| 1 | @c Copyright (C) 1991-2017 Free Software Foundation, Inc. |
| 2 | @c This is part of the GAS manual. |
| 3 | @c For copying conditions, see the file as.texinfo. |
| 4 | @c man end |
| 5 | |
| 6 | @ifset GENERIC |
| 7 | @page |
| 8 | @node i386-Dependent |
| 9 | @chapter 80386 Dependent Features |
| 10 | @end ifset |
| 11 | @ifclear GENERIC |
| 12 | @node Machine Dependencies |
| 13 | @chapter 80386 Dependent Features |
| 14 | @end ifclear |
| 15 | |
| 16 | @cindex i386 support |
| 17 | @cindex i80386 support |
| 18 | @cindex x86-64 support |
| 19 | |
| 20 | The i386 version @code{@value{AS}} supports both the original Intel 386 |
| 21 | architecture in both 16 and 32-bit mode as well as AMD x86-64 architecture |
| 22 | extending the Intel architecture to 64-bits. |
| 23 | |
| 24 | @menu |
| 25 | * i386-Options:: Options |
| 26 | * i386-Directives:: X86 specific directives |
| 27 | * i386-Syntax:: Syntactical considerations |
| 28 | * i386-Mnemonics:: Instruction Naming |
| 29 | * i386-Regs:: Register Naming |
| 30 | * i386-Prefixes:: Instruction Prefixes |
| 31 | * i386-Memory:: Memory References |
| 32 | * i386-Jumps:: Handling of Jump Instructions |
| 33 | * i386-Float:: Floating Point |
| 34 | * i386-SIMD:: Intel's MMX and AMD's 3DNow! SIMD Operations |
| 35 | * i386-LWP:: AMD's Lightweight Profiling Instructions |
| 36 | * i386-BMI:: Bit Manipulation Instruction |
| 37 | * i386-TBM:: AMD's Trailing Bit Manipulation Instructions |
| 38 | * i386-16bit:: Writing 16-bit Code |
| 39 | * i386-Arch:: Specifying an x86 CPU architecture |
| 40 | * i386-Bugs:: AT&T Syntax bugs |
| 41 | * i386-Notes:: Notes |
| 42 | @end menu |
| 43 | |
| 44 | @node i386-Options |
| 45 | @section Options |
| 46 | |
| 47 | @cindex options for i386 |
| 48 | @cindex options for x86-64 |
| 49 | @cindex i386 options |
| 50 | @cindex x86-64 options |
| 51 | |
| 52 | The i386 version of @code{@value{AS}} has a few machine |
| 53 | dependent options: |
| 54 | |
| 55 | @c man begin OPTIONS |
| 56 | @table @gcctabopt |
| 57 | @cindex @samp{--32} option, i386 |
| 58 | @cindex @samp{--32} option, x86-64 |
| 59 | @cindex @samp{--x32} option, i386 |
| 60 | @cindex @samp{--x32} option, x86-64 |
| 61 | @cindex @samp{--64} option, i386 |
| 62 | @cindex @samp{--64} option, x86-64 |
| 63 | @item --32 | --x32 | --64 |
| 64 | Select the word size, either 32 bits or 64 bits. @samp{--32} |
| 65 | implies Intel i386 architecture, while @samp{--x32} and @samp{--64} |
| 66 | imply AMD x86-64 architecture with 32-bit or 64-bit word-size |
| 67 | respectively. |
| 68 | |
| 69 | These options are only available with the ELF object file format, and |
| 70 | require that the necessary BFD support has been included (on a 32-bit |
| 71 | platform you have to add --enable-64-bit-bfd to configure enable 64-bit |
| 72 | usage and use x86-64 as target platform). |
| 73 | |
| 74 | @item -n |
| 75 | By default, x86 GAS replaces multiple nop instructions used for |
| 76 | alignment within code sections with multi-byte nop instructions such |
| 77 | as leal 0(%esi,1),%esi. This switch disables the optimization. |
| 78 | |
| 79 | @cindex @samp{--divide} option, i386 |
| 80 | @item --divide |
| 81 | On SVR4-derived platforms, the character @samp{/} is treated as a comment |
| 82 | character, which means that it cannot be used in expressions. The |
| 83 | @samp{--divide} option turns @samp{/} into a normal character. This does |
| 84 | not disable @samp{/} at the beginning of a line starting a comment, or |
| 85 | affect using @samp{#} for starting a comment. |
| 86 | |
| 87 | @cindex @samp{-march=} option, i386 |
| 88 | @cindex @samp{-march=} option, x86-64 |
| 89 | @item -march=@var{CPU}[+@var{EXTENSION}@dots{}] |
| 90 | This option specifies the target processor. The assembler will |
| 91 | issue an error message if an attempt is made to assemble an instruction |
| 92 | which will not execute on the target processor. The following |
| 93 | processor names are recognized: |
| 94 | @code{i8086}, |
| 95 | @code{i186}, |
