_width)) : src;


Summary: Sign-extends AX into EAX (also CWDE).

Sign-extends the 16-bit value in AX into the 32-bit register EAX; the sign bit of AX (bit 15) is copied to all high-order bits (31-16) of EAX, and EAX's low 16 bits (AX) remain unchanged. This is a zero-operand instruction with no flags modified. In 64-bit mode, CWDE is the canonical mnemonic and has the same behavior.


Summary: Sign-extends EAX into EDX:EAX (also CDQ).

Sign-extends the 32-bit value in EAX into the 64-bit pair EDX:EAX; the sign bit of EAX (bit 31) is copied to all bits of EDX (bits 63-32), and EAX remains unchanged. This is a zero-operand instruction with no flags modified. In 64-bit mode, CDQ is the canonical mnemonic and has the same behavior. Commonly used before IDIV to prepare the dividend.


Summary: Sign-extends RAX into RDX:RAX (also CQO).

Sign-extends the 64-bit value in RAX into the 128-bit pair RDX:RAX (64-bit mode only); the sign bit of RAX (bit 63) is copied to all bits of RDX, and RAX remains unchanged. This is a zero-operand instruction with no flags modified. CQO is the canonical mnemonic for this operation. Commonly used before IDIV (64-bit) to prepare the dividend.


Summary: Reverses the byte order of a register (Endian swap).

dest

32-bit general-purpose register (e.g. EAX)

Reverses the byte order of a 32-bit register, converting between little-endian and big-endian representations. No flags are affected. This instruction requires 386+ and operates on 32-bit operands in protected and 64-bit modes; in 64-bit mode, a REX.W prefix extends it to 64-bit operands.


Summary: Exchanges dest and src, then loads sum into dest.

Exchanges the values of dest and src, then stores their sum into dest. Sets OF, SF, ZF, AF, CF, PF based on the addition result. Implicitly uses the accumulator (EAX/RAX) for implicit operand size determination. Available in 386+ with size variants 8/16/32/64-bit; used in multi-threaded code for atomic operations.

temp ← src
src ← dest
dest ← dest + temp
flags ← set based on (dest + temp) result
ZF ← (dest == 0); CF ← carry_out; OF ← overflow; SF ← (dest & sign_bit) != 0; PF ← parity(dest); AF ← (((dest ^ temp) ^ result) & 0x10) != 0


Summary: Compares accumulator with dest; if equal, dest = src; else accumulator = dest.

Compares an implicit accumulator (AL/AX/EAX/RAX) with dest; if equal, src is written to dest and ZF is set; otherwise dest is written to the accumulator and ZF is cleared. Sets OF, SF, ZF, AF, CF, PF based on the comparison. Available in 386+ with size variants 8/16/32/64-bit; used for atomic compare-and-swap operations in lock-free code.

if (size == 8) {
  if (AL == dest) { dest ← src; ZF ← 1; } else { AL ← dest; ZF ← 0; }
} else if (size == 16) {
  if (AX == dest) { dest ← src; ZF ← 1; } else { AX ← dest; ZF ← 0; }
} else if (size == 32) {
  if (EAX == dest) { dest ← src; ZF ← 1; } else { EAX ← dest; ZF ← 0; }
} else { /* size == 64 */
  if (RAX == dest) { dest ← src; ZF ← 1; } else { RAX ← dest; ZF ← 0; }
}
OF, SF, AF, CF, PF ← undefined (or set by comparison result)


Summary: Moves data if condition code is met (e.g., CMOVE, CMOVNE).

Conditionally moves src to dest if the specified condition code (based on EFLAGS) is true; otherwise dest is unchanged. No flags are modified. Available in P6+ processors (CMOV extension) with size variants 16/32/64-bit; eliminates branch mispredictions in conditional data flow.

if (condition_code) {
  dest ← src
}
/* EFLAGS unchanged */


Summary: Sets byte to 1 if condition met, else 0 (e.g., SETE, SETZ).

Sets the byte at dest to 1 if the specified condition code (based on EFLAGS) is true, otherwise sets it to 0. No other flags are affected. Available in 386+ with 8-bit size only; condition codes include SETE, SETNE, SETL, SETG, SETA, SETB, etc.

if (condition_code) {
  dest[0:7] ← 0xFF
} else {
  dest[0:7] ← 0x00
}
/* EFLAGS unchanged */


Summary: Stops instruction execution and places processor in HALT state.

Stops instruction execution and places the processor in a HALT state, waiting for an external interrupt or reset. Requires privilege level 0 (kernel mode); attempting HLT in user mode raises a #GP exception. No flags are affected. Used in idle loops and system shutdown sequences.

halt_cpu()
/* Wait for external interrupt or reset */


Summary: Calls to interrupt procedure.

Invokes an interrupt handler identified by the 8-bit vector. Pushes EFLAGS (or RFLAGS), CS, and EIP (or RIP) onto the stack, then transfers control to the interrupt handler. Privilege level checked; IF flag is cleared upon entry. Available in all modes with different stack/address behaviors in real vs. protected vs. 64-bit mode.

if (mode == 64) {
  RSP ← RSP - 8; [RSP] ← RFLAGS
  RSP ← RSP - 8; [RSP] ← CS
  RSP ← RSP - 8; [RSP] ← RIP
} else {
  ESP ← ESP - 4; [ESP] ← EFLAGS
  ESP ← ESP - 4; [ESP] ← CS
  ESP ← ESP - 4; [ESP] ← EIP
}
CS:RIP ← IDT[imm8]
IF ← 0
TF ← 0


Summary: Calls to interrupt vector 3 (Debugger breakpoint).

Invokes interrupt vector 3, which typically triggers a debugger breakpoint. Equivalent to INT 3 but encoded as a single byte (0xCC) for efficient inline breakpoint insertion. Pushes EFLAGS, CS, and EIP (or RFLAGS, CS, RIP in 64-bit mode) onto the stack. Available in all modes and privilege levels.

if (mode == 64) {
  RSP ← RSP - 8; [RSP] ← RFLAGS
  RSP ← RSP - 8; [RSP] ← CS
  RSP ← RSP - 8; [RSP] ← RIP
} else {
  ESP ← ESP - 4; [ESP] ← EFLAGS
  ESP ← ESP - 4; [ESP] ← CS
  ESP ← ESP - 4; [ESP] ← EIP
}
CS:RIP ← IDT[3]
IF ← 0
TF ← 0


Summary: Generates an invalid opcode exception.

Generates an invalid opcode exception (#UD) unconditionally, causing the processor to raise a fault. This instruction has no operands and performs no other operation. It is commonly used for intentional traps, unreachable code markers, and testing exception handling.


Summary: Improves performance of spin-wait loops (alias for REP NOP).

Provides a hint to the processor that the code is executing a spin-wait loop, improving power efficiency and reducing contention on shared memory buses without altering program logic. The instruction is semantically equivalent to REP NOP (F3 90 encoding) and executes as a very short delay; no flags are affected.

// Improves performance of spin-wait loops (alias for REP NOP)


Summary: Sets the CF flag to 0.

Unconditionally clears the Carry Flag (CF) to 0. Only the CF flag is modified; all other flags and CPU state remain unchanged. Available in all modes (real, protected, and 64-bit).


Summary: Sets the CF flag to 1.

Unconditionally sets the Carry Flag (CF) to 1. Only the CF flag is modified; all other flags and CPU state remain unchanged. Available in all modes (real, protected, and 64-bit).


Summary: Toggles the CF flag.

Complements (toggles) the Carry Flag (CF): if CF=0 it becomes 1, and if CF=1 it becomes 0. Only the CF flag is modified; all other flags remain unchanged. Available in all modes (real, protected, and 64-bit).


Summary: Sets DF to 0 (String operations increment).

Clears the Direction Flag (DF) to 0, causing string instructions (MOVS, SCAS, LODS, STOS, CMPS) to auto-increment the index registers (ESI/EDI or RSI/RDI) rather than decrement them. Only DF is modified; all other flags remain unchanged. Available in all modes.


Summary: Sets DF to 1 (String operations decrement).

Sets the Direction Flag (DF) to 1, causing string instructions (MOVS, SCAS, LODS, STOS, CMPS) to auto-decrement the index registers (ESI/EDI or RSI/RDI) rather than increment them. Only DF is modified; all other flags remain unchanged. Available in all modes.


Summary: Disables maskable hardware interrupts.

Clears the Interrupt Flag (IF) to 0, disabling maskable hardware interrupts (IRQ0-IRQ15) but not non-maskable interrupts (NMI) or exceptions. This instruction is privileged and requires CPL=0; execution in user mode raises a #GP exception. Available in protected and 64-bit modes.

IF ← 0  // Requires CPL = 0 (kernel mode)


Summary: Enables maskable hardware interrupts.

Sets the Interrupt Flag (IF) in EFLAGS, enabling maskable hardware interrupts at the next instruction boundary. This is a privileged instruction that requires CPL=0 (kernel mode). The instruction takes effect after the next instruction executes, allowing one more instruction to complete before interrupts are actually serviced.

IF (CPL == 0) THEN IF ← 1; ELSE #GP(0); FI;


Summary: Loads SF, ZF, AF, PF, and CF from AH.

Loads the lower byte of EFLAGS from the AH register, restoring flags CF, PF, AF, ZF, and SF. The upper bits of EFLAGS (IF, TF, DF, OF, NT, RF, VM, AC, VIF, VIP, ID) are unaffected. This is commonly used to restore previously saved flag state.

CF ← AH[0]; PF ← AH[2]; AF ← AH[4]; ZF ← AH[6]; SF ← AH[7];


Summary: Loads bits 0, 2, 4, 6, and 7 of EFLAGS into AH.

Loads the lower byte of EFLAGS into the AH register, extracting flags CF, PF, AF, ZF, and SF. Bits 1, 3, and 5 are set to 0, bit 7 contains SF, and bits 0, 2, 4, 6 contain CF, PF, AF, ZF respectively. This is commonly used to save flag state for later restoration with SAHF.

AH ← 0; AH[0] ← CF; AH[2] ← PF; AH[4] ← AF; AH[6] ← ZF; AH[7] ← SF;


Summary: Decrements ECX/RCX and jumps if not zero.

Decrements the count register (ECX in 32-bit mode, RCX in 64-bit mode) and jumps to the destination if the count is non-zero. Does not set any flags; it only reads the decremented value to determine branch condition. In 64-bit mode, LOOP with a 32-bit operand-size prefix uses ECX (with implicit ZX of RCX).

count ← (MODE64 ? RCX : ECX); count ← count - 1; IF (MODE64) RCX ← count; ELSE ECX ← count; IF (count != 0) THEN IP ← IP + sign_extend(rel8); FI;


Summary: Decrements count; jumps if count!=0 and ZF=1.

Decrements the count register (ECX/RCX) and jumps to destination if count is non-zero AND the Zero Flag is set. Combines loop counting with a zero-flag condition, useful for scanning arrays until an element matches or count exhausted. No flags are modified by this instruction.

count ← (MODE64 ? RCX : ECX); count ← count - 1; IF (MODE64) RCX ← count; ELSE ECX ← count; IF ((count != 0) ∧ (ZF == 1)) THEN IP ← IP + sign_extend(rel8); FI;


Summary: Decrements count; jumps if count!=0 and ZF=0.

