Nasm Instruction Set Reference

This is derived from the old, obsolete, and potentially buggy instruction set reference from the old Nasm Manual. The Nasm development team explicitly disclaims any responsibility for errors and omissions in this document!

Contents | Index

Appendix A: x86 Instruction Reference

This appendix provides a complete list of the machine instructions which NASM will assemble, and a short description of the function of each one.

It is not intended to be an exhaustive documentation on the fine details of the instructions' function, such as which exceptions they can trigger: for such documentation, you should go to Intel's Web site, http://developer.intel.com/design/Pentium4/manuals/.

Instead, this appendix is intended primarily to provide documentation on the way the instructions may be used within NASM. For example, looking up LOOP will tell you that NASM allows CX or ECX to be specified as an optional second argument to the LOOP instruction, to enforce which of the two possible counter registers should be used if the default is not the one desired.

The instructions are not quite listed in alphabetical order, since groups of instructions with similar functions are lumped together in the same entry. Most of them don't move very far from their alphabetic position because of this.

A.1 Key to Operand Specifications

The instruction descriptions in this appendix specify their operands using the following notation:

Registers: reg8 denotes an 8-bit general purpose register, reg16 denotes a 16-bit general purpose register, reg32 a 32-bit one and reg64 a 64-bit one. fpureg denotes one of the eight FPU stack registers, mmxreg denotes one of the eight 64-bit MMX registers, and segreg denotes a segment register. xmmreg denotes one of the 8, or 16 in x64 long mode, SSE XMM registers. In addition, some registers (such as AL, DX, ECX or RAX) may be specified explicitly.
Immediate operands: imm denotes a generic immediate operand. imm8, imm16 and imm32 are used when the operand is intended to be a specific size. For some of these instructions, NASM needs an explicit specifier: for example, ADD ESP,16 could be interpreted as either ADD r/m32,imm32 or ADD r/m32,imm8. NASM chooses the former by default, and so you must specify ADD ESP,BYTE 16 for the latter. There is a special case of the allowance of an imm64 for particular x64 versions of the MOV instruction.
Memory references: mem denotes a generic memory reference; mem8, mem16, mem32, mem64 and mem80 are used when the operand needs to be a specific size. Again, a specifier is needed in some cases: DEC [address] is ambiguous and will be rejected by NASM. You must specify DEC BYTE [address], DEC WORD [address] or DEC DWORD [address] instead.
Restricted memory references: one form of the MOV instruction allows a memory address to be specified without allowing the normal range of register combinations and effective address processing. This is denoted by memoffs8, memoffs16, memoffs32 or memoffs64.
Register or memory choices: many instructions can accept either a register or a memory reference as an operand. r/m8 is shorthand for reg8/mem8; similarly r/m16 and r/m32. On legacy x86 modes, r/m64 is MMX-related, and is shorthand for mmxreg/mem64. When utilizing the x86-64 architecture extension, r/m64 denotes use of a 64-bit GPR as well, and is shorthand for reg64/mem64.

A.2 Key to Opcode Descriptions

This appendix also provides the opcodes which NASM will generate for each form of each instruction. The opcodes are listed in the following way:

A hex number, such as 3F, indicates a fixed byte containing that number.
A hex number followed by +r, such as C8+r, indicates that one of the operands to the instruction is a register, and the `register value' of that register should be added to the hex number to produce the generated byte. For example, EDX has register value 2, so the code C8+r, when the register operand is EDX, generates the hex byte CA. Register values for specific registers are given in section A.2.1.
A hex number followed by +cc, such as 40+cc, indicates that the instruction name has a condition code suffix, and the numeric representation of the condition code should be added to the hex number to produce the generated byte. For example, the code 40+cc, when the instruction contains the NE condition, generates the hex byte 45. Condition codes and their numeric representations are given in section A.2.2.
A slash followed by a digit, such as /2, indicates that one of the operands to the instruction is a memory address or register (denoted mem or r/m, with an optional size). This is to be encoded as an effective address, with a ModR/M byte, an optional SIB byte, and an optional displacement, and the spare (register) field of the ModR/M byte should be the digit given (which will be from 0 to 7, so it fits in three bits). The encoding of effective addresses is given in section A.2.5.
The code /r combines the above two: it indicates that one of the operands is a memory address or r/m, and another is a register, and that an effective address should be generated with the spare (register) field in the ModR/M byte being equal to the `register value' of the register operand. The encoding of effective addresses is given in section A.2.5; register values are given in section A.2.1.
The codes ib, iw and id indicate that one of the operands to the instruction is an immediate value, and that this is to be encoded as a byte, little-endian word or little-endian doubleword respectively.
The codes rb, rw and rd indicate that one of the operands to the instruction is an immediate value, and that the difference between this value and the address of the end of the instruction is to be encoded as a byte, word or doubleword respectively. Where the form rw/rd appears, it indicates that either rw or rd should be used according to whether assembly is being performed in BITS 16 or BITS 32 state respectively.
The codes ow and od indicate that one of the operands to the instruction is a reference to the contents of a memory address specified as an immediate value: this encoding is used in some forms of the MOV instruction in place of the standard effective-address mechanism. The displacement is encoded as a word or doubleword. Again, ow/od denotes that ow or od should be chosen according to the BITS setting.
The codes o16 and o32 indicate that the given form of the instruction should be assembled with operand size 16 or 32 bits. In other words, o16 indicates a 66 prefix in BITS 32 state, but generates no code in BITS 16 state; and o32 indicates a 66 prefix in BITS 16 state but generates nothing in BITS 32.
The codes a16 and a32, similarly to o16 and o32, indicate the address size of the given form of the instruction. Where this does not match the BITS setting, a 67 prefix is required. Please note that a16 is useless in long mode as 16-bit addressing is depreciated on the x86-64 architecture extension.

A.2.1 Register Values

Where an instruction requires a register value, it is already implicit in the encoding of the rest of the instruction what type of register is intended: an 8-bit general-purpose register, a segment register, a debug register, an MMX register, or whatever. Therefore there is no problem with registers of different types sharing an encoding value.

Please note that for the register classes listed below, the register extensions (REX) classes require the use of the REX prefix, in which is only available when in long mode on the x86-64 processor. This pretty much goes for any register that has a number higher than 7.

