x86 Instruction Set – Flags and miscellaneous

Introduction

This page gathers the general-purpose instructions that fit no other family: the ones that set, clear, save and restore the flags register, CPUID, the random number instructions, LEA and XLAT, the no-operations and the instructions that are defined to be invalid.

The flags register is FLAGS (16 bits) on the 8086 and 80286, EFLAGS (32 bits) from the 80386, and RFLAGS (64 bits, the upper half reserved) in 64-bit mode. Its bits are:

Bit	Flag	Meaning
0	CF	Carry
1	–	Always 1
2	PF	Parity: the low byte of the result has an even number of 1 bits
4	AF	Auxiliary carry, out of bit 3
6	ZF	Zero
7	SF	Sign
8	TF	Trap: a debug exception after each instruction (single-stepping)
9	IF	Interrupts enabled
10	DF	Direction, for the string instructions
11	OF	Overflow
12–13	IOPL	I/O privilege level (80286)
14	NT	Nested task (80286)
16	RF	Resume: no debug fault on the next instruction (80386)
17	VM	Virtual-8086 mode (80386)
18	AC	Alignment check (80486)
19–20	VIF, VIP	Virtual interrupt flag and pending (Pentium)
21	ID	Can be changed only on a processor that has CPUID

The instructions

The notation is as on the Data transfer page.

Setting and clearing flags

Instruction	Forms	Encoding	What it does	Set
`clc`	–	`F8`	Clears CF.	8086 (Intel 8086, 1978)
`stc`	–	`F9`	Sets CF.	8086 (Intel 8086, 1978)
`cmc`	–	`F5`	Inverts CF.	8086 (Intel 8086, 1978)
`cld`	–	`FC`	Clears DF, so that the string instructions step upwards. The usual calling conventions expect DF clear.	8086 (Intel 8086, 1978)
`std`	–	`FD`	Sets DF, so that the string instructions step downwards.	8086 (Intel 8086, 1978)
`cli`	–	`FA`	Clears IF: maskable interrupts are held off. In protected mode it needs CPL ≤ IOPL, or raises #GP (virtual-interrupt extensions aside).	8086 (Intel 8086, 1978)
`sti`	–	`FB`	Sets IF. Interrupts are taken only after the next instruction, so `sti; hlt` cannot miss one in between. The same privilege rule as `cli`.	8086 (Intel 8086, 1978)
`lahf`	–	`9F`	Copies SF, ZF, AF, PF and CF (bits 7, 6, 4, 2 and 0 of the flags) into AH. In 64-bit mode only on processors that report it in CPUID leaf 8000_0001h, ECX bit 0; the first x86-64 processors did not.	8086 (Intel 8086, 1978)
`sahf`	–	`9E`	Copies AH into SF, ZF, AF, PF and CF. The same 64-bit rule as `lahf`.	8086 (Intel 8086, 1978)

Saving and restoring the flags

Instruction	Forms	Encoding	What it does	Set
`pushf`	–	`9C` (16-bit operand size)	Pushes the low 16 bits of the flags.	8086 (Intel 8086, 1978)
`pushfd`	–	`9C` (32-bit operand size)	Pushes EFLAGS, with VM and RF cleared in the copy. Not available in 64-bit mode.	80386 (Intel 80386, 1985)
`pushfq`	–	`9C` (64-bit mode)	Pushes RFLAGS. In 64-bit mode the operand size is 64 bits by default; a 66 prefix gives `pushf`.	x86-64 (AMD Opteron, 2003, and Intel EM64T, 2004)
`popf`	–	`9D` (16-bit operand size)	Pops the low 16 bits of the flags. Which flags change depends on the privilege level: IF only when CPL ≤ IOPL, IOPL only at CPL 0; the others are left alone without a fault.	8086 (Intel 8086, 1978)
`popfd`	–	`9D` (32-bit operand size)	Pops EFLAGS, with the same rules; VM, VIF and VIP are not changed. Toggling bit 21 (ID) with `pushfd` and `popfd` is how a program finds out whether it may use `cpuid`. Not available in 64-bit mode.	80386 (Intel 80386, 1985)
`popfq`	–	`9D` (64-bit mode)	Pops RFLAGS.	x86-64 (AMD Opteron, 2003, and Intel EM64T, 2004)

