x86 Instruction Set – Opcode maps

Introduction

An opcode map gives, for each value of the opcode byte, the instruction it starts. x86 has several: the one-byte map, the two-byte map reached through the escape byte 0F, and the three-byte maps reached through 0F 38 and 0F 3A. VEX, EVEX and XOP name a map in their own fields instead of using escape bytes. The tables below follow Intel’s manual (volume 2, appendix A) and AMD’s (volume 3, appendix A), and are checked against the explorer’s disassembler tables (map0.js, map0f.js and the others). Like Intel’s, each map is printed in two halves: the low opcodes of each row (x0 to x7), then the high ones (x8 to xF). Every mnemonic links to its instruction.

The operands are in Intel’s notation: an upper-case letter for where the operand comes from and lower-case letters for its size.

The sizes are b byte, w word, d doubleword, q quadword, dq 16 bytes, v the operand size (16, 32 or 64), z 16 or 32 (32 for a 64-bit operand size), y 32 or 64, p a far pointer, a a pair of bounds, ps and pd packed single and double precision, ss and sd scalars, x a full vector. A register name such as rAX or eAX follows the operand size, and Zv is the register in the opcode’s low three bits. Marks: i64 invalid in 64-bit mode, o64 only in 64-bit mode, d64 64-bit operand size by default in 64-bit mode, f64 always 64-bit there.

The one-byte map

Rows are the high digit of the opcode, columns the low digit.

In 64-bit mode, 40 to 4F are the REX prefix, A0 to A3 take an 8-byte address and are shown as movabs, as is B8+r with REX.W, and C4, C5, 62 and D5 always start VEX, EVEX and REX2. Outside 64-bit mode, C4, C5 and 62 start VEX and EVEX only when the next byte is C0 or above. 8F starts XOP when the next byte’s low five bits are 8 or more.

The one-byte map’s groups

In a group, ModRM.reg picks the instruction.

The two-byte map (0F)

Many cells hold one instruction per mandatory prefix: none, 66, F3 or F2, written before each name. Most of the SSE instructions also have a VEX form, the same mnemonic with a v in front and an extra source operand (H), in VEX map 1; and with a VEX prefix, some of the CMOVcc and SETcc cells hold the AVX-512 mask instructions (kandw, kmovw …). Empty cells are invalid, and the disassembler shows them as (bad).

In row 2 the control and debug register moves take Rq, Cq and Dq in 64-bit mode. Row C holds xadd at C0 and C1, and the byte swaps at C8 to CF in the second half.

The two-byte map’s groups

As in the one-byte map, ModRM.reg picks the instruction; some groups also depend on whether the operand is memory or a register (mod 11), and on the mandatory prefix.

The three-byte maps, 0F 38 and 0F 3A

These two maps hold the later SIMD instructions and several general-purpose ones. Almost every entry needs a mandatory prefix, usually 66. Every instruction in 0F 3A takes an immediate byte. Many opcodes exist only in VEX form (VEX maps 2 and 3); the lists below give the ranges, and each family page has the instructions.

How the VEX, EVEX and XOP maps relate

VEX and EVEX do not have maps of their own so much as new forms of the legacy ones: VEX and EVEX map 1 hold the AVX and AVX-512 forms of the 0F map’s SIMD instructions, at the same opcodes, and maps 2 and 3 those of 0F 38 and 0F 3A. The later maps are new.

Two more opcode spaces sit inside the legacy maps: the x87 escapes D8 to DF, where ModRM picks among about a hundred floating-point instructions, and AMD’s 3DNow! at 0F 0F, where a byte after the operands is the opcode.

Links