NASM 2.05 based x86 Instruction Reference

This document has been compiled on 2024-10-14.

1: License #

NASM is now licensed under the 2-clause BSD license, also known as the simplified BSD license.

Copyright 1996-2009 the NASM Authors - All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

A: x86 Instruction Reference #

This appendix provides a complete list of the machine instructions which NASM will assemble, and a short description of the function of each one.

It is not intended to be an exhaustive documentation on the fine details of the instructions' function, such as which exceptions they can trigger: for such documentation, you should go to Intel's Web site, http://developer.intel.com/design/Pentium4/manuals/.

Instead, this appendix is intended primarily to provide documentation on the way the instructions may be used within NASM. For example, looking up LOOP will tell you that NASM allows CX or ECX to be specified as an optional second argument to the LOOP instruction, to enforce which of the two possible counter registers should be used if the default is not the one desired.

The instructions are not quite listed in alphabetical order, since groups of instructions with similar functions are lumped together in the same entry. Most of them don't move very far from their alphabetic position because of this.

A.1 Key to Operand Specifications #

The instruction descriptions in this appendix specify their operands using the following notation:

Registers: reg8 denotes an 8-bit general purpose register, reg16 denotes a 16-bit general purpose register, reg32 a 32-bit one and reg64 a 64-bit one. fpureg denotes one of the eight FPU stack registers, mmxreg denotes one of the eight 64-bit MMX registers, and segreg denotes a segment register. xmmreg denotes one of the 8, or 16 in x64 long mode, SSE XMM registers. In addition, some registers (such as AL, DX, ECX or RAX) may be specified explicitly.
Immediate operands: imm denotes a generic immediate operand. imm8, imm16 and imm32 are used when the operand is intended to be a specific size. For some of these instructions, NASM allows an explicit specifier: for example, ADD ESP,16 could be interpreted as either ADD r/m32,imm32 or ADD r/m32,imm8. If the immediate value is known during the assembling of that instruction, and fits in the range of a signed byte, then recent versions of NASM automatically optimise the instruction by choosing the latter form. It is allowed to specify ADD ESP,BYTE 16 explicitly, which is needed to indicate that optimisation in case the immediate value is not known by NASM. (Eg, if it is a symbol reference only resolved by the linker.) Conversely, using the qualifiers STRICT WORD or STRICT DWORD forces NASM to use the longer forms. There is a special case of the allowance of an imm64 for particular x64 versions of the MOV instruction.
Memory references: mem denotes a generic memory reference; mem8, mem16, mem32, mem64 and mem80 are used when the operand needs to be a specific size. Again, a specifier is needed in some cases: DEC [address] is ambiguous and will be rejected by NASM. You must specify DEC BYTE [address], DEC WORD [address] or DEC DWORD [address] instead.
Restricted memory references: one form of the MOV instruction allows a memory address to be specified without allowing the normal range of register combinations and effective address processing. This is denoted by memoffs8, memoffs16, memoffs32 or memoffs64.
Register or memory choices: many instructions can accept either a register or a memory reference as an operand. r/m8 is shorthand for reg8/mem8; similarly r/m16 and r/m32. On legacy x86 modes, r/m64 is MMX-related, and is shorthand for mmxreg/mem64. When utilizing the x86-64 architecture extension, r/m64 denotes use of a 64-bit GPR as well, and is shorthand for reg64/mem64.

A.2 Key to Opcode Descriptions #

This appendix also provides the opcodes which NASM will generate for each form of each instruction. The opcodes are listed in the following way:

A hex number, such as 3F, indicates a fixed byte containing that number.
A hex number followed by +r, such as C8+r, indicates that one of the operands to the instruction is a register, and the ‘register value’ of that register should be added to the hex number to produce the generated byte. For example, EDX has register value 2, so the code C8+r, when the register operand is EDX, generates the hex byte CA. Register values for specific registers are given in section A.2.1.
A hex number followed by +cc, such as 70+cc, indicates that the instruction name has a condition code suffix, and the numeric representation of the condition code should be added to the hex number to produce the generated byte. For example, the code 70+cc, when the instruction contains the NE condition, generates the hex byte 75. Condition codes and their numeric representations are given in section A.2.2. In one case, 70+(cc^1) is given, which means that the inverse condition code is encoded in the byte.
A slash followed by a digit, such as /2, indicates that one of the operands to the instruction is a memory address or register (denoted mem or r/m, with an optional size). This is to be encoded as an effective address, with a ModR/M byte, an optional SIB byte, and an optional displacement, and the spare (register) field of the ModR/M byte should be the digit given (which will be from 0 to 7, so it fits in three bits). The encoding of effective addresses is given in section A.2.6.
The code /r combines the above two: it indicates that one of the operands is a memory address or r/m, and another is a register, and that an effective address should be generated with the spare (register) field in the ModR/M byte being equal to the ‘register value’ of the register operand. The encoding of effective addresses is given in section A.2.6; register values are given in section A.2.1.
The codes ib, iw and id indicate that one of the operands to the instruction is an immediate value, and that this is to be encoded as a byte, little-endian word or little-endian doubleword respectively.
The codes rb, rw and rd indicate that one of the operands to the instruction is an immediate value, and that the difference between this value and the address of the end of the instruction is to be encoded as a byte, word or doubleword respectively. Where the form rw/rd appears, it indicates that either rw or rd should be used according to whether assembly is being performed in BITS 16 or BITS 32 state respectively.
The codes ow and od indicate that one of the operands to the instruction is a reference to the contents of a memory address specified as an immediate value: this encoding is used in some forms of the MOV instruction in place of the standard effective-address mechanism. The displacement is encoded as a word or doubleword. Again, ow/od denotes that ow or od should be chosen according to the BITS setting.
The codes o16 and o32 indicate that the given form of the instruction should be assembled with operand size 16 or 32 bits. In other words, o16 indicates a 66 prefix in BITS 32 state, but generates no code in BITS 16 state; and o32 indicates a 66 prefix in BITS 16 state but generates nothing in BITS 32.
The codes a16 and a32, similarly to o16 and o32, indicate the address size of the given form of the instruction. Where this does not match the BITS setting, a 67 prefix is required. Please note that a16 is useless in long mode as 16-bit addressing is depreciated on the x86-64 architecture extension.

A.2.1 Register Values #

Where an instruction requires a register value, it is already implicit in the encoding of the rest of the instruction what type of register is intended: an 8-bit general-purpose register, a segment register, a debug register, an MMX register, or whatever. Therefore there is no problem with registers of different types sharing an encoding value.

Please note that for the register classes listed below, the register extensions (REX) classes require the use of the REX prefix, which is only available when in long mode on an x86-64 processor. This pretty much goes for any register that has a number higher than 7.

