x86 Instruction Set – SSE4.1, SSE4.2 and SSE4a

Introduction

Three extensions share this page. All of them work in the XMM registers (XMM0 to XMM7, XMM0 to XMM15 in 64-bit mode) and use MXCSR, as SSE does.

SSE4.1 came with the Core 2 made on Intel’s 45 nm process, Penryn, in 2007. It adds blends, dot products, rounding, inserts and extracts of single elements, sign- and zero-extending loads, and the integer minimum, maximum and multiply instructions that SSE2 lacked. Most of it lives in the three-byte opcode maps 0F 38 and 0F 3A, with a 66 prefix. A program checks for it with CPUID leaf 1: ECX bit 19.
SSE4.2 came with the first Core i7, Nehalem, in 2008. It adds the four string and text comparison instructions (pcmpestri and the rest), pcmpgtq and crc32. A program checks for it with CPUID leaf 1: ECX bit 20. popcnt came at the same time but has its own CPUID bit, ECX bit 23.
SSE4a is AMD’s, from the Phenom (family 10h) in 2007. It has four instructions: two bit-field operations on the low quadword of an XMM register, and two scalar non-temporal stores. Intel processors do not have it. A program checks for it with CPUID leaf 80000001h: ECX bit 6.

Most SSE4.1 and SSE4.2 instructions have VEX forms, which came with AVX; their names start with v and they are described on the AVX page. Each row below links to it.

The instructions

In the forms, xmm1 is the ModRM.reg operand and xmm2/m128 the ModRM.r/m operand. <XMM0> is an operand that is not encoded: the instruction always uses XMM0.

SSE4.1: blends

Instruction	Forms	Encoding	What it does	Set
`blendps`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 0C /r ib`	Takes each single-precision element from the second operand where its bit in imm8[3:0] is set, and keeps the first operand’s where it is clear. VEX form: `vblendps`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`blendpd`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 0D /r ib`	The same for the two double-precision elements, by imm8[1:0]. VEX form: `vblendpd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`blendvps`	`xmm1, xmm2/m128, <XMM0>`	`66 0F 38 14 /r`	Takes each single-precision element from the second operand where the top bit of the matching element of XMM0 is set. VEX form: `vblendvps`, which names its mask register.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`blendvpd`	`xmm1, xmm2/m128, <XMM0>`	`66 0F 38 15 /r`	The same for double-precision elements. VEX form: `vblendvpd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pblendvb`	`xmm1, xmm2/m128, <XMM0>`	`66 0F 38 10 /r`	The same for each of the sixteen bytes. VEX form: `vpblendvb`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pblendw`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 0E /r ib`	Takes each of the eight words from the second operand where its bit in imm8 is set. VEX form: `vpblendw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)

SSE4.1: dot products, sums and rounding

Instruction	Forms	Encoding	What it does	Set
`dpps`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 40 /r ib`	Multiplies the single-precision elements, sums the products that imm8[7:4] selects, and writes the sum to the elements that imm8[3:0] selects; the others are zeroed. VEX form: `vdpps`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`dppd`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 41 /r ib`	The same for the two double-precision elements, by imm8[5:4] and imm8[1:0]. VEX form: `vdppd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`mpsadbw`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 42 /r ib`	Eight sums of absolute differences: one 4-byte block of the second operand (picked by imm8[1:0]) against eight overlapping 4-byte blocks of the first (starting at byte 0 or 4, by imm8[2]). Writes eight unsigned words. VEX form: `vmpsadbw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`phminposuw`	`xmm1, xmm2/m128`	`66 0F 38 41 /r`	Finds the smallest unsigned word of the source: its value goes to bits 15:0, its index to bits 18:16, and the rest is zeroed. VEX form: `vphminposuw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`roundps`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 08 /r ib`	Rounds four single-precision values to integral values. imm8[1:0] is the mode (0 nearest, 1 down, 2 up, 3 towards zero); imm8[2] set uses MXCSR.RC instead; imm8[3] set suppresses the precision exception. VEX form: `vroundps`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`roundpd`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 09 /r ib`	The same for two double-precision values. VEX form: `vroundpd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`roundss`	`xmm1, xmm2/m32, imm8`	`66 0F 3A 0A /r ib`	Rounds the low single-precision value; the other three are unchanged. VEX form: `vroundss`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`roundsd`	`xmm1, xmm2/m64, imm8`	`66 0F 3A 0B /r ib`	Rounds the low double-precision value; the high one is unchanged. VEX form: `vroundsd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)

SSE4.1: inserts and extracts

An extract to a general register zero-extends the element. The forms with a 64-bit general register are for 64-bit mode only; elsewhere REX.W does not exist and the opcode gives the doubleword form.