The encodings for the various classes of register are:

8-bit general registers: AL is 0, CL is 1, DL is 2, BL is 3, AH is 4, CH is 5, DH is 6 and BH is 7. Please note that AH, BH, CH and DH are not addressable when using the REX prefix in long mode.
8-bit general register extensions (REX): SPL is 4, BPL is 5, SIL is 6, DIL is 7, R8B is 8, R9B is 9, R10B is 10, R11B is 11, R12B is 12, R13B is 13, R14B is 14 and R15B is 15.
16-bit general registers: AX is 0, CX is 1, DX is 2, BX is 3, SP is 4, BP is 5, SI is 6, and DI is 7.
16-bit general register extensions (REX): R8W is 8, R9W is 9, R10w is 10, R11W is 11, R12W is 12, R13W is 13, R14W is 14 and R15W is 15.
32-bit general registers: EAX is 0, ECX is 1, EDX is 2, EBX is 3, ESP is 4, EBP is 5, ESI is 6, and EDI is 7.
32-bit general register extensions (REX): R8D is 8, R9D is 9, R10D is 10, R11D is 11, R12D is 12, R13D is 13, R14D is 14 and R15D is 15.
64-bit general register extensions (REX): RAX is 0, RCX is 1, RDX is 2, RBX is 3, RSP is 4, RBP is 5, RSI is 6, RDI is 7, R8 is 8, R9 is 9, R10 is 10, R11 is 11, R12 is 12, R13 is 13, R14 is 14 and R15 is 15.
Segment registers: ES is 0, CS is 1, SS is 2, DS is 3, FS is 4, and GS is 5.
Floating-point registers: ST0 is 0, ST1 is 1, ST2 is 2, ST3 is 3, ST4 is 4, ST5 is 5, ST6 is 6, and ST7 is 7.
64-bit MMX registers: MM0 is 0, MM1 is 1, MM2 is 2, MM3 is 3, MM4 is 4, MM5 is 5, MM6 is 6, and MM7 is 7.
128-bit XMM (SSE) registers: XMM0 is 0, XMM1 is 1, XMM2 is 2, XMM3 is 3, XMM4 is 4, XMM5 is 5, XMM6 is 6 and XMM7 is 7.
128-bit XMM (SSE) register extensions (REX): XMM8 is 8, XMM9 is 9, XMM10 is 10, XMM11 is 11, XMM12 is 12, XMM13 is 13, XMM14 is 14 and XMM15 is 15.
Control registers: CR0 is 0, CR2 is 2, CR3 is 3, and CR4 is 4.
Control register extensions: CR8 is 8.
Debug registers: DR0 is 0, DR1 is 1, DR2 is 2, DR3 is 3, DR6 is 6, and DR7 is 7.
Test registers: TR3 is 3, TR4 is 4, TR5 is 5, TR6 is 6, and TR7 is 7.

(Note that wherever a register name contains a number, that number is also the register value for that register.)

A.2.2 Condition Codes

The available condition codes are given here, along with their numeric representations as part of opcodes. Many of these condition codes have synonyms, so several will be listed at a time.

In the following descriptions, the word `either', when applied to two possible trigger conditions, is used to mean `either or both'. If `either but not both' is meant, the phrase `exactly one of' is used.

O is 0 (trigger if the overflow flag is set); NO is 1.
B, C and NAE are 2 (trigger if the carry flag is set); AE, NB and NC are 3.
E and Z are 4 (trigger if the zero flag is set); NE and NZ are 5.
BE and NA are 6 (trigger if either of the carry or zero flags is set); A and NBE are 7.
S is 8 (trigger if the sign flag is set); NS is 9.
P and PE are 10 (trigger if the parity flag is set); NP and PO are 11.
L and NGE are 12 (trigger if exactly one of the sign and overflow flags is set); GE and NL are 13.
LE and NG are 14 (trigger if either the zero flag is set, or exactly one of the sign and overflow flags is set); G and NLE are 15.

Note that in all cases, the sense of a condition code may be reversed by changing the low bit of the numeric representation.

For details of when an instruction sets each of the status flags, see the individual instruction, plus the Status Flags reference in section A.2.4

A.2.3 SSE Condition Predicates

The condition predicates for SSE comparison instructions are the codes used as part of the opcode, to determine what form of comparison is being carried out. In each case, the imm8 value is the final byte of the opcode encoding, and the predicate is the code used as part of the mnemonic for the instruction (equivalent to the "cc" in an integer instruction that used a condition code). The instructions that use this will give details of what the various mnemonics are, this table is used to help you work out details of what is happening.

Predi-  imm8  Description Relation where:   Emula- Result   QNaN 
 cate  Encod-             A Is 1st Operand  tion   if NaN   Signal 
        ing               B Is 2nd Operand         Operand  Invalid 

EQ     000B   equal       A = B                    False     No 

LT     001B   less-than   A < B                    False     Yes 

LE     010B   less-than-  A <= B                   False     Yes 
               or-equal 

---    ----   greater     A > B             Swap   False     Yes 
              than                          Operands, 
                                            Use LT 

---    ----   greater-    A >= B            Swap   False     Yes 
              than-or-equal                 Operands, 
                                            Use LE 

UNORD  011B   unordered   A, B = Unordered         True      No 

NEQ    100B   not-equal   A != B                   True      No 

NLT    101B   not-less-   NOT(A < B)               True      Yes 
              than 

NLE    110B   not-less-   NOT(A <= B)              True      Yes 
              than-or- 
              equal 

---    ----   not-greater NOT(A > B)        Swap   True      Yes 
              than                          Operands, 
                                            Use NLT 

---    ----   not-greater NOT(A >= B)       Swap   True      Yes 
              than-                         Operands, 
              or-equal                      Use NLE 

ORD    111B   ordered      A , B = Ordered         False     No

The unordered relationship is true when at least one of the two values being compared is a NaN or in an unsupported format.

Note that the comparisons which are listed as not having a predicate or encoding can only be achieved through software emulation, as described in the "emulation" column. Note in particular that an instruction such as greater-than is not the same as NLE, as, unlike with the CMP instruction, it has to take into account the possibility of one operand containing a NaN or an unsupported numeric format.

A.2.4 Status Flags

The status flags provide some information about the result of the arithmetic instructions. This information can be used by conditional instructions (such a Jcc and CMOVcc) as well as by some of the other instructions (such as ADC and INTO).

There are 6 status flags:

CF - Carry flag.

Set if an arithmetic operation generates a carry or a borrow out of the most-significant bit of the result; cleared otherwise. This flag indicates an overflow condition for unsigned-integer arithmetic. It is also used in multiple-precision arithmetic.

PF - Parity flag.

Set if the least-significant byte of the result contains an even number of 1 bits; cleared otherwise.

AF - Adjust flag.

Set if an arithmetic operation generates a carry or a borrow out of bit 3 of the result; cleared otherwise. This flag is used in binary-coded decimal (BCD) arithmetic.

ZF - Zero flag.

Set if the result is zero; cleared otherwise.

SF - Sign flag.

Set equal to the most-significant bit of the result, which is the sign bit of a signed integer. (0 indicates a positive value and 1 indicates a negative value.)

OF - Overflow flag.

Set if the integer result is too large a positive number or too small a negative number (excluding the sign-bit) to fit in the destination operand; cleared otherwise. This flag indicates an overflow condition for signed-integer (two's complement) arithmetic.

A.2.5 Effective Address Encoding: ModR/M and SIB

An effective address is encoded in up to three parts: a ModR/M byte, an optional SIB byte, and an optional byte, word or doubleword displacement field.