Decrements the count register (ECX/RCX) and jumps to destination if count is non-zero AND the Zero Flag is clear. Combines loop counting with a non-zero-flag condition, useful for scanning arrays until an element matches or count exhausted. No flags are modified by this instruction.

count ← (MODE64 ? RCX : ECX); count ← count - 1; IF (MODE64) RCX ← count; ELSE ECX ← count; IF ((count != 0) ∧ (ZF == 0)) THEN IP ← IP + sign_extend(rel8); FI;


Summary: Jumps if ECX register is 0.

Jumps to the destination if ECX register is zero (or RCX in 64-bit mode when used with REX.W). Unlike LOOP variants, this instruction does not modify any register or flag; it only tests the count value. In 64-bit mode, the non-REX.W form still checks ECX (32-bit).

IF (MODE64 ∧ REX.W) THEN IF (RCX == 0) THEN IP ← IP + sign_extend(rel8); FI; ELSE IF (ECX == 0) THEN IP ← IP + sign_extend(rel8); FI; FI;


Summary: Creates a stack frame for procedure parameters.

Creates a stack frame for a procedure call by pushing RBP/EBP and allocating local variable space, supporting nested frames via the nesting level (imm8). The size (imm16) specifies bytes to allocate; nesting level controls how many prior frame pointers are copied. No flags are affected. High nesting levels serialize execution due to repeated memory operations.

push_size ← (OPSIZE == 16 ? 2 : 8); level ← imm8 & 0x1F; size ← imm16; SP ← SP - push_size; [SP] ← BP; frame_ptr ← SP; IF (level > 0) THEN FOR i ← 1 TO level-1 DO BP ← BP - push_size; SP ← SP - push_size; [SP] ← [BP]; OD; SP ← SP - push_size; [SP] ← frame_ptr; FI; BP ← frame_ptr; SP ← SP - size;


Summary: Releases stack frame (MOV ESP, EBP; POP EBP).

Releases the current stack frame by copying the base pointer (EBP/RBP) to the stack pointer (ESP/RSP), then pops the saved base pointer from the stack. This is the inverse of ENTER and restores the caller's frame pointer. No flags are affected. Valid in 16/32/64-bit modes; in 64-bit mode it operates on RBP/RSP.

if (OperandSize == 64) {
  RSP ← RBP;
  RBP ← [RSP];
  RSP ← RSP + 8;
} else if (OperandSize == 32) {
  ESP ← EBP;
  EBP ← [ESP];
  ESP ← ESP + 4;
} else {
  SP ← BP;
  BP ← [SP];
  SP ← SP + 2;
}


Summary: Moves ECX bytes/words from [ESI] to [EDI].

Implicit memory for MOVS: ES:[DI] destination, DS:[SI] source

Copies ECX/RCX bytes or words from the memory location at DS:[ESI/RSI] to ES:[EDI/RDI], decrementing or incrementing the pointers based on the Direction Flag (DF), and decrementing the counter. Repeats until RCX=0 or an interrupt occurs. No flags are modified by the instruction itself, though DF controls direction. The REP prefix causes automatic looping at the microarchitectural level.

while (RCX != 0) {
  if (OperandSize == 8) {
    [RDI] ← [RSI];
    if (DF == 0) { RSI ← RSI + 1; RDI ← RDI + 1; } else { RSI ← RSI - 1; RDI ← RDI - 1; }
  } else if (OperandSize == 16) {
    [RDI] ← [RSI];
    if (DF == 0) { RSI ← RSI + 2; RDI ← RDI + 2; } else { RSI ← RSI - 2; RDI ← RDI - 2; }
  } else {
    [RDI] ← [RSI];
    if (DF == 0) { RSI ← RSI + 4; RDI ← RDI + 4; } else { RSI ← RSI - 4; RDI ← RDI - 4; }
  }
  RCX ← RCX - 1;
}


Summary: Fills [EDI] with AL/AX/EAX for ECX repeats.

Implicit memory destination for STOS (ES:[DI])

Stores the value in AL/AX/EAX/RAX into memory at ES:[RDI] repeatedly, incrementing or decrementing RDI based on the Direction Flag, and decrementing RCX until the counter reaches zero. No flags are modified. The REP prefix enables automatic looping in hardware.

while (RCX != 0) {
  if (OperandSize == 8) {
    [RDI] ← AL;
    if (DF == 0) { RDI ← RDI + 1; } else { RDI ← RDI - 1; }
  } else if (OperandSize == 16) {
    [RDI] ← AX;
    if (DF == 0) { RDI ← RDI + 2; } else { RDI ← RDI - 2; }
  } else if (OperandSize == 32) {
    [RDI] ← EAX;
    if (DF == 0) { RDI ← RDI + 4; } else { RDI ← RDI - 4; }
  } else {
    [RDI] ← RAX;
    if (DF == 0) { RDI ← RDI + 8; } else { RDI ← RDI - 8; }
  }
  RCX ← RCX - 1;
}


Summary: Compares [ESI] and [EDI] until mismatch or ECX=0.

Implicit memory for CMPS string compare (DS:[SI] vs ES:[DI])

Compares bytes or words at DS:[RSI] with ES:[RDI], setting flags as if by a SUB instruction, and repeats while the Zero Flag is set (operands equal) and RCX > 0. Stops on mismatch, RCX=0, or interrupt. Flags OF, SF, ZF, AF, CF, PF are set based on the comparison result.

while (RCX != 0) {
  if (OperandSize == 8) {
    result ← [RSI] - [RDI];
    if (DF == 0) { RSI ← RSI + 1; RDI ← RDI + 1; } else { RSI ← RSI - 1; RDI ← RDI - 1; }
  } else if (OperandSize == 16) {
    result ← [RSI] - [RDI];
    if (DF == 0) { RSI ← RSI + 2; RDI ← RDI + 2; } else { RSI ← RSI - 2; RDI ← RDI - 2; }
  } else {
    result ← [RSI] - [RDI];
    if (DF == 0) { RSI ← RSI + 4; RDI ← RDI + 4; } else { RSI ← RSI - 4; RDI ← RDI - 4; }
  }
  RCX ← RCX - 1;
  OF ← OverflowFlag(result); SF ← SignBit(result); ZF ← (result == 0); AF ← AuxiliaryFlag(result); CF ← CarryFlag(result); PF ← ParityFlag(result);
  if (ZF == 0) break;
}


Summary: Scans [EDI] for AL/AX/EAX until match or ECX=0.

Implicit memory for SCAS (compare accumulator with ES:[DI])

Scans memory at ES:[RDI] for a match with AL/AX/EAX/RAX, setting flags by subtraction, and repeats while the Zero Flag is clear (no match) and RCX > 0. Stops on a match, RCX=0, or interrupt. Flags OF, SF, ZF, AF, CF, PF are set based on the comparison.

while (RCX != 0) {
  if (OperandSize == 8) {
    result ← AL - [RDI];
    if (DF == 0) { RDI ← RDI + 1; } else { RDI ← RDI - 1; }
  } else if (OperandSize == 16) {
    result ← AX - [RDI];
    if (DF == 0) { RDI ← RDI + 2; } else { RDI ← RDI - 2; }
  } else if (OperandSize == 32) {
    result ← EAX - [RDI];
    if (DF == 0) { RDI ← RDI + 4; } else { RDI ← RDI - 4; }
  } else {
    result ← RAX - [RDI];
    if (DF == 0) { RDI ← RDI + 8; } else { RDI ← RDI - 8; }
  }
  RCX ← RCX - 1;
  OF ← OverflowFlag(result); SF ← SignBit(result); ZF ← (result == 0); AF ← AuxiliaryFlag(result); CF ← CarryFlag(result); PF ← ParityFlag(result);
  if (ZF == 1) break;
}


Summary: Rotates bits left.

Rotates the bits in the destination operand left by the number of bit positions specified in the source (immediate or CL register), with the leftmost bit wrapping to the rightmost position. The Carry Flag is set to the bit shifted out; Overflow Flag is set only if the operation rotates by 1 and the sign bit changed. No other flags are affected for rotations > 1.

shift_count ← src & ((OperandSize * 8) - 1);
if (shift_count == 0) { CF ← undefined; OF ← undefined; }
else {
  for (i = 0; i < shift_count; i++) {
    CF ← MSB(dest);
    dest ← (dest << 1) | CF;
  }
  if (shift_count == 1) {
    OF ← MSB_before_rotation XOR MSB_after_rotation;
  } else {
    OF ← undefined;
  }
}


Summary: Rotates bits right.

Rotates the bits in the destination operand right by the number of bit positions specified in the source, with the rightmost bit wrapping to the leftmost position. The Carry Flag is set to the bit shifted out; Overflow Flag is set only if rotating by 1 and the sign bit changed. No other flags are affected for rotations > 1.

shift_count ← src & ((OperandSize * 8) - 1);
if (shift_count == 0) { CF ← undefined; OF ← undefined; }
else {
  for (i = 0; i < shift_count; i++) {
    CF ← LSB(dest);
    dest ← (dest >> 1) | (CF << (OperandSize * 8 - 1));
  }
  if (shift_count == 1) {
    OF ← MSB_before_rotation XOR (MSB_before_rotation >> 1);
  } else {
    OF ← undefined;
  }
}


Summary: Rotates bits left through Carry Flag.

Rotates the bits in the destination operand left through the Carry Flag by the number of bit positions specified in the source, treating CF as an additional bit position between the MSB and LSB. The CF is set to the bit shifted out. Overflow Flag is set if rotating by 1 and the MSB changed sign. For shifts > 1, OF is undefined. Other flags unchanged.

shift_count ← src & ((OperandSize * 8) - 1);
if (shift_count == 0) { CF ← undefined; OF ← undefined; }
else if (shift_count == 1) {
  temp_CF ← MSB(dest);
  dest ← (dest << 1) | CF;
  CF ← temp_CF;
  OF ← MSB_before XOR MSB_after;
}
else {
  for (i = 0; i < shift_count; i++) {
    temp_CF ← MSB(dest);
    dest ← (dest << 1) | CF;
    CF ← temp_CF;
  }
  OF ← undefined;
}


Summary: Rotates bits right through Carry Flag.

Rotates the bits of the destination operand right by the number of positions specified in the count operand, with the carry flag inserted at the high end and the low bit shifted into the carry flag. The rotation is through the carry flag, making it part of the rotating chain. All bits including CF participate in a circular rotate. The OF flag is set/cleared based on the most significant bit change on a single-bit rotate; CF is updated to the last bit shifted out.

count ← (src == 0) ? 1 : src & 0x1F;
temp_cf ← CF;
for i ← 0 to count - 1:
    new_cf ← dest & 1;
    dest ← (dest >> 1) | (temp_cf << (width - 1));
    temp_cf ← new_cf;
CF ← temp_cf;
if count == 1:
    OF ← MSB_before_rotate XOR CF;


Summary: Selects a bit and stores it in CF.

Tests a bit in the destination operand at the position specified by the source operand and stores the selected bit value in the carry flag. The destination is not modified. The source operand specifies which bit to test (bit position is source value modulo operand size). OF, SF, ZF, AF, PF flags are undefined; only CF is set to the tested bit value.

bit_position ← src MOD (width of dest);
CF ← (dest >> bit_position) & 1;
OF ← undefined;
SF ← undefined;
ZF ← undefined;
AF ← undefined;
PF ← undefined;


Summary: Stores bit in CF and sets bit to 1.