| 96 | @code{i286}, |
| 97 | @code{i386}, |
| 98 | @code{i486}, |
| 99 | @code{i586}, |
| 100 | @code{i686}, |
| 101 | @code{pentium}, |
| 102 | @code{pentiumpro}, |
| 103 | @code{pentiumii}, |
| 104 | @code{pentiumiii}, |
| 105 | @code{pentium4}, |
| 106 | @code{prescott}, |
| 107 | @code{nocona}, |
| 108 | @code{core}, |
| 109 | @code{core2}, |
| 110 | @code{corei7}, |
| 111 | @code{l1om}, |
| 112 | @code{k1om}, |
| 113 | @code{iamcu}, |
| 114 | @code{k6}, |
| 115 | @code{k6_2}, |
| 116 | @code{athlon}, |
| 117 | @code{opteron}, |
| 118 | @code{k8}, |
| 119 | @code{amdfam10}, |
| 120 | @code{bdver1}, |
| 121 | @code{bdver2}, |
| 122 | @code{bdver3}, |
| 123 | @code{bdver4}, |
| 124 | @code{znver1}, |
| 125 | @code{btver1}, |
| 126 | @code{btver2}, |
| 127 | @code{generic32} and |
| 128 | @code{generic64}. |
| 129 | |
| 130 | In addition to the basic instruction set, the assembler can be told to |
| 131 | accept various extension mnemonics. For example, |
| 132 | @code{-march=i686+sse4+vmx} extends @var{i686} with @var{sse4} and |
| 133 | @var{vmx}. The following extensions are currently supported: |
| 134 | @code{8087}, |
| 135 | @code{287}, |
| 136 | @code{387}, |
| 137 | @code{687}, |
| 138 | @code{no87}, |
| 139 | @code{no287}, |
| 140 | @code{no387}, |
| 141 | @code{no687}, |
| 142 | @code{mmx}, |
| 143 | @code{nommx}, |
| 144 | @code{sse}, |
| 145 | @code{sse2}, |
| 146 | @code{sse3}, |
| 147 | @code{ssse3}, |
| 148 | @code{sse4.1}, |
| 149 | @code{sse4.2}, |
| 150 | @code{sse4}, |
| 151 | @code{nosse}, |
| 152 | @code{nosse2}, |
| 153 | @code{nosse3}, |
| 154 | @code{nossse3}, |
| 155 | @code{nosse4.1}, |
| 156 | @code{nosse4.2}, |
| 157 | @code{nosse4}, |
| 158 | @code{avx}, |
| 159 | @code{avx2}, |
| 160 | @code{noavx}, |
| 161 | @code{noavx2}, |
| 162 | @code{adx}, |
| 163 | @code{rdseed}, |
| 164 | @code{prfchw}, |
| 165 | @code{smap}, |
| 166 | @code{mpx}, |
| 167 | @code{sha}, |
| 168 | @code{rdpid}, |
| 169 | @code{ptwrite}, |
| 170 | @code{cet}, |
| 171 | @code{prefetchwt1}, |
| 172 | @code{clflushopt}, |
| 173 | @code{se1}, |
| 174 | @code{clwb}, |
| 175 | @code{avx512f}, |
| 176 | @code{avx512cd}, |
| 177 | @code{avx512er}, |
| 178 | @code{avx512pf}, |
| 179 | @code{avx512vl}, |
| 180 | @code{avx512bw}, |
| 181 | @code{avx512dq}, |
| 182 | @code{avx512ifma}, |
| 183 | @code{avx512vbmi}, |
| 184 | @code{avx512_4fmaps}, |
| 185 | @code{avx512_4vnniw}, |
| 186 | @code{avx512_vpopcntdq}, |
| 187 | @code{noavx512f}, |
| 188 | @code{noavx512cd}, |
| 189 | @code{noavx512er}, |
| 190 | @code{noavx512pf}, |
| 191 | @code{noavx512vl}, |
| 192 | @code{noavx512bw}, |
| 193 | @code{noavx512dq}, |
| 194 | @code{noavx512ifma}, |
| 195 | @code{noavx512vbmi}, |
| 196 | @code{noavx512_4fmaps}, |
| 197 | @code{noavx512_4vnniw}, |
| 198 | @code{noavx512_vpopcntdq}, |
| 199 | @code{vmx}, |
| 200 | @code{vmfunc}, |
| 201 | @code{smx}, |
| 202 | @code{xsave}, |
| 203 | @code{xsaveopt}, |
| 204 | @code{xsavec}, |
| 205 | @code{xsaves}, |
| 206 | @code{aes}, |
| 207 | @code{pclmul}, |
| 208 | @code{fsgsbase}, |
| 209 | @code{rdrnd}, |
| 210 | @code{f16c}, |
| 211 | @code{bmi2}, |
| 212 | @code{fma}, |
| 213 | @code{movbe}, |
| 214 | @code{ept}, |
| 215 | @code{lzcnt}, |
| 216 | @code{hle}, |
| 217 | @code{rtm}, |
| 218 | @code{invpcid}, |
| 219 | @code{clflush}, |
| 220 | @code{mwaitx}, |
| 221 | @code{clzero}, |
| 222 | @code{lwp}, |
| 223 | @code{fma4}, |
| 224 | @code{xop}, |
| 225 | @code{cx16}, |
| 226 | @code{syscall}, |
| 227 | @code{rdtscp}, |
| 228 | @code{3dnow}, |
| 229 | @code{3dnowa}, |
| 230 | @code{sse4a}, |
| 231 | @code{sse5}, |
| 232 | @code{svme}, |
| 233 | @code{abm} and |
| 234 | @code{padlock}. |
| 235 | Note that rather than extending a basic instruction set, the extension |
| 236 | mnemonics starting with @code{no} revoke the respective functionality. |
| 237 | |
| 238 | When the @code{.arch} directive is used with @option{-march}, the |
| 239 | @code{.arch} directive will take precedent. |
| 240 | |
| 241 | @cindex @samp{-mtune=} option, i386 |