The encodings for the various classes of register are:

8-bit general registers: AL is 0, CL is 1, DL is 2, BL is 3, AH is 4, CH is 5, DH is 6 and BH is 7. Please note that AH, BH, CH and DH are not addressable when using the REX prefix in long mode.
8-bit general register extensions (REX): SPL is 4, BPL is 5, SIL is 6, DIL is 7, R8B is 8, R9B is 9, R10B is 10, R11B is 11, R12B is 12, R13B is 13, R14B is 14 and R15B is 15.
16-bit general registers: AX is 0, CX is 1, DX is 2, BX is 3, SP is 4, BP is 5, SI is 6, and DI is 7.
16-bit general register extensions (REX): R8W is 8, R9W is 9, R10w is 10, R11W is 11, R12W is 12, R13W is 13, R14W is 14 and R15W is 15.
32-bit general registers: EAX is 0, ECX is 1, EDX is 2, EBX is 3, ESP is 4, EBP is 5, ESI is 6, and EDI is 7.
32-bit general register extensions (REX): R8D is 8, R9D is 9, R10D is 10, R11D is 11, R12D is 12, R13D is 13, R14D is 14 and R15D is 15.
64-bit general register extensions (REX): RAX is 0, RCX is 1, RDX is 2, RBX is 3, RSP is 4, RBP is 5, RSI is 6, RDI is 7, R8 is 8, R9 is 9, R10 is 10, R11 is 11, R12 is 12, R13 is 13, R14 is 14 and R15 is 15.
Segment registers: ES is 0, CS is 1, SS is 2, DS is 3, FS is 4, and GS is 5.
Floating-point registers: ST0 is 0, ST1 is 1, ST2 is 2, ST3 is 3, ST4 is 4, ST5 is 5, ST6 is 6, and ST7 is 7.
64-bit MMX registers: MM0 is 0, MM1 is 1, MM2 is 2, MM3 is 3, MM4 is 4, MM5 is 5, MM6 is 6, and MM7 is 7.
128-bit XMM (SSE) registers: XMM0 is 0, XMM1 is 1, XMM2 is 2, XMM3 is 3, XMM4 is 4, XMM5 is 5, XMM6 is 6 and XMM7 is 7.
128-bit XMM (SSE) register extensions (REX): XMM8 is 8, XMM9 is 9, XMM10 is 10, XMM11 is 11, XMM12 is 12, XMM13 is 13, XMM14 is 14 and XMM15 is 15.
Control registers: CR0 is 0, CR2 is 2, CR3 is 3, and CR4 is 4.
Control register extensions: CR8 is 8.
Debug registers: DR0 is 0, DR1 is 1, DR2 is 2, DR3 is 3, DR6 is 6, and DR7 is 7.
Test registers: TR3 is 3, TR4 is 4, TR5 is 5, TR6 is 6, and TR7 is 7.

(Note that wherever a register name contains a number, that number is also the register value for that register.)

A.2.2 Condition Codes #

The available condition codes are given here, along with their numeric representations as part of opcodes. Many of these condition codes have synonyms, so several will be listed at a time.

In the following descriptions, the word ‘either’, when applied to two possible trigger conditions, is used to mean ‘either or both’. If ‘either but not both’ is meant, the phrase ‘exactly one of’ is used.

O is 0 (trigger if the overflow flag is set); NO is 1.
B, C and NAE are 2 (trigger if the carry flag is set); AE, NB and NC are 3.
E and Z are 4 (trigger if the zero flag is set); NE and NZ are 5.
BE and NA are 6 (trigger if either of the carry or zero flags is set); A and NBE are 7.
S is 8 (trigger if the sign flag is set); NS is 9.
P and PE are 10 (trigger if the parity flag is set); NP and PO are 11.
L and NGE are 12 (trigger if exactly one of the sign and overflow flags is set); GE and NL are 13.
LE and NG are 14 (trigger if either the zero flag is set, or exactly one of the sign and overflow flags is set); G and NLE are 15.

Note that in all cases, the sense of a condition code may be reversed by changing the low bit of the numeric representation.

For details of when an instruction sets each of the status flags, see the individual instruction, plus the Status Flags reference in section A.2.4

A.2.3 SSE Condition Predicates #

The condition predicates for SSE comparison instructions are the codes used as part of the opcode, to determine what form of comparison is being carried out. In each case, the imm8 value is the final byte of the opcode encoding, and the predicate is the code used as part of the mnemonic for the instruction (equivalent to the "cc" in an integer instruction that used a condition code). The instructions that use this will give details of what the various mnemonics are, this table is used to help you work out details of what is happening.

Predi-  imm8  Description Relation where:   Emula- Result   QNaN
 cate  Encod-             A Is 1st Operand  tion   if NaN   Signal
        ing               B Is 2nd Operand         Operand  Invalid

EQ     000B   equal       A = B                    False     No

LT     001B   less-than   A < B                    False     Yes

LE     010B   less-than-  A <= B                   False     Yes
               or-equal

---    ----   greater     A > B             Swap   False     Yes
              than                          Operands,
                                            Use LT

---    ----   greater-    A >= B            Swap   False     Yes
              than-or-equal                 Operands,
                                            Use LE

UNORD  011B   unordered   A, B = Unordered         True      No

NEQ    100B   not-equal   A != B                   True      No

NLT    101B   not-less-   NOT(A < B)               True      Yes
              than

NLE    110B   not-less-   NOT(A <= B)              True      Yes
              than-or-
              equal

---    ----   not-greater NOT(A > B)        Swap   True      Yes
              than                          Operands,
                                            Use NLT

---    ----   not-greater NOT(A >= B)       Swap   True      Yes
              than-                         Operands,
              or-equal                      Use NLE

ORD    111B   ordered      A , B = Ordered         False     No

The unordered relationship is true when at least one of the two values being compared is a NaN or in an unsupported format.

Note that the comparisons which are listed as not having a predicate or encoding can only be achieved through software emulation, as described in the "emulation" column. Note in particular that an instruction such as greater-than is not the same as NLE, as, unlike with the CMP instruction, it has to take into account the possibility of one operand containing a NaN or an unsupported numeric format.

A.2.4 Status Flags #

The status flags provide some information about the result of the arithmetic instructions. This information can be used by conditional instructions (such as Jcc and CMOVcc) as well as by some of the other instructions (such as ADC and INTO).

There are 6 status flags:

CF - Carry flag.

Set if an arithmetic operation generates a carry or a borrow out of the most-significant bit of the result; cleared otherwise. This flag indicates an overflow condition for unsigned-integer arithmetic. It is also used in multiple-precision arithmetic.

PF - Parity flag.

Set if the least-significant byte of the result contains an even number of 1 bits; cleared otherwise.

AF - Adjust flag.

Set if an arithmetic operation generates a carry or a borrow out of bit 3 of the result; cleared otherwise. This flag is used in binary-coded decimal (BCD) arithmetic.

ZF - Zero flag.

Set if the result is zero; cleared otherwise.

SF - Sign flag.

Set equal to the most-significant bit of the result, which is the sign bit of a signed integer. (0 indicates a positive value and 1 indicates a negative value.)

OF - Overflow flag.

Set if the integer result is too large a positive number or too small a negative number (excluding the sign-bit) to fit in the destination operand; cleared otherwise. This flag indicates an overflow condition for signed-integer (two's complement) arithmetic.

A.2.5 Control Flags #

Control Flags control aspects of the CPU's operation. In the 16-bit FLAGS register there are 3 such flags supported on all CPUs down to the 8086. They are:

A.2.5.1 IF - Interrupt flag #

If set, enables hardware interrupts (IRQs) to be serviced by the CPU. Note that a MOV or POP to SS (see section A.5.156 and section A.5.244) disables hardware interrupt servicing and Trace flag tracing until after the next instruction, to allow atomic setting of both SS and SP at the same time. (There is a bug that makes this interrupt lockout fail on early 8086/8088 CPUs, which is why 8086-compatible code that sets SS and SP usually also clears the Interrupt flag explicitly first.)

A.2.5.2 DF - Direction flag #

If set (called DN ‘Down’), string operations such as MOVSx (section A.5.178) decrement their index registers, (E)SI and/or (E)DI. If clear (called UP), which is the usual default state, the string operations increment their index registers.

