x86 Instruction Set – Instruction encoding

The instruction format

An x86 instruction is 1 to 15 bytes long. Its length is not stored anywhere: it follows from the bytes themselves, read in order. That is why a disassembler must decode each instruction to find where the next one starts, and why the same bytes can mean different instructions when decoding starts at a different place. In order, an instruction has these parts, all but the opcode optional:

All multi-byte values (displacements, immediates) are little-endian. The bytes on this page are written in hexadecimal; the disassembly beside them is the explorer’s disassembler’s own output, which matches llvm-objdump’s Intel syntax except where the notes at the end say. Branch targets assume the instruction is at address 0x1000. The opcodes themselves are in the opcode maps.

Legacy prefixes

The legacy prefixes fall into four groups. An instruction may have at most one from each group, in any order. Where there is more than one from a group, the disassembler takes the last one.

REX

In 64-bit mode the bytes 40 to 4F are not INC and DEC but the REX prefix, which AMD added with x86-64. Its low four bits extend the instruction:

With R, X and B, sixteen general registers (and xmm0 to xmm15) can be named. Any REX prefix, even 40 with no bits set, changes the byte registers: register numbers 4 to 7 become SPL, BPL, SIL and DIL instead of AH, CH, DH and BH, which can then not be used. REX must come straight before the opcode (or the 0F escape): a REX followed by a legacy prefix is ignored, and only the last of several REX prefixes counts.

REX2 (APX)

Intel’s APX (Advanced Performance Extensions) doubles the general registers to 32, R16 to R31. For legacy instructions it adds REX2, two bytes in 64-bit mode: D5, which is AAD outside 64-bit mode and invalid in it, and a payload byte:

REX2 cannot be used with a REX prefix, and not with the instructions in rows 4, 7 and E of the one-byte map, row A except JMPABS, or rows 3 and 8 of the 0F map (WRMSR to GETSEC and the escapes, and Jcc rel32); there it is #UD. With W = 1, PUSH and POP (50 to 5F) become PUSHP and POPP, and A1 with W = 0 is JMPABS. The fifth bits only apply to general registers.

VEX

Intel’s AVX (2011) brought the VEX prefix, which packs into two or three bytes what the legacy encoding spreads over a mandatory prefix, REX and escape bytes, and adds a third register operand (vvvv) and the vector length (L). Several of its fields are stored inverted (marked with a bar), so that in 32-bit code the byte after C4 or C5 has both top bits set, which LES and LDS cannot have: there, C4 or C5 is VEX only when the next byte is C0 or above.

• R̄, X̄, B̄: REX.R, X and B, inverted; the two-byte form has only R. Outside 64-bit mode R̄ and X̄ are 1 (which is what puts the byte at C0 or above) and B̄ is ignored.
• m-mmmm: the opcode map. 1 is the 0F map, 2 is 0F 38, 3 is 0F 3A; 5 and 7 hold a few recent instructions (AMX-FP8, AMX-MOVRS and the MSR-IMM forms). The two-byte form always means map 1.
• W: REX.W for general-register operands, or an opcode bit; ignored by many instructions (WIG).
• v̄v̄v̄v̄: a register operand, inverted. Unused, it must be 1111. Outside 64-bit mode only eight registers exist, but the top bit must still be 1.
• L: the vector length, 0 for 128 bits (xmm) and 1 for 256 (ymm). Scalar instructions ignore it (LIG) or need 0 (LZ).
• pp: the mandatory prefix: 00 none, 01 66, 10 F3, 11 F2.

A 66, F2, F3, LOCK or REX prefix before VEX is #UD, and the disassembler shows the bytes as (bad). Some four-operand instructions name a fourth register in the top four bits of an immediate byte (is4); outside 64-bit mode its top bit is ignored.

EVEX

AVX-512 (2016) brought EVEX, four bytes starting with 62, which was BOUND. It reaches 32 vector registers (xmm, ymm or zmm 0 to 31), adds the opmask registers k1 to k7 for masking, 512-bit vectors, broadcast, rounding control and a compressed 8-bit displacement. In 32-bit code, as with VEX, 62 is EVEX only when the next byte is C0 or above.

• R̄, X̄, B̄, W, v̄v̄v̄v̄, pp: as in VEX.
• R̄′ and V̄′: the fifth bits of ModRM.reg and of vvvv, inverted, for registers 16 to 31. For a vector register in ModRM.rm, X̄ is the fifth bit.
• mmm: the map. 1, 2 and 3 are the 0F, 0F 38 and 0F 3A maps, as in VEX; 5 and 6 hold AVX-512 FP16 and AVX10.2; 4 holds APX’s promoted legacy instructions.
• z: with a mask, 1 zeroes the masked-off elements ({z}), 0 leaves them as they were (merging).
• L′L: the vector length, 00 for 128 bits, 01 for 256 and 10 for 512; 11 is reserved, and the disassembler shows it as (bad).
• b: with a memory operand, broadcast; with register operands, rounding control or suppress-all-exceptions.
• aaa: the opmask register, k1 to k7; 000 means no masking.

XOP and 3DNow!