Tests a bit in the destination operand at the position specified by the source operand, stores the selected bit value in the carry flag, and then sets that bit to 1. The destination is modified atomically with respect to memory accesses. CF receives the original bit value before it is set. OF, SF, ZF, AF, PF flags are undefined.

bit_position ← src MOD (width of dest);
CF ← (dest >> bit_position) & 1;
dest ← dest | (1 << bit_position);
OF ← undefined;
SF ← undefined;
ZF ← undefined;
AF ← undefined;
PF ← undefined;


Summary: Stores bit in CF and clears bit to 0.

Tests a bit in the destination operand at the position specified by the source operand, stores the selected bit value in the carry flag, and then clears that bit to 0. The destination is modified atomically with respect to memory accesses. CF receives the original bit value before it is cleared. OF, SF, ZF, AF, PF flags are undefined.

bit_position ← src MOD (width of dest);
CF ← (dest >> bit_position) & 1;
dest ← dest & ~(1 << bit_position);
OF ← undefined;
SF ← undefined;
ZF ← undefined;
AF ← undefined;
PF ← undefined;


Summary: Stores bit in CF and complements the bit.

Tests a bit in the destination operand at the position specified by the source operand, stores the selected bit value in the carry flag, and then complements (inverts) that bit. The destination is modified atomically with respect to memory accesses. CF receives the original bit value before it is complemented. OF, SF, ZF, AF, PF flags are undefined.

bit_position ← src MOD (width of dest);
CF ← (dest >> bit_position) & 1;
dest ← dest XOR (1 << bit_position);
OF ← undefined;
SF ← undefined;
ZF ← undefined;
AF ← undefined;
PF ← undefined;


Summary: Scans for LSB set to 1.

Scans the source operand from the least significant bit (LSB) forward to locate the first set bit, and stores the bit position in the destination register. If no set bit is found, the zero flag is set and the destination register is undefined. This instruction is commonly used to find the index of the lowest set bit in a value.

for i ← 0 to (width - 1):
    if (src >> i) & 1 == 1:
        dest ← i;
        ZF ← 0;
        return;
ZF ← 1;
dest ← undefined;


Summary: Scans for MSB set to 1.

Scans the source operand from the most significant bit (MSB) backward to locate the first set bit, and stores the bit position in the destination register. If no set bit is found, the zero flag is set and the destination register is undefined. This instruction is commonly used to find the index of the highest set bit in a value.

for i ← (width - 1) down to 0:
    if (src >> i) & 1 == 1:
        dest ← i;
        ZF ← 0;
        return;
ZF ← 1;
dest ← undefined;


Summary: Counts number of leading zeros.

Counts the number of leading zero bits in the source operand and stores the result in the destination register. This is an ABM (Advanced Bit Manipulation) instruction that sets the zero flag if the source is zero (result is operand width) and clears it otherwise. Unlike BSR, this always produces a result without undefined behavior, making it safer for leading zero counting.

count ← 0;
for i ← (width - 1) down to 0:
    if (src >> i) & 1 == 1:
        break;
    count ← count + 1;
if src == 0:
    dest ← width;
    ZF ← 1;
else:
    dest ← count;
    ZF ← 0;


Summary: Counts number of bits set to 1.

Counts the number of set bits (1s) in the source operand and stores the result in the destination register. This instruction requires the SSE4.2 extension and is available in 16/32/64-bit variants. No flags are affected by this instruction, making it useful for bit-counting operations in high-performance code.


Summary: Replaces AL with byte from table at [EBX+AL].

Translates the byte in AL using a table in memory located at address EBX + AL (or RBX + AL in 64-bit mode), replacing AL with the byte from the table. The base address is determined by EBX/RBX, and the offset is the current value of AL. No flags are affected. This instruction is useful for character translation and lookup tables.


Summary: Pushes EFLAGS onto stack.

Pushes the EFLAGS register (or FLAGS register in 16-bit mode) onto the stack, decrementing the stack pointer. In 64-bit mode, PUSHF pushes the lower 32 bits of RFLAGS. All flag states are preserved on the stack. This instruction is commonly used to save the current processor state before modifying flags.


Summary: Pops stack into EFLAGS.

Pops a value from the stack into the EFLAGS register (or FLAGS in 16-bit mode), restoring previously saved flag states. This instruction restores OF, SF, ZF, AF, PF, and CF flags from the popped value. POPF also increments the stack pointer. Certain flags may be restricted based on the current privilege level.


Summary: Pushes AX, CX, DX, BX, SP, BP, SI, DI (Invalid in 64-bit).

Pushes all eight general-purpose 16-bit or 32-bit registers (AX/EAX, CX/ECX, DX/EDX, BX/EBX, SP/ESP, BP/EBP, SI/ESI, DI/EDI) onto the stack in that order. The SP/ESP value pushed is the value before the first push. This instruction is invalid in 64-bit mode and is primarily a legacy instruction. No flags are affected.

temp ← SP; SP ← SP - 16; [SP+0] ← AX; [SP+2] ← CX; [SP+4] ← DX; [SP+6] ← BX; [SP+8] ← temp; [SP+10] ← BP; [SP+12] ← SI; [SP+14] ← DI


Summary: Pops into DI, SI, BP, SP, BX, DX, CX, AX (Invalid in 64-bit).

Pops eight values from the stack into the general-purpose registers in reverse order of PUSHA (DI, SI, BP, SP, BX, DX, CX, AX), restoring a previously saved register state. The SP/ESP value is automatically popped and discarded. This instruction is invalid in 64-bit mode. No flags are affected.

DI ← [SP+0]; SI ← [SP+2]; BP ← [SP+4]; SP ← SP + 6; BX ← [SP+0]; DX ← [SP+2]; CX ← [SP+4]; AX ← [SP+6]; SP ← SP + 8


Summary: Checks if operand is within bounds defined in memory.

Checks whether the signed value in the register operand is within the bounds specified by two signed integers in memory (lower bound at m, upper bound at m+size). If the value is outside the bounds, a #BR (BOUND Range Exceeded) exception is generated. This instruction is invalid in 64-bit mode. No flags are affected if no exception occurs.

lower ← [mem]; upper ← [mem + operand_size]; if (register < lower || register > upper) { raise BR_exception }


Summary: Adjusts AL after addition for unpacked BCD.

Adjusts AL after addition of two unpacked BCD (Binary Coded Decimal) digits, correcting the result to ensure valid BCD. If the lower nibble of AL is greater than 9 or the AF flag is set, AL is adjusted by adding 6 to the lower nibble and 1 is added to AH. The AF and CF flags are set or cleared accordingly. This instruction is invalid in 64-bit mode and is primarily legacy.

if ((AL & 0x0F) > 9 || AF == 1) { AL ← (AL + 6) & 0xFF; AH ← AH + 1; AF ← 1; CF ← 1 } else { AF ← 0; CF ← 0 }; AL ← AL & 0x0F


Summary: Adjusts AL after subtraction for unpacked BCD.

Adjusts the value in AL after a subtraction operation to make it a valid unpacked BCD digit (0-9 in the lower nibble). If the lower nibble of AL is greater than 9 or the auxiliary carry flag is set, AL is decremented by 6 and AH is decremented by 1; otherwise no adjustment occurs. Sets or clears AF and CF based on whether an adjustment was made; other flags are undefined.

if ((AL & 0x0F) > 9) || (AF == 1) {
  AL ← AL - 6;
  AH ← AH - 1;
  AF ← 1;
  CF ← 1;
} else {
  AF ← 0;
  CF ← 0;
}
AL ← AL & 0x0F;


Summary: Adjusts AL after addition for packed BCD.

Adjusts AL after addition of two packed BCD values. If the lower nibble exceeds 9 or AF is set, adds 6 to AL; if the upper nibble then exceeds 9 or CF is set, adds 0x60 to AL. Sets CF and AF as needed; OF is undefined; SF, ZF, PF are computed on the result.

old_AL ← AL;
if ((AL & 0x0F) > 9) || (AF == 1) {
  AL ← AL + 6;
  AF ← 1;
} else {
  AF ← 0;
}
if (old_AL > 0x99) || (CF == 1) {
  AL ← AL + 0x60;
  CF ← 1;
} else {
  CF ← 0;
}
ZF ← (AL == 0);
SF ← (AL[7] == 1);
PF ← parity(AL);


Summary: Adjusts AL after subtraction for packed BCD.

Adjusts AL after subtraction of two packed BCD values. If the lower nibble exceeds 9 or AF is set, subtracts 6 from AL; if the upper nibble then exceeds 9 or CF is set, subtracts 0x60 from AL. Sets CF and AF as needed; OF is undefined; SF, ZF, PF are computed on the result.

old_AL ← AL;
if ((AL & 0x0F) > 9) || (AF == 1) {
  AL ← AL - 6;
  AF ← 1;
} else {
  AF ← 0;
}
if (old_AL > 0x99) || (CF == 1) {
  AL ← AL - 0x60;
  CF ← 1;
} else {
  CF ← 0;
}
ZF ← (AL == 0);
SF ← (AL[7] == 1);
PF ← parity(AL);


Summary: Adjusts AX after multiply for unpacked BCD.

Adjusts AX after a multiply operation on unpacked BCD operands (imm8 specifies the radix, typically 10). Divides AL by the immediate operand, placing the quotient in AH and remainder in AL. Sets SF, ZF, PF based on the result in AL; CF and OF are undefined; AF is undefined.

AH ← AL / imm8;
AL ← AL % imm8;
ZF ← (AL == 0);
SF ← (AL[7] == 1);
PF ← parity(AL);


Summary: Adjusts AX before division for unpacked BCD.

Adjusts AX before a division operation on unpacked BCD operands (imm8 specifies the radix, typically 10). Multiplies AH by the immediate operand and adds to AL, placing the result in AL with AH cleared to 0. Sets SF, ZF, PF based on the result; CF and OF are undefined; AF is undefined.

AL ← (AH * imm8) + AL;
AH ← 0;
ZF ← (AL == 0);
SF ← (AL[7] == 1);
PF ← parity(AL);


Summary: Sign-extends AL into AX.

Sign-extends the byte value in AL to a word in AX by copying bit 7 of AL to all bits 8-15 of AX. No flags are affected. In 64-bit mode, only the lower word of RAX is modified.


Summary: Sign-extends AX into DX:AX.

Sign-extends the word value in AX to a doubleword across DX:AX by copying bit 15 of AX to all bits of DX. No flags are affected. In 64-bit mode, this is typically replaced by CDQE or CQO for larger sign extensions.


Summary: Wait for FPU (same as FWAIT).

Waits for pending FPU operations to complete by checking the FPU busy flag; execution stalls until the FPU signals completion. Commonly used to synchronize between x87 floating-point and integer units. No flags are modified.

while (FPU_busy_flag == 1) {
  stall();
}


Summary: Loads AMX tile configuration from memory.

Loads a 512-bit tile configuration structure from memory into the AMX tile configuration state, enabling subsequent AMX tile operations. The memory operand must be 64-byte aligned. This instruction is a serializing operation that flushes pending tile operations and updates the internal tile geometry metadata (rows and columns for each tile). Requires AMX-TILE extension support; raises #UD if AMX is not enabled or memory is misaligned.

tilecfg_state ← load_512bits_from_memory(m512); tile_config_valid ← 1;


Summary: Stores AMX tile configuration to memory.

Stores the current AMX tile configuration state to a 512-bit memory location. Writes the internal tile dimensions and configuration metadata that was previously loaded via LDTILECFG. The memory operand must be 64-byte aligned. This is a serializing operation that ensures all pending tile operations complete before the store. Requires AMX-TILE extension support.