A.2.5.3 TF - Trace flag #

If set, the CPU will invoke the Trace interrupt (interrupt 1) after the next instruction. There are a few special cases:

Other interrupt invocations ignore the prior Trace flag status. That is, interrupts are not traced.
After an interrupt invocation, the IRET (see section A.5.127) restores TF=1, but the Trace interrupt is then only called after another instruction. That is, the Trace interrupt ‘fires too late’.
When interrupt lockout due to MOV or POP to SS is in effect, no Trace interrupt is invoked.
When a repeated string operation is invoked, at most one iteration is executed. (E)IP is reset in case more iterations are to be executed.
If (E)CX was greater than 1, and (for CMPSx and SCASx) after the first comparison the Zero flag is set or clear so as to repeat the operation, the (E)IP address is reset to point to the first prefix opcode and then a Trace interrupt is invoked.

When (E)CX was 1 prior to the instruction, or the Zero flag after the comparison indicates to break out of the repetition, then one iteration is executed, (E)IP is not reset, and a Trace interrupt is invoked.

When (E)CX was 0 prior to the instruction, then no iteration is executed, but (E)IP is still incremented to point after the instruction, and a Trace interrupt is invoked.

A.2.6 Effective Address Encoding: ModR/M and SIB #

An effective address is encoded in up to three parts: a ModR/M byte, an optional SIB byte, and an optional byte, word or doubleword displacement field.

The ModR/M byte consists of three fields: the mod field, ranging from 0 to 3, in the upper two bits of the byte, the r/m field, ranging from 0 to 7, in the lower three bits, and the spare (register) field in the middle (bit 3 to bit 5). The spare field is not relevant to the effective address being encoded, and either contains an extension to the instruction opcode or the register value of another operand.

A.2.6.1 ModR/M encoding a register #

The ModR/M system can be used to encode a direct register reference rather than a memory access. This is always done by setting the mod field to 3 and the r/m field to the register value of the register in question (it must be a general-purpose register, and the size of the register must already be implicit in the encoding of the rest of the instruction). In this case, the SIB byte and displacement field are both absent.

A.2.6.2 Memory a16 ModR/M encoding #

In 16-bit addressing mode (either BITS 16 with no 67 prefix, or BITS 32 with a 67 prefix), the SIB byte is never used. The general rules for mod and r/m (there is an exception, given below) are:

The mod field gives the length of the displacement field: 0 means no displacement, 1 means one byte, and 2 means two bytes.
The r/m field encodes the combination of registers to be added to the displacement to give the accessed address: 0 means BX+SI, 1 means BX+DI, 2 means BP+SI, 3 means BP+DI, 4 means SI only, 5 means DI only, 6 means BP only, and 7 means BX only.

However, there is a special case:

If mod is 0 and r/m is 6, the effective address encoded is not [BP] as the above rules would suggest, but instead [disp16]: the displacement field is present and is two bytes long, and no registers are added to the displacement.

Therefore the effective address [BP] cannot be encoded as efficiently as [BX]; so if you code [BP] in a program, NASM adds a notional 8-bit zero displacement, and sets mod to 1, r/m to 6, and the one-byte displacement field to 0.

If BP is used in an address then the default segment register is SS. Otherwise, it is DS.

A.2.6.3 Memory a32 ModR/M and SIB encoding #

In 32-bit addressing mode (either BITS 16 with a 67 prefix, or BITS 32 with no 67 prefix) the general rules (again, there are exceptions) for mod and r/m are:

The mod field gives the length of the displacement field: 0 means no displacement, 1 means one byte, and 2 means four bytes.
If only one register is to be added to the displacement, and it is not ESP, the r/m field gives its register value, and the SIB byte is absent. If the r/m field is 4 (which would encode ESP), the SIB byte is present and gives the combination and scaling of registers to be added to the displacement.

If the SIB byte is present, it describes the combination of registers (an optional base register, and an optional index register scaled by multiplication by 1, 2, 4 or 8) to be added to the displacement. The SIB byte is divided into the scale field, in the top two bits, the index field in the next three, and the base field in the bottom three. The general rules are:

The base field encodes the register value of the base register.
The index field encodes the register value of the index register, unless it is 4, in which case no index register is used (so ESP cannot be used as an index register). If a 4 is encoded then the scale field is ignored.
The scale field encodes the multiplier by which the index register is scaled before adding it to the base and displacement: 0 encodes a multiplier of 1, 1 encodes 2, 2 encodes 4 and 3 encodes 8.

The exceptions to the 32-bit encoding rules are:

If mod is 0 and r/m is 5, the effective address encoded is not [EBP] as the above rules would suggest, but instead [disp32]: the displacement field is present and is four bytes long, and no registers are added to the displacement.
If mod is 0, r/m is 4 (meaning the SIB byte is present) and base is 5, the effective address encoded is not [EBP+index] as the above rules would suggest, but instead [disp32+index]: the displacement field is present and is four bytes long, and there is no base register (but the index register is still processed in the normal way).
Note that if the prior exception applies, then the index register field can also be encoded as 4. This combines the two special cases, resulting in a longer encoding of [disp32] without any registers. (This longer encoding differs only in a 64-bit code segment from the short mod=0 r/m=5 encoding of [disp32].)

If EBP or ESP is used as the base register in an address then the default segment register is SS. Otherwise, it is DS. (The use of these registers corresponds to r/m = 5 or base = 5 or 4, except for the special cases with mod = 0.)

A.2.7 Register Extensions: The REX Prefix #

The Register Extensions, or REX for short, prefix is the means of accessing extended registers on the x86-64 architecture. REX is considered an instruction prefix, but is required to be after all other prefixes and thus immediately before the first instruction opcode itself. So overall, REX can be thought of as an "Opcode Prefix" instead. The REX prefix itself is indicated by a value of 0x4X, where X is one of 16 different combinations of the actual REX flags.

The REX prefix flags consist of four 1-bit extensions fields. These flags are found in the lower nibble of the actual REX prefix opcode. Below is the list of REX prefix flags, from high bit to low bit.

REX.W: When set, this flag indicates the use of a 64-bit operand, as opposed to the default of using 32-bit operands as found in 32-bit Protected Mode.

REX.R: When set, this flag extends the reg (spare) field of the ModR/M byte. Overall, this raises the amount of addressable registers in this field from 8 to 16.

REX.X: When set, this flag extends the index field of the SIB byte. Overall, this raises the amount of addressable registers in this field from 8 to 16.

REX.B: When set, this flag extends the r/m field of the ModR/M byte. This flag can also represent an extension to the opcode register (/r) field. The determination of which is used varies depending on which instruction is used. Overall, this raises the amount of addressable registers in these fields from 8 to 16.

Internal use of the REX prefix by the processor is consistent, yet non-trivial. Most instructions use the REX prefix as indicated by the above flags. Some instructions require the REX prefix to be present even if the flags are empty. Some instructions default to a 64-bit operand and require the REX prefix only for actual register extensions, and thus ignores the REX.W field completely.

At any rate, NASM is designed to handle, and fully supports, the REX prefix internally. Please read the appropriate processor documentation for further information on the REX prefix.

You may have noticed that opcodes 0x40 through 0x4F are actually opcodes for the INC/DEC instructions for each General Purpose Register. This is, of course, correct... for legacy x86. While in long mode, opcodes 0x40 through 0x4F are reserved for use as the REX prefix. The other opcode forms of the INC/DEC instructions are used instead.