Identification and random numbers

Instruction	Forms	Encoding	What it does	Set
`cpuid`	–	`0F A2`	Returns information about the processor in EAX, EBX, ECX and EDX: the leaf in EAX (and for some leaves a sub-leaf in ECX) picks what. Leaf 0 gives the highest leaf and the vendor string (`GenuineIntel`, `AuthenticAMD`); leaf 1 the family, model and stepping and the first feature bits; leaf 7 and leaf 8000_0001h more feature bits. Every family page of this reference gives the bit that reports its instructions.	CPUID (Intel 486 (later models) and Pentium, 1993)
`rdrand`	`r16/32/64`	`0F C7 /6` (register form)	Loads a random number from the processor’s generator, a cryptographically secure generator that the hardware entropy source reseeds. CF = 1 means the value is valid; CF = 0 means none was ready and the register is zero, so the program should try again. The other status flags are cleared. CPUID leaf 1, ECX bit 30.	RDRAND (Intel Ivy Bridge, 2012)
`rdseed`	`r16/32/64`	`0F C7 /7` (register form)	The same, but takes the value straight from the entropy source, for seeding another generator. It runs out sooner than RDRAND. CPUID leaf 7, EBX bit 18. With F3 the same bytes are `rdpid`.	RDSEED (Intel Broadwell, 2014)

Address and table lookup

Instruction	Forms	Encoding	What it does	Set
`lea`	`r16/32/64, m`	`8D /r`	Load effective address: works out the address of the memory operand, base + index × scale + displacement, and writes it to the register. Memory is not touched, so compilers also use it for arithmetic (`lea eax, [rdi + 4*rsi + 3]`). The register form is invalid. With RIP-relative addressing it gives the address of nearby data: `lea rax, [rip + 0x…]`.	8086 (Intel 8086, 1978)
`xlatb`	–	`D7`	Table lookup: AL = the byte at [rBX + AL], AL taken as unsigned. A segment prefix changes the segment.	8086 (Intel 8086, 1978)
`salc`	–	`D6`	Undocumented by Intel: sets AL to `FF` if CF = 1 and to `00` otherwise, without changing the flags. Invalid in 64-bit mode.	8086 (Intel 8086, 1978)

No-operations and hints

Instruction	Forms	Encoding	What it does	Set
`nop`	– `r/m16/32`	`90` `0F 1F /0`	Does nothing. `90` is really `xchg eax, eax`, treated as a NOP; in 64-bit mode it does not clear the upper half of RAX. `0F 1F /0` is the multi-byte NOP, which compilers use to pad code: its ModRM, SIB and displacement make NOPs of 3 to 8 bytes, and 66 prefixes longer ones. The other opcodes from `0F 19` to `0F 1F`, and the forms of `0F 18` and `0F 1C` with no meaning of their own, are reserved hint NOPs, which the disassembler shows as `nop`, as LLVM does.	8086 (Intel 8086, 1978); the multi-byte NOP Pentium Pro (Intel Pentium Pro, 1995)
`pause`	–	`F3 90`	A hint in a spin-wait loop: the processor waits a little and avoids the penalty of leaving the loop, and saves power. Older processors run it as a NOP, so it is safe everywhere.	Pentium 4 (Intel Pentium 4, 2000)

Undefined instructions

These are guaranteed to raise #UD, for testing and to mark code that should never run. The disassembler marks them, like hlt and int3, as instructions that the code does not run on past.

Instruction	Forms	Encoding	What it does	Set
`ud2`	–	`0F 0B`	Raises #UD. Compilers put it after calls that do not return and at unreachable code.	Pentium Pro (Intel Pentium Pro, 1995)
`ud1`	`r16/32/64, r/m16/32/64`	`0F B9 /r`	Raises #UD. It has a ModRM byte, so its length depends on the operands.	Pentium Pro (Intel Pentium Pro, 1995), as the decoder files it
`ud0`	`r16/32/64, r/m16/32/64`	`0F FF /r`	Raises #UD. Intel’s manual notes that some older processors decode it without a ModRM byte; the disassembler, like LLVM, reads one.	Pentium Pro (Intel Pentium Pro, 1995), as the decoder files it

Notes

Other flag instructions. SETcc, which turns a flag into a byte, is on the Logic page. CLAC and STAC, which change AC for SMAP, are on the System instructions page.
64-bit mode. PUSHF and POPF default to 64 bits there, as PUSH and POP do; there is no 32-bit form.