| 242 | @cindex @samp{-mtune=} option, x86-64 |
| 243 | @item -mtune=@var{CPU} |
| 244 | This option specifies a processor to optimize for. When used in |
| 245 | conjunction with the @option{-march} option, only instructions |
| 246 | of the processor specified by the @option{-march} option will be |
| 247 | generated. |
| 248 | |
| 249 | Valid @var{CPU} values are identical to the processor list of |
| 250 | @option{-march=@var{CPU}}. |
| 251 | |
| 252 | @cindex @samp{-msse2avx} option, i386 |
| 253 | @cindex @samp{-msse2avx} option, x86-64 |
| 254 | @item -msse2avx |
| 255 | This option specifies that the assembler should encode SSE instructions |
| 256 | with VEX prefix. |
| 257 | |
| 258 | @cindex @samp{-msse-check=} option, i386 |
| 259 | @cindex @samp{-msse-check=} option, x86-64 |
| 260 | @item -msse-check=@var{none} |
| 261 | @itemx -msse-check=@var{warning} |
| 262 | @itemx -msse-check=@var{error} |
| 263 | These options control if the assembler should check SSE instructions. |
| 264 | @option{-msse-check=@var{none}} will make the assembler not to check SSE |
| 265 | instructions, which is the default. @option{-msse-check=@var{warning}} |
| 266 | will make the assembler issue a warning for any SSE instruction. |
| 267 | @option{-msse-check=@var{error}} will make the assembler issue an error |
| 268 | for any SSE instruction. |
| 269 | |
| 270 | @cindex @samp{-mavxscalar=} option, i386 |
| 271 | @cindex @samp{-mavxscalar=} option, x86-64 |
| 272 | @item -mavxscalar=@var{128} |
| 273 | @itemx -mavxscalar=@var{256} |
| 274 | These options control how the assembler should encode scalar AVX |
| 275 | instructions. @option{-mavxscalar=@var{128}} will encode scalar |
| 276 | AVX instructions with 128bit vector length, which is the default. |
| 277 | @option{-mavxscalar=@var{256}} will encode scalar AVX instructions |
| 278 | with 256bit vector length. |
| 279 | |
| 280 | @cindex @samp{-mevexlig=} option, i386 |
| 281 | @cindex @samp{-mevexlig=} option, x86-64 |
| 282 | @item -mevexlig=@var{128} |
| 283 | @itemx -mevexlig=@var{256} |
| 284 | @itemx -mevexlig=@var{512} |
| 285 | These options control how the assembler should encode length-ignored |
| 286 | (LIG) EVEX instructions. @option{-mevexlig=@var{128}} will encode LIG |
| 287 | EVEX instructions with 128bit vector length, which is the default. |
| 288 | @option{-mevexlig=@var{256}} and @option{-mevexlig=@var{512}} will |
| 289 | encode LIG EVEX instructions with 256bit and 512bit vector length, |
| 290 | respectively. |
| 291 | |
| 292 | @cindex @samp{-mevexwig=} option, i386 |
| 293 | @cindex @samp{-mevexwig=} option, x86-64 |
| 294 | @item -mevexwig=@var{0} |
| 295 | @itemx -mevexwig=@var{1} |
| 296 | These options control how the assembler should encode w-ignored (WIG) |
| 297 | EVEX instructions. @option{-mevexwig=@var{0}} will encode WIG |
| 298 | EVEX instructions with evex.w = 0, which is the default. |
| 299 | @option{-mevexwig=@var{1}} will encode WIG EVEX instructions with |
| 300 | evex.w = 1. |
| 301 | |
| 302 | @cindex @samp{-mmnemonic=} option, i386 |
| 303 | @cindex @samp{-mmnemonic=} option, x86-64 |
| 304 | @item -mmnemonic=@var{att} |
| 305 | @itemx -mmnemonic=@var{intel} |
| 306 | This option specifies instruction mnemonic for matching instructions. |
| 307 | The @code{.att_mnemonic} and @code{.intel_mnemonic} directives will |
| 308 | take precedent. |
| 309 | |
| 310 | @cindex @samp{-msyntax=} option, i386 |
| 311 | @cindex @samp{-msyntax=} option, x86-64 |
| 312 | @item -msyntax=@var{att} |
| 313 | @itemx -msyntax=@var{intel} |
| 314 | This option specifies instruction syntax when processing instructions. |
| 315 | The @code{.att_syntax} and @code{.intel_syntax} directives will |
| 316 | take precedent. |
| 317 | |
| 318 | @cindex @samp{-mnaked-reg} option, i386 |
| 319 | @cindex @samp{-mnaked-reg} option, x86-64 |
| 320 | @item -mnaked-reg |
| 321 | This option specifies that registers don't require a @samp{%} prefix. |
| 322 | The @code{.att_syntax} and @code{.intel_syntax} directives will take precedent. |