A.3 Key to Instruction Flags #

Given along with each instruction in this appendix is a set of flags, denoting the type of the instruction. The types are as follows:

8086, 186, 286, 386, 486, PENT and P6 denote the lowest processor type that supports the instruction. Most instructions run on all processors above the given type; those that do not are documented. The Pentium II contains no additional instructions beyond the P6 (Pentium Pro); from the point of view of its instruction set, it can be thought of as a P6 with MMX capability.
3DNOW indicates that the instruction is a 3DNow! one, and will run on the AMD K6-2 and later processors. ATHLON extensions to the 3DNow! instruction set are documented as such.
CYRIX indicates that the instruction is specific to Cyrix processors, for example the extra MMX instructions in the Cyrix extended MMX instruction set.
FPU indicates that the instruction is a floating-point one, and will only run on machines with a coprocessor (automatically including 486DX, Pentium and above).
KATMAI indicates that the instruction was introduced as part of the Katmai New Instruction set. These instructions are available on the Pentium III and later processors. Those which are not specifically SSE instructions are also available on the AMD Athlon.
MMX indicates that the instruction is an MMX one, and will run on MMX-capable Pentium processors and the Pentium II.
PRIV indicates that the instruction is a protected-mode management instruction. Many of these may only be used in protected mode, or only at privilege level zero.
SSE and SSE2 indicate that the instruction is a Streaming SIMD Extension instruction. These instructions operate on multiple values in a single operation. SSE was introduced with the Pentium III and SSE2 was introduced with the Pentium 4.
UNDOC indicates that the instruction is an undocumented one, and not part of the official Intel Architecture; it may or may not be supported on any given machine.
WILLAMETTE indicates that the instruction was introduced as part of the new instruction set in the Pentium 4 and Intel Xeon processors. These instructions are also known as SSE2 instructions.
X64 indicates that the instruction was introduced as part of the new instruction set in the x86-64 architecture extension, commonly referred to as x64, AMD64 or EM64T.

A.4 Emulator notes #

A.4.1 Common corner cases #

POP to CS is invalid, and used by 286+ CPUs as prefix byte for two-byte instructions. Some 8086s may actually implement it however. It is unclear how this interacts with the prefetch queue, which is known to be purged by every JMP, CALL, interrupt, or return instruction.
LEA has to encode a memory reference as source operand, and thus not a register.
MOV to and from segregs can encode invalid non-existent segment registers beyond DS, or (on a 386+) beyond GS.
MOV to a segreg mustn't encode CS as destination. Like POP to CS, the prefetch queue behaviour is uncertain.
HLT should cause the machine to halt, ideally until the next hardware interrupt occurs. It may however simply cause the machine to sleep or give up a timeslice in a multitasker. Failing even that is in error.
SHL and other shift and rotate instructions mask the shift count (either from CL or the immediate operand) with 31 on 186+ machines, except NEC V20/V30. The latter, and 8088/8086, use the entire shift count.
On the 8088/8086, the divide by zero interrupt points behind the instruction that caused the exception. Otherwise, it points at the instruction.
AAD and AAM accept immediate bytes other than 10 on some machines, but not on the NEC V20/V30.
Interrupt 6 (Invalid opcode) didn't exist on the 8088/8086. Unsupported instructions may behave as one- or two-byte no-ops or otherwise oddly.
Interrupt lockout after MOV or POP to SS is described in the Control Flags description of the Interrupt Flag, section A.2.5.1.
Proper repeated string operations tracing is described in the Control Flags description of the Trace Flag, section A.2.5.3.

A.4.2 Emulator call encodings #

NTVDM uses C4 C4 (LES with a register source) followed by one or two callback identifier bytes.
DOSBox uses FE 38 (invalid encoding with /7) followed by a callback identifier word.
dosemu2 uses HLT and dispatches based on the address of the HLT.
8086tiny uses 0F followed by one identifier byte, currently in the range 00 to 04.

A.5 x86 Instruction Set #

A.5.1 `AAA`, `AAS`, `AAM`, `AAD`: ASCII Adjustments #

AAA                           ; 37                   [8086]

AAS                           ; 3F                   [8086]

AAD                           ; D5 0A                [8086]
AAD imm8                      ; D5 ib                [8086]

AAM                           ; D4 0A                [8086]
AAM imm8                      ; D4 ib                [8086]

These instructions are used in conjunction with the add, subtract, multiply and divide instructions to perform binary-coded decimal arithmetic in unpacked (one BCD digit per byte - easy to translate to and from ASCII, hence the instruction names) form. There are also packed BCD instructions DAA and DAS: see section A.5.57.

AAA (ASCII Adjust After Addition) should be used after a one-byte ADD instruction whose destination was the AL register: by means of examining the value in the low nibble of AL and also the auxiliary carry flag AF, it determines whether the addition has overflowed, and adjusts it (and sets the carry flag) if so. You can add long BCD strings together by doing ADD/AAA on the low digits, then doing ADC/AAA on each subsequent digit.
AAS (ASCII Adjust AL After Subtraction) works similarly to AAA, but is for use after SUB instructions rather than ADD.
AAM (ASCII Adjust AX After Multiply) is for use after you have multiplied two decimal digits together and left the result in AL: it divides AL by ten and stores the quotient in AH, leaving the remainder in AL. The divisor 10 can be changed by specifying an operand to the instruction: a particularly handy use of this is AAM 16, causing the two nibbles in AL to be separated into AH and AL. Note that the divisor immediate byte is ignored by some implementations such as the NEC V20/V30, which always use 10 as divisor.
AAD (ASCII Adjust AX Before Division) performs the inverse operation to AAM: it multiplies AH by ten, adds it to AL, and sets AH to zero. Again, the multiplier 10 can be changed on some implementations.

A.5.2 `ADC`: Add with Carry #

ADC r/m8,reg8                 ; 10 /r                [8086]
ADC r/m16,reg16               ; o16 11 /r            [8086]
ADC r/m32,reg32               ; o32 11 /r            [386]

ADC reg8,r/m8                 ; 12 /r                [8086]
ADC reg16,r/m16               ; o16 13 /r            [8086]
ADC reg32,r/m32               ; o32 13 /r            [386]

ADC r/m8,imm8                 ; 80 /2 ib             [8086]
ADC r/m16,imm16               ; o16 81 /2 iw         [8086]
ADC r/m32,imm32               ; o32 81 /2 id         [386]

ADC r/m16,imm8                ; o16 83 /2 ib         [8086]
ADC r/m32,imm8                ; o32 83 /2 ib         [386]

ADC AL,imm8                   ; 14 ib                [8086]
ADC AX,imm16                  ; o16 15 iw            [8086]
ADC EAX,imm32                 ; o32 15 id            [386]

ADC performs integer addition: it adds its two operands together, plus the value of the carry flag, and leaves the result in its destination (first) operand. The destination operand can be a register or a memory location. The source operand can be a register, a memory location or an immediate value.

The flags are set according to the result of the operation: in particular, the carry flag is affected and can be used by a subsequent ADC instruction.

In the forms with an 8-bit immediate second operand and a longer first operand, the second operand is considered to be signed, and is sign-extended to the length of the first operand. The BYTE qualifier can be used to force NASM to generate this form of the instruction. Recent versions of NASM automatically optimise to this form if the immediate operand's value is known during the assembling of that instruction, and fits in the range of a signed byte. The longer variant can then still be forced using the STRICT WORD or STRICT DWORD qualifier.

To add two numbers without also adding the contents of the carry flag, use ADD (section A.5.3).

A.5.3 `ADD`: Add Integers #

ADD r/m8,reg8                 ; 00 /r                [8086]
ADD r/m16,reg16               ; o16 01 /r            [8086]
ADD r/m32,reg32               ; o32 01 /r            [386]

ADD reg8,r/m8                 ; 02 /r                [8086]
ADD reg16,r/m16               ; o16 03 /r            [8086]
ADD reg32,r/m32               ; o32 03 /r            [386]

ADD r/m8,imm8                 ; 80 /7 ib             [8086]
ADD r/m16,imm16               ; o16 81 /7 iw         [8086]
ADD r/m32,imm32               ; o32 81 /7 id         [386]

ADD r/m16,imm8                ; o16 83 /7 ib         [8086]
ADD r/m32,imm8                ; o32 83 /7 ib         [386]

ADD AL,imm8                   ; 04 ib                [8086]
ADD AX,imm16                  ; o16 05 iw            [8086]
ADD EAX,imm32                 ; o32 05 id            [386]

ADD performs integer addition: it adds its two operands together, and leaves the result in its destination (first) operand. The destination operand can be a register or a memory location. The source operand can be a register, a memory location or an immediate value.