Summary: Loads data into an AMX tile register.

Loads a rectangular block of 32-bit doubleword elements from memory into an AMX tile register according to the current tile configuration. The memory layout is row-major; the memory address is typically formed from a base register and a stride register. This is a non-faulting instruction that respects the tile row/column dimensions set by LDTILECFG. Requires AMX-TILE extension and valid tile configuration.

stride ← (addressing mode determines memory stride); rows ← tilecfg_state.rows[tmm1]; cols ← tilecfg_state.cols[tmm1]; for (i = 0; i < rows; i++) { for (j = 0; j < cols; j++) { tmm1[i, j] ← m[base + i*stride + j*4]; } }


Summary: Stores data from an AMX tile register to memory.

Stores a rectangular block of 32-bit doubleword elements from an AMX tile register to memory in row-major order, respecting the tile configuration dimensions. The destination memory address is typically formed from a base register and a stride register. This is a non-faulting instruction that outputs only the configured rows and columns. Requires AMX-TILE extension and valid tile configuration.

stride ← (addressing mode determines memory stride); rows ← tilecfg_state.rows[tmm_src]; cols ← tilecfg_state.cols[tmm_src]; for (i = 0; i < rows; i++) { for (j = 0; j < cols; j++) { m[base + i*stride + j*4] ← tmm_src[i, j]; } }


Summary: Clears an AMX tile register.

Clears all elements of an AMX tile register to zero. The tile retains its configured dimensions; only the data elements are zeroed. This instruction is a common initialization step for accumulator tiles before performing matrix operations. Requires AMX-TILE extension and valid tile configuration. No flags are affected.

rows ← tilecfg_state.rows[tmm1]; cols ← tilecfg_state.cols[tmm1]; for (i = 0; i < rows; i++) { for (j = 0; j < cols; j++) { tmm1[i, j] ← 0; } }


Tile Dot Product Byte Signed Signed Doubleword

Summary: Matrix multiply (Signed Int8 * Signed Int8) accumulating to Int32.

Performs a tile matrix multiply-accumulate operation: multiplies signed 8-bit elements from two source tiles and accumulates the 32-bit signed products into a 32-bit destination tile. Computes dest[i,k] += sum(src1[i,j] * src2[j,k]) for all j over the configured row/column ranges. The operation respects the tile configuration for all three operands. Requires AMX-INT8 extension. No EFLAGS are modified.

rows_dest ← tilecfg_state.rows[tmm1]; cols_dest ← tilecfg_state.cols[tmm1]; cols_src1 ← tilecfg_state.cols[tmm2]; for (i = 0; i < rows_dest; i++) { for (k = 0; k < cols_dest; k++) { for (j = 0; j < cols_src1; j++) { product ← (int32_t)(int8_t)src1[i,j] * (int32_t)(int8_t)src2[j,k]; tmm1[i,k] ← (int32_t)tmm1[i,k] + product; } } }


Tile Dot Product Byte Signed Unsigned Doubleword

Summary: Matrix multiply (Signed * Unsigned) accumulating to Int32.

Performs a tile matrix multiply-accumulate operation: multiplies signed 8-bit elements from the first source by unsigned 8-bit elements from the second source, accumulating 32-bit signed results into the destination tile. Computes dest[i,k] += sum(src1[i,j] * src2[j,k]) for all j, with src1 treated as signed and src2 as unsigned. Respects tile configuration dimensions. Requires AMX-INT8 extension. No EFLAGS are modified.

rows_dest ← tilecfg_state.rows[tmm1]; cols_dest ← tilecfg_state.cols[tmm1]; cols_src1 ← tilecfg_state.cols[tmm2]; for (i = 0; i < rows_dest; i++) { for (k = 0; k < cols_dest; k++) { for (j = 0; j < cols_src1; j++) { product ← (int32_t)(int8_t)src1[i,j] * (int32_t)(uint8_t)src2[j,k]; tmm1[i,k] ← (int32_t)tmm1[i,k] + product; } } }


Summary: Matrix multiply (BFloat16) accumulating to Float32.

Performs a tile matrix multiply-accumulate operation on BFloat16 (16-bit brain float) elements, accumulating 32-bit floating-point results into the destination tile. Computes dest[i,k] += sum(src1[i,j] * src2[j,k]) for all j using BFloat16 multiplication and single-precision floating-point accumulation. Respects tile configuration for row/column dimensions. Requires AMX-BF16 extension. No EFLAGS are modified.

rows_dest ← tilecfg_state.rows[tmm1]; cols_dest ← tilecfg_state.cols[tmm1]; cols_src1 ← tilecfg_state.cols[tmm2]; for (i = 0; i < rows_dest; i++) { for (k = 0; k < cols_dest; k++) { for (j = 0; j < cols_src1; j++) { product ← convert_bf16_to_fp32(src1[i,j]) * convert_bf16_to_fp32(src2[j,k]); tmm1[i,k] ← (float32)tmm1[i,k] + product; } } }


Summary: Marker instruction for Indirect Branch Tracking (IBT).

End Branch 64-bit marker for Control Flow Enforcement Technology (CET) Indirect Branch Tracking. This is a NOP-like instruction that marks valid target points for indirect branches in 64-bit mode; it is consumed by hardware when CET-IBT is enabled and causes a control-flow exception (#CP) if an indirect branch lands on a non-ENDBR64/ENDBR32 location. No flags are affected. Requires CET-IBT capability.

// Marker instruction for Indirect Branch Tracking (IBT)


End Branch 32-bit marker for Control Flow Enforcement Technology (CET) Indirect Branch Tracking. Similar to ENDBR64, this marks valid indirect branch targets in 32-bit or compat mode; enforces CET-IBT policy when enabled. No flags are affected. Requires CET-IBT capability.


Summary: Reads the current shadow stack pointer into a register.

64-bit general-purpose register (e.g. RAX)

Read Shadow Stack Pointer into a 64-bit register. Reads the current shadow stack pointer (SSP) maintained by CET-SS hardware and stores it in the destination register. No flags are affected. Requires CET-SS (Control Flow Enforcement Technology-Shadow Stack) capability; 64-bit mode only.


Increment Shadow Stack Pointer (Quadword)

Summary: Adjusts the shadow stack pointer.

Increment Shadow Stack Pointer by the value in a 64-bit register. Adjusts the shadow stack pointer (SSP) forward by the count specified in the source register, typically used to skip multiple shadow stack entries or adjust SSP during context switching. No flags are affected. Requires CET-SS capability; 64-bit mode only.


Summary: Restores SSP from memory token.

Restore Shadow Stack Pointer from a 64-bit memory token. Reads a restoration token from memory and updates the shadow stack pointer (SSP); validates the token format and raises #CP if invalid. Used during context restoration or privilege transitions with CET-SS. No flags are affected. Requires CET-SS capability; 64-bit mode only.

token ← [src]
// Validate token format; if invalid raise #CP
SSP ← token


Summary: Saves the previous SSP to the shadow stack token.

Save the previous Shadow Stack Pointer to the top of the shadow stack. Writes the previous SSP value (stored in a CET control register) as a token to the current shadow stack location and typically increments SSP. Used to preserve SSP across context switches or privilege transitions. No flags are affected. Requires CET-SS capability; 64-bit mode only.


Summary: Writes back modified cache line without flushing (Persistent Memory).

Cache Line Write Back to memory without invalidation. Writes back a modified cache line to memory (coherent with other agents) but does not invalidate it from the cache hierarchy; optimized for persistent memory workloads. No flags are affected. Serialization and memory ordering depend on surrounding instructions. Requires CLWB capability.

// Write back cache line containing [m8] to memory
// Cache line remains in cache after writeback
write_back_cache_line(address(m8))


Summary: Optimized version of CLFLUSH (Higher throughput).

Optimized Cache Line Flush with higher throughput than CLFLUSH. Invalidates a cache line from all levels of the cache hierarchy and writes it back to memory if modified. No flags are affected. Provides better pipelining and throughput characteristics than legacy CLFLUSH. Requires CLFLUSHOPT capability.

// Invalidate and writeback cache line containing [m8]
invalidate_writeback_cache_line(address(m8))


Summary: Hints to move cache line to lower cache level.

Provides a hint to demote a cache line to a lower cache level (L2 or L3) without invalidating it. The instruction has no architectural effect on cache state and does not modify flags; it is a performance hint that may improve system throughput by reducing cache coherency traffic. Requires CLDEMOTE instruction extension; available in 64-bit mode.

// Hint to demote cache line at m8
// No architectural registers or flags are modified
DemoteHint([m8])


Summary: Moves 32/64-bit data avoiding cache pollution (Direct IO).

Moves 32-bit or 64-bit data from a general-purpose register directly to memory, bypassing the cache hierarchy to avoid cache pollution (Direct I/O store). The instruction writes directly to memory without allocating or updating cache lines. No flags are affected; requires MOVDIRI instruction extension and is intended for low-latency memory-mapped I/O operations.

if (src is r32) {
  [dest] ← src[31:0];
} else if (src is r64) {
  [dest] ← src[63:0];
}
// No cache line allocated; bypasses cache hierarchy
// No flags modified


Summary: Atomically moves 64-byte block avoiding cache pollution.

Atomically moves a 64-byte block from memory to memory using a Direct I/O store, bypassing the cache hierarchy without allocating cache lines. The operation is atomic with respect to other MOVDIR64B operations and ensures the destination cache line is not allocated. No flags are affected; requires MOVDIR64B extension and 64-byte alignment of both operands.

// Atomically copy 64 bytes from src to dest, bypassing cache
for (i = 0; i < 64; i++) {
  [dest + i] ← [src + i];
}
// Destination cache line not allocated
// Operation is atomic and serializing
// No flags modified


Summary: Specifies start of Restricted Transactional Memory region.

Specifies the entry point into a Restricted Transactional Memory (RTM) region; execution begins optimistically buffering memory updates. If the transaction aborts, execution branches to the fallback address (rel32); if successful, the transaction commits on XEND. The ZF flag is cleared on successful entry and set on abort; EAX contains a non-zero abort code if a transaction fails.

if (RTM_EntryAllowed) {
  RTM_TransactionActive ← 1;
  ZF ← 0;
  // Speculatively execute instructions; buffer memory modifications
} else {
  // Transaction abort
  ZF ← 1;
  EAX ← abort_code;
  RIP ← RIP + rel32;  // Branch to fallback address
}


Summary: Specifies end of RTM region.

Marks the end of a Restricted Transactional Memory (RTM) region and commits all buffered memory writes if the transaction succeeds. If the transaction has been aborted prior, XEND is a no-op; no flags are modified. Requires RTM extension and must be paired with XBEGIN.

if (RTM_TransactionActive) {
  if (RTMAborted) {
    // No-op; abort already occurred
  } else {
    // Commit buffered writes atomically
    CommitBufferedWrites();
    RTM_TransactionActive ← 0;
  }
  // No flags modified
}


Summary: Forces an RTM abort.

Forces an explicit abort of the current Restricted Transactional Memory (RTM) transaction, causing execution to branch to the XBEGIN fallback address. The 8-bit immediate value is encoded in the low byte of EAX to indicate the abort reason. No flags are modified by XABORT itself; control flow branches via the RTM abort mechanism.

if (RTM_TransactionActive) {
  // Abort transaction
  EAX[7:0] ← imm8;
  RTM_TransactionActive ← 0;
  RIP ← XBEGINFallbackAddress;  // Branch to XBEGIN offset
} else {
  // Outside transaction; XABORT is a no-op
}


Summary: Sets ZF if processor is in transactional region.

