The x86 instruction set has been extended several times, introducing wider registers and datatypes as well as new functionality.
Additionally, they can be overridden on a per-instruction basis with two new instruction prefixes that were introduced in the 80386: The 80386 also introduced the two new segment registers FS and GS as well as the x86 control, debug and test registers.
[k] In early processors, the TSC was a cycle counter, incrementing by 1 for each clock cycle (which could cause its rate to vary on processors that could change clock speed at runtime) – in later processors, it increments at a fixed rate that doesn't necessarily match the CPU clock speed.
[v][60] These instructions are provided for software testing to explicitly generate invalid opcodes.
WRMSR to the x2APIC ICR (Interrupt Command Register; MSR 830h) is commonly used to produce an IPI (Inter-processor interrupt) - on Intel[40] but not AMD[41] CPUs, such an IPI can be reordered before an older memory store.
They fall in four groups: Most instructions with a 64 bit operand size encode this using a REX.W prefix; in the absence of the REX.W prefix, the corresponding instruction with 32 bit operand size is encoded.
These are not listed here as they do not gain a new mnemonic in Intel syntax when used with a 64 bit operand size.
Intel CET (Control-Flow Enforcement Technology) adds two distinct features to help protect against security exploits such as return-oriented programming: a shadow stack (CET_SS), and indirect branch tracking (CET_IBT).
This is done by defining a series of state-components, each with a size and offset within a given save area, and each corresponding to a subset of the state needed for one CPU extension or another.
The EAX=0Dh CPUID leaf is used to provide information about which state-components the CPU supports and what their sizes/offsets are, so that the OS can reserve the proper amount of space and set the associated enable-bits.
Depending on function, the instruction may return data in RBX and/or an error code in EAX.
Depending on function, the instruction may return data/status information in EAX and/or RCX.
If the instruction fails, it will set EFLAGS.ZF=1 and return an error code in EAX.
[u] Part of Intel DSA (Data Streaming Accelerator Architecture).
Intel XED uses the mnemonics hint-taken and hint-not-taken for these branch hints.
Any unsupported value in EAX causes a #GP exception.The EENTER and ERESUME functions cannot be executed inside an SGX enclave – the other functions can only be executed inside an enclave.
Any unsupported value in EAX causes a #GP exception.The ENCLV instruction is only present on systems that support the EPC Oversubscription Extensions to SGX ("OVERSUB").
The x86 CPUs contain undocumented instructions which are implemented on the chips but not listed in some official documents.
Microsoft Windows 95 Setup is known to depend on 0F FF being invalid[163][164] – it is used as a self check to test that its #UD exception handler is working properly.
Other invalid opcodes that are being relied on by commercial software to produce #UD exceptions include FF FF (DIF-2,[165] LaserLok[166]) and C4 C4 ("BOP"[167][168]), however as of January 2022 they are not published as intentionally invalid opcodes.
[171] In a forum post at the Vintage Computing Federation, this instruction (with F1 prefix) is explained as SAVEALL.
The NexGen Nx586 CPU uses "hyper code"[178] (x86 code sequences unpacked at boot time and only accessible in a special "hyper mode" operation mode, similar to DEC Alpha's PALcode and Intel's XuCode[179]) for many complicated operations that are implemented with microcode in most other x86 CPUs.
The Nx586 provides a large number of undocumented instructions to assist hyper mode operation.
Opcode reused for documented PSWAPD instruction from AMD K7 onwards.
64 0F (80..8F) rel16/32 Segment prefixes on conditional branches are accepted but ignored by non-NetBurst CPUs.