A tour of the instruction set

The previous chapter showed that 20 mnemonics make up about 93% of the instructions in ordinary programs. This chapter goes through those instructions, grouped by what they do. Each group has a live demo: step through it and watch the registers change.

Moving data

The same byte, 0x80, becomes 128 with movzx and -128 (0xffffff80) with movsx: it depends on whether the source is treated as unsigned or signed. In C, that's the difference between unsigned char and signed char. lea computes rbx + rbx*4 = 5 × 0xff80 = 0x4fd80 without touching memory or the flags, which is why compilers use it for small multiplications. push then pop moves rax into rdi through the stack, and rsp goes down by 8 and back up.

Arithmetic

Division is the odd one out. It takes no destination operand: it always divides the 64-bit value edx:eax (or the 128-bit rdx:rax), and it writes two results, the quotient in eax and the remainder in edx. That's why a signed division in compiled code is almost always preceded by cdq or cqo. Dividing by zero doesn't produce a value: it raises a processor exception, which the OS turns into a crash (SIGFPE on Linux).

Division is also slow: often 10 to 40 cycles, depending on the CPU and the operand size, against 1 for an addition. Compilers avoid it when they can: dividing by a constant usually compiles to a multiplication by a "magic number" followed by a shift.

Bits and shifts

• and with a mask keeps selected bits, or sets them and xor flips them.
• xor eax, eax is the usual way to set a register to 0, and test eax, eax the usual way to check whether it's 0.
• sar and shr differ only on negative numbers. sar keeps -16 negative (-4); shr treats it as a huge unsigned number.
• sar also rounds toward minus infinity: -17 sar 2 is -5, while C's -17 / 4 is -4. That's why a signed division by a power of two compiles to a few extra instructions around the sar.

Comparing and choosing

These instructions compare, and then act on the result through the flags. The flags chapter covers every condition.

cmp followed by a conditional jump is how every if, loop and switch is compiled. setcc and cmovcc compute the same kind of decision without jumping, which avoids branch mispredictions.

Calls and jumps

call pushes the address of the jmp onto the stack before jumping to triple. ret pops it back, so execution continues right after the call, with eax = 18. How arguments and return values travel is the subject of the calling conventions chapter.

The rest of the instruction set

A few more families show up less often, but you'll meet them:

• String instructions — movsb, stosb, cmpsb, scasb with a rep prefix — copy, fill, compare or search whole blocks of memory in one instruction. rep stosb is used for memset. The microcode chapter shows how one such instruction becomes a loop.
• System instructions: syscall asks the operating system for a service, int3 is the one-byte breakpoint debuggers insert (0xcc), hlt stops the CPU until the next interrupt, and nop does nothing — useful as padding.
• Floating point and SIMD: the SSE and AVX instructions work on the xmm, ymm and zmm registers. They handle float and double (addsd, mulss…) and operate on several values at once (paddd, vaddps…). The old x87 floating-point stack survives mostly in 32-bit code.

Takeaways

• Moving data: mov, movzx/movsx (unsigned vs signed widening), lea (address arithmetic without memory), push/pop.
• Arithmetic: add, sub, inc, dec, neg, imul. Division uses rdx:rax implicitly and returns a quotient and a remainder.
• Bits: and/or/xor with masks. shl/shr/sar multiply and divide by powers of two; sar keeps the sign.
• Deciding: cmp/test set the flags, then jcc, setcc or cmovcc act on them.
• Control: jmp, call, ret — plus string, system and SIMD instructions for special jobs.