Tests whether the processor is currently executing within a Restricted Transactional Memory (RTM) region by setting the Zero Flag (ZF) to 1 if inside a transaction, or clearing it (ZF = 0) if outside. No other flags or registers are modified; useful for conditional logic in fallback code paths.

if (RTM_TransactionActive) {
  ZF ← 1;  // Inside transaction
} else {
  ZF ← 0;  // Outside transaction
}
// All other flags unchanged


Summary: Sets up a monitor address for User Wait instructions.

Sets up a monitor address for User Wait instructions (UMWAIT, TPAUSE) by storing the linear address from the source register in the hardware monitor. The monitor watches for writes to the address range to arm the wait condition. No flags are modified; requires WAITPKG extension and 64-bit mode.

// Load monitor address from r64
MonitorAddress ← src;
MonitorState ← ARMED;
// Monitor watches for writes to this address
// No flags modified


Summary: Waits for store to monitored address (Low power state).

Enters a low-power wait state and monitors the address specified in EDX:EAX until a store occurs to that monitored address or a timeout expires. The timeout value in ECX specifies the deadline. This instruction requires WAITPKG support and operates only in protected/64-bit mode at privilege level 0 (CPL=0). No flags are modified by this instruction.

if (WAITPKG not supported) raise #UD;
if (CPL != 0) raise #GP(0);
monitor_address ← EDX:EAX;
timeout_value ← ECX;
enter_low_power_state();
while (monitored_address not written && current_time < timeout_value) {
  // CPU stays in low-power state
}
exit_low_power_state();
EAX ← status_code;


Summary: Pauses execution for a specified time or until trigger.

Pauses execution for a specified time interval (in TSC cycles) or until an external interrupt/event occurs, whichever comes first. The pause duration is specified in EDX:EAX and source operand controls pause type. This instruction requires WAITPKG support and operates only in protected/64-bit modes. No flags are modified; EAX contains a status code on completion.

if (WAITPKG not supported) raise #UD;
pause_type ← r32 & 0xF;
duration ← EDX:EAX;
if (pause_type == 0) {
  // Absolute TSC deadline
  while (current_tsc < duration && no_interrupt) pause_cycle();
} else if (pause_type == 1) {
  // Relative delay
  end_time ← current_tsc + duration;
  while (current_tsc < end_time && no_interrupt) pause_cycle();
}
EAX ← status_code;


Summary: Adds half-precision floating-point values.

512-bit ZMM AVX-512 register or Memory operand

Adds 32 pairs of half-precision (FP16) floating-point values from zmm2 and zmm3/m512, storing the result in zmm1 with optional write masking via k1. The operation follows IEEE 754 semantics for FP16 arithmetic, supporting rounding modes from MXCSR. Requires AVX-512-FP16 extension. Denormal operands may trigger exceptions per MXCSR exception mask settings.

for i ← 0 to 31 do
  if (k1[i] or no_mask) then
    zmm1[16*i+15:16*i] ← FP16_ADD(zmm2[16*i+15:16*i], zmm3[16*i+15:16*i]);
  else if (zeroing_mask)
    zmm1[16*i+15:16*i] ← 0;
endfor;
// MXCSR exception flags updated per result


Summary: Subtracts half-precision floating-point values.

Subtracts 32 pairs of half-precision (FP16) floating-point values (zmm3/m512 from zmm2), storing the result in zmm1 with optional write masking via k1. The operation follows IEEE 754 semantics for FP16 arithmetic with configurable rounding modes from MXCSR. Requires AVX-512-FP16 extension. Exception behavior depends on MXCSR exception mask and denormal handling.

for i ← 0 to 31 do
  if (k1[i] or no_mask) then
    zmm1[16*i+15:16*i] ← FP16_SUB(zmm2[16*i+15:16*i], zmm3[16*i+15:16*i]);
  else if (zeroing_mask)
    zmm1[16*i+15:16*i] ← 0;
endfor;
// MXCSR exception flags updated per result


Summary: Multiplies half-precision floating-point values.

Multiplies 32 pairs of half-precision (FP16) floating-point values from zmm2 and zmm3/m512, storing the result in zmm1 with optional write masking via k1. Follows IEEE 754 semantics with rounding controlled by MXCSR. Requires AVX-512-FP16 extension. Exception flags in MXCSR are set per IEEE 754 rules (underflow, overflow, precision, invalid operation).

for i ← 0 to 31 do
  if (k1[i] or no_mask) then
    zmm1[16*i+15:16*i] ← FP16_MUL(zmm2[16*i+15:16*i], zmm3[16*i+15:16*i]);
  else if (zeroing_mask)
    zmm1[16*i+15:16*i] ← 0;
endfor;
// MXCSR exception flags updated per result


Summary: Divides half-precision floating-point values.

Divides 32 half-precision (FP16) floating-point values in zmm2 by corresponding values in zmm3/m512, storing the result in zmm1 with optional write masking via k1. Division follows IEEE 754 semantics with configurable rounding from MXCSR. Requires AVX-512-FP16 extension. Division-by-zero, invalid operations, and underflow/overflow exceptions are reported via MXCSR.

for i ← 0 to 31 do
  if (k1[i] or no_mask) then
    zmm1[16*i+15:16*i] ← FP16_DIV(zmm2[16*i+15:16*i], zmm3[16*i+15:16*i]);
  else if (zeroing_mask)
    zmm1[16*i+15:16*i] ← 0;
endfor;
// MXCSR exception flags updated per result (division-by-zero, etc.)


Summary: Square root of half-precision values.

Computes the square root of 32 half-precision (FP16) floating-point values from zmm2/m512, storing the result in zmm1 with optional write masking via k1. Square root follows IEEE 754 semantics with rounding controlled by MXCSR. Requires AVX-512-FP16 extension. Invalid operation (negative non-zero operand) and underflow/precision exceptions are reported via MXCSR.

for i ← 0 to 31 do
  if (k1[i] or no_mask) then
    zmm1[16*i+15:16*i] ← FP16_SQRT(zmm2[16*i+15:16*i]);
  else if (zeroing_mask)
    zmm1[16*i+15:16*i] ← 0;
endfor;
// MXCSR exception flags updated per result (invalid operation, underflow, etc.)


Summary: Minimum of half-precision values.

Computes element-wise minimum of 32 half-precision (FP16) floating-point values from zmm2 and zmm3/m512, storing the result in zmm1 with optional write masking via k1. Comparison follows IEEE 754 minimum semantics: NaN handling returns non-NaN operand when possible; equal values return zmm2. Requires AVX-512-FP16 extension. No exception flags are modified by comparison.

for i ← 0 to 31 do
  if (k1[i] or no_mask) then
    a ← zmm2[16*i+15:16*i];
    b ← zmm3[16*i+15:16*i];
    if (is_nan(a) && not is_nan(b)) zmm1[16*i+15:16*i] ← b;
    else if (is_nan(b) && not is_nan(a)) zmm1[16*i+15:16*i] ← a;
    else zmm1[16*i+15:16*i] ← (a < b) ? a : b;
  else if (zeroing_mask)
    zmm1[16*i+15:16*i] ← 0;
endfor;


Summary: Maximum of half-precision values.

Computes the maximum of packed half-precision (FP16) values from two 512-bit sources, writing results to a 512-bit ZMM register under EVEX mask control. The instruction performs element-wise comparison following IEEE 754 semantics, with special handling for NaN and signed zero. No arithmetic flags are modified; this is a masked operation requiring AVX-512-FP16 support.


Summary: Computes (Dest * Src2) + Src1 in half-precision.

Fused multiply-add instruction computing (zmm1 × zmm3/m512) + zmm2 in FP16 precision with a single rounding operation, improving accuracy and performance. The operand order (132) indicates zmm1 is the first multiplier, zmm3/m512 is the second, and zmm2 is the addend. Requires AVX-512-FP16; no arithmetic flags are modified; results are written to zmm1 under EVEX mask control.


Summary: Computes (Src1 * Dest) + Src2 in half-precision.

Fused multiply-add instruction computing (zmm2 × zmm1) + zmm3/m512 in FP16 precision with a single rounding operation. The operand order (213) indicates zmm2 is the first multiplier, zmm1 is the second, and zmm3/m512 is the addend. Requires AVX-512-FP16; no arithmetic flags are modified; results are written to zmm1 under EVEX mask control.


Summary: Computes (Src1 * Src2) + Dest in half-precision.

Fused multiply-add instruction computing (zmm2 × zmm3/m512) + zmm1 in FP16 precision with a single rounding operation. The operand order (231) indicates zmm2 is the first multiplier, zmm3/m512 is the second, and zmm1 is the addend. Requires AVX-512-FP16; no arithmetic flags are modified; results are written to zmm1 under EVEX mask control.


Convert Two Packed Single to Packed BFloat16

Summary: Converts two float vectors to one BFloat16 vector.

VCVTNE2PS2BF16 zmm1 {k1}, zmm2, zmm3/m512

Converts two packed single-precision (FP32) vectors into one packed bfloat16 vector by interleaving and rounding, producing 32 bfloat16 values in the destination ZMM register. The 'ne2' notation indicates two inputs are consumed to produce one output with truncation-based rounding (not MXCSR-controlled). Requires AVX-512-BF16; results are written under EVEX mask control; no arithmetic flags are modified.


Summary: BFloat16 dot product accumulating to Float32.

Dot product instruction that multiplies pairs of bfloat16 elements from two sources and accumulates the products into FP32 results, with 32-bit precision accumulation improving accuracy for neural network operations. Each 512-bit register holds 8 groups of 4 bfloat16 values (32 elements total) producing 8 FP32 sums. Requires AVX-512-BF16; no arithmetic flags are modified; results are written to zmm1 under EVEX mask control.


Summary: AES Encrypt on 512-bit vector.

Performs AES single-round encryption on 512-bit data, applying SubBytes, ShiftRows, MixColumns, and AddRoundKey operations to four independent 128-bit AES blocks in parallel. The instruction treats the 512-bit register as four consecutive 128-bit AES state blocks and applies the round key (zmm3/m512) element-wise. Requires AVX-512-VAES; no arithmetic flags are modified; results are written to zmm1.

for block = 0 to 3:
  state_128 ← zmm2[128*block:128*block+127]
  round_key_128 ← zmm3/m512[128*block:128*block+127]
  state_128 ← AES_SubBytes(state_128)
  state_128 ← AES_ShiftRows(state_128)
  state_128 ← AES_MixColumns(state_128)
  state_128 ← state_128 XOR round_key_128
  zmm1[128*block:128*block+127] ← state_128


Summary: AES Decrypt on 512-bit vector.

Performs AES single-round decryption on 512-bit data, applying InvSubBytes, InvShiftRows, InvMixColumns, and AddRoundKey operations to four independent 128-bit AES blocks in parallel. The instruction treats the 512-bit register as four consecutive 128-bit AES state blocks and applies the round key (zmm3/m512) element-wise. Requires AVX-512-VAES; no arithmetic flags are modified; results are written to zmm1.

for block = 0 to 3:
  state_128 ← zmm2[128*block:128*block+127]
  round_key_128 ← zmm3/m512[128*block:128*block+127]
  state_128 ← AES_InvSubBytes(state_128)
  state_128 ← AES_InvShiftRows(state_128)
  state_128 ← AES_InvMixColumns(state_128)
  state_128 ← state_128 XOR round_key_128
  zmm1[128*block:128*block+127] ← state_128


Vector Carry-Less Multiplication (AVX512)

Summary: Carry-less multiply on 512-bit vector.