The ModR/M byte consists of three fields: the mod field, ranging from 0 to 3, in the upper two bits of the byte, the r/m field, ranging from 0 to 7, in the lower three bits, and the spare (register) field in the middle (bit 3 to bit 5). The spare field is not relevant to the effective address being encoded, and either contains an extension to the instruction opcode or the register value of another operand.

The ModR/M system can be used to encode a direct register reference rather than a memory access. This is always done by setting the mod field to 3 and the r/m field to the register value of the register in question (it must be a general-purpose register, and the size of the register must already be implicit in the encoding of the rest of the instruction). In this case, the SIB byte and displacement field are both absent.

In 16-bit addressing mode (either BITS 16 with no 67 prefix, or BITS 32 with a 67 prefix), the SIB byte is never used. The general rules for mod and r/m (there is an exception, given below) are:

The mod field gives the length of the displacement field: 0 means no displacement, 1 means one byte, and 2 means two bytes.
The r/m field encodes the combination of registers to be added to the displacement to give the accessed address: 0 means BX+SI, 1 means BX+DI, 2 means BP+SI, 3 means BP+DI, 4 means SI only, 5 means DI only, 6 means BP only, and 7 means BX only.

However, there is a special case:

If mod is 0 and r/m is 6, the effective address encoded is not [BP] as the above rules would suggest, but instead [disp16]: the displacement field is present and is two bytes long, and no registers are added to the displacement.

Therefore the effective address [BP] cannot be encoded as efficiently as [BX]; so if you code [BP] in a program, NASM adds a notional 8-bit zero displacement, and sets mod to 1, r/m to 6, and the one-byte displacement field to 0.

In 32-bit addressing mode (either BITS 16 with a 67 prefix, or BITS 32 with no 67 prefix) the general rules (again, there are exceptions) for mod and r/m are:

The mod field gives the length of the displacement field: 0 means no displacement, 1 means one byte, and 2 means four bytes.
If only one register is to be added to the displacement, and it is not ESP, the r/m field gives its register value, and the SIB byte is absent. If the r/m field is 4 (which would encode ESP), the SIB byte is present and gives the combination and scaling of registers to be added to the displacement.

If the SIB byte is present, it describes the combination of registers (an optional base register, and an optional index register scaled by multiplication by 1, 2, 4 or 8) to be added to the displacement. The SIB byte is divided into the scale field, in the top two bits, the index field in the next three, and the base field in the bottom three. The general rules are:

The base field encodes the register value of the base register.
The index field encodes the register value of the index register, unless it is 4, in which case no index register is used (so ESP cannot be used as an index register).
The scale field encodes the multiplier by which the index register is scaled before adding it to the base and displacement: 0 encodes a multiplier of 1, 1 encodes 2, 2 encodes 4 and 3 encodes 8.

The exceptions to the 32-bit encoding rules are:

If mod is 0 and r/m is 5, the effective address encoded is not [EBP] as the above rules would suggest, but instead [disp32]: the displacement field is present and is four bytes long, and no registers are added to the displacement.
If mod is 0, r/m is 4 (meaning the SIB byte is present) and base is 5, the effective address encoded is not [EBP+index] as the above rules would suggest, but instead [disp32+index]: the displacement field is present and is four bytes long, and there is no base register (but the index register is still processed in the normal way).

A.2.6 Register Extensions: The REX Prefix

The Register Extensions, or REX for short, prefix is the means of accessing extended registers on the x86-64 architecture. REX is considered an instruction prefix, but is required to be after all other prefixes and thus immediately before the first instruction opcode itself. So overall, REX can be thought of as an "Opcode Prefix" instead. The REX prefix itself is indicated by a value of 0x4X, where X is one of 16 different combinations of the actual REX flags.

The REX prefix flags consist of four 1-bit extensions fields. These flags are found in the lower nibble of the actual REX prefix opcode. Below is the list of REX prefix flags, from high bit to low bit.

REX.W: When set, this flag indicates the use of a 64-bit operand, as opposed to the default of using 32-bit operands as found in 32-bit Protected Mode.

REX.R: When set, this flag extends the reg (spare) field of the ModRM byte. Overall, this raises the amount of addressable registers in this field from 8 to 16.

REX.X: When set, this flag extends the index field of the SIB byte. Overall, this raises the amount of addressable registers in this field from 8 to 16.

REX.B: When set, this flag extends the r/m field of the ModRM byte. This flag can also represent an extension to the opcode register (/r) field. The determination of which is used varies depending on which instruction is used. Overall, this raises the amount of addressable registers in these fields from 8 to 16.

Interal use of the REX prefix by the processor is consistent, yet non-trivial. Most instructions use the REX prefix as indicated by the above flags. Some instructions require the REX prefix to be present even if the flags are empty. Some instructions default to a 64-bit operand and require the REX prefix only for actual register extensions, and thus ignores the REX.W field completely.

At any rate, NASM is designed to handle, and fully supports, the REX prefix internally. Please read the appropriate processor documentation for further information on the REX prefix.

You may have noticed that opcodes 0x40 through 0x4F are actually opcodes for the INC/DEC instructions for each General Purpose Register. This is, of course, correct... for legacy x86. While in long mode, opcodes 0x40 through 0x4F are reserved for use as the REX prefix. The other opcode forms of the INC/DEC instructions are used instead.

A.3 Key to Instruction Flags

Given along with each instruction in this appendix is a set of flags, denoting the type of the instruction. The types are as follows:

8086, 186, 286, 386, 486, PENT and P6 denote the lowest processor type that supports the instruction. Most instructions run on all processors above the given type; those that do not are documented. The Pentium II contains no additional instructions beyond the P6 (Pentium Pro); from the point of view of its instruction set, it can be thought of as a P6 with MMX capability.
3DNOW indicates that the instruction is a 3DNow! one, and will run on the AMD K6-2 and later processors. ATHLON extensions to the 3DNow! instruction set are documented as such.
CYRIX indicates that the instruction is specific to Cyrix processors, for example the extra MMX instructions in the Cyrix extended MMX instruction set.
FPU indicates that the instruction is a floating-point one, and will only run on machines with a coprocessor (automatically including 486DX, Pentium and above).
KATMAI indicates that the instruction was introduced as part of the Katmai New Instruction set. These instructions are available on the Pentium III and later processors. Those which are not specifically SSE instructions are also available on the AMD Athlon.
MMX indicates that the instruction is an MMX one, and will run on MMX-capable Pentium processors and the Pentium II.
PRIV indicates that the instruction is a protected-mode management instruction. Many of these may only be used in protected mode, or only at privilege level zero.
SSE and SSE2 indicate that the instruction is a Streaming SIMD Extension instruction. These instructions operate on multiple values in a single operation. SSE was introduced with the Pentium III and SSE2 was introduced with the Pentium 4.
UNDOC indicates that the instruction is an undocumented one, and not part of the official Intel Architecture; it may or may not be supported on any given machine.
WILLAMETTE indicates that the instruction was introduced as part of the new instruction set in the Pentium 4 and Intel Xeon processors. These instructions are also known as SSE2 instructions.
X64 indicates that the instruction was introduced as part of the new instruction set in the x86-64 architecture extension, commonly referred to as x64, AMD64 or EM64T.

