   This file documents NASM, the Netwide Assembler: an assembler
targetting the Intel x86 series of processors, with portable source.

   Copyright 2003 The NASM Development Team

   All rights reserved. This document is redistributable under the
licence given in the file "COPYING" distributed in the NASM archive.

B.4.303. `STOSB', `STOSW', `STOSD': Store Byte to String
--------------------------------------------------------

     STOSB                         ; AA                   [8086]
     STOSW                         ; o16 AB               [8086]
     STOSD                         ; o32 AB               [386]

   `STOSB' stores the byte in `AL' at `[ES:DI]' or `[ES:EDI]', and sets
the flags accordingly. It then increments or decrements (depending on
the direction flag: increments if the flag is clear, decrements if it
is set) `DI' (or `EDI').

   The register used is `DI' if the address size is 16 bits, and `EDI'
if it is 32 bits. If you need to use an address size not equal to the
current `BITS' setting, you can use an explicit `a16' or `a32' prefix.

   Segment override prefixes have no effect for this instruction: the
use of `ES' for the store to `[DI]' or `[EDI]' cannot be overridden.

   `STOSW' and `STOSD' work in the same way, but they store the word in
`AX' or the doubleword in `EAX' instead of the byte in `AL', and
increment or decrement the addressing registers by 2 or 4 instead of 1.

   The `REP' prefix may be used to repeat the instruction `CX' (or
`ECX' - again, the address size chooses which) times.

B.4.304. `STR': Store Task Register
-----------------------------------

     STR r/m16                     ; 0F 00 /1             [286,PRIV]

   `STR' stores the segment selector corresponding to the contents of
the Task Register into its operand. When the operand size is 32 bit and
the destination is a register, the upper 16-bits are cleared to 0s.
When the destination operand is a memory location, 16 bits are written
regardless of the operand size.

B.4.305. `SUB': Subtract Integers
---------------------------------

     SUB r/m8,reg8                 ; 28 /r                [8086]
     SUB r/m16,reg16               ; o16 29 /r            [8086]
     SUB r/m32,reg32               ; o32 29 /r            [386]

     SUB reg8,r/m8                 ; 2A /r                [8086]
     SUB reg16,r/m16               ; o16 2B /r            [8086]
     SUB reg32,r/m32               ; o32 2B /r            [386]

     SUB r/m8,imm8                 ; 80 /5 ib             [8086]
     SUB r/m16,imm16               ; o16 81 /5 iw         [8086]
     SUB r/m32,imm32               ; o32 81 /5 id         [386]

     SUB r/m16,imm8                ; o16 83 /5 ib         [8086]
     SUB r/m32,imm8                ; o32 83 /5 ib         [386]

     SUB AL,imm8                   ; 2C ib                [8086]
     SUB AX,imm16                  ; o16 2D iw            [8086]
     SUB EAX,imm32                 ; o32 2D id            [386]

   `SUB' performs integer subtraction: it subtracts its second operand
from its first, and leaves the result in its destination (first)
operand.  The flags are set according to the result of the operation:
in particular, the carry flag is affected and can be used by a
subsequent `SBB' instruction (see Section B.4.285).

   In the forms with an 8-bit immediate second operand and a longer
first operand, the second operand is considered to be signed, and is
sign- extended to the length of the first operand. In these cases, the
`BYTE' qualifier is necessary to force NASM to generate this form of
the instruction.

B.4.306. `SUBPD': Packed Double-Precision FP Subtract
-----------------------------------------------------

     SUBPD xmm1,xmm2/m128          ; 66 0F 5C /r     [WILLAMETTE,SSE2]

   `SUBPD' subtracts the packed double-precision FP values of the source
operand from those of the destination operand, and stores the result in
the destination operation.

B.4.307. `SUBPS': Packed Single-Precision FP Subtract
-----------------------------------------------------

     SUBPS xmm1,xmm2/m128          ; 0F 5C /r        [KATMAI,SSE]

   `SUBPS' subtracts the packed single-precision FP values of the source
operand from those of the destination operand, and stores the result in
the destination operation.