| 323 | |
| 324 | @cindex @samp{-madd-bnd-prefix} option, i386 |
| 325 | @cindex @samp{-madd-bnd-prefix} option, x86-64 |
| 326 | @item -madd-bnd-prefix |
| 327 | This option forces the assembler to add BND prefix to all branches, even |
| 328 | if such prefix was not explicitly specified in the source code. |
| 329 | |
| 330 | @cindex @samp{-mshared} option, i386 |
| 331 | @cindex @samp{-mshared} option, x86-64 |
| 332 | @item -mno-shared |
| 333 | On ELF target, the assembler normally optimizes out non-PLT relocations |
| 334 | against defined non-weak global branch targets with default visibility. |
| 335 | The @samp{-mshared} option tells the assembler to generate code which |
| 336 | may go into a shared library where all non-weak global branch targets |
| 337 | with default visibility can be preempted. The resulting code is |
| 338 | slightly bigger. This option only affects the handling of branch |
| 339 | instructions. |
| 340 | |
| 341 | @cindex @samp{-mbig-obj} option, x86-64 |
| 342 | @item -mbig-obj |
| 343 | On x86-64 PE/COFF target this option forces the use of big object file |
| 344 | format, which allows more than 32768 sections. |
| 345 | |
| 346 | @cindex @samp{-momit-lock-prefix=} option, i386 |
| 347 | @cindex @samp{-momit-lock-prefix=} option, x86-64 |
| 348 | @item -momit-lock-prefix=@var{no} |
| 349 | @itemx -momit-lock-prefix=@var{yes} |
| 350 | These options control how the assembler should encode lock prefix. |
| 351 | This option is intended as a workaround for processors, that fail on |
| 352 | lock prefix. This option can only be safely used with single-core, |
| 353 | single-thread computers |
| 354 | @option{-momit-lock-prefix=@var{yes}} will omit all lock prefixes. |
| 355 | @option{-momit-lock-prefix=@var{no}} will encode lock prefix as usual, |
| 356 | which is the default. |
| 357 | |
| 358 | @cindex @samp{-mfence-as-lock-add=} option, i386 |
| 359 | @cindex @samp{-mfence-as-lock-add=} option, x86-64 |
| 360 | @item -mfence-as-lock-add=@var{no} |
| 361 | @itemx -mfence-as-lock-add=@var{yes} |
| 362 | These options control how the assembler should encode lfence, mfence and |
| 363 | sfence. |
| 364 | @option{-mfence-as-lock-add=@var{yes}} will encode lfence, mfence and |
| 365 | sfence as @samp{lock addl $0x0, (%rsp)} in 64-bit mode and |
| 366 | @samp{lock addl $0x0, (%esp)} in 32-bit mode. |
| 367 | @option{-mfence-as-lock-add=@var{no}} will encode lfence, mfence and |
| 368 | sfence as usual, which is the default. |
| 369 | |
| 370 | @cindex @samp{-mrelax-relocations=} option, i386 |
| 371 | @cindex @samp{-mrelax-relocations=} option, x86-64 |
| 372 | @item -mrelax-relocations=@var{no} |
| 373 | @itemx -mrelax-relocations=@var{yes} |
| 374 | These options control whether the assembler should generate relax |
| 375 | relocations, R_386_GOT32X, in 32-bit mode, or R_X86_64_GOTPCRELX and |
| 376 | R_X86_64_REX_GOTPCRELX, in 64-bit mode. |
| 377 | @option{-mrelax-relocations=@var{yes}} will generate relax relocations. |
| 378 | @option{-mrelax-relocations=@var{no}} will not generate relax |
| 379 | relocations. The default can be controlled by a configure option |
| 380 | @option{--enable-x86-relax-relocations}. |
| 381 | |
| 382 | @cindex @samp{-mevexrcig=} option, i386 |
| 383 | @cindex @samp{-mevexrcig=} option, x86-64 |
| 384 | @item -mevexrcig=@var{rne} |
| 385 | @itemx -mevexrcig=@var{rd} |
| 386 | @itemx -mevexrcig=@var{ru} |
| 387 | @itemx -mevexrcig=@var{rz} |
| 388 | These options control how the assembler should encode SAE-only |
| 389 | EVEX instructions. @option{-mevexrcig=@var{rne}} will encode RC bits |
| 390 | of EVEX instruction with 00, which is the default. |
| 391 | @option{-mevexrcig=@var{rd}}, @option{-mevexrcig=@var{ru}} |
| 392 | and @option{-mevexrcig=@var{rz}} will encode SAE-only EVEX instructions |
| 393 | with 01, 10 and 11 RC bits, respectively. |
| 394 | |
| 395 | @cindex @samp{-mamd64} option, x86-64 |
| 396 | @cindex @samp{-mintel64} option, x86-64 |
| 397 | @item -mamd64 |