A.4 x86 Instruction Set

A.4.1 `AAA`, `AAS`, `AAM`, `AAD`: ASCII Adjustments

AAA                           ; 37                   [8086]

AAS                           ; 3F                   [8086]

AAD                           ; D5 0A                [8086] 
AAD imm                       ; D5 ib                [8086]

AAM                           ; D4 0A                [8086] 
AAM imm                       ; D4 ib                [8086]

These instructions are used in conjunction with the add, subtract, multiply and divide instructions to perform binary-coded decimal arithmetic in unpacked (one BCD digit per byte - easy to translate to and from ASCII, hence the instruction names) form. There are also packed BCD instructions DAA and DAS: see section A.4.57.

AAA (ASCII Adjust After Addition) should be used after a one-byte ADD instruction whose destination was the AL register: by means of examining the value in the low nibble of AL and also the auxiliary carry flag AF, it determines whether the addition has overflowed, and adjusts it (and sets the carry flag) if so. You can add long BCD strings together by doing ADD/AAA on the low digits, then doing ADC/AAA on each subsequent digit.
AAS (ASCII Adjust AL After Subtraction) works similarly to AAA, but is for use after SUB instructions rather than ADD.
AAM (ASCII Adjust AX After Multiply) is for use after you have multiplied two decimal digits together and left the result in AL: it divides AL by ten and stores the quotient in AH, leaving the remainder in AL. The divisor 10 can be changed by specifying an operand to the instruction: a particularly handy use of this is AAM 16, causing the two nibbles in AL to be separated into AH and AL.
AAD (ASCII Adjust AX Before Division) performs the inverse operation to AAM: it multiplies AH by ten, adds it to AL, and sets AH to zero. Again, the multiplier 10 can be changed.

A.4.2 `ADC`: Add with Carry

ADC r/m8,reg8                 ; 10 /r                [8086] 
ADC r/m16,reg16               ; o16 11 /r            [8086] 
ADC r/m32,reg32               ; o32 11 /r            [386]

ADC reg8,r/m8                 ; 12 /r                [8086] 
ADC reg16,r/m16               ; o16 13 /r            [8086] 
ADC reg32,r/m32               ; o32 13 /r            [386]

ADC r/m8,imm8                 ; 80 /2 ib             [8086] 
ADC r/m16,imm16               ; o16 81 /2 iw         [8086] 
ADC r/m32,imm32               ; o32 81 /2 id         [386]

ADC r/m16,imm8                ; o16 83 /2 ib         [8086] 
ADC r/m32,imm8                ; o32 83 /2 ib         [386]

ADC AL,imm8                   ; 14 ib                [8086] 
ADC AX,imm16                  ; o16 15 iw            [8086] 
ADC EAX,imm32                 ; o32 15 id            [386]

ADC performs integer addition: it adds its two operands together, plus the value of the carry flag, and leaves the result in its destination (first) operand. The destination operand can be a register or a memory location. The source operand can be a register, a memory location or an immediate value.

The flags are set according to the result of the operation: in particular, the carry flag is affected and can be used by a subsequent ADC instruction.

In the forms with an 8-bit immediate second operand and a longer first operand, the second operand is considered to be signed, and is sign-extended to the length of the first operand. In these cases, the BYTE qualifier is necessary to force NASM to generate this form of the instruction.

To add two numbers without also adding the contents of the carry flag, use ADD (section A.4.3).

A.4.3 `ADD`: Add Integers

ADD r/m8,reg8                 ; 00 /r                [8086] 
ADD r/m16,reg16               ; o16 01 /r            [8086] 
ADD r/m32,reg32               ; o32 01 /r            [386]

ADD reg8,r/m8                 ; 02 /r                [8086] 
ADD reg16,r/m16               ; o16 03 /r            [8086] 
ADD reg32,r/m32               ; o32 03 /r            [386]

ADD r/m8,imm8                 ; 80 /7 ib             [8086] 
ADD r/m16,imm16               ; o16 81 /7 iw         [8086] 
ADD r/m32,imm32               ; o32 81 /7 id         [386]

ADD r/m16,imm8                ; o16 83 /7 ib         [8086] 
ADD r/m32,imm8                ; o32 83 /7 ib         [386]

ADD AL,imm8                   ; 04 ib                [8086] 
ADD AX,imm16                  ; o16 05 iw            [8086] 
ADD EAX,imm32                 ; o32 05 id            [386]

ADD performs integer addition: it adds its two operands together, and leaves the result in its destination (first) operand. The destination operand can be a register or a memory location. The source operand can be a register, a memory location or an immediate value.

The flags are set according to the result of the operation: in particular, the carry flag is affected and can be used by a subsequent ADC instruction.

A.4.4 `ADDPD`: ADD Packed Double-Precision FP Values

ADDPD xmm1,xmm2/mem128        ; 66 0F 58 /r     [WILLAMETTE,SSE2]

ADDPD performs addition on each of two packed double-precision FP value pairs.

   dst[0-63]   := dst[0-63]   + src[0-63], 
   dst[64-127] := dst[64-127] + src[64-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.4.5 `ADDPS`: ADD Packed Single-Precision FP Values

ADDPS xmm1,xmm2/mem128        ; 0F 58 /r        [KATMAI,SSE]

ADDPS performs addition on each of four packed single-precision FP value pairs

   dst[0-31]   := dst[0-31]   + src[0-31], 
   dst[32-63]  := dst[32-63]  + src[32-63], 
   dst[64-95]  := dst[64-95]  + src[64-95], 
   dst[96-127] := dst[96-127] + src[96-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.4.6 `ADDSD`: ADD Scalar Double-Precision FP Values

ADDSD xmm1,xmm2/mem64         ; F2 0F 58 /r     [KATMAI,SSE]

ADDSD adds the low double-precision FP values from the source and destination operands and stores the double-precision FP result in the destination operand.

   dst[0-63]   := dst[0-63] + src[0-63], 
   dst[64-127) remains unchanged.

The destination is an XMM register. The source operand can be either an XMM register or a 64-bit memory location.

A.4.7 `ADDSS`: ADD Scalar Single-Precision FP Values

ADDSS xmm1,xmm2/mem32         ; F3 0F 58 /r     [WILLAMETTE,SSE2]

ADDSS adds the low single-precision FP values from the source and destination operands and stores the single-precision FP result in the destination operand.

   dst[0-31]   := dst[0-31] + src[0-31], 
   dst[32-127] remains unchanged.

The destination is an XMM register. The source operand can be either an XMM register or a 32-bit memory location.