B.4.308. `SUBSD': Scalar Single-FP Subtract
-------------------------------------------

     SUBSD xmm1,xmm2/m128          ; F2 0F 5C /r     [WILLAMETTE,SSE2]

   `SUBSD' subtracts the low-order double-precision FP value of the
source operand from that of the destination operand, and stores the
result in the destination operation. The high quadword is unchanged.

B.4.309. `SUBSS': Scalar Single-FP Subtract
-------------------------------------------

     SUBSS xmm1,xmm2/m128          ; F3 0F 5C /r     [KATMAI,SSE]

   `SUBSS' subtracts the low-order single-precision FP value of the
source operand from that of the destination operand, and stores the
result in the destination operation. The three high doublewords are
unchanged.

B.4.310. `SVDC': Save Segment Register and Descriptor
-----------------------------------------------------

     SVDC m80,segreg               ; 0F 78 /r        [486,CYRIX,SMM]

   `SVDC' saves a segment register (DS, ES, FS, GS, or SS) and its
descriptor to mem80.

B.4.311. `SVLDT': Save LDTR and Descriptor
------------------------------------------

     SVLDT m80                     ; 0F 7A /0        [486,CYRIX,SMM]

   `SVLDT' saves the Local Descriptor Table (LDTR) to mem80.

B.4.312. `SVTS': Save TSR and Descriptor
----------------------------------------

     SVTS m80                      ; 0F 7C /0        [486,CYRIX,SMM]

   `SVTS' saves the Task State Register (TSR) to mem80.

B.4.313. `SYSCALL': Call Operating System
-----------------------------------------

     SYSCALL                       ; 0F 05                [P6,AMD]

   `SYSCALL' provides a fast method of transferring control to a fixed
entry point in an operating system.

   * The `EIP' register is copied into the `ECX' register.

   * Bits [31-0] of the 64-bit SYSCALL/SYSRET Target Address Register
     (`STAR') are copied into the `EIP' register.

   * Bits [47-32] of the `STAR' register specify the selector that is
     copied into the `CS' register.

   * Bits [47-32]+1000b of the `STAR' register specify the selector
     that is copied into the SS register.

   The `CS' and `SS' registers should not be modified by the operating
system between the execution of the `SYSCALL' instruction and its
corresponding `SYSRET' instruction.

   For more information, see the `SYSCALL and SYSRET Instruction
Specification' (AMD document number 21086.pdf).

B.4.314. `SYSENTER': Fast System Call
-------------------------------------

     SYSENTER                      ; 0F 34                [P6]

   `SYSENTER' executes a fast call to a level 0 system procedure or
routine. Before using this instruction, various MSRs need to be set up:

   * `SYSENTER_CS_MSR' contains the 32-bit segment selector for the
     privilege level 0 code segment. (This value is also used to
     compute the segment selector of the privilege level 0 stack
     segment.)

   * `SYSENTER_EIP_MSR' contains the 32-bit offset into the privilege
     level 0 code segment to the first instruction of the selected
     operating procedure or routine.

   * `SYSENTER_ESP_MSR' contains the 32-bit stack pointer for the
     privilege level 0 stack.

   `SYSENTER' performs the following sequence of operations:

   * Loads the segment selector from the `SYSENTER_CS_MSR' into the
     `CS' register.

   * Loads the instruction pointer from the `SYSENTER_EIP_MSR' into the
     `EIP' register.

   * Adds 8 to the value in `SYSENTER_CS_MSR' and loads it into the
     `SS' register.

   * Loads the stack pointer from the `SYSENTER_ESP_MSR' into the `ESP'
     register.

   * Switches to privilege level 0.

   * Clears the `VM' flag in the `EFLAGS' register, if the flag is set.

   * Begins executing the selected system procedure.

   In particular, note that this instruction des not save the values of
`CS' or `(E)IP'. If you need to return to the calling code, you need to
write your code to cater for this.

   For more information, see the Intel Architecture Software Developer's
Manual, Volume 2.