| 398 | @itemx -mintel64 |
| 399 | This option specifies that the assembler should accept only AMD64 or |
| 400 | Intel64 ISA in 64-bit mode. The default is to accept both. |
| 401 | |
| 402 | @end table |
| 403 | @c man end |
| 404 | |
| 405 | @node i386-Directives |
| 406 | @section x86 specific Directives |
| 407 | |
| 408 | @cindex machine directives, x86 |
| 409 | @cindex x86 machine directives |
| 410 | @table @code |
| 411 | |
| 412 | @cindex @code{lcomm} directive, COFF |
| 413 | @item .lcomm @var{symbol} , @var{length}[, @var{alignment}] |
| 414 | Reserve @var{length} (an absolute expression) bytes for a local common |
| 415 | denoted by @var{symbol}. The section and value of @var{symbol} are |
| 416 | those of the new local common. The addresses are allocated in the bss |
| 417 | section, so that at run-time the bytes start off zeroed. Since |
| 418 | @var{symbol} is not declared global, it is normally not visible to |
| 419 | @code{@value{LD}}. The optional third parameter, @var{alignment}, |
| 420 | specifies the desired alignment of the symbol in the bss section. |
| 421 | |
| 422 | This directive is only available for COFF based x86 targets. |
| 423 | |
| 424 | @c FIXME: Document other x86 specific directives ? Eg: .code16gcc, |
| 425 | @c .largecomm |
| 426 | |
| 427 | @end table |
| 428 | |
| 429 | @node i386-Syntax |
| 430 | @section i386 Syntactical Considerations |
| 431 | @menu |
| 432 | * i386-Variations:: AT&T Syntax versus Intel Syntax |
| 433 | * i386-Chars:: Special Characters |
| 434 | @end menu |
| 435 | |
| 436 | @node i386-Variations |
| 437 | @subsection AT&T Syntax versus Intel Syntax |
| 438 | |
| 439 | @cindex i386 intel_syntax pseudo op |
| 440 | @cindex intel_syntax pseudo op, i386 |
| 441 | @cindex i386 att_syntax pseudo op |
| 442 | @cindex att_syntax pseudo op, i386 |
| 443 | @cindex i386 syntax compatibility |
| 444 | @cindex syntax compatibility, i386 |
| 445 | @cindex x86-64 intel_syntax pseudo op |
| 446 | @cindex intel_syntax pseudo op, x86-64 |
| 447 | @cindex x86-64 att_syntax pseudo op |
| 448 | @cindex att_syntax pseudo op, x86-64 |
| 449 | @cindex x86-64 syntax compatibility |
| 450 | @cindex syntax compatibility, x86-64 |
| 451 | |
| 452 | @code{@value{AS}} now supports assembly using Intel assembler syntax. |
| 453 | @code{.intel_syntax} selects Intel mode, and @code{.att_syntax} switches |
| 454 | back to the usual AT&T mode for compatibility with the output of |
| 455 | @code{@value{GCC}}. Either of these directives may have an optional |
| 456 | argument, @code{prefix}, or @code{noprefix} specifying whether registers |
| 457 | require a @samp{%} prefix. AT&T System V/386 assembler syntax is quite |
| 458 | different from Intel syntax. We mention these differences because |
| 459 | almost all 80386 documents use Intel syntax. Notable differences |
| 460 | between the two syntaxes are: |
| 461 | |
| 462 | @cindex immediate operands, i386 |
| 463 | @cindex i386 immediate operands |
| 464 | @cindex register operands, i386 |
| 465 | @cindex i386 register operands |
| 466 | @cindex jump/call operands, i386 |
| 467 | @cindex i386 jump/call operands |
| 468 | @cindex operand delimiters, i386 |
| 469 | |
| 470 | @cindex immediate operands, x86-64 |
| 471 | @cindex x86-64 immediate operands |
| 472 | @cindex register operands, x86-64 |
| 473 | @cindex x86-64 register operands |
| 474 | @cindex jump/call operands, x86-64 |
| 475 | @cindex x86-64 jump/call operands |
| 476 | @cindex operand delimiters, x86-64 |
| 477 | @itemize @bullet |
| 478 | @item |
| 479 | AT&T immediate operands are preceded by @samp{$}; Intel immediate |
| 480 | operands are undelimited (Intel @samp{push 4} is AT&T @samp{pushl $4}). |
| 481 | AT&T register operands are preceded by @samp{%}; Intel register operands |
| 482 | are undelimited. AT&T absolute (as opposed to PC relative) jump/call |
| 483 | operands are prefixed by @samp{*}; they are undelimited in Intel syntax. |
| 484 | |
| 485 | @cindex i386 source, destination operands |