A.4.8 `AND`: Bitwise AND

AND r/m8,reg8                 ; 20 /r                [8086] 
AND r/m16,reg16               ; o16 21 /r            [8086] 
AND r/m32,reg32               ; o32 21 /r            [386]

AND reg8,r/m8                 ; 22 /r                [8086] 
AND reg16,r/m16               ; o16 23 /r            [8086] 
AND reg32,r/m32               ; o32 23 /r            [386]

AND r/m8,imm8                 ; 80 /4 ib             [8086] 
AND r/m16,imm16               ; o16 81 /4 iw         [8086] 
AND r/m32,imm32               ; o32 81 /4 id         [386]

AND r/m16,imm8                ; o16 83 /4 ib         [8086] 
AND r/m32,imm8                ; o32 83 /4 ib         [386]

AND AL,imm8                   ; 24 ib                [8086] 
AND AX,imm16                  ; o16 25 iw            [8086] 
AND EAX,imm32                 ; o32 25 id            [386]

AND performs a bitwise AND operation between its two operands (i.e. each bit of the result is 1 if and only if the corresponding bits of the two inputs were both 1), and stores the result in the destination (first) operand. The destination operand can be a register or a memory location. The source operand can be a register, a memory location or an immediate value.

The MMX instruction PAND (see section A.4.202) performs the same operation on the 64-bit MMX registers.

A.4.9 `ANDNPD`: Bitwise Logical AND NOT of Packed Double-Precision FP Values

ANDNPD xmm1,xmm2/mem128       ; 66 0F 55 /r     [WILLAMETTE,SSE2]

ANDNPD inverts the bits of the two double-precision floating-point values in the destination register, and then performs a logical AND between the two double-precision floating-point values in the source operand and the temporary inverted result, storing the result in the destination register.

   dst[0-63]   := src[0-63]   AND NOT dst[0-63], 
   dst[64-127] := src[64-127] AND NOT dst[64-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.4.10 `ANDNPS`: Bitwise Logical AND NOT of Packed Single-Precision FP Values

ANDNPS xmm1,xmm2/mem128       ; 0F 55 /r        [KATMAI,SSE]

ANDNPS inverts the bits of the four single-precision floating-point values in the destination register, and then performs a logical AND between the four single-precision floating-point values in the source operand and the temporary inverted result, storing the result in the destination register.

   dst[0-31]   := src[0-31]   AND NOT dst[0-31], 
   dst[32-63]  := src[32-63]  AND NOT dst[32-63], 
   dst[64-95]  := src[64-95]  AND NOT dst[64-95], 
   dst[96-127] := src[96-127] AND NOT dst[96-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.4.11 `ANDPD`: Bitwise Logical AND For Single FP

ANDPD xmm1,xmm2/mem128        ; 66 0F 54 /r     [WILLAMETTE,SSE2]

ANDPD performs a bitwise logical AND of the two double-precision floating point values in the source and destination operand, and stores the result in the destination register.

   dst[0-63]   := src[0-63]   AND dst[0-63], 
   dst[64-127] := src[64-127] AND dst[64-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.4.12 `ANDPS`: Bitwise Logical AND For Single FP

ANDPS xmm1,xmm2/mem128        ; 0F 54 /r        [KATMAI,SSE]

ANDPS performs a bitwise logical AND of the four single-precision floating point values in the source and destination operand, and stores the result in the destination register.

   dst[0-31]   := src[0-31]   AND dst[0-31], 
   dst[32-63]  := src[32-63]  AND dst[32-63], 
   dst[64-95]  := src[64-95]  AND dst[64-95], 
   dst[96-127] := src[96-127] AND dst[96-127].

The destination is an XMM register. The source operand can be either an XMM register or a 128-bit memory location.

A.4.13 `ARPL`: Adjust RPL Field of Selector

ARPL r/m16,reg16              ; 63 /r                [286,PRIV]

ARPL expects its two word operands to be segment selectors. It adjusts the RPL (requested privilege level - stored in the bottom two bits of the selector) field of the destination (first) operand to ensure that it is no less (i.e. no more privileged than) the RPL field of the source operand. The zero flag is set if and only if a change had to be made.

A.4.14 `BOUND`: Check Array Index against Bounds

BOUND reg16,mem               ; o16 62 /r            [186] 
BOUND reg32,mem               ; o32 62 /r            [386]

BOUND expects its second operand to point to an area of memory containing two signed values of the same size as its first operand (i.e. two words for the 16-bit form; two doublewords for the 32-bit form). It performs two signed comparisons: if the value in the register passed as its first operand is less than the first of the in-memory values, or is greater than or equal to the second, it throws a BR exception. Otherwise, it does nothing.

A.4.15 `BSF`, `BSR`: Bit Scan

BSF reg16,r/m16               ; o16 0F BC /r         [386] 
BSF reg32,r/m32               ; o32 0F BC /r         [386]

BSR reg16,r/m16               ; o16 0F BD /r         [386] 
BSR reg32,r/m32               ; o32 0F BD /r         [386]

BSF searches for the least significant set bit in its source (second) operand, and if it finds one, stores the index in its destination (first) operand. If no set bit is found, the contents of the destination operand are undefined. If the source operand is zero, the zero flag is set.
BSR performs the same function, but searches from the top instead, so it finds the most significant set bit.

Bit indices are from 0 (least significant) to 15 or 31 (most significant). The destination operand can only be a register. The source operand can be a register or a memory location.

A.4.16 `BSWAP`: Byte Swap

BSWAP reg32                   ; o32 0F C8+r          [486]

BSWAP swaps the order of the four bytes of a 32-bit register: bits 0-7 exchange places with bits 24-31, and bits 8-15 swap with bits 16-23. There is no explicit 16-bit equivalent: to byte-swap AX, BX, CX or DX, XCHG can be used. When BSWAP is used with a 16-bit register, the result is undefined.

A.4.17 `BT`, `BTC`, `BTR`, `BTS`: Bit Test

BT r/m16,reg16                ; o16 0F A3 /r         [386] 
BT r/m32,reg32                ; o32 0F A3 /r         [386] 
BT r/m16,imm8                 ; o16 0F BA /4 ib      [386] 
BT r/m32,imm8                 ; o32 0F BA /4 ib      [386]

BTC r/m16,reg16               ; o16 0F BB /r         [386] 
BTC r/m32,reg32               ; o32 0F BB /r         [386] 
BTC r/m16,imm8                ; o16 0F BA /7 ib      [386] 
BTC r/m32,imm8                ; o32 0F BA /7 ib      [386]

BTR r/m16,reg16               ; o16 0F B3 /r         [386] 
BTR r/m32,reg32               ; o32 0F B3 /r         [386] 
BTR r/m16,imm8                ; o16 0F BA /6 ib      [386] 
BTR r/m32,imm8                ; o32 0F BA /6 ib      [386]

BTS r/m16,reg16               ; o16 0F AB /r         [386] 
BTS r/m32,reg32               ; o32 0F AB /r         [386] 
BTS r/m16,imm                 ; o16 0F BA /5 ib      [386] 
BTS r/m32,imm                 ; o32 0F BA /5 ib      [386]

These instructions all test one bit of their first operand, whose index is given by the second operand, and store the value of that bit into the carry flag. Bit indices are from 0 (least significant) to 15 or 31 (most significant).