The flags are set according to the result of the operation: in particular, the carry flag is affected and can be used by a subsequent ADC instruction.

A.5.4 `ADDPD`: ADD Packed Double-Precision FP Values #

ADDPD xmm1,xmm2/mem128        ; 66 0F 58 /r     [WILLAMETTE,SSE2]

ADDPD performs addition on each of two packed double-precision FP value pairs.

   dst[0-63]   := dst[0-63]   + src[0-63],
   dst[64-127] := dst[64-127] + src[64-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.5.5 `ADDPS`: ADD Packed Single-Precision FP Values #

ADDPS xmm1,xmm2/mem128        ; 0F 58 /r        [KATMAI,SSE]

ADDPS performs addition on each of four packed single-precision FP value pairs

   dst[0-31]   := dst[0-31]   + src[0-31],
   dst[32-63]  := dst[32-63]  + src[32-63],
   dst[64-95]  := dst[64-95]  + src[64-95],
   dst[96-127] := dst[96-127] + src[96-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.5.6 `ADDSD`: ADD Scalar Double-Precision FP Values #

ADDSD xmm1,xmm2/mem64         ; F2 0F 58 /r     [KATMAI,SSE]

ADDSD adds the low double-precision FP values from the source and destination operands and stores the double-precision FP result in the destination operand.

   dst[0-63]   := dst[0-63] + src[0-63],
   dst[64-127] remains unchanged.

The destination is an XMM register. The source operand can be either an XMM register or a 64-bit memory location.

A.5.7 `ADDSS`: ADD Scalar Single-Precision FP Values #

ADDSS xmm1,xmm2/mem32         ; F3 0F 58 /r     [WILLAMETTE,SSE2]

ADDSS adds the low single-precision FP values from the source and destination operands and stores the single-precision FP result in the destination operand.

   dst[0-31]   := dst[0-31] + src[0-31],
   dst[32-127] remains unchanged.

The destination is an XMM register. The source operand can be either an XMM register or a 32-bit memory location.

A.5.8 `AND`: Bitwise AND #

AND r/m8,reg8                 ; 20 /r                [8086]
AND r/m16,reg16               ; o16 21 /r            [8086]
AND r/m32,reg32               ; o32 21 /r            [386]

AND reg8,r/m8                 ; 22 /r                [8086]
AND reg16,r/m16               ; o16 23 /r            [8086]
AND reg32,r/m32               ; o32 23 /r            [386]

AND r/m8,imm8                 ; 80 /4 ib             [8086]
AND r/m16,imm16               ; o16 81 /4 iw         [8086]
AND r/m32,imm32               ; o32 81 /4 id         [386]

AND r/m16,imm8                ; o16 83 /4 ib         [8086]
AND r/m32,imm8                ; o32 83 /4 ib         [386]

AND AL,imm8                   ; 24 ib                [8086]
AND AX,imm16                  ; o16 25 iw            [8086]
AND EAX,imm32                 ; o32 25 id            [386]

AND performs a bitwise AND operation between its two operands (i.e. each bit of the result is 1 if and only if the corresponding bits of the two inputs were both 1), and stores the result in the destination (first) operand. The destination operand can be a register or a memory location. The source operand can be a register, a memory location or an immediate value.

The Carry Flag is cleared by AND. The Zero Flag is set according to whether the result is zero.

The TEST (see section A.5.317) instruction performs the same operation as AND but without writing to the destination operand. That is, it only reads the operands and writes the status flags.

The MMX instruction PAND (see section A.5.202) performs the same operation on the 64-bit MMX registers.

A.5.9 `ANDNPD`: Bitwise Logical AND NOT of Packed Double-Precision FP Values #

ANDNPD xmm1,xmm2/mem128       ; 66 0F 55 /r     [WILLAMETTE,SSE2]

ANDNPD inverts the bits of the two double-precision floating-point values in the destination register, and then performs a logical AND between the two double-precision floating-point values in the source operand and the temporary inverted result, storing the result in the destination register.

   dst[0-63]   := src[0-63]   AND NOT dst[0-63],
   dst[64-127] := src[64-127] AND NOT dst[64-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.5.10 `ANDNPS`: Bitwise Logical AND NOT of Packed Single-Precision FP Values #

ANDNPS xmm1,xmm2/mem128       ; 0F 55 /r        [KATMAI,SSE]

ANDNPS inverts the bits of the four single-precision floating-point values in the destination register, and then performs a logical AND between the four single-precision floating-point values in the source operand and the temporary inverted result, storing the result in the destination register.

   dst[0-31]   := src[0-31]   AND NOT dst[0-31],
   dst[32-63]  := src[32-63]  AND NOT dst[32-63],
   dst[64-95]  := src[64-95]  AND NOT dst[64-95],
   dst[96-127] := src[96-127] AND NOT dst[96-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.5.11 `ANDPD`: Bitwise Logical AND For Single FP #

ANDPD xmm1,xmm2/mem128        ; 66 0F 54 /r     [WILLAMETTE,SSE2]

ANDPD performs a bitwise logical AND of the two double-precision floating point values in the source and destination operand, and stores the result in the destination register.

   dst[0-63]   := src[0-63]   AND dst[0-63],
   dst[64-127] := src[64-127] AND dst[64-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.5.12 `ANDPS`: Bitwise Logical AND For Single FP #

ANDPS xmm1,xmm2/mem128        ; 0F 54 /r        [KATMAI,SSE]

ANDPS performs a bitwise logical AND of the four single-precision floating point values in the source and destination operand, and stores the result in the destination register.

   dst[0-31]   := src[0-31]   AND dst[0-31],
   dst[32-63]  := src[32-63]  AND dst[32-63],
   dst[64-95]  := src[64-95]  AND dst[64-95],
   dst[96-127] := src[96-127] AND dst[96-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.5.13 `ARPL`: Adjust RPL Field of Selector #

ARPL r/m16,reg16              ; 63 /r                [286,PRIV]

ARPL expects its two word operands to be segment selectors. It adjusts the RPL (requested privilege level - stored in the bottom two bits of the selector) field of the destination (first) operand to ensure that it is no less (i.e. no more privileged than) the RPL field of the source operand. The zero flag is set if and only if a change had to be made.

A.5.14 `BOUND`: Check Array Index against Bounds #

BOUND reg16,mem               ; o16 62 /r            [186]
BOUND reg32,mem               ; o32 62 /r            [386]

BOUND expects its second operand to point to an area of memory containing two signed values of the same size as its first operand (i.e. two words for the 16-bit form; two doublewords for the 32-bit form). It performs two signed comparisons: if the value in the register passed as its first operand is less than the first of the in-memory values, or is greater than or equal to the second, it throws a BR exception. Otherwise, it does nothing.

A.5.15 `BSF`, `BSR`: Bit Scan #

BSF reg16,r/m16               ; o16 0F BC /r         [386]
BSF reg32,r/m32               ; o32 0F BC /r         [386]

BSR reg16,r/m16               ; o16 0F BD /r         [386]
BSR reg32,r/m32               ; o32 0F BD /r         [386]

BSF searches for the least significant set bit in its source (second) operand, and if it finds one, stores the index in its destination (first) operand. If no set bit is found, the contents of the destination operand are undefined. If the source operand is zero, the zero flag is set.
BSR performs the same function, but searches from the top instead, so it finds the most significant set bit.