| 486 | @cindex source, destination operands; i386 |
| 487 | @cindex x86-64 source, destination operands |
| 488 | @cindex source, destination operands; x86-64 |
| 489 | @item |
| 490 | AT&T and Intel syntax use the opposite order for source and destination |
| 491 | operands. Intel @samp{add eax, 4} is @samp{addl $4, %eax}. The |
| 492 | @samp{source, dest} convention is maintained for compatibility with |
| 493 | previous Unix assemblers. Note that @samp{bound}, @samp{invlpga}, and |
| 494 | instructions with 2 immediate operands, such as the @samp{enter} |
| 495 | instruction, do @emph{not} have reversed order. @ref{i386-Bugs}. |
| 496 | |
| 497 | @cindex mnemonic suffixes, i386 |
| 498 | @cindex sizes operands, i386 |
| 499 | @cindex i386 size suffixes |
| 500 | @cindex mnemonic suffixes, x86-64 |
| 501 | @cindex sizes operands, x86-64 |
| 502 | @cindex x86-64 size suffixes |
| 503 | @item |
| 504 | In AT&T syntax the size of memory operands is determined from the last |
| 505 | character of the instruction mnemonic. Mnemonic suffixes of @samp{b}, |
| 506 | @samp{w}, @samp{l} and @samp{q} specify byte (8-bit), word (16-bit), long |
| 507 | (32-bit) and quadruple word (64-bit) memory references. Intel syntax accomplishes |
| 508 | this by prefixing memory operands (@emph{not} the instruction mnemonics) with |
| 509 | @samp{byte ptr}, @samp{word ptr}, @samp{dword ptr} and @samp{qword ptr}. Thus, |
| 510 | Intel @samp{mov al, byte ptr @var{foo}} is @samp{movb @var{foo}, %al} in AT&T |
| 511 | syntax. |
| 512 | |
| 513 | In 64-bit code, @samp{movabs} can be used to encode the @samp{mov} |
| 514 | instruction with the 64-bit displacement or immediate operand. |
| 515 | |
| 516 | @cindex return instructions, i386 |
| 517 | @cindex i386 jump, call, return |
| 518 | @cindex return instructions, x86-64 |
| 519 | @cindex x86-64 jump, call, return |
| 520 | @item |
| 521 | Immediate form long jumps and calls are |
| 522 | @samp{lcall/ljmp $@var{section}, $@var{offset}} in AT&T syntax; the |
| 523 | Intel syntax is |
| 524 | @samp{call/jmp far @var{section}:@var{offset}}. Also, the far return |
| 525 | instruction |
| 526 | is @samp{lret $@var{stack-adjust}} in AT&T syntax; Intel syntax is |
| 527 | @samp{ret far @var{stack-adjust}}. |
| 528 | |
| 529 | @cindex sections, i386 |
| 530 | @cindex i386 sections |
| 531 | @cindex sections, x86-64 |
| 532 | @cindex x86-64 sections |
| 533 | @item |
| 534 | The AT&T assembler does not provide support for multiple section |
| 535 | programs. Unix style systems expect all programs to be single sections. |
| 536 | @end itemize |
| 537 | |
| 538 | @node i386-Chars |
| 539 | @subsection Special Characters |
| 540 | |
| 541 | @cindex line comment character, i386 |
| 542 | @cindex i386 line comment character |
| 543 | The presence of a @samp{#} appearing anywhere on a line indicates the |
| 544 | start of a comment that extends to the end of that line. |
| 545 | |
| 546 | If a @samp{#} appears as the first character of a line then the whole |
| 547 | line is treated as a comment, but in this case the line can also be a |
| 548 | logical line number directive (@pxref{Comments}) or a preprocessor |
| 549 | control command (@pxref{Preprocessing}). |
| 550 | |
| 551 | If the @option{--divide} command line option has not been specified |
| 552 | then the @samp{/} character appearing anywhere on a line also |
| 553 | introduces a line comment. |
| 554 | |
| 555 | @cindex line separator, i386 |
| 556 | @cindex statement separator, i386 |
| 557 | @cindex i386 line separator |
| 558 | The @samp{;} character can be used to separate statements on the same |
| 559 | line. |
| 560 | |
| 561 | @node i386-Mnemonics |
| 562 | @section i386-Mnemonics |
| 563 | @subsection Instruction Naming |
| 564 | |
| 565 | @cindex i386 instruction naming |
| 566 | @cindex instruction naming, i386 |
| 567 | @cindex x86-64 instruction naming |
| 568 | @cindex instruction naming, x86-64 |
| 569 | |
| 570 | Instruction mnemonics are suffixed with one character modifiers which |