In addition to storing the original value of the bit into the carry flag, BTR also resets (clears) the bit in the operand itself. BTS sets the bit, and BTC complements the bit. BT does not modify its operands.

The destination can be a register or a memory location. The source can be a register or an immediate value.

If the destination operand is a register, the bit offset should be in the range 0-15 (for 16-bit operands) or 0-31 (for 32-bit operands). An immediate value outside these ranges will be taken modulo 16/32 by the processor.

If the destination operand is a memory location, then an immediate bit offset follows the same rules as for a register. If the bit offset is in a register, then it can be anything within the signed range of the register used (ie, for a 32-bit operand, it can be (-2^31) to (2^31 - 1)

A.4.18 `CALL`: Call Subroutine

CALL imm                      ; E8 rw/rd             [8086] 
CALL imm:imm16                ; o16 9A iw iw         [8086] 
CALL imm:imm32                ; o32 9A id iw         [386] 
CALL FAR mem16                ; o16 FF /3            [8086] 
CALL FAR mem32                ; o32 FF /3            [386] 
CALL r/m16                    ; o16 FF /2            [8086] 
CALL r/m32                    ; o32 FF /2            [386]

CALL calls a subroutine, by means of pushing the current instruction pointer (IP) and optionally CS as well on the stack, and then jumping to a given address.

CS is pushed as well as IP if and only if the call is a far call, i.e. a destination segment address is specified in the instruction. The forms involving two colon-separated arguments are far calls; so are the CALL FAR mem forms.

The immediate near call takes one of two forms (call imm16/imm32, determined by the current segment size limit. For 16-bit operands, you would use CALL 0x1234, and for 32-bit operands you would use CALL 0x12345678. The value passed as an operand is a relative offset.

You can choose between the two immediate far call forms (CALL imm:imm) by the use of the WORD and DWORD keywords: CALL WORD 0x1234:0x5678) or CALL DWORD 0x1234:0x56789abc.

The CALL FAR mem forms execute a far call by loading the destination address out of memory. The address loaded consists of 16 or 32 bits of offset (depending on the operand size), and 16 bits of segment. The operand size may be overridden using CALL WORD FAR mem or CALL DWORD FAR mem.

The CALL r/m forms execute a near call (within the same segment), loading the destination address out of memory or out of a register. The keyword NEAR may be specified, for clarity, in these forms, but is not necessary. Again, operand size can be overridden using CALL WORD mem or CALL DWORD mem.

As a convenience, NASM does not require you to call a far procedure symbol by coding the cumbersome CALL SEG routine:routine, but instead allows the easier synonym CALL FAR routine.

The CALL r/m forms given above are near calls; NASM will accept the NEAR keyword (e.g. CALL NEAR [address]), even though it is not strictly necessary.

A.4.19 `CBW`, `CWD`, `CDQ`, `CWDE`: Sign Extensions

CBW                           ; o16 98               [8086] 
CWDE                          ; o32 98               [386]

CWD                           ; o16 99               [8086] 
CDQ                           ; o32 99               [386]

All these instructions sign-extend a short value into a longer one, by replicating the top bit of the original value to fill the extended one.

CBW extends AL into AX by repeating the top bit of AL in every bit of AH. CWDE extends AX into EAX. CWD extends AX into DX:AX by repeating the top bit of AX throughout DX, and CDQ extends EAX into EDX:EAX.

A.4.20 `CLC`, `CLD`, `CLI`, `CLTS`: Clear Flags

CLC                           ; F8                   [8086] 
CLD                           ; FC                   [8086] 
CLI                           ; FA                   [8086] 
CLTS                          ; 0F 06                [286,PRIV]

These instructions clear various flags. CLC clears the carry flag; CLD clears the direction flag; CLI clears the interrupt flag (thus disabling interrupts); and CLTS clears the task-switched (TS) flag in CR0.

To set the carry, direction, or interrupt flags, use the STC, STD and STI instructions (section A.4.301). To invert the carry flag, use CMC (section A.4.22).

A.4.21 `CLFLUSH`: Flush Cache Line

CLFLUSH mem                   ; 0F AE /7        [WILLAMETTE,SSE2]

CLFLUSH invalidates the cache line that contains the linear address specified by the source operand from all levels of the processor cache hierarchy (data and instruction). If, at any level of the cache hierarchy, the line is inconsistent with memory (dirty) it is written to memory before invalidation. The source operand points to a byte-sized memory location.

Although CLFLUSH is flagged SSE2 and above, it may not be present on all processors which have SSE2 support, and it may be supported on other processors; the CPUID instruction (section A.4.34) will return a bit which indicates support for the CLFLUSH instruction.

A.4.22 `CMC`: Complement Carry Flag

CMC                           ; F5                   [8086]

CMC changes the value of the carry flag: if it was 0, it sets it to 1, and vice versa.

A.4.23 `CMOVcc`: Conditional Move

CMOVcc reg16,r/m16            ; o16 0F 40+cc /r      [P6] 
CMOVcc reg32,r/m32            ; o32 0F 40+cc /r      [P6]

CMOV moves its source (second) operand into its destination (first) operand if the given condition code is satisfied; otherwise it does nothing.

For a list of condition codes, see section A.2.2.

Although the CMOV instructions are flagged P6 and above, they may not be supported by all Pentium Pro processors; the CPUID instruction (section A.4.34) will return a bit which indicates whether conditional moves are supported.

A.4.24 `CMP`: Compare Integers

CMP r/m8,reg8                 ; 38 /r                [8086] 
CMP r/m16,reg16               ; o16 39 /r            [8086] 
CMP r/m32,reg32               ; o32 39 /r            [386]

CMP reg8,r/m8                 ; 3A /r                [8086] 
CMP reg16,r/m16               ; o16 3B /r            [8086] 
CMP reg32,r/m32               ; o32 3B /r            [386]

CMP r/m8,imm8                 ; 80 /7 ib             [8086] 
CMP r/m16,imm16               ; o16 81 /7 iw         [8086] 
CMP r/m32,imm32               ; o32 81 /7 id         [386]

CMP r/m16,imm8                ; o16 83 /7 ib         [8086] 
CMP r/m32,imm8                ; o32 83 /7 ib         [386]

CMP AL,imm8                   ; 3C ib                [8086] 
CMP AX,imm16                  ; o16 3D iw            [8086] 
CMP EAX,imm32                 ; o32 3D id            [386]

CMP performs a `mental' subtraction of its second operand from its first operand, and affects the flags as if the subtraction had taken place, but does not store the result of the subtraction anywhere.

The destination operand can be a register or a memory location. The source can be a register, memory location or an immediate value of the same size as the destination.