Bit indices are from 0 (least significant) to 15 or 31 (most significant). The destination operand can only be a register. The source operand can be a register or a memory location.

A.5.16 `BSWAP`: Byte Swap #

BSWAP reg32                   ; o32 0F C8+r          [486]

BSWAP swaps the order of the four bytes of a 32-bit register: bits 0-7 exchange places with bits 24-31, and bits 8-15 swap with bits 16-23. There is no explicit 16-bit equivalent: to byte-swap AX, BX, CX or DX, XCHG can be used. When BSWAP is used with a 16-bit register, the result is undefined.

A.5.17 `BT`, `BTC`, `BTR`, `BTS`: Bit Test #

BT r/m16,reg16                ; o16 0F A3 /r         [386]
BT r/m32,reg32                ; o32 0F A3 /r         [386]
BT r/m16,imm8                 ; o16 0F BA /4 ib      [386]
BT r/m32,imm8                 ; o32 0F BA /4 ib      [386]

BTC r/m16,reg16               ; o16 0F BB /r         [386]
BTC r/m32,reg32               ; o32 0F BB /r         [386]
BTC r/m16,imm8                ; o16 0F BA /7 ib      [386]
BTC r/m32,imm8                ; o32 0F BA /7 ib      [386]

BTR r/m16,reg16               ; o16 0F B3 /r         [386]
BTR r/m32,reg32               ; o32 0F B3 /r         [386]
BTR r/m16,imm8                ; o16 0F BA /6 ib      [386]
BTR r/m32,imm8                ; o32 0F BA /6 ib      [386]

BTS r/m16,reg16               ; o16 0F AB /r         [386]
BTS r/m32,reg32               ; o32 0F AB /r         [386]
BTS r/m16,imm8                ; o16 0F BA /5 ib      [386]
BTS r/m32,imm8                ; o32 0F BA /5 ib      [386]

These instructions all test one bit of their first operand, whose index is given by the second operand, and store the value of that bit into the carry flag. Bit indices are from 0 (least significant) to 15 or 31 (most significant).

In addition to storing the original value of the bit into the carry flag, BTR also resets (clears) the bit in the operand itself. BTS sets the bit, and BTC complements the bit. BT does not modify its operands.

The destination can be a register or a memory location. The source can be a register or an immediate value.

If the destination operand is a register, the bit offset should be in the range 0-15 (for 16-bit operands) or 0-31 (for 32-bit operands). An immediate value outside these ranges will be taken modulo 16/32 by the processor.

If the destination operand is a memory location, then an immediate bit offset follows the same rules as for a register. If the bit offset is in a register, then it can be anything within the signed range of the register used (ie, for a 32-bit operand, it can be (-2^31) to (2^31 - 1)).

A.5.18 `CALL`: Call Subroutine #

CALL imm                      ; E8 rw/rd             [8086]
CALL imm:imm16                ; o16 9A iw iw         [8086]
CALL imm:imm32                ; o32 9A id iw         [386]
CALL FAR mem16                ; o16 FF /3            [8086]
CALL FAR mem32                ; o32 FF /3            [386]
CALL r/m16                    ; o16 FF /2            [8086]
CALL r/m32                    ; o32 FF /2            [386]

CALL calls a subroutine, by means of pushing the current instruction pointer (IP) and optionally CS as well on the stack, and then jumping to a given address.

CS is pushed as well as IP if and only if the call is a far call, i.e. a destination segment address is specified in the instruction. The forms involving two colon-separated arguments are far calls; so are the CALL FAR mem forms.

The immediate near call takes one of two forms (CALL imm16/imm32), determined by the current segment size limit. For 16-bit operands, you would use CALL 0x1234, and for 32-bit operands you would use CALL 0x12345678. The value passed as an operand is a relative offset.

You can choose between the two immediate far call forms (CALL imm:imm) by the use of the WORD and DWORD keywords: CALL WORD 0x1234:0x5678 or CALL DWORD 0x1234:0x56789abc.

The CALL FAR mem forms execute a far call by loading the destination address out of memory. The address loaded consists of 16 or 32 bits of offset (depending on the operand size), and 16 bits of segment. The operand size may be overridden using CALL WORD FAR mem or CALL DWORD FAR mem.

The CALL r/m forms execute a near call (within the same segment), loading the destination address out of memory or out of a register. The keyword NEAR may be specified, for clarity, in these forms, but is not necessary. Again, operand size can be overridden using CALL WORD mem or CALL DWORD mem.

As a convenience, NASM does not require you to call a far procedure symbol by coding the cumbersome CALL SEG routine:routine, but instead allows the easier synonym CALL FAR routine.

A.5.19 `CBW`, `CWD`, `CDQ`, `CWDE`: Sign Extensions #

CBW                           ; o16 98               [8086]
CWDE                          ; o32 98               [386]

CWD                           ; o16 99               [8086]
CDQ                           ; o32 99               [386]

All these instructions sign-extend a short value into a longer one, by replicating the top bit of the original value to fill the extended one.

CBW extends AL into AX by repeating the top bit of AL in every bit of AH. CWDE extends AX into EAX. CWD extends AX into DX:AX by repeating the top bit of AX throughout DX, and CDQ extends EAX into EDX:EAX.

A.5.20 `CLC`, `CLD`, `CLI`, `CLTS`: Clear Flags #

CLC                           ; F8                   [8086]
CLD                           ; FC                   [8086]
CLI                           ; FA                   [8086]
CLTS                          ; 0F 06                [286,PRIV]

These instructions clear various flags. CLC clears the carry flag; CLD clears the direction flag; CLI clears the interrupt flag (thus disabling interrupts); and CLTS clears the task-switched (TS) flag in CR0.

To set the carry, direction, or interrupt flags, use the STC, STD and STI instructions (section A.5.301). To invert the carry flag, use CMC (section A.5.22).

A.5.21 `CLFLUSH`: Flush Cache Line #

CLFLUSH mem                   ; 0F AE /7        [WILLAMETTE,SSE2]

CLFLUSH invalidates the cache line that contains the linear address specified by the source operand from all levels of the processor cache hierarchy (data and instruction). If, at any level of the cache hierarchy, the line is inconsistent with memory (dirty) it is written to memory before invalidation. The source operand points to a byte-sized memory location.

Although CLFLUSH is flagged SSE2 and above, it may not be present on all processors which have SSE2 support, and it may be supported on other processors; the CPUID instruction (section A.5.34) will return a bit which indicates support for the CLFLUSH instruction.

A.5.22 `CMC`: Complement Carry Flag #

CMC                           ; F5                   [8086]

CMC changes the value of the carry flag: if it was 0, it sets it to 1, and vice versa.

A.5.23 `CMOVcc`: Conditional Move #

CMOVcc reg16,r/m16            ; o16 0F 40+cc /r      [P6]
CMOVcc reg32,r/m32            ; o32 0F 40+cc /r      [P6]

CMOV moves its source (second) operand into its destination (first) operand if the given condition code is satisfied; otherwise it does nothing.

For a list of condition codes, see section A.2.2.

Although the CMOV instructions are flagged P6 and above, they may not be supported by all Pentium Pro processors; the CPUID instruction (section A.5.34) will return a bit which indicates whether conditional moves are supported.