| 571 | specify the size of operands. The letters @samp{b}, @samp{w}, @samp{l} |
| 572 | and @samp{q} specify byte, word, long and quadruple word operands. If |
| 573 | no suffix is specified by an instruction then @code{@value{AS}} tries to |
| 574 | fill in the missing suffix based on the destination register operand |
| 575 | (the last one by convention). Thus, @samp{mov %ax, %bx} is equivalent |
| 576 | to @samp{movw %ax, %bx}; also, @samp{mov $1, %bx} is equivalent to |
| 577 | @samp{movw $1, bx}. Note that this is incompatible with the AT&T Unix |
| 578 | assembler which assumes that a missing mnemonic suffix implies long |
| 579 | operand size. (This incompatibility does not affect compiler output |
| 580 | since compilers always explicitly specify the mnemonic suffix.) |
| 581 | |
| 582 | Almost all instructions have the same names in AT&T and Intel format. |
| 583 | There are a few exceptions. The sign extend and zero extend |
| 584 | instructions need two sizes to specify them. They need a size to |
| 585 | sign/zero extend @emph{from} and a size to zero extend @emph{to}. This |
| 586 | is accomplished by using two instruction mnemonic suffixes in AT&T |
| 587 | syntax. Base names for sign extend and zero extend are |
| 588 | @samp{movs@dots{}} and @samp{movz@dots{}} in AT&T syntax (@samp{movsx} |
| 589 | and @samp{movzx} in Intel syntax). The instruction mnemonic suffixes |
| 590 | are tacked on to this base name, the @emph{from} suffix before the |
| 591 | @emph{to} suffix. Thus, @samp{movsbl %al, %edx} is AT&T syntax for |
| 592 | ``move sign extend @emph{from} %al @emph{to} %edx.'' Possible suffixes, |
| 593 | thus, are @samp{bl} (from byte to long), @samp{bw} (from byte to word), |
| 594 | @samp{wl} (from word to long), @samp{bq} (from byte to quadruple word), |
| 595 | @samp{wq} (from word to quadruple word), and @samp{lq} (from long to |
| 596 | quadruple word). |
| 597 | |
| 598 | @cindex encoding options, i386 |
| 599 | @cindex encoding options, x86-64 |
| 600 | |
| 601 | Different encoding options can be specified via pseudo prefixes: |
| 602 | |
| 603 | @itemize @bullet |
| 604 | @item |
| 605 | @samp{@{disp8@}} -- prefer 8-bit displacement. |
| 606 | |
| 607 | @item |
| 608 | @samp{@{disp32@}} -- prefer 32-bit displacement. |
| 609 | |
| 610 | @item |
| 611 | @samp{@{load@}} -- prefer load-form instruction. |
| 612 | |
| 613 | @item |
| 614 | @samp{@{store@}} -- prefer store-form instruction. |
| 615 | |
| 616 | @item |
| 617 | @samp{@{vex2@}} -- prefer 2-byte VEX prefix for VEX instruction. |
| 618 | |
| 619 | @item |
| 620 | @samp{@{vex3@}} -- prefer 3-byte VEX prefix for VEX instruction. |
| 621 | |
| 622 | @item |
| 623 | @samp{@{evex@}} -- encode with EVEX prefix. |
| 624 | @end itemize |
| 625 | |
| 626 | @cindex conversion instructions, i386 |
| 627 | @cindex i386 conversion instructions |
| 628 | @cindex conversion instructions, x86-64 |
| 629 | @cindex x86-64 conversion instructions |
| 630 | The Intel-syntax conversion instructions |
| 631 | |
| 632 | @itemize @bullet |
| 633 | @item |
| 634 | @samp{cbw} --- sign-extend byte in @samp{%al} to word in @samp{%ax}, |
| 635 | |
| 636 | @item |
| 637 | @samp{cwde} --- sign-extend word in @samp{%ax} to long in @samp{%eax}, |
| 638 | |
| 639 | @item |
| 640 | @samp{cwd} --- sign-extend word in @samp{%ax} to long in @samp{%dx:%ax}, |
| 641 | |
| 642 | @item |
| 643 | @samp{cdq} --- sign-extend dword in @samp{%eax} to quad in @samp{%edx:%eax}, |
| 644 | |
| 645 | @item |
| 646 | @samp{cdqe} --- sign-extend dword in @samp{%eax} to quad in @samp{%rax} |
| 647 | (x86-64 only), |
| 648 | |
| 649 | @item |
| 650 | @samp{cqo} --- sign-extend quad in @samp{%rax} to octuple in |
| 651 | @samp{%rdx:%rax} (x86-64 only), |
| 652 | @end itemize |
| 653 | |
| 654 | @noindent |
| 655 | are called @samp{cbtw}, @samp{cwtl}, @samp{cwtd}, @samp{cltd}, @samp{cltq}, and |
| 656 | @samp{cqto} in AT&T naming. @code{@value{AS}} accepts either naming for these |
| 657 | instructions. |
| 658 | |
| 659 | @cindex jump instructions, i386 |