B.4.315. `SYSEXIT': Fast Return From System Call
------------------------------------------------

     SYSEXIT                       ; 0F 35                [P6,PRIV]

   `SYSEXIT' executes a fast return to privilege level 3 user code. This
instruction is a companion instruction to the `SYSENTER' instruction,
and can only be executed by privilege level 0 code. Various registers
need to be set up before calling this instruction:

   * `SYSENTER_CS_MSR' contains the 32-bit segment selector for the
     privilege level 0 code segment in which the processor is currently
     executing. (This value is used to compute the segment selectors
     for the privilege level 3 code and stack segments.)

   * `EDX' contains the 32-bit offset into the privilege level 3 code
     segment to the first instruction to be executed in the user code.

   * `ECX' contains the 32-bit stack pointer for the privilege level 3
     stack.

   `SYSEXIT' performs the following sequence of operations:

   * Adds 16 to the value in `SYSENTER_CS_MSR' and loads the sum into
     the `CS' selector register.

   * Loads the instruction pointer from the `EDX' register into the
     `EIP' register.

   * Adds 24 to the value in `SYSENTER_CS_MSR' and loads the sum into
     the `SS' selector register.

   * Loads the stack pointer from the `ECX' register into the `ESP'
     register.

   * Switches to privilege level 3.

   * Begins executing the user code at the `EIP' address.

   For more information on the use of the `SYSENTER' and `SYSEXIT'
instructions, see the Intel Architecture Software Developer's Manual,
Volume 2.

B.4.316. `SYSRET': Return From Operating System
-----------------------------------------------

     SYSRET                        ; 0F 07                [P6,AMD,PRIV]

   `SYSRET' is the return instruction used in conjunction with the
`SYSCALL' instruction to provide fast entry/exit to an operating system.

   * The `ECX' register, which points to the next sequential instruction
     after the corresponding `SYSCALL' instruction, is copied into the
     `EIP' register.

   * Bits [63-48] of the `STAR' register specify the selector that is
     copied into the `CS' register.

   * Bits [63-48]+1000b of the `STAR' register specify the selector
     that is copied into the `SS' register.

   * Bits [1-0] of the `SS' register are set to 11b (RPL of 3)
     regardless of the value of bits [49-48] of the `STAR' register.

   The `CS' and `SS' registers should not be modified by the operating
system between the execution of the `SYSCALL' instruction and its
corresponding `SYSRET' instruction.

   For more information, see the `SYSCALL and SYSRET Instruction
Specification' (AMD document number 21086.pdf).

B.4.317. `TEST': Test Bits (notional bitwise AND)
-------------------------------------------------

     TEST r/m8,reg8                ; 84 /r                [8086]
     TEST r/m16,reg16              ; o16 85 /r            [8086]
     TEST r/m32,reg32              ; o32 85 /r            [386]

     TEST r/m8,imm8                ; F6 /0 ib             [8086]
     TEST r/m16,imm16              ; o16 F7 /0 iw         [8086]
     TEST r/m32,imm32              ; o32 F7 /0 id         [386]

     TEST AL,imm8                  ; A8 ib                [8086]
     TEST AX,imm16                 ; o16 A9 iw            [8086]
     TEST EAX,imm32                ; o32 A9 id            [386]

   `TEST' performs a `mental' bitwise AND of its two operands, and
affects the flags as if the operation had taken place, but does not
store the result of the operation anywhere.

B.4.318. `UCOMISD': Unordered Scalar Double-Precision FP compare and set EFLAGS
-------------------------------------------------------------------------------

     UCOMISD xmm1,xmm2/m128        ; 66 0F 2E /r     [WILLAMETTE,SSE2]

   `UCOMISD' compares the low-order double-precision FP numbers in the
two operands, and sets the `ZF', `PF' and `CF' bits in the `EFLAGS'
register. In addition, the `OF', `SF' and `AF' bits in the `EFLAGS'
register are zeroed out. The unordered predicate (`ZF', `PF' and `CF'
all set) is returned if either source operand is a `NaN' (`qNaN' or
`sNaN').