A.4.25 `CMPccPD`: Packed Double-Precision FP Compare

CMPPD xmm1,xmm2/mem128,imm8   ; 66 0F C2 /r ib  [WILLAMETTE,SSE2]

CMPEQPD xmm1,xmm2/mem128      ; 66 0F C2 /r 00  [WILLAMETTE,SSE2] 
CMPLTPD xmm1,xmm2/mem128      ; 66 0F C2 /r 01  [WILLAMETTE,SSE2] 
CMPLEPD xmm1,xmm2/mem128      ; 66 0F C2 /r 02  [WILLAMETTE,SSE2] 
CMPUNORDPD xmm1,xmm2/mem128   ; 66 0F C2 /r 03  [WILLAMETTE,SSE2] 
CMPNEQPD xmm1,xmm2/mem128     ; 66 0F C2 /r 04  [WILLAMETTE,SSE2] 
CMPNLTPD xmm1,xmm2/mem128     ; 66 0F C2 /r 05  [WILLAMETTE,SSE2] 
CMPNLEPD xmm1,xmm2/mem128     ; 66 0F C2 /r 06  [WILLAMETTE,SSE2] 
CMPORDPD xmm1,xmm2/mem128     ; 66 0F C2 /r 07  [WILLAMETTE,SSE2]

The CMPccPD instructions compare the two packed double-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a quadword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

The third operand is an 8-bit immediate value, of which the low 3 bits define the type of comparison. For ease of programming, the 8 two-operand pseudo-instructions are provided, with the third operand already filled in. The Condition Predicates are:

EQ     0   Equal 
LT     1   Less-than 
LE     2   Less-than-or-equal 
UNORD  3   Unordered 
NE     4   Not-equal 
NLT    5   Not-less-than 
NLE    6   Not-less-than-or-equal 
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.4.26 `CMPccPS`: Packed Single-Precision FP Compare

CMPPS xmm1,xmm2/mem128,imm8   ; 0F C2 /r ib     [KATMAI,SSE]

CMPEQPS xmm1,xmm2/mem128      ; 0F C2 /r 00     [KATMAI,SSE] 
CMPLTPS xmm1,xmm2/mem128      ; 0F C2 /r 01     [KATMAI,SSE] 
CMPLEPS xmm1,xmm2/mem128      ; 0F C2 /r 02     [KATMAI,SSE] 
CMPUNORDPS xmm1,xmm2/mem128   ; 0F C2 /r 03     [KATMAI,SSE] 
CMPNEQPS xmm1,xmm2/mem128     ; 0F C2 /r 04     [KATMAI,SSE] 
CMPNLTPS xmm1,xmm2/mem128     ; 0F C2 /r 05     [KATMAI,SSE] 
CMPNLEPS xmm1,xmm2/mem128     ; 0F C2 /r 06     [KATMAI,SSE] 
CMPORDPS xmm1,xmm2/mem128     ; 0F C2 /r 07     [KATMAI,SSE]

The CMPccPS instructions compare the two packed single-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a doubleword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

EQ     0   Equal 
LT     1   Less-than 
LE     2   Less-than-or-equal 
UNORD  3   Unordered 
NE     4   Not-equal 
NLT    5   Not-less-than 
NLE    6   Not-less-than-or-equal 
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.4.27 `CMPSB`, `CMPSW`, `CMPSD`: Compare Strings

CMPSB                         ; A6                   [8086] 
CMPSW                         ; o16 A7               [8086] 
CMPSD                         ; o32 A7               [386]

CMPSB compares the byte at [DS:SI] or [DS:ESI] with the byte at [ES:DI] or [ES:EDI], and sets the flags accordingly. It then increments or decrements (depending on the direction flag: increments if the flag is clear, decrements if it is set) SI and DI (or ESI and EDI).

The registers used are SI and DI if the address size is 16 bits, and ESI and EDI if it is 32 bits. If you need to use an address size not equal to the current BITS setting, you can use an explicit a16 or a32 prefix.

The segment register used to load from [SI] or [ESI] can be overridden by using a segment register name as a prefix (for example, ES CMPSB). The use of ES for the load from [DI] or [EDI] cannot be overridden.

CMPSW and CMPSD work in the same way, but they compare a word or a doubleword instead of a byte, and increment or decrement the addressing registers by 2 or 4 instead of 1.

The REPE and REPNE prefixes (equivalently, REPZ and REPNZ) may be used to repeat the instruction up to CX (or ECX - again, the address size chooses which) times until the first unequal or equal byte is found.

A.4.28 `CMPccSD`: Scalar Double-Precision FP Compare

CMPSD xmm1,xmm2/mem64,imm8    ; F2 0F C2 /r ib  [WILLAMETTE,SSE2]

CMPEQSD xmm1,xmm2/mem64       ; F2 0F C2 /r 00  [WILLAMETTE,SSE2] 
CMPLTSD xmm1,xmm2/mem64       ; F2 0F C2 /r 01  [WILLAMETTE,SSE2] 
CMPLESD xmm1,xmm2/mem64       ; F2 0F C2 /r 02  [WILLAMETTE,SSE2] 
CMPUNORDSD xmm1,xmm2/mem64    ; F2 0F C2 /r 03  [WILLAMETTE,SSE2] 
CMPNEQSD xmm1,xmm2/mem64      ; F2 0F C2 /r 04  [WILLAMETTE,SSE2] 
CMPNLTSD xmm1,xmm2/mem64      ; F2 0F C2 /r 05  [WILLAMETTE,SSE2] 
CMPNLESD xmm1,xmm2/mem64      ; F2 0F C2 /r 06  [WILLAMETTE,SSE2] 
CMPORDSD xmm1,xmm2/mem64      ; F2 0F C2 /r 07  [WILLAMETTE,SSE2]

The CMPccSD instructions compare the low-order double-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a quadword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

EQ     0   Equal 
LT     1   Less-than 
LE     2   Less-than-or-equal 
UNORD  3   Unordered 
NE     4   Not-equal 
NLT    5   Not-less-than 
NLE    6   Not-less-than-or-equal 
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.4.29 `CMPccSS`: Scalar Single-Precision FP Compare

CMPSS xmm1,xmm2/mem32,imm8    ; F3 0F C2 /r ib  [KATMAI,SSE]

CMPEQSS xmm1,xmm2/mem32       ; F3 0F C2 /r 00  [KATMAI,SSE] 
CMPLTSS xmm1,xmm2/mem32       ; F3 0F C2 /r 01  [KATMAI,SSE] 
CMPLESS xmm1,xmm2/mem32       ; F3 0F C2 /r 02  [KATMAI,SSE] 
CMPUNORDSS xmm1,xmm2/mem32    ; F3 0F C2 /r 03  [KATMAI,SSE] 
CMPNEQSS xmm1,xmm2/mem32      ; F3 0F C2 /r 04  [KATMAI,SSE] 
CMPNLTSS xmm1,xmm2/mem32      ; F3 0F C2 /r 05  [KATMAI,SSE] 
CMPNLESS xmm1,xmm2/mem32      ; F3 0F C2 /r 06  [KATMAI,SSE] 
CMPORDSS xmm1,xmm2/mem32      ; F3 0F C2 /r 07  [KATMAI,SSE]

The CMPccSS instructions compare the low-order single-precision FP values in the source and destination operands, and returns the result of the comparison in the destination register. The result of each comparison is a doubleword mask of all 1s (comparison true) or all 0s (comparison false).