Performs carry-less multiplication of 64-bit elements from two 512-bit vectors, producing 128-bit results that are stored in the destination ZMM register. The imm8 field selects which 64-bit quadwords from the source operands participate in the multiplication. No flags are affected; this is a cryptographic primitive used in GCM and other authenticated encryption modes.


Summary: SHA512 intermediate calculation (AVX512).

Computes SHA-512 message schedule expansion for the first message schedule instruction, operating on a 128-bit XMM source and producing a 256-bit YMM result. This instruction is part of the SHA-512 cryptographic hash computation pipeline and requires AVX-512 or SHA512 extension support. No EFLAGS are modified.


Summary: SHA512 final calculation (AVX512).

Computes the second stage of SHA-512 message schedule expansion, combining two 256-bit YMM inputs to produce a 256-bit result. This instruction is used after VSHA512MSG1 to complete the message schedule preparation for SHA-512 block processing. No EFLAGS are modified.


Summary: SHA512 2 rounds calculation (AVX512).

Executes two rounds of SHA-512 compression function, processing a 256-bit working variable vector (ymm1) using a 256-bit state operand (ymm2) and round constants from a 128-bit XMM register. This instruction performs the core iterative hash compression and does not modify EFLAGS.

A_B[0..1] ← ymm1[128*i..128*i+127] for i in 0 to 1
C_D_E_F_G_H[0..3] ← ymm2[64*i..64*i+63] for i in 0 to 3
RK[0..1] ← xmm3[64*i..64*i+63] for i in 0 to 1
for round in 0 to 1:
  temp ← sha512_compress_round(A_B, C_D_E_F_G_H, RK[round])
  A_B, C_D_E_F_G_H ← temp
ymm1[256 bits] ← A_B[0..1]


Summary: SM3 crypto message schedule part 1.

Performs the first stage of SM3 (Chinese cryptographic hash standard) message schedule computation on 128-bit inputs, producing a 128-bit expanded message word. This instruction combines three XMM operands using SM3-specific expansion logic and does not modify EFLAGS.

W ← xmm2[32*i..32*i+31] for i in 0 to 3
W_prime ← xmm3[32*i..32*i+31] for i in 0 to 3
W_new ← sm3_msg1_expand(W, W_prime)
xmm1[128 bits] ← W_new


Summary: SM3 crypto 2 rounds.

Executes two rounds of SM3 compression function using a 128-bit working variable XMM register and an immediate value specifying round constants and control flow. The instruction applies SM3-specific round transformations and does not modify EFLAGS.

A_B_C_D ← xmm1[32*i..32*i+31] for i in 0 to 3
E_F_G_H ← xmm2[32*i..32*i+31] for i in 0 to 3
round_sel ← imm8[7..0]
for round in 0 to 1:
  RK ← sm3_round_constant(round_sel + round)
  temp ← sm3_compress_round(A_B_C_D, E_F_G_H, RK)
  A_B_C_D, E_F_G_H ← temp
xmm1[128 bits] ← A_B_C_D


Summary: Performs four rounds of SM4 encryption.

128-bit XMM SIMD register or 128-bit memory operand

Performs one round of SM4 block cipher encryption on 128-bit data, applying the SM4 S-box substitution and linear transformation using round key material from the source XMM register. This instruction is used iteratively to encrypt 32 rounds of the SM4 algorithm and does not modify EFLAGS.

plaintext ← xmm1[32*i..32*i+31] for i in 0 to 3
RK ← xmm2[32*i..32*i+31] for i in 0 to 3
for i in 0 to 3:
  X ← plaintext[0..3]
  X ← SM4_F(X, RK[i])
  plaintext ← rotate_left(X, 1)
xmm1[128 bits] ← plaintext


Summary: SM4 key generation.

Performs key schedule expansion for SM4 block cipher, deriving round keys from a 128-bit key material input and producing expanded key words in the destination XMM register. This instruction is used during SM4 key setup to generate all required round keys and does not modify EFLAGS.

key ← xmm2[32*i..32*i+31] for i in 0 to 3
expanded_key ← SM4_KEY_SCHEDULE(key)
xmm1[128 bits] ← expanded_key[0..3]


Summary: Loads the Key Locker internal wrapping key.

Loads the Key Locker internal wrapping key from xmm2 into the processor's internal state, using xmm1 as a control operand. This instruction requires the KEYLOCKER CPU feature and is a privileged operation. No flags are modified; the instruction serializes execution and may cause a general-protection exception (#GP) if the key material is invalid or the CPL is not 0.

IF CPL != 0 THEN #GP(0) FI;
if CPUID.KEYLOCKER = 0 THEN #UD FI;
INTERNAL_WRAPPING_KEY ← xmm2[127:0];
CONTROL ← xmm1[127:0];


Summary: Wraps a 128-bit AES key into a handle.

Wraps a 128-bit AES key into an encoded Key Locker handle, where the second r32 operand contains the key and the first r32 receives status/handle information. The ZF flag is set to indicate success (ZF=0) or failure (ZF=1). This instruction requires KEYLOCKER support and uses the internal wrapping key loaded by LOADIWKEY.

IF CPUID.KEYLOCKER = 0 THEN #UD FI;
key_material ← src[31:0];
handle_out ← AES_WRAP_128(key_material, INTERNAL_WRAPPING_KEY);
dest[31:0] ← handle_out;
ZF ← 0;


Summary: Encrypts data using Key Locker handle.

Performs AES encryption on 128-bit data in the XMM register using a Key Locker handle stored in memory. The encrypted result is written back to the XMM register, and ZF is set to indicate success or failure of the operation. This instruction requires KEYLOCKER support and performs the operation using the internal wrapping key.

IF CPUID.KEYLOCKER = 0 THEN #UD FI;
handle ← [dest][127:0];
plaintext ← src[127:0];
ciphertext ← AES_ENCRYPT_128(plaintext, UNWRAP_KEY_128(handle, INTERNAL_WRAPPING_KEY));
src[127:0] ← ciphertext;
ZF ← 0;


Summary: Decrypts data using Key Locker handle.

Performs AES decryption on 128-bit data in the XMM register using a Key Locker handle stored in memory. The decrypted result is written back to the XMM register, and ZF is set to indicate success or failure. This instruction requires KEYLOCKER support and unwraps the key using the internal wrapping key.

IF CPUID.KEYLOCKER = 0 THEN #UD FI;
handle ← [dest][127:0];
ciphertext ← src[127:0];
plaintext ← AES_DECRYPT_128(ciphertext, UNWRAP_KEY_128(handle, INTERNAL_WRAPPING_KEY));
src[127:0] ← plaintext;
ZF ← 0;


Summary: Resets processor history (prediction) structures.

Resets selected processor prediction/history structures (BTB, TLB, or other micro-architectural caches) as specified by the 8-bit immediate operand. The instruction may serialize the execution pipeline and is typically used to mitigate side-channel attacks. No EFLAGS are modified; the instruction requires HRESET CPU feature support.

IF CPUID.HRESET = 0 THEN #UD FI;
select_bits ← imm8[7:0];
IF select_bits & 0x01 THEN RESET_BTB() FI;
IF select_bits & 0x02 THEN RESET_TLB() FI;
IF select_bits & 0x04 THEN RESET_RSB() FI;


Summary: Forces serialization of instruction fetch/execution.

Serializes instruction execution by ensuring all prior instructions have completed and all memory operations are ordered before subsequent instructions execute. This instruction blocks out-of-order execution, flushes the pipeline, and may have significant performance impact. No flags are modified; the instruction requires SERIALIZE CPU feature and may incur substantial latency.

IF CPUID.SERIALIZE = 0 THEN #UD FI;
WAIT_FOR_ALL_PRIOR_INSTRUCTIONS();
FLUSH_EXECUTION_PIPELINE();
CLEAR_OUT_OF_ORDER_BUFFERS();


Summary: Reads the processor ID (TSC_AUX) into register.

Reads the processor ID (IA32_TSC_AUX MSR value) into the destination 32-bit register, providing thread/core identification information. This is a fast operation compared to RDMSR and requires the RDPID CPU feature. No flags are modified; the instruction can execute in user mode if IA32_TSC_AUX is readable.

IF CPUID.RDPID = 0 THEN #UD FI;
dest[31:0] ← IA32_TSC_AUX[31:0];
dest[63:32] ← 0;


Summary: Saves supervisor state components to memory (Compact).

Saves processor extended state components (both user and supervisor states) to memory in compact form, controlled by the XCR0 and IA32_XSS MSRs and a mask in EDX:EAX. This instruction is a supervisor-mode only operation requiring CPL=0 and XSAVES feature support. No EFLAGS are modified; memory layout is compact and may trigger #GP if state is invalid.

IF CPL != 0 THEN #GP(0) FI;
IF CPUID.XSAVES = 0 THEN #UD FI;
mask ← (EDX << 32) | EAX;
save_regions ← GET_SAVE_REGIONS_MASKED(XCR0, IA32_XSS, mask);
COMPACT_SAVE_STATE(dest, save_regions);


Summary: Restores supervisor state components from memory (Compact).

Restores processor extended state components (XMM, YMM, ZMM, and other state) from memory in compact form, using the state bitmap in EDX:EAX to determine which components to restore. This instruction is privileged (ring 0 only) and requires the XSAVES extension. Requires XSAVE feature enabled and XSAVES support; no flags are affected.

IF (CR4.OSXSAVE == 0 || CPL != 0) THEN #UD;
IF (m is not 64-byte aligned) THEN #GP(0);
state_bitmap ← EDX:EAX;
restore_xsave_state_from_memory(m, state_bitmap, supervisor=true);


Summary: Writes data to the Intel Processor Trace stream.

General-purpose register or General-purpose register

Writes a 32-bit or 64-bit value from a general-purpose register into the Intel Processor Trace output stream, if PT is enabled and PT.PTW is set. The write is non-blocking and does not modify CPU flags. Requires PTWRITE extension support; operation has no effect if Processor Trace is disabled.

IF (CPL > 0 && IA32_RTIT_CTL.CR3Filter == 1) THEN #GP(0);
IF (PT_enabled && PT.PTW) THEN {
  trace_output ← operand;
  generate_ptw_packet(operand);
}
ELSE {
  // No effect if PT disabled or PTW not set
}


Summary: Returns from a User Interrupt handler.

Returns from a User Interrupt handler to user code, restoring the previously saved user context (RIP, RFLAGS) from the User Interrupt Stack Table (UIST). This is a privileged operation (executed only in the UIRET target code path) and requires UINTR extension support. No flags are affected by the instruction itself; user flags are restored from the saved context.

IF (!UINTR_enabled) THEN #UD;
temp_rip ← read_from_UIST();
temp_rflags ← read_from_UIST();
RIP ← temp_rip;
RFLAGS ← temp_rflags;
RETURN_TO_USER_MODE();


Summary: Sends a User IPI to another processor.

Sends a User Inter-Processor Interrupt (User IPI) to another processor identified by the UIPI index stored in the source 64-bit register. The source register contains an UPID (User IPI Posting Descriptor) index that identifies the target thread. Requires UINTR extension support; operation may be serializing and updates the target processor's interrupt state.