Instruction	Forms	Encoding	What it does	Set
`extractps`	`r/m32, xmm1, imm8`	`66 0F 3A 17 /r ib`	Copies the single-precision element chosen by imm8[1:0], as bits, to a general register or memory. VEX form: `vextractps`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`insertps`	`xmm1, xmm2/m32, imm8`	`66 0F 3A 21 /r ib`	Writes one single-precision value into the element chosen by imm8[5:4], then zeroes the elements whose bits are set in imm8[3:0]. From a register the source element is imm8[7:6]; from memory it is the 32 bits read. VEX form: `vinsertps`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pextrb`	`r32/m8, xmm2, imm8`	`66 0F 3A 14 /r ib`	Copies the byte chosen by imm8[3:0]. VEX form: `vpextrb`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pextrw`	`r32/m16, xmm, imm8`	`66 0F 3A 15 /r ib`	Copies the word chosen by imm8[2:0]. This form adds the store to memory; SSE2’s `pextrw` (66 0F C5) writes a register only. VEX form: `vpextrw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pextrd`	`r/m32, xmm2, imm8`	`66 0F 3A 16 /r ib`	Copies the doubleword chosen by imm8[1:0]. VEX form: `vpextrd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pextrq`	`r/m64, xmm2, imm8`	`66 REX.W 0F 3A 16 /r ib`	Copies the quadword chosen by imm8[0]. 64-bit mode only. VEX form: `vpextrq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pinsrb`	`xmm1, r32/m8, imm8`	`66 0F 3A 20 /r ib`	Writes the low byte of the source into the byte chosen by imm8[3:0]. VEX form: `vpinsrb`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pinsrd`	`xmm1, r/m32, imm8`	`66 0F 3A 22 /r ib`	Writes a doubleword into the element chosen by imm8[1:0]. VEX form: `vpinsrd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pinsrq`	`xmm1, r/m64, imm8`	`66 REX.W 0F 3A 22 /r ib`	Writes a quadword into the element chosen by imm8[0]. 64-bit mode only. VEX form: `vpinsrq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)

SSE4.1: integer arithmetic and tests

Instruction	Forms	Encoding	What it does	Set
`pmulld`	`xmm1, xmm2/m128`	`66 0F 38 40 /r`	Multiplies signed doublewords and keeps the low 32 bits of each product. VEX form: `vpmulld`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmuldq`	`xmm1, xmm2/m128`	`66 0F 38 28 /r`	Multiplies the signed low doubleword of each quadword and writes the two 64-bit products; the signed partner of SSE2’s `pmuludq`. VEX form: `vpmuldq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pminsb`	`xmm1, xmm2/m128`	`66 0F 38 38 /r`	Minimum of signed bytes. VEX form: `vpminsb`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pminsd`	`xmm1, xmm2/m128`	`66 0F 38 39 /r`	Minimum of signed doublewords. VEX form: `vpminsd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pminuw`	`xmm1, xmm2/m128`	`66 0F 38 3A /r`	Minimum of unsigned words. VEX form: `vpminuw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pminud`	`xmm1, xmm2/m128`	`66 0F 38 3B /r`	Minimum of unsigned doublewords. VEX form: `vpminud`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmaxsb`	`xmm1, xmm2/m128`	`66 0F 38 3C /r`	Maximum of signed bytes. VEX form: `vpmaxsb`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmaxsd`	`xmm1, xmm2/m128`	`66 0F 38 3D /r`	Maximum of signed doublewords. VEX form: `vpmaxsd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmaxuw`	`xmm1, xmm2/m128`	`66 0F 38 3E /r`	Maximum of unsigned words. VEX form: `vpmaxuw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmaxud`	`xmm1, xmm2/m128`	`66 0F 38 3F /r`	Maximum of unsigned doublewords. VEX form: `vpmaxud`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pcmpeqq`	`xmm1, xmm2/m128`	`66 0F 38 29 /r`	Sets each quadword to all ones where the quadwords are equal, all zeros where not. VEX form: `vpcmpeqq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`packusdw`	`xmm1, xmm2/m128`	`66 0F 38 2B /r`	Narrows the signed doublewords of both operands to unsigned words with saturation; the first operand’s fill the low half. VEX form: `vpackusdw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`ptest`	`xmm1, xmm2/m128`	`66 0F 38 17 /r`	Sets ZF if (xmm1 AND xmm2/m128) is zero, and CF if (NOT xmm1 AND xmm2/m128) is zero; clears OF, AF, PF and SF. Writes no register. VEX form: `vptest`.	SSE4.1 (Intel Core 2 (Penryn), 2007)