B.4.319. `UCOMISS': Unordered Scalar Single-Precision FP compare and set EFLAGS
-------------------------------------------------------------------------------

     UCOMISS xmm1,xmm2/m128        ; 0F 2E /r        [KATMAI,SSE]

   `UCOMISS' compares the low-order single-precision FP numbers in the
two operands, and sets the `ZF', `PF' and `CF' bits in the `EFLAGS'
register. In addition, the `OF', `SF' and `AF' bits in the `EFLAGS'
register are zeroed out. The unordered predicate (`ZF', `PF' and `CF'
all set) is returned if either source operand is a `NaN' (`qNaN' or
`sNaN').

B.4.320. `UD0', `UD1', `UD2': Undefined Instruction
---------------------------------------------------

     UD0                           ; 0F FF                [186,UNDOC]
     UD1                           ; 0F B9                [186,UNDOC]
     UD2                           ; 0F 0B                [186]

   `UDx' can be used to generate an invalid opcode exception, for
testing purposes.

   `UD0' is specifically documented by AMD as being reserved for this
purpose.

   `UD1' is documented by Intel as being available for this purpose.

   `UD2' is specifically documented by Intel as being reserved for this
purpose. Intel document this as the preferred method of generating an
invalid opcode exception.

   All these opcodes can be used to generate invalid opcode exceptions
on all currently available processors.

B.4.321. `UMOV': User Move Data
-------------------------------

     UMOV r/m8,reg8                ; 0F 10 /r             [386,UNDOC]
     UMOV r/m16,reg16              ; o16 0F 11 /r         [386,UNDOC]
     UMOV r/m32,reg32              ; o32 0F 11 /r         [386,UNDOC]

     UMOV reg8,r/m8                ; 0F 12 /r             [386,UNDOC]
     UMOV reg16,r/m16              ; o16 0F 13 /r         [386,UNDOC]
     UMOV reg32,r/m32              ; o32 0F 13 /r         [386,UNDOC]

   This undocumented instruction is used by in-circuit emulators to
access user memory (as opposed to host memory). It is used just like an
ordinary memory/register or register/register `MOV' instruction, but
accesses user space.

   This instruction is only available on some AMD and IBM 386 and 486
processors.

B.4.322. `UNPCKHPD': Unpack and Interleave High Packed Double-Precision FP Values
---------------------------------------------------------------------------------

     UNPCKHPD xmm1,xmm2/m128       ; 66 0F 15 /r     [WILLAMETTE,SSE2]

   `UNPCKHPD' performs an interleaved unpack of the high-order data
elements of the source and destination operands, saving the result in
`xmm1'. It ignores the lower half of the sources.

   The operation of this instruction is:

        dst[63-0]   := dst[127-64];
        dst[127-64] := src[127-64].

B.4.323. `UNPCKHPS': Unpack and Interleave High Packed Single-Precision FP Values
---------------------------------------------------------------------------------

     UNPCKHPS xmm1,xmm2/m128       ; 0F 15 /r        [KATMAI,SSE]

   `UNPCKHPS' performs an interleaved unpack of the high-order data
elements of the source and destination operands, saving the result in
`xmm1'. It ignores the lower half of the sources.

   The operation of this instruction is:

        dst[31-0]   := dst[95-64];
        dst[63-32]  := src[95-64];
        dst[95-64]  := dst[127-96];
        dst[127-96] := src[127-96].

B.4.324. `UNPCKLPD': Unpack and Interleave Low Packed Double-Precision FP Data
------------------------------------------------------------------------------

     UNPCKLPD xmm1,xmm2/m128       ; 66 0F 14 /r     [WILLAMETTE,SSE2]

   `UNPCKLPD' performs an interleaved unpack of the low-order data
elements of the source and destination operands, saving the result in
`xmm1'. It ignores the lower half of the sources.

   The operation of this instruction is:

        dst[63-0]   := dst[63-0];
        dst[127-64] := src[63-0].

B.4.325. `UNPCKLPS': Unpack and Interleave Low Packed Single-Precision FP Data
------------------------------------------------------------------------------

     UNPCKLPS xmm1,xmm2/m128       ; 0F 14 /r        [KATMAI,SSE]

   `UNPCKLPS' performs an interleaved unpack of the low-order data
elements of the source and destination operands, saving the result in
`xmm1'. It ignores the lower half of the sources.