IF (!UINTR_enabled) THEN #UD;
uipi_index ← src_reg[63:0];
upid ← retrieve_UPID_from_index(uipi_index);
post_user_interrupt_to_target(upid);
SEND_IPI_TO_TARGET_CPU();


Summary: Reads data from an I/O port into AL/AX/EAX.

Implicit AL register (8-bit accumulator)

Reads a byte from an I/O port (specified by the immediate 8-bit operand) and stores the result in AL. If IOPL permits, this instruction can be used in user mode; otherwise it requires ring 0. No flags are affected. The port number is zero-extended to 16 bits for I/O address calculation.

IF (CPL > IOPL && !V86_mode) THEN #GP(0);
AL ← I/O_port[imm8];


Summary: Writes data from AL/AX/EAX to an I/O port.

Writes a byte from AL to an I/O port (specified by the immediate 8-bit operand). If IOPL permits, this instruction can be used in user mode; otherwise it requires ring 0. No flags are affected. The port number is zero-extended to 16 bits for I/O address calculation.

IF (CPL > IOPL && !V86_mode) THEN #GP(0);
I/O_port[imm8] ← AL;


Summary: Reads string from I/O port to memory at [EDI].

Reads a byte from the I/O port specified in DX and writes it to memory at the address [RDI/EDI/DI] (selected by address-size override). The destination address pointer is incremented or decremented by 1 based on the direction flag (DF). This is a string instruction often used with REP prefix; no flags are affected directly by INS itself.

IF (CPL > IOPL && !V86_mode) THEN #GP(0);
tempByte ← I/O_port[DX];
[RDI] ← tempByte;
IF (DF == 0) THEN RDI ← RDI + 1;
ELSE RDI ← RDI - 1;


Summary: Writes string from memory at [ESI] to I/O port.

Reads a byte from memory at the address [RSI/ESI/SI] (selected by address-size override) and writes it to the I/O port specified in DX. The source address pointer is incremented or decremented by 1 based on the direction flag (DF). This is a string instruction often used with REP prefix; no flags are affected directly by OUTS itself.

IF (CPL > IOPL && !V86_mode) THEN #GP(0);
tempByte ← [RSI];
I/O_port[DX] ← tempByte;
IF (DF == 0) THEN RSI ← RSI + 1;
ELSE RSI ← RSI - 1;


Summary: Loads byte/word/dword from [ESI] into AL/AX/EAX.

Loads a byte, word, or doubleword from memory at address DS:[ESI] (or RSI in 64-bit mode) into the accumulator (AL, AX, or EAX respectively), then increments or decrements ESI/RSI by the operand size based on the direction flag (DF). No flags are affected by this instruction.

if (DF == 0) {
  ESI ← ESI + operand_size;
} else {
  ESI ← ESI - operand_size;
}
AL/AX/EAX ← [DS:ESI];


Summary: Stores AL/AX/EAX to memory at [EDI].

Stores the contents of the accumulator (AL, AX, or EAX) into memory at address ES:[EDI] (or RDI in 64-bit mode), then increments or decrements EDI/RDI by the operand size based on the direction flag (DF). No flags are affected. This instruction is commonly used with REP prefix for bulk memory fills.

[ES:EDI] ← AL/AX/EAX;
if (DF == 0) {
  EDI ← EDI + operand_size;
} else {
  EDI ← EDI - operand_size;
}


Summary: Compares AL/AX/EAX with memory at [EDI].

Compares the accumulator (AL, AX, or EAX) with a byte, word, or doubleword in memory at address ES:[EDI], setting EFLAGS as if by subtraction, then increments or decrements EDI/RDI by the operand size based on DF. ZF, CF, OF, SF, AF, and PF are set according to the comparison result.

temp ← AL/AX/EAX - [ES:EDI];
ZF ← (temp == 0);
CF ← (AL/AX/EAX < [ES:EDI]);
OF ← overflow_from_subtraction;
SF ← sign_bit_of(temp);
AF ← auxiliary_carry_from_subtraction;
PF ← parity_of(temp);
if (DF == 0) {
  EDI ← EDI + operand_size;
} else {
  EDI ← EDI - operand_size;
}


Summary: Compares byte/word at [ESI] with [EDI].

Compares a byte, word, or doubleword at memory address DS:[ESI] with the value at ES:[EDI], setting EFLAGS as if by subtraction, then increments or decrements both ESI/RSI and EDI/RDI by the operand size based on DF. ZF, CF, OF, SF, AF, and PF reflect the comparison result.

temp ← [DS:ESI] - [ES:EDI];
ZF ← (temp == 0);
CF ← ([DS:ESI] < [ES:EDI]);
OF ← overflow_from_subtraction;
SF ← sign_bit_of(temp);
AF ← auxiliary_carry_from_subtraction;
PF ← parity_of(temp);
if (DF == 0) {
  ESI ← ESI + operand_size;
  EDI ← EDI + operand_size;
} else {
  ESI ← ESI - operand_size;
  EDI ← EDI - operand_size;
}


Summary: Loads pointer into DS and register.

Loads a far pointer from memory into a general-purpose register and the DS segment register. The memory operand contains a 32-bit pointer (16-bit offset and 16-bit segment) in 16/32-bit modes. Not available in 64-bit mode. No flags are affected.

dest ← [src];
DS ← [src + operand_size];


Summary: Loads pointer into ES and register.

Loads a far pointer from memory into a general-purpose register and the ES segment register. The memory operand contains a 32-bit pointer (16-bit offset and 16-bit segment) in 16/32-bit modes. Not available in 64-bit mode. No flags are affected.

dest ← [src];
ES ← [src + operand_size];


Summary: Loads pointer into FS and register.

Loads a far pointer from memory into a general-purpose register and the FS segment register. The memory operand contains a 32-bit or 48-bit pointer (16/32-bit offset and 16-bit segment). Available in 32-bit and 64-bit modes. No flags are affected.

dest ← [src];
FS ← [src + operand_size];


Summary: Loads pointer into GS and register.

Loads a far pointer from memory into a general-purpose register and the GS segment register. The memory operand contains a 32-bit or 48-bit pointer (16/32-bit offset and 16-bit segment). Available in 32-bit and 64-bit modes. No flags are affected.

dest ← [src];
GS ← [src + operand_size];


Summary: Loads pointer into SS and register.

Loads a 48-bit or 80-bit far pointer from memory into SS and a general-purpose register, updating the stack segment base address and register value simultaneously. The memory operand contains the offset and segment selector; the segment is loaded into SS and the offset into the destination register. This instruction does not modify any flags and is available in real, protected, and 64-bit modes.

if (operand_size == 32) {
  offset ← [src];
  SS ← [src + 4];
  dest ← offset;
} else if (operand_size == 64) {
  offset ← [src];
  SS ← [src + 8];
  dest ← offset;
}


Summary: Swaps user/kernel GS base address (System).

Atomically exchanges the user-mode and kernel-mode FS base register values by swapping the contents of the MSR_FS_BASE and MSR_KERNEL_FS_BASE model-specific registers. This is a 64-bit only instruction used for efficient user/kernel context switching in system software. No flags are modified, and the operation serializes the instruction pipeline.

if (CODESIZE == 64 && CPL == 0) {
  temp ← MSR_FS_BASE;
  MSR_FS_BASE ← MSR_KERNEL_FS_BASE;
  MSR_KERNEL_FS_BASE ← temp;
}


Summary: Reads the FS base address into a register.

Reads the current FS segment base address (from MSR_FS_BASE) into a 64-bit general-purpose register. Available only in 64-bit mode and requires the FSGSBASE CPU feature to be enabled. No flags are modified; the instruction executes with serialization semantics to ensure consistency of segment-base state.

if (FSGSBASE_enabled) {
  dest ← MSR_FS_BASE;
} else {
  raise(UD_EXCEPTION);
}


Summary: Reads the GS base address into a register.

Reads the current GS segment base address (from MSR_GS_BASE) into a 64-bit general-purpose register. Available only in 64-bit mode and requires the FSGSBASE CPU feature to be enabled. No flags are modified; the instruction executes with serialization semantics to ensure consistency of segment-base state.

if (FSGSBASE_enabled) {
  dest ← MSR_GS_BASE;
} else {
  raise(UD_EXCEPTION);
}


Summary: Writes a register to the FS base address.

Writes the value from a 64-bit general-purpose register into the FS segment base address (MSR_FS_BASE). Available only in 64-bit mode and requires the FSGSBASE CPU feature to be enabled. No flags are modified; the instruction executes with serialization semantics to ensure consistency of segment-base state.

if (FSGSBASE_enabled) {
  MSR_FS_BASE ← dest;
} else {
  raise(UD_EXCEPTION);
}


Summary: Writes a register to the GS base address.

Writes the value from a 64-bit general-purpose register into the GS segment base address (MSR_GS_BASE). Available only in 64-bit mode and requires the FSGSBASE CPU feature to be enabled. No flags are modified; the instruction executes with serialization semantics to ensure consistency of segment-base state.

if (FSGSBASE_enabled) {
  MSR_GS_BASE ← src;
} else {
  raise(UD_EXCEPTION);
}


Summary: Sets up a linear address range to be monitored.

Establishes a linear address range starting at [RAX] with a size specified by ECX (in bytes) to be monitored for writes by the CPU. The EAX and ECX registers supply the monitor address and size; EDX supplies optional extensions. No flags are modified. This instruction typically requires CPL ≤ 1 (ring 0/1) and is used with MWAIT for efficient polling.

if (CPL <= 1 || (CR4.MONITOR_BIT && CPL == 3)) {
  MONITOR_ADDR ← RAX;
  MONITOR_SIZE ← ECX;
  MONITOR_EXT ← EDX;
  set_up_address_range_monitoring();
} else {
  raise(GP_EXCEPTION);
}


Summary: Waits for a write to a monitored address.

Suspends CPU execution and waits for a write to an address range that was previously set up by MONITOR, or waits for an interrupt or other wake event. The EAX register specifies the monitor sub-C-state (low byte) and optional extensions (high bytes); EBX may specify additional parameters depending on CPU model. No flags are modified. This instruction serializes the processor and is typically restricted to CPL ≤ 1.

if (CPL <= 1 || (CR4.MONITOR_BIT && CPL == 3)) {
  substate ← EAX[7:0];
  extensions ← EAX[31:8];
  enter_monitor_wait(substate, extensions);
  wait_for_wakeup_or_interrupt();
} else {
  raise(GP_EXCEPTION);
}


Summary: Entry point for Safer Mode Extensions (Trusted Execution).

Entry point for Safer Mode Extensions (SMX), allowing software to invoke security functions in trusted execution mode. The specific function is determined by the EAX register at execution time. This instruction serializes the pipeline, disables interrupts during execution, and requires either SMX mode to be enabled or execution from authenticated code. On success, control returns to the instruction following GETSEC; on failure or security violation, a #UD or system reset may occur.

// EAX contains function code (e.g., GETSEC.CAPABILITIES=0, GETSEC.ENTERACCS=2, etc.)
// Execution is serialized; interrupts disabled during SMX operation
IF (SMX_mode_enabled OR authenticated_code_execution_mode) THEN
  Invoke_SMX_function(EAX);
  // Control returns here on success
ELSE
  #UD; // Undefined Opcode fault
END;


Summary: Creates bounds data for MPX.

