x86 Instruction Set – APX

Introduction

APX (Intel Advanced Performance Extensions) extends the general-purpose part of x86-64. It doubles the general registers to 32, adds a two-byte prefix, REX2, to reach them, and gives most integer instructions an EVEX form with a separate destination register and a choice of whether to set the flags. It also adds conditional compares, two-register pushes and pops, a 64-bit absolute jump and a conditional move that does not fault.

APX works in 64-bit mode only. A program checks CPUID.(EAX=07H, ECX=1):EDX[bit 21] (APX_F), and the operating system must enable XCR0 bit 19. The new registers are XSAVE state component 19, which takes the place in the XSAVE area that MPX’s state had, so the two cannot be enabled together.

Intel published the APX specification in July 2023 and has announced APX for the processors code-named Nova Lake (Core) and Diamond Rapids (Xeon). Neither was on sale when this page was written, in November 2026: Intel has given 2027 for Diamond Rapids.

Most APX instructions are ordinary instructions in a new encoding. Their rows are on the pages of the instructions themselves, and the promoted instructions section lists them by family. This page has full rows only for the EVEX forms of KMOV, which belong to no other page.

When the explorer disassembles a program, each instruction it shows links to its row on these pages.

The registers r16 to r31

The sixteen new registers are r16 to r31. As with r8 to r15, the low 32, 16 and 8 bits have their own names: r16d, r16w and r16b, and so on; there are no high-byte registers for them. They are general registers in every way: instructions read and write them, and they can be the base or index of an address. Writing a 32-bit register clears the upper half, as for the first sixteen.

Only REX2 and EVEX can name them. A legacy REX prefix has one extra bit per register field, which reaches r8 to r15; REX2 and EVEX add a second, R4, X4 and B4 (and V4 for EVEX’s vvvv). VEX has no room, so the VEX instructions that APX wanted to reach the new registers (BMI, AMX’s loads, KMOV and others) were given EVEX forms. In the AVX-512 and AVX10 instructions, B4 and X4 let the base and index of a memory operand be r16 to r31.

REX2

REX2 is the byte D5 followed by one payload byte. Outside 64-bit mode D5 is AAD; in 64-bit mode it was invalid before APX. REX2 comes straight before the opcode, after any legacy prefixes, and a REX prefix may not come before it. It replaces both REX and the 0F escape:

The bits are not inverted. REX2 reaches only maps 0 and 1: the 0F 38 and 0F 3A instructions get the new registers through EVEX instead. In map 0, rows 4, 7, A and E (40–4F, the Jcc rel8 at 70–7F, A0–AF and E0–EF) cannot take REX2, except A1 with W = 0, which is JMPABS; in map 1, rows 3 and 8 (WRMSR, RDTSC, SYSENTER and the rest, the 0F 38 and 0F 3A escapes, and Jcc rel32) cannot. So d5 00 a1 followed by eight bytes is jmpabs to that address.

With REX2.W = 1, PUSH and POP of a register (50–5F) become PUSHP and POPP, the same operations with the PPX hint (see PUSH2, POP2 and PPX).

The extended EVEX of map 4

APX uses EVEX map 4, which AVX-512 left empty, for its promoted forms of legacy instructions, and changes the meaning of some of EVEX’s payload bits there. A map 4 instruction starts 62, then three payload bytes:

For CCMP and CTEST, P2 bits 3–0 hold the condition instead. EVEX.pp = 01 is an operand-size prefix, as 66 is, unless the opcode needs it; F3 and F2 are part of the opcode.

PUSH2, POP2 and PPX

PUSH2 and POP2 push or pop two 64-bit registers, one in vvvv and one in ModRM.rm, in one instruction: push2 rax, rcx is 62 f4 7c 18 ff f1 (FF /6 with ND = 1) and pop2 is 8F /0 with ND = 1. The stack pointer must be a multiple of 16, or they raise #GP.

PPX (push-pop acceleration) is a hint that a push and a later pop are a matched pair, as a function’s saves and restores are, so that the processor can speed up passing the value from one to the other. PUSHP and POPP are PUSH and POP with REX2.W = 1; PUSH2P and POP2P are PUSH2 and POP2 with EVEX.W = 1.

JMPABS and CFCMOV

JMPABS jumps to a 64-bit address held in the instruction: REX2 with M0 = 0 and W = 0, then A1, then the eight bytes of the address. Before it, a jump to an arbitrary 64-bit address needed a register or a memory operand.

CFCMOVcc (conditionally faulting CMOV) is a CMOV that touches memory only when the condition holds. An ordinary CMOVcc with a memory source always reads it, and can fault even when it moves nothing. In map 4 at 40 to 4F:

• ND = 0, NF = 0: cfcmovcc r, r/m, which loads only if the condition holds and otherwise sets the register to zero;
• ND = 0, NF = 1: cfcmovcc r/m, r, which stores only if the condition holds;
• ND = 1, NF = 0: cmovcc r, r, r/m, the NDD form of CMOVcc;
• ND = 1, NF = 1: cfcmovcc r, r, r/m, its conditionally faulting form.

The promoted instructions

These have EVEX forms, which reach r16 to r31; the NDD and NF columns say which take a new data destination and {nf}. Besides these, the legacy instructions of maps 0 and 1 take REX2, apart from the rows given under REX2.

The promoted VEX instructions are in EVEX maps 2 and 3, at their VEX opcodes; LLVM shows them without {evex}, and so do we.

Instructions

Notes

• 64-bit mode only. Outside it, D5 is AAD and EVEX map 4 is invalid.
• LOCK. A promoted instruction with a memory destination that takes LOCK in its legacy form takes it before the EVEX prefix too. With ND = 1 it is invalid, and the explorer says so.
• X4 in AVX-512 instructions. AVX-512 fixed bit 2 of P1 at 1; APX uses it as X4. A register form has no index register, so an APX processor ignores the bit there, and so do we, except with EVEX.b set, where AVX10.2’s withdrawn 256-bit rounding used it (see the AVX10 page).
• Mask registers. As in the VEX forms, only k0 to k7 exist: a register bit that would name k8 or above makes the encoding invalid.

Links