SSE4.1: sign and zero extension

Each reads the low part of the source (a register, or memory of the size given) and widens every element into the destination.

Instruction	Forms	Encoding	What it does	Set
`pmovsxbw`	`xmm1, xmm2/m64`	`66 0F 38 20 /r`	Sign-extends eight bytes to eight words. VEX form: `vpmovsxbw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovsxbd`	`xmm1, xmm2/m32`	`66 0F 38 21 /r`	Sign-extends four bytes to four doublewords. VEX form: `vpmovsxbd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovsxbq`	`xmm1, xmm2/m16`	`66 0F 38 22 /r`	Sign-extends two bytes to two quadwords. VEX form: `vpmovsxbq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovsxwd`	`xmm1, xmm2/m64`	`66 0F 38 23 /r`	Sign-extends four words to four doublewords. VEX form: `vpmovsxwd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovsxwq`	`xmm1, xmm2/m32`	`66 0F 38 24 /r`	Sign-extends two words to two quadwords. VEX form: `vpmovsxwq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovsxdq`	`xmm1, xmm2/m64`	`66 0F 38 25 /r`	Sign-extends two doublewords to two quadwords. VEX form: `vpmovsxdq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovzxbw`	`xmm1, xmm2/m64`	`66 0F 38 30 /r`	Zero-extends eight bytes to eight words. VEX form: `vpmovzxbw`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovzxbd`	`xmm1, xmm2/m32`	`66 0F 38 31 /r`	Zero-extends four bytes to four doublewords. VEX form: `vpmovzxbd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovzxbq`	`xmm1, xmm2/m16`	`66 0F 38 32 /r`	Zero-extends two bytes to two quadwords. VEX form: `vpmovzxbq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovzxwd`	`xmm1, xmm2/m64`	`66 0F 38 33 /r`	Zero-extends four words to four doublewords. VEX form: `vpmovzxwd`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovzxwq`	`xmm1, xmm2/m32`	`66 0F 38 34 /r`	Zero-extends two words to two quadwords. VEX form: `vpmovzxwq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)
`pmovzxdq`	`xmm1, xmm2/m64`	`66 0F 38 35 /r`	Zero-extends two doublewords to two quadwords. VEX form: `vpmovzxdq`.	SSE4.1 (Intel Core 2 (Penryn), 2007)

SSE4.1: streaming load

Instruction	Forms	Encoding	What it does	Set
`movntdqa`	`xmm1, m128`	`66 0F 38 2A /r`	Loads 128 bits with a non-temporal hint. From write-combining memory it can read a whole line into a streaming buffer instead of the caches; on other memory types it acts as an ordinary load. Memory must be 16-byte aligned. VEX form: `vmovntdqa`.	SSE4.1 (Intel Core 2 (Penryn), 2007)

SSE4.2: string comparisons

The four string instructions compare two strings of up to sixteen bytes or eight words, held in xmm1 and xmm2/m128. imm8 says how:

bits 1:0, the element: unsigned bytes, unsigned words, signed bytes or signed words (0 to 3);
bits 3:2, the comparison: equal any (any character of a set), ranges, equal each (string equality) or equal ordered (substring search);
bits 5:4, the polarity: whether the result bits are inverted, in all or only up to the end of the string;
bit 6: for the index forms, whether the lowest or the highest set bit is reported; for the mask forms, whether the mask is a bit mask or a byte or word mask.

The e forms take the two string lengths from EAX and EDX (RAX and RDX with REX.W); the i forms end each string at its first zero element. All four set CF if the result is not zero, ZF if xmm2/m128’s string ends within the register, SF if xmm1’s string ends within it, and OF to bit 0 of the result. They clear AF and PF. Memory need not be aligned.