The destination is an XMM register. The source can be either an XMM register or a 128-bit memory location.

EQ     0   Equal 
LT     1   Less-than 
LE     2   Less-than-or-equal 
UNORD  3   Unordered 
NE     4   Not-equal 
NLT    5   Not-less-than 
NLE    6   Not-less-than-or-equal 
ORD    7   Ordered

For more details of the comparison predicates, and details of how to emulate the "greater-than" equivalents, see section A.2.3

A.4.30 `CMPXCHG`, `CMPXCHG486`: Compare and Exchange

CMPXCHG r/m8,reg8             ; 0F B0 /r             [PENT] 
CMPXCHG r/m16,reg16           ; o16 0F B1 /r         [PENT] 
CMPXCHG r/m32,reg32           ; o32 0F B1 /r         [PENT]

CMPXCHG486 r/m8,reg8          ; 0F A6 /r             [486,UNDOC] 
CMPXCHG486 r/m16,reg16        ; o16 0F A7 /r         [486,UNDOC] 
CMPXCHG486 r/m32,reg32        ; o32 0F A7 /r         [486,UNDOC]

These two instructions perform exactly the same operation; however, apparently some (not all) 486 processors support it under a non-standard opcode, so NASM provides the undocumented CMPXCHG486 form to generate the non-standard opcode.

CMPXCHG compares its destination (first) operand to the value in AL, AX or EAX (depending on the operand size of the instruction). If they are equal, it copies its source (second) operand into the destination and sets the zero flag. Otherwise, it clears the zero flag and copies the destination register to AL, AX or EAX.

The destination can be either a register or a memory location. The source is a register.

CMPXCHG is intended to be used for atomic operations in multitasking or multiprocessor environments. To safely update a value in shared memory, for example, you might load the value into EAX, load the updated value into EBX, and then execute the instruction LOCK CMPXCHG [value],EBX. If value has not changed since being loaded, it is updated with your desired new value, and the zero flag is set to let you know it has worked. (The LOCK prefix prevents another processor doing anything in the middle of this operation: it guarantees atomicity.) However, if another processor has modified the value in between your load and your attempted store, the store does not happen, and you are notified of the failure by a cleared zero flag, so you can go round and try again.

A.4.31 `CMPXCHG8B`: Compare and Exchange Eight Bytes

CMPXCHG8B mem                 ; 0F C7 /1             [PENT]

This is a larger and more unwieldy version of CMPXCHG: it compares the 64-bit (eight-byte) value stored at [mem] with the value in EDX:EAX. If they are equal, it sets the zero flag and stores ECX:EBX into the memory area. If they are unequal, it clears the zero flag and stores the memory contents into EDX:EAX.

CMPXCHG8B can be used with the LOCK prefix, to allow atomic execution. This is useful in multi-processor and multi-tasking environments.

A.4.32 `COMISD`: Scalar Ordered Double-Precision FP Compare and Set EFLAGS

COMISD xmm1,xmm2/mem64        ; 66 0F 2F /r     [WILLAMETTE,SSE2]

COMISD compares the low-order double-precision FP value in the two source operands. ZF, PF and CF are set according to the result. OF, AF and AF are cleared. The unordered result is returned if either source is a NaN (QNaN or SNaN).

The destination operand is an XMM register. The source can be either an XMM register or a memory location.

The flags are set according to the following rules:

   Result          Flags        Values

   UNORDERED:      ZF,PF,CF <-- 111; 
   GREATER_THAN:   ZF,PF,CF <-- 000; 
   LESS_THAN:      ZF,PF,CF <-- 001; 
   EQUAL:          ZF,PF,CF <-- 100;

A.4.33 `COMISS`: Scalar Ordered Single-Precision FP Compare and Set EFLAGS

COMISS xmm1,xmm2/mem32        ; 66 0F 2F /r     [KATMAI,SSE]

COMISS compares the low-order single-precision FP value in the two source operands. ZF, PF and CF are set according to the result. OF, AF and AF are cleared. The unordered result is returned if either source is a NaN (QNaN or SNaN).

The destination operand is an XMM register. The source can be either an XMM register or a memory location.

The flags are set according to the following rules:

   Result          Flags        Values

   UNORDERED:      ZF,PF,CF <-- 111; 
   GREATER_THAN:   ZF,PF,CF <-- 000; 
   LESS_THAN:      ZF,PF,CF <-- 001; 
   EQUAL:          ZF,PF,CF <-- 100;

A.4.34 `CPUID`: Get CPU Identification Code

CPUID                         ; 0F A2                [PENT]

CPUID returns various information about the processor it is being executed on. It fills the four registers EAX, EBX, ECX and EDX with information, which varies depending on the input contents of EAX.

CPUID also acts as a barrier to serialize instruction execution: executing the CPUID instruction guarantees that all the effects (memory modification, flag modification, register modification) of previous instructions have been completed before the next instruction gets fetched.

The information returned is as follows:

If EAX is zero on input, EAX on output holds the maximum acceptable input value of EAX, and EBX:EDX:ECX contain the string "GenuineIntel" (or not, if you have a clone processor). That is to say, EBX contains "Genu" (in NASM's own sense of character constants, EDX contains "ineI" and ECX contains "ntel".
If EAX is one on input, EAX on output contains version information about the processor, and EDX contains a set of feature flags, showing the presence and absence of various features. For example, bit 8 is set if the CMPXCHG8B instruction (section A.4.31) is supported, bit 15 is set if the conditional move instructions (section A.4.23 and section A.4.72) are supported, and bit 23 is set if MMX instructions are supported.
If EAX is two on input, EAX, EBX, ECX and EDX all contain information about caches and TLBs (Translation Lookahead Buffers).

For more information on the data returned from CPUID, see the documentation from Intel and other processor manufacturers.

A.4.35 `CVTDQ2PD`: Packed Signed INT32 to Packed Double-Precision FP Conversion

CVTDQ2PD xmm1,xmm2/mem64      ; F3 0F E6 /r     [WILLAMETTE,SSE2]

CVTDQ2PD converts two packed signed doublewords from the source operand to two packed double-precision FP values in the destination operand.

The destination operand is an XMM register. The source can be either an XMM register or a 64-bit memory location. If the source is a register, the packed integers are in the low quadword.

A.4.36 `CVTDQ2PS`: Packed Signed INT32 to Packed Single-Precision FP Conversion

CVTDQ2PS xmm1,xmm2/mem128     ; 0F 5B /r        [WILLAMETTE,SSE2]

CVTDQ2PS converts four packed signed doublewords from the source operand to four packed single-precision FP values in the destination operand.

The destination operand is an XMM register. The source can be either an XMM register or a 128-bit memory location.