Creates a bounds pair from a memory address range, storing the lower bound and upper bound in the destination bounds register (bnd0-bnd3). The source memory operand specifies an address; the instruction computes bounds from memory operand addressing. No flags are set. This instruction is part of Memory Protection Extensions (MPX) and is deprecated on modern processors.

// Compute bounds from memory operand m
// The bounds are derived from the addressing operation itself
lower_bound ← compute_lower_bound(m);
upper_bound ← compute_upper_bound(m);
// Store in 128-bit bounds register (2×64-bit values)
bndN.lower ← lower_bound;
bndN.upper ← upper_bound;


Summary: Checks if address is within lower bound.

Checks if an address or value is greater than or equal to the lower bound stored in the bounds register; if not, a bounds exception (#BR) is signaled. The source operand (register or memory) contains the address to be checked against bndN.lower. No flags are modified; an out-of-bounds condition triggers exception delivery. This instruction is part of deprecated Memory Protection Extensions (MPX).

address ← (src is memory) ? load_from_memory(src) : src;
IF (address < bndN.lower) THEN
  #BR; // Bounds Range Exceeded exception
END;
// No flags modified; execution continues on success


Summary: Checks if address is within upper bound.

Checks if an address or value is less than or equal to the upper bound stored in the bounds register; if not, a bounds exception (#BR) is signaled. The source operand (register or memory) contains the address to be checked against bndN.upper. No flags are modified; an out-of-bounds condition triggers exception delivery. This instruction is part of deprecated Memory Protection Extensions (MPX).

address ← (src is memory) ? load_from_memory(src) : src;
IF (address > bndN.upper) THEN
  #BR; // Bounds Range Exceeded exception
END;
// No flags modified; execution continues on success


Summary: Moves MPX bounds data.

Moves a 128-bit bounds pair from source (bounds register or memory) to destination (bounds register). The bounds pair consists of two 64-bit values (lower and upper bounds). No flags are set or modified. This instruction is part of deprecated Memory Protection Extensions (MPX) and is one of the few instructions that operate directly on bounds data.

// Source can be bounds register or 16 bytes of memory
IF (src is bounds register) THEN
  bndN.lower ← src.lower;
  bndN.upper ← src.upper;
ELSE
  bndN.lower ← [src];
  bndN.upper ← [src + 8];
END;
// No flags modified


Summary: Reads PKRU register into EAX (User-mode pages).

Reads the Protection Key Rights User register (PKRU) into EAX; EDX is zeroed. PKRU controls read and write access permissions for pages marked with a protection key (0-15). This instruction is a serializing operation at the architectural level and is only available in 64-bit mode and user mode (CPL=3). No flags are modified by this instruction.

// Read PKRU into EAX, zero EDX
EAX ← PKRU;
EDX ← 0;
// No flags modified; instruction is serializing


Summary: Writes EAX/EDX to PKRU register.

Writes the value in EAX to the Protection Key Rights User register (PKRU); EDX must be zero. PKRU controls read/write access permissions for pages with protection keys (0-15). This instruction is a serializing operation and is available only in 64-bit mode at user mode (CPL=3). No flags are set; if EDX is nonzero, #GP(0) is raised.

// Write EAX to PKRU, EDX must be zero
IF (EDX ≠ 0) THEN
  #GP(0); // General Protection Fault
ELSE
  PKRU ← EAX;
END;
// No flags modified; instruction is serializing


Multiply and Add Unsigned and Signed Bytes

Summary: Dot product of unsigned/signed bytes, accum to dword.

Performs a dot product of unsigned 8-bit and signed 8-bit integers across multiple pairs, accumulating the results into 32-bit dwords. Processes 512 bits (64 bytes) with 16 sets of 4-byte dot products (zmm2[31:0] × zmm3[31:0] + zmm1[31:0]), with masking and rounding support via EVEX encoding. ZF, PF, CF, OF, SF, AF are undefined after execution; no integer flags are modified.

// VPDPBUSD zmm1{k1}{z}, zmm2, zmm3/m512
// Signed 8×4 dot products with 32-bit accumulation
FOR i ← 0 TO 15 DO  // 16 dwords in 512-bit vector
  prod0 ← (unsigned int8) zmm2[i*32 + 7:0] × (signed int8) zmm3[i*32 + 7:0];
  prod1 ← (unsigned int8) zmm2[i*32 + 15:8] × (signed int8) zmm3[i*32 + 15:8];
  prod2 ← (unsigned int8) zmm2[i*32 + 23:16] × (signed int8) zmm3[i*32 + 23:16];
  prod3 ← (unsigned int8) zmm2[i*32 + 31:24] × (signed int8) zmm3[i*32 + 31:24];
  sum ← prod0 + prod1 + prod2 + prod3;
  zmm1[i*32 + 31:0] ← zmm1[i*32 + 31:0] + sum; // Accumulate
END;
// Masking and zeroing applied per EVEX encoding; no flags modified


Multiply and Add Unsigned and Signed Bytes with Saturation

Summary: Dot product of unsigned/signed bytes, accum to dword (Saturate).

Computes dot product of unsigned and signed bytes, accumulating results into 32-bit signed integers with saturation. Processes 16 pairs of (unsigned byte × signed byte) products per 512-bit vector, summing each group of 4 products and saturating the result to the signed 32-bit range. No flags are affected; operates only on vector registers and memory.

for i in 0 to 15 {
  prod0 = ZeroExtend(src1[i*32+0:7]) * SignExtend(src2[i*32+0:7]);
  prod1 = ZeroExtend(src1[i*32+8:15]) * SignExtend(src2[i*32+8:15]);
  prod2 = ZeroExtend(src1[i*32+16:23]) * SignExtend(src2[i*32+16:23]);
  prod3 = ZeroExtend(src1[i*32+24:31]) * SignExtend(src2[i*32+24:31]);
  sum = prod0 + prod1 + prod2 + prod3;
  dest[i*32:31] ← SaturateSignedToS32(sum);
}


Summary: Dot product of signed words, accum to dword.

Computes dot product of signed 16-bit words, accumulating results into 32-bit signed integers without saturation. Processes 8 pairs of signed word products per 512-bit vector, summing each group of 2 products and storing the result to the destination. No flags are affected; operates only on vector registers and memory.

for i in 0 to 7 {
  prod0 = SignExtend(src1[i*32+0:15]) * SignExtend(src2[i*32+0:15]);
  prod1 = SignExtend(src1[i*32+16:31]) * SignExtend(src2[i*32+16:31]);
  sum = prod0 + prod1;
  dest[i*32:31] ← sum;
}


Multiply and Add Signed Words with Saturation

Summary: Dot product of signed words, accum to dword (Saturate).

Computes dot product of signed 16-bit words, accumulating results into 32-bit signed integers with saturation. Processes 8 pairs of signed word products per 512-bit vector, summing each group of 2 products and saturating the result to the signed 32-bit range. No flags are affected; operates only on vector registers and memory.

for i in 0 to 7 {
  prod0 = SignExtend(src1[i*32+0:15]) * SignExtend(src2[i*32+0:15]);
  prod1 = SignExtend(src1[i*32+16:31]) * SignExtend(src2[i*32+16:31]);
  sum = prod0 + prod1;
  dest[i*32:31] ← SaturateSignedToS32(sum);
}


Galois Field Affine Transformation Inverse

Summary: Computes inverse affine transformation in GF(2^8).

128-bit XMM SIMD register or Memory operand

Performs inverse affine transformation in the Galois Field GF(2^8) on 128-bit packed bytes. Each byte is transformed by computing b × src1 ⊕ imm8 where operations are in GF(2^8), with b from the first operand. The immediate byte controls the constant term of the affine transformation. No flags are affected; operates only on vector registers and memory.

for i in 0 to 15 {
  byte_val = dest[i*8:7];
  gf_prod = GF2P8_MultiplyInverse(byte_val, src1[i*8:7]);
  dest[i*8:7] ← gf_prod ⊕ imm8;
}


Prefetch Data into Caches in Anticipation of a Write

Summary: Prefetches data with intent to write (RFO).

Prefetches a cache line from memory with intent to write, requesting read-for-ownership (RFO) semantics. Brings the data into the lowest-level private cache (typically L1D) in exclusive or modified state to optimize subsequent write operations. This instruction is a hint and has no architectural effect on registers, flags, or memory contents.

// Prefetch memory address for writing (RFO semantics)
CachePrefetchForWrite([mem_address]);


Summary: Prefetches data to L2 (T1 hint) with intent to write.

Prefetches a cache line from memory with intent to write into the L2 cache (T1 hint). Optimizes for temporal locality by loading data into the mid-level cache hierarchy rather than L1, reducing contention when multiple cores are writing to different addresses. This instruction is a hint and has no architectural effect on registers, flags, or memory contents.

// Prefetch memory address to L2 (T1 hint) with write intent
CachePrefetchToL2ForWrite([mem_address]);


Summary: Stores floats to non-contiguous memory locations.

VSCATTERDPS [base+zmm_idx*scale] {k1}, zmm1

AVX-512 scatter: base register + scaled ZMM vector index

Stores 16 packed single-precision floats (32-bit each) to non-contiguous memory locations determined by a base register and 32-bit ZMM index vector with optional scaling. Each element is stored to memory[base + index[i] × scale] where the index is zero-extended from the low 32 bits of each 64-bit ZMM element. The operation is masked via the k1 writemask; no flags are affected.

for i in 0 to 15 {
  if k1[i] {
    addr = base_reg + ZeroExtend(src2_idx[i*32:31]) * scale;
    [addr] ← src1[i*32:31];
  }
}


Summary: Stores doubles to non-contiguous memory locations.

VSCATTERDPD [base+zmm_idx*scale] {k1}, zmm1

Stores 8 packed double-precision floats (64-bit each) to non-contiguous memory locations determined by a base register and 64-bit ZMM index vector with optional scaling. Each element is stored to memory[base + index[i] × scale] where the index comes from the corresponding 64-bit ZMM element. The operation is masked via the k1 writemask; no flags are affected.

for i in 0 to 7 {
  if k1[i] {
    addr = base_reg + src2_idx[i*64:63] * scale;
    [addr] ← src1[i*64:63];
  }
}


Scatter Packed Single Precision (Quadword Indices)

Summary: Stores floats using 64-bit indices.

VSCATTERQPS [base+zmm_idx*scale] {k1}, zmm1

Scatters packed single-precision (32-bit) floating-point values from a ZMM register to memory using 64-bit quadword indices with optional scaling. Each element in the source ZMM is written to a memory location computed as [base + index[i]*scale], with write masking controlled by the opmask register k1. This is a non-temporal scatter operation that does not update CPU flags.

for i in 0 to 7:
  if k1[i] == 1:
    addr ← base + sign_extend(zmm_idx[i]) * scale
    [addr] ← src.f32[i]


Scatter Packed Double Precision (Quadword Indices)

Summary: Stores doubles using 64-bit indices.

VSCATTERQPD [base+zmm_idx*scale] {k1}, zmm1

Scatters packed double-precision (64-bit) floating-point values from a ZMM register to memory using 64-bit quadword indices with optional scaling. Each element in the source ZMM is written to a memory location computed as [base + index[i]*scale], with write masking controlled by the opmask register k1. This is a non-temporal scatter operation that does not update CPU flags.

for i in 0 to 3:
  if k1[i] == 1:
    addr ← base + sign_extend(zmm_idx[i]) * scale
    [addr] ← src.f64[i]