Instruction	Forms	Encoding	What it does	Set
`pcmpestri`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 61 /r ib`	Compares strings of explicit length and writes an index to ECX (16 or 8 when there is no match). VEX form: `vpcmpestri`.	SSE4.2 (Intel Core i7 (Nehalem), 2008)
`pcmpestrm`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 60 /r ib`	Compares strings of explicit length and writes a mask to XMM0. VEX form: `vpcmpestrm`.	SSE4.2 (Intel Core i7 (Nehalem), 2008)
`pcmpistri`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 63 /r ib`	Compares zero-terminated strings and writes an index to ECX. VEX form: `vpcmpistri`.	SSE4.2 (Intel Core i7 (Nehalem), 2008)
`pcmpistrm`	`xmm1, xmm2/m128, imm8`	`66 0F 3A 62 /r ib`	Compares zero-terminated strings and writes a mask to XMM0. VEX form: `vpcmpistrm`.	SSE4.2 (Intel Core i7 (Nehalem), 2008)

SSE4.2: other instructions

Instruction	Forms	Encoding	What it does	Set
`pcmpgtq`	`xmm1, xmm2/m128`	`66 0F 38 37 /r`	Sets each quadword to all ones where the first operand’s signed quadword is greater. VEX form: `vpcmpgtq`.	SSE4.2 (Intel Core i7 (Nehalem), 2008)
`crc32`	`r32, r/m8` `r32, r/m16` `r32, r/m32` `r64, r/m8` `r64, r/m64`	`F2 0F 38 F0 /r` `66 F2 0F 38 F1 /r` `F2 0F 38 F1 /r` `F2 REX.W 0F 38 F0 /r` `F2 REX.W 0F 38 F1 /r`	Adds the source’s bytes to a running CRC-32C held in the destination: the Castagnoli polynomial 11EDC6F41h, bit-reflected, as iSCSI and ext4 use. Not the polynomial of zip and PNG. Flags unchanged. A general-purpose instruction, with no VEX form.	SSE4.2 (Intel Core i7 (Nehalem), 2008)

SSE4a

The bit-field instructions work on the low quadword of an XMM register. The field length (bits 5:0, 0 meaning 64) and the index of its lowest bit (bits 5:0) come from two immediates or from a second register; a field that runs past bit 63 gives an undefined result. The upper quadword of the destination is undefined afterwards.

Instruction	Forms	Encoding	What it does	Set
`extrq`	`xmm1, imm8, imm8` `xmm1, xmm2`	`66 0F 78 /0 ib ib` `66 0F 79 /r`	Extracts a bit field from xmm1 and writes it, zero-extended, to xmm1’s low quadword. The immediates are the length, then the index; in the register form they are xmm2’s bits 5:0 and 13:8.	SSE4a (AMD Phenom, 2007)
`insertq`	`xmm1, xmm2, imm8, imm8` `xmm1, xmm2`	`F2 0F 78 /r ib ib` `F2 0F 79 /r`	Inserts the low bits of xmm2 as a bit field into xmm1’s low quadword. The immediates are the length, then the index; in the register form they are xmm2’s bits 69:64 and 77:72.	SSE4a (AMD Phenom, 2007)
`movntss`	`m32, xmm`	`F3 0F 2B /r`	Stores the low single-precision value with a non-temporal hint.	SSE4a (AMD Phenom, 2007)
`movntsd`	`m64, xmm`	`F2 0F 2B /r`	Stores the low double-precision value with a non-temporal hint.	SSE4a (AMD Phenom, 2007)

Notes

Alignment. In the legacy encodings a 128-bit memory operand must be 16-byte aligned, or the instruction raises #GP. The string comparisons and the narrower memory operands are the exceptions.
Exceptions. The floating-point instructions (blends aside) set the exception flags in MXCSR, as SSE’s do. The rounding instructions can suppress the precision exception with imm8 bit 3.
Decoding. 0F 78 and 0F 79 with no prefix are vmread and vmwrite. With 66 or F2 and a register operand they are extrq and insertq; with a memory operand the disassembler, as LLVM does, still shows vmread and vmwrite.
CRC32 and F2. In crc32 the F2 prefix is part of the opcode: without it, 0F 38 F0 and F1 are movbe.