A.5.24 `CMP`: Compare Integers #

CMP r/m8,reg8                 ; 38 /r                [8086]
CMP r/m16,reg16               ; o16 39 /r            [8086]
CMP r/m32,reg32               ; o32 39 /r            [386]

CMP reg8,r/m8                 ; 3A /r                [8086]
CMP reg16,r/m16               ; o16 3B /r            [8086]
CMP reg32,r/m32               ; o32 3B /r            [386]

CMP r/m8,imm8                 ; 80 /7 ib             [8086]
CMP r/m16,imm16               ; o16 81 /7 iw         [8086]
CMP r/m32,imm32               ; o32 81 /7 id         [386]

CMP r/m16,imm8                ; o16 83 /7 ib         [8086]
CMP r/m32,imm8                ; o32 83 /7 ib         [386]

CMP AL,imm8                   ; 3C ib                [8086]
CMP AX,imm16                  ; o16 3D iw            [8086]
CMP EAX,imm32                 ; o32 3D id            [386]

CMP performs a ‘mental’ subtraction of its second operand from its first operand, and affects the flags as if the subtraction had taken place, but does not store the result of the subtraction anywhere. (For subtraction that does store the result, see section A.5.305.)

The destination operand can be a register or a memory location. The source can be a register, memory location or an immediate value of the same size as the destination.

A.5.25 `CMPccPD`: Packed Double-Precision FP Compare #

CMPPD xmm1,xmm2/mem128,imm8   ; 66 0F C2 /r ib  [WILLAMETTE,SSE2]

CMPEQPD xmm1,xmm2/mem128      ; 66 0F C2 /r 00  [WILLAMETTE,SSE2]
CMPLTPD xmm1,xmm2/mem128      ; 66 0F C2 /r 01  [WILLAMETTE,SSE2]
CMPLEPD xmm1,xmm2/mem128      ; 66 0F C2 /r 02  [WILLAMETTE,SSE2]
CMPUNORDPD xmm1,xmm2/mem128   ; 66 0F C2 /r 03  [WILLAMETTE,SSE2]
CMPNEQPD xmm1,xmm2/mem128     ; 66 0F C2 /r 04  [WILLAMETTE,SSE2]
CMPNLTPD xmm1,xmm2/mem128     ; 66 0F C2 /r 05  [WILLAMETTE,SSE2]
CMPNLEPD xmm1,xmm2/mem128     ; 66 0F C2 /r 06  [WILLAMETTE,SSE2]
CMPORDPD xmm1,xmm2/mem128     ; 66 0F C2 /r 07  [WILLAMETTE,SSE2]

The CMPccPD instructions compare the two packed double-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a quadword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

The third operand is an 8-bit immediate value, of which the low 3 bits define the type of comparison. For ease of programming, the 8 two-operand pseudo-instructions are provided, with the third operand already filled in. The Condition Predicates are:

EQ     0   Equal
LT     1   Less-than
LE     2   Less-than-or-equal
UNORD  3   Unordered
NE     4   Not-equal
NLT    5   Not-less-than
NLE    6   Not-less-than-or-equal
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.5.26 `CMPccPS`: Packed Single-Precision FP Compare #

CMPPS xmm1,xmm2/mem128,imm8   ; 0F C2 /r ib     [KATMAI,SSE]

CMPEQPS xmm1,xmm2/mem128      ; 0F C2 /r 00     [KATMAI,SSE]
CMPLTPS xmm1,xmm2/mem128      ; 0F C2 /r 01     [KATMAI,SSE]
CMPLEPS xmm1,xmm2/mem128      ; 0F C2 /r 02     [KATMAI,SSE]
CMPUNORDPS xmm1,xmm2/mem128   ; 0F C2 /r 03     [KATMAI,SSE]
CMPNEQPS xmm1,xmm2/mem128     ; 0F C2 /r 04     [KATMAI,SSE]
CMPNLTPS xmm1,xmm2/mem128     ; 0F C2 /r 05     [KATMAI,SSE]
CMPNLEPS xmm1,xmm2/mem128     ; 0F C2 /r 06     [KATMAI,SSE]
CMPORDPS xmm1,xmm2/mem128     ; 0F C2 /r 07     [KATMAI,SSE]

The CMPccPS instructions compare the two packed single-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a doubleword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

EQ     0   Equal
LT     1   Less-than
LE     2   Less-than-or-equal
UNORD  3   Unordered
NE     4   Not-equal
NLT    5   Not-less-than
NLE    6   Not-less-than-or-equal
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.5.27 `CMPSB`, `CMPSW`, `CMPSD`: Compare Strings #

CMPSB                         ; A6                   [8086]
CMPSW                         ; o16 A7               [8086]
CMPSD                         ; o32 A7               [386]

CMPSB compares the byte at [DS:SI] or [DS:ESI] with the byte at [ES:DI] or [ES:EDI], and sets the flags accordingly. It then increments or decrements (depending on the direction flag: increments if the flag is clear, decrements if it is set) SI and DI (or ESI and EDI).

The registers used are SI and DI if the address size is 16 bits, and ESI and EDI if it is 32 bits. If you need to use an address size not equal to the current BITS setting, you can use an explicit a16 or a32 prefix.

The segment register used to load from [SI] or [ESI] can be overridden by using a segment register name as a prefix (for example, ES CMPSB). The use of ES for the load from [DI] or [EDI] cannot be overridden.

CMPSW and CMPSD work in the same way, but they compare a word or a doubleword instead of a byte, and increment or decrement the addressing registers by 2 or 4 instead of 1.

The REPE and REPNE prefixes (equivalently, REPZ and REPNZ) may be used to repeat the instruction up to CX (or ECX - again, the address size chooses which) times until the first unequal or equal element is found. To NASM, REP is an alias for REPE.

A.5.27.1 Pseudo-code examples #

a16 CMPSB without segment override and with Direction Flag clear (UP) is equal to

CMP BYTE [SI], BYTE [ES:DI]
LEA SI, [SI + 1]
LEA DI, [DI + 1]

a16 REPE CMPSW without segment override and with Direction Flag clear (UP) is equal to

JCXZ @FF
@@:
CMP WORD [SI], WORD [ES:DI]
LEA SI, [SI + 2]
LEA DI, [DI + 2]
a16 LOOPE @B
@@:

a32 ES CMPSD with Direction Flag set (DN) is equal to

CMP DWORD [ES:ESI], DWORD [ES:EDI]
LEA ESI, [ESI - 4]
LEA EDI, [EDI - 4]

A.5.28 `CMPccSD`: Scalar Double-Precision FP Compare #

CMPSD xmm1,xmm2/mem64,imm8    ; F2 0F C2 /r ib  [WILLAMETTE,SSE2]

CMPEQSD xmm1,xmm2/mem64       ; F2 0F C2 /r 00  [WILLAMETTE,SSE2]
CMPLTSD xmm1,xmm2/mem64       ; F2 0F C2 /r 01  [WILLAMETTE,SSE2]
CMPLESD xmm1,xmm2/mem64       ; F2 0F C2 /r 02  [WILLAMETTE,SSE2]
CMPUNORDSD xmm1,xmm2/mem64    ; F2 0F C2 /r 03  [WILLAMETTE,SSE2]
CMPNEQSD xmm1,xmm2/mem64      ; F2 0F C2 /r 04  [WILLAMETTE,SSE2]
CMPNLTSD xmm1,xmm2/mem64      ; F2 0F C2 /r 05  [WILLAMETTE,SSE2]
CMPNLESD xmm1,xmm2/mem64      ; F2 0F C2 /r 06  [WILLAMETTE,SSE2]
CMPORDSD xmm1,xmm2/mem64      ; F2 0F C2 /r 07  [WILLAMETTE,SSE2]

The CMPccSD instructions compare the low-order double-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a quadword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

EQ     0   Equal
LT     1   Less-than
LE     2   Less-than-or-equal
UNORD  3   Unordered
NE     4   Not-equal
NLT    5   Not-less-than
NLE    6   Not-less-than-or-equal
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.5.29 `CMPccSS`: Scalar Single-Precision FP Compare #