   The operation of this instruction is:

        dst[31-0]   := dst[31-0];
        dst[63-32]  := src[31-0];
        dst[95-64]  := dst[63-32];
        dst[127-96] := src[63-32].

B.4.326. `VERR', `VERW': Verify Segment Readability/Writability
---------------------------------------------------------------

     VERR r/m16                    ; 0F 00 /4             [286,PRIV]

     VERW r/m16                    ; 0F 00 /5             [286,PRIV]

   * `VERR' sets the zero flag if the segment specified by the selector
     in its operand can be read from at the current privilege level.
     Otherwise it is cleared.

   * `VERW' sets the zero flag if the segment can be written.

B.4.327. `WAIT': Wait for Floating-Point Processor
--------------------------------------------------

     WAIT                          ; 9B                   [8086]
     FWAIT                         ; 9B                   [8086]

   `WAIT', on 8086 systems with a separate 8087 FPU, waits for the FPU
to have finished any operation it is engaged in before continuing main
processor operations, so that (for example) an FPU store to main memory
can be guaranteed to have completed before the CPU tries to read the
result back out.

   On higher processors, `WAIT' is unnecessary for this purpose, and it
has the alternative purpose of ensuring that any pending unmasked FPU
exceptions have happened before execution continues.

B.4.328. `WBINVD': Write Back and Invalidate Cache
--------------------------------------------------

     WBINVD                        ; 0F 09                [486]

   `WBINVD' invalidates and empties the processor's internal caches, and
causes the processor to instruct external caches to do the same. It
writes the contents of the caches back to memory first, so no data is
lost. To flush the caches quickly without bothering to write the data
back first, use `INVD' (see Section B.4.125).

B.4.329. `WRMSR': Write Model-Specific Registers
------------------------------------------------

     WRMSR                         ; 0F 30                [PENT]

   `WRMSR' writes the value in `EDX:EAX' to the processor Model-
Specific Register (MSR) whose index is stored in `ECX'. See also
`RDMSR' (see Section B.4.270).

B.4.330. `WRSHR': Write SMM Header Pointer Register
---------------------------------------------------

     WRSHR r/m32                   ; 0F 37 /0        [386,CYRIX,SMM]

   `WRSHR' loads the contents of either a 32-bit memory location or a
32- bit register into the SMM header pointer register.

   See also `RDSHR' (see Section B.4.272).

B.4.331. `XADD': Exchange and Add
---------------------------------

     XADD r/m8,reg8                ; 0F C0 /r             [486]
     XADD r/m16,reg16              ; o16 0F C1 /r         [486]
     XADD r/m32,reg32              ; o32 0F C1 /r         [486]

   `XADD' exchanges the values in its two operands, and then adds them
together and writes the result into the destination (first) operand.
This instruction can be used with a `LOCK' prefix for multi-processor
synchronisation purposes.

B.4.332. `XBTS': Extract Bit String
-----------------------------------

     XBTS reg16,r/m16              ; o16 0F A6 /r         [386,UNDOC]
     XBTS reg32,r/m32              ; o32 0F A6 /r         [386,UNDOC]

   The implied operation of this instruction is:

     XBTS r/m16,reg16,AX,CL
     XBTS r/m32,reg32,EAX,CL

   Writes a bit string from the source operand to the destination. `CL'
indicates the number of bits to be copied, and `(E)AX' indicates the
low order bit offset in the source. The bits are written to the low
order bits of the destination register. For example, if `CL' is set to
4 and `AX' (for 16-bit code) is set to 5, bits 5-8 of `src' will be
copied to bits 0-3 of `dst'. This instruction is very poorly
documented, and I have been unable to find any official source of
documentation on it.

   `XBTS' is supported only on the early Intel 386s, and conflicts with
the opcodes for `CMPXCHG486' (on early Intel 486s). NASM supports it
only for completeness. Its counterpart is `IBTS' (see Section B.4.116).