AMD’s XOP prefix (Bulldozer, 2011) is laid out like three-byte VEX, but starts with 8F, which is POP r/m. It is told apart by its map field, 8, 9 or 10: POP needs ModRM.reg = 000, so its ModRM byte’s low five bits are always below 8. Map 8 holds instructions with an immediate byte, map 9 those without, and map 10 those with a 32-bit immediate; AMD’s TBM and LWP use maps 9 and 10.

AMD’s 3DNow! (K6-2, 1998) used yet another scheme: 0F 0F, the ModRM byte and any SIB and displacement, and then an immediate-like byte that is the real opcode. 0F 0F C1 9E is pfadd mm0, mm1 and 0F 0F C1 B4 is pfmul mm0, mm1. See the 3DNow! page.

The opcode

In legacy code the opcode is one byte from the one-byte map, or 0F and a byte from the two-byte map, or 0F 38 or 0F 3A and a byte from a three-byte map. VEX, EVEX, REX2 and XOP name the map in their own fields and leave the escape bytes out. Within a map, an opcode may also depend on the mandatory prefix, on ModRM.reg (an opcode extension, written /0 to /7), on whether ModRM.mod is 11, on the whole ModRM byte, on W or on L. Some one-byte opcodes hold a register in their low three bits (50+r, B8+r). The maps are on the Opcode maps page.

ModRM

Most instructions with operands have a ModRM byte after the opcode:

With 32-bit and 64-bit addressing, two rm values are special:

The register numbers are 0 eax, 1 ecx, 2 edx, 3 ebx, 4 esp, 5 ebp, 6 esi and 7 edi (and their 8-, 16- and 64-bit forms), extended to 8–15 by REX and 16–31 by REX2 or EVEX. The special cases go by the low three bits, so R12 needs a SIB byte like RSP, and R13 with mod 00 means disp32 like RBP; their plain forms take a SIB byte or a zero disp8.

SIB

A SIB byte follows ModRM when rm is 100 and mod is not 11. The address is base + index × scale + displacement.

An index of 100 with a scale above 1, or where a SIB byte was not needed, still means no index; LLVM writes it as eiz or riz, GNU’s name for a zero index register, so that the encoding can be seen, and so does the disassembler. Gathers and scatters use a vector register as the index (VSIB).

16-bit addressing

With a 16-bit address size (16-bit code, or 67 in 32-bit code) there is no SIB byte, and rm picks one of eight base and index pairs. The forms with BP use SS by default; the others DS.

RIP-relative addressing

In 64-bit mode, ModRM mod 00 with rm 101 no longer means an absolute disp32: it means RIP + disp32, counted from the end of the instruction. Code can then reach its data wherever it is loaded, which is how almost all 64-bit code addresses globals, constants and import table slots. With a 67 prefix it is EIP-relative. The explorer works out the address each one refers to, and names it when it is a known symbol such as an imported function.

Displacements and immediates

A displacement follows ModRM and SIB: 1 byte (mod 01, sign-extended), or 4 bytes (mod 10, and the disp32-only forms), or 2 bytes in 16-bit addressing. With EVEX, a 1-byte displacement is scaled (disp8×N). The accumulator moves A0 to A3 instead hold a memory offset (moffs) of the address size, which is 8 bytes in 64-bit mode.

An immediate comes last. Its size is in the opcode’s operand notation: a byte (ib), a word (iw), or the operand size limited to 32 bits (iz: 2 or 4 bytes, sign-extended to 64 bits with REX.W). Only B8+r with REX.W takes a full 8-byte immediate. ENTER takes a word and a byte, and the far JMP and CALL a 4- or 6-byte far pointer. A byte immediate to an arithmetic instruction (83) is sign-extended.

Operand and address size

The code segment says whether code is 16-bit, 32-bit or 64-bit, and that gives the default operand and address sizes. Prefixes change them for one instruction. Byte operands are not a size setting: they have opcodes of their own (the even opcode of a pair, such as 88 beside 89).

In 64-bit mode some instructions are 64-bit by default, and a 66 prefix gives 16 bits (there is no 32-bit form): PUSH, POP, PUSHF, POPF, LEAVE, ENTER and the near RET. The near branches, relative and indirect (JMP, CALL, Jcc, LOOP), always use 64 bits on Intel’s processors. The string instructions, LOOP and JrCXZ take their count and pointer registers by the address size.

Where the disassembler differs from LLVM

The disassembler’s text matches llvm-objdump’s Intel syntax, except where LLVM is wrong about what a processor does or loses information. There it follows Intel’s manual, or AMD’s for AMD-only instructions:

• 66 on near branches in 64-bit mode is ignored, as Intel’s processors ignore it. AMD’s honour it, and LLVM decodes it AMD’s way.
• 16-bit code: 66 is taken as a mandatory prefix there too, as processors take it (66 0F 58 is addpd in any mode); LLVM does not.
• F2 on Jcc rel32 is shown as BND (MPX), which LLVM loses.
• Display: a disp16 alone, a 64-bit moffs and a far selector are shown unsigned; a disp32 alone is shown signed.
• is4 registers (imm8 bits 7–4) outside 64-bit mode ignore bit 7, as binutils does.
• MOV to and from control and debug registers ignores ModRM.mod, as processors do; a legacy prefix before VEX, EVEX or XOP, and a reserved EVEX L′L, are shown as (bad), since they raise #UD.

Links