CMPSS xmm1,xmm2/mem32,imm8    ; F3 0F C2 /r ib  [KATMAI,SSE]

CMPEQSS xmm1,xmm2/mem32       ; F3 0F C2 /r 00  [KATMAI,SSE]
CMPLTSS xmm1,xmm2/mem32       ; F3 0F C2 /r 01  [KATMAI,SSE]
CMPLESS xmm1,xmm2/mem32       ; F3 0F C2 /r 02  [KATMAI,SSE]
CMPUNORDSS xmm1,xmm2/mem32    ; F3 0F C2 /r 03  [KATMAI,SSE]
CMPNEQSS xmm1,xmm2/mem32      ; F3 0F C2 /r 04  [KATMAI,SSE]
CMPNLTSS xmm1,xmm2/mem32      ; F3 0F C2 /r 05  [KATMAI,SSE]
CMPNLESS xmm1,xmm2/mem32      ; F3 0F C2 /r 06  [KATMAI,SSE]
CMPORDSS xmm1,xmm2/mem32      ; F3 0F C2 /r 07  [KATMAI,SSE]

The CMPccSS instructions compare the low-order single-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a doubleword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

EQ     0   Equal
LT     1   Less-than
LE     2   Less-than-or-equal
UNORD  3   Unordered
NE     4   Not-equal
NLT    5   Not-less-than
NLE    6   Not-less-than-or-equal
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.5.30 `CMPXCHG`, `CMPXCHG486`: Compare and Exchange #

CMPXCHG r/m8,reg8             ; 0F B0 /r             [PENT]
CMPXCHG r/m16,reg16           ; o16 0F B1 /r         [PENT]
CMPXCHG r/m32,reg32           ; o32 0F B1 /r         [PENT]

CMPXCHG486 r/m8,reg8          ; 0F A6 /r             [486,UNDOC]
CMPXCHG486 r/m16,reg16        ; o16 0F A7 /r         [486,UNDOC]
CMPXCHG486 r/m32,reg32        ; o32 0F A7 /r         [486,UNDOC]

These two instructions perform exactly the same operation; however, apparently some (not all) 486 processors support it under a non-standard opcode, so NASM provides the undocumented CMPXCHG486 form to generate the non-standard opcode.

CMPXCHG compares its destination (first) operand to the value in AL, AX or EAX (depending on the operand size of the instruction). If they are equal, it copies its source (second) operand into the destination and sets the zero flag. Otherwise, it clears the zero flag and copies the destination register to AL, AX or EAX.

The destination can be either a register or a memory location. The source is a register.

CMPXCHG is intended to be used for atomic operations in multitasking or multiprocessor environments. To safely update a value in shared memory, for example, you might load the value into EAX, load the updated value into EBX, and then execute the instruction LOCK CMPXCHG [value],EBX. If value has not changed since being loaded, it is updated with your desired new value, and the zero flag is set to let you know it has worked. (The LOCK prefix prevents another processor doing anything in the middle of this operation: it guarantees atomicity.) However, if another processor has modified the value in between your load and your attempted store, the store does not happen, and you are notified of the failure by a cleared zero flag, so you can go round and try again.

A.5.31 `CMPXCHG8B`: Compare and Exchange Eight Bytes #

CMPXCHG8B mem                 ; 0F C7 /1             [PENT]

This is a larger and more unwieldy version of CMPXCHG: it compares the 64-bit (eight-byte) value stored at [mem] with the value in EDX:EAX. If they are equal, it sets the zero flag and stores ECX:EBX into the memory area. If they are unequal, it clears the zero flag and stores the memory contents into EDX:EAX.

CMPXCHG8B can be used with the LOCK prefix, to allow atomic execution. This is useful in multi-processor and multi-tasking environments.

A.5.32 `COMISD`: Scalar Ordered Double-Precision FP Compare and Set EFLAGS #

COMISD xmm1,xmm2/mem64        ; 66 0F 2F /r     [WILLAMETTE,SSE2]

COMISD compares the low-order double-precision FP value in the two source operands. ZF, PF and CF are set according to the result. OF, AF and AF are cleared. The unordered result is returned if either source is a NaN (QNaN or SNaN).

The destination operand is an XMM register. The source can be either an XMM register or a memory location.

The flags are set according to the following rules:

   Result          Flags        Values

   UNORDERED:      ZF,PF,CF <-- 111;
   GREATER_THAN:   ZF,PF,CF <-- 000;
   LESS_THAN:      ZF,PF,CF <-- 001;
   EQUAL:          ZF,PF,CF <-- 100;

A.5.33 `COMISS`: Scalar Ordered Single-Precision FP Compare and Set EFLAGS #

COMISS xmm1,xmm2/mem32        ; 66 0F 2F /r     [KATMAI,SSE]

COMISS compares the low-order single-precision FP value in the two source operands. ZF, PF and CF are set according to the result. OF, AF and AF are cleared. The unordered result is returned if either source is a NaN (QNaN or SNaN).

The destination operand is an XMM register. The source can be either an XMM register or a memory location.

The flags are set according to the following rules:

   Result          Flags        Values

   UNORDERED:      ZF,PF,CF <-- 111;
   GREATER_THAN:   ZF,PF,CF <-- 000;
   LESS_THAN:      ZF,PF,CF <-- 001;
   EQUAL:          ZF,PF,CF <-- 100;

A.5.34 `CPUID`: Get CPU Identification Code #

CPUID                         ; 0F A2                [PENT]

CPUID returns various information about the processor it is being executed on. It fills the four registers EAX, EBX, ECX and EDX with information, which varies depending on the input contents of EAX.

CPUID also acts as a barrier to serialize instruction execution: executing the CPUID instruction guarantees that all the effects (memory modification, flag modification, register modification) of previous instructions have been completed before the next instruction gets fetched.

The information returned is as follows:

If EAX is zero on input, EAX on output holds the maximum acceptable input value of EAX, and EBX:EDX:ECX contain the string ‘GenuineIntel’ (or not, if you have a clone processor). That is to say, EBX contains ‘Genu’ (in NASM's own sense of character constants), EDX contains ‘ineI’ and ECX contains ‘ntel’.
If EAX is one on input, EAX on output contains version information about the processor, and EDX contains a set of feature flags, showing the presence and absence of various features. For example, bit 8 is set if the CMPXCHG8B instruction (section A.5.31) is supported, bit 15 is set if the conditional move instructions (section A.5.23 and section A.5.72) are supported, and bit 23 is set if MMX instructions are supported.
If EAX is two on input, EAX, EBX, ECX and EDX all contain information about caches and TLBs (Translation Lookahead Buffers).

For more information on the data returned from CPUID, see the documentation from Intel and other processor manufacturers.

A.5.35 `CVTDQ2PD`: Packed Signed INT32 to Packed Double-Precision FP Conversion #

CVTDQ2PD xmm1,xmm2/mem64      ; F3 0F E6 /r     [WILLAMETTE,SSE2]

CVTDQ2PD converts two packed signed doublewords from the source operand to two packed double-precision FP values in the destination operand.

The destination operand is an XMM register. The source can be either an XMM register or a 64-bit memory location. If the source is a register, the packed integers are in the low quadword.

A.5.36 `CVTDQ2PS`: Packed Signed INT32 to Packed Single-Precision FP Conversion #

CVTDQ2PS xmm1,xmm2/mem128     ; 0F 5B /r        [WILLAMETTE,SSE2]

CVTDQ2PS converts four packed signed doublewords from the source operand to four packed single-precision FP values in the destination operand.

The destination operand is an XMM register. The source can be either an XMM register or a 128-bit memory location.