B.4.333. `XCHG': Exchange
-------------------------

     XCHG reg8,r/m8                ; 86 /r                [8086]
     XCHG reg16,r/m8               ; o16 87 /r            [8086]
     XCHG reg32,r/m32              ; o32 87 /r            [386]

     XCHG r/m8,reg8                ; 86 /r                [8086]
     XCHG r/m16,reg16              ; o16 87 /r            [8086]
     XCHG r/m32,reg32              ; o32 87 /r            [386]

     XCHG AX,reg16                 ; o16 90+r             [8086]
     XCHG EAX,reg32                ; o32 90+r             [386]
     XCHG reg16,AX                 ; o16 90+r             [8086]
     XCHG reg32,EAX                ; o32 90+r             [386]

   `XCHG' exchanges the values in its two operands. It can be used with
a `LOCK' prefix for purposes of multi-processor synchronisation.

   `XCHG AX,AX' or `XCHG EAX,EAX' (depending on the `BITS' setting)
generates the opcode `90h', and so is a synonym for `NOP' (see
Section B.4.190).

B.4.334. `XLATB': Translate Byte in Lookup Table
------------------------------------------------

     XLAT                          ; D7                   [8086]
     XLATB                         ; D7                   [8086]

   `XLATB' adds the value in `AL', treated as an unsigned byte, to `BX'
or `EBX', and loads the byte from the resulting address (in the segment
specified by `DS') back into `AL'.

   The base register used is `BX' if the address size is 16 bits, and
`EBX' if it is 32 bits. If you need to use an address size not equal to
the current `BITS' setting, you can use an explicit `a16' or `a32'
prefix.

   The segment register used to load from `[BX+AL]' or `[EBX+AL]' can
be overridden by using a segment register name as a prefix (for
example, `es xlatb').

B.4.335. `XOR': Bitwise Exclusive OR
------------------------------------

     XOR r/m8,reg8                 ; 30 /r                [8086]
     XOR r/m16,reg16               ; o16 31 /r            [8086]
     XOR r/m32,reg32               ; o32 31 /r            [386]

     XOR reg8,r/m8                 ; 32 /r                [8086]
     XOR reg16,r/m16               ; o16 33 /r            [8086]
     XOR reg32,r/m32               ; o32 33 /r            [386]

     XOR r/m8,imm8                 ; 80 /6 ib             [8086]
     XOR r/m16,imm16               ; o16 81 /6 iw         [8086]
     XOR r/m32,imm32               ; o32 81 /6 id         [386]

     XOR r/m16,imm8                ; o16 83 /6 ib         [8086]
     XOR r/m32,imm8                ; o32 83 /6 ib         [386]

     XOR AL,imm8                   ; 34 ib                [8086]
     XOR AX,imm16                  ; o16 35 iw            [8086]
     XOR EAX,imm32                 ; o32 35 id            [386]

   `XOR' performs a bitwise XOR operation between its two operands (i.e.
each bit of the result is 1 if and only if exactly one of the
corresponding bits of the two inputs was 1), and stores the result in
the destination (first) operand.

   In the forms with an 8-bit immediate second operand and a longer
first operand, the second operand is considered to be signed, and is
sign- extended to the length of the first operand. In these cases, the
`BYTE' qualifier is necessary to force NASM to generate this form of
the instruction.

   The `MMX' instruction `PXOR' (see Section B.4.266) performs
the same operation on the 64-bit `MMX' registers.

B.4.336. `XORPD': Bitwise Logical XOR of Double-Precision FP Values
-------------------------------------------------------------------

     XORPD xmm1,xmm2/m128          ; 66 0F 57 /r     [WILLAMETTE,SSE2]

   `XORPD' returns a bit-wise logical XOR between the source and
destination operands, storing the result in the destination operand.

B.4.337. `XORPS': Bitwise Logical XOR of Single-Precision FP Values
-------------------------------------------------------------------

     XORPS xmm1,xmm2/m128          ; 0F 57 /r        [KATMAI,SSE]

   `XORPS' returns a bit-wise logical XOR between the source and
destination operands, storing the result in the destination operand.