| 660 | @cindex call instructions, i386 |
| 661 | @cindex jump instructions, x86-64 |
| 662 | @cindex call instructions, x86-64 |
| 663 | Far call/jump instructions are @samp{lcall} and @samp{ljmp} in |
| 664 | AT&T syntax, but are @samp{call far} and @samp{jump far} in Intel |
| 665 | convention. |
| 666 | |
| 667 | @subsection AT&T Mnemonic versus Intel Mnemonic |
| 668 | |
| 669 | @cindex i386 mnemonic compatibility |
| 670 | @cindex mnemonic compatibility, i386 |
| 671 | |
| 672 | @code{@value{AS}} supports assembly using Intel mnemonic. |
| 673 | @code{.intel_mnemonic} selects Intel mnemonic with Intel syntax, and |
| 674 | @code{.att_mnemonic} switches back to the usual AT&T mnemonic with AT&T |
| 675 | syntax for compatibility with the output of @code{@value{GCC}}. |
| 676 | Several x87 instructions, @samp{fadd}, @samp{fdiv}, @samp{fdivp}, |
| 677 | @samp{fdivr}, @samp{fdivrp}, @samp{fmul}, @samp{fsub}, @samp{fsubp}, |
| 678 | @samp{fsubr} and @samp{fsubrp}, are implemented in AT&T System V/386 |
| 679 | assembler with different mnemonics from those in Intel IA32 specification. |
| 680 | @code{@value{GCC}} generates those instructions with AT&T mnemonic. |
| 681 | |
| 682 | @node i386-Regs |
| 683 | @section Register Naming |
| 684 | |
| 685 | @cindex i386 registers |
| 686 | @cindex registers, i386 |
| 687 | @cindex x86-64 registers |
| 688 | @cindex registers, x86-64 |
| 689 | Register operands are always prefixed with @samp{%}. The 80386 registers |
| 690 | consist of |
| 691 | |
| 692 | @itemize @bullet |
| 693 | @item |
| 694 | the 8 32-bit registers @samp{%eax} (the accumulator), @samp{%ebx}, |
| 695 | @samp{%ecx}, @samp{%edx}, @samp{%edi}, @samp{%esi}, @samp{%ebp} (the |
| 696 | frame pointer), and @samp{%esp} (the stack pointer). |
| 697 | |
| 698 | @item |
| 699 | the 8 16-bit low-ends of these: @samp{%ax}, @samp{%bx}, @samp{%cx}, |
| 700 | @samp{%dx}, @samp{%di}, @samp{%si}, @samp{%bp}, and @samp{%sp}. |
| 701 | |
| 702 | @item |
| 703 | the 8 8-bit registers: @samp{%ah}, @samp{%al}, @samp{%bh}, |
| 704 | @samp{%bl}, @samp{%ch}, @samp{%cl}, @samp{%dh}, and @samp{%dl} (These |
| 705 | are the high-bytes and low-bytes of @samp{%ax}, @samp{%bx}, |
| 706 | @samp{%cx}, and @samp{%dx}) |
| 707 | |
| 708 | @item |
| 709 | the 6 section registers @samp{%cs} (code section), @samp{%ds} |
| 710 | (data section), @samp{%ss} (stack section), @samp{%es}, @samp{%fs}, |
| 711 | and @samp{%gs}. |
| 712 | |
| 713 | @item |
| 714 | the 5 processor control registers @samp{%cr0}, @samp{%cr2}, |
| 715 | @samp{%cr3}, @samp{%cr4}, and @samp{%cr8}. |
| 716 | |
| 717 | @item |
| 718 | the 6 debug registers @samp{%db0}, @samp{%db1}, @samp{%db2}, |
| 719 | @samp{%db3}, @samp{%db6}, and @samp{%db7}. |
| 720 | |
| 721 | @item |
| 722 | the 2 test registers @samp{%tr6} and @samp{%tr7}. |
| 723 | |
| 724 | @item |
| 725 | the 8 floating point register stack @samp{%st} or equivalently |
| 726 | @samp{%st(0)}, @samp{%st(1)}, @samp{%st(2)}, @samp{%st(3)}, |
| 727 | @samp{%st(4)}, @samp{%st(5)}, @samp{%st(6)}, and @samp{%st(7)}. |
| 728 | These registers are overloaded by 8 MMX registers @samp{%mm0}, |
| 729 | @samp{%mm1}, @samp{%mm2}, @samp{%mm3}, @samp{%mm4}, @samp{%mm5}, |
| 730 | @samp{%mm6} and @samp{%mm7}. |
| 731 | |
| 732 | @item |
| 733 | the 8 128-bit SSE registers registers @samp{%xmm0}, @samp{%xmm1}, @samp{%xmm2}, |
| 734 | @samp{%xmm3}, @samp{%xmm4}, @samp{%xmm5}, @samp{%xmm6} and @samp{%xmm7}. |
| 735 | @end itemize |
| 736 | |
| 737 | The AMD x86-64 architecture extends the register set by: |
| 738 | |
| 739 | @itemize @bullet |
| 740 | @item |
| 741 | enhancing the 8 32-bit registers to 64-bit: @samp{%rax} (the |
| 742 | accumulator), @samp{%rbx}, @samp{%rcx}, @samp{%rdx}, @samp{%rdi}, |
| 743 | @samp{%rsi}, @samp{%rbp} (the frame pointer), @samp{%rsp} (the stack |
| 744 | pointer) |
| 745 | |
| 746 | @item |
| 747 | the 8 extended registers @samp{%r8}--@samp{%r15}. |
| 748 | |
| 749 | @item |
| 750 | the 8 32-bit low ends of the extended registers: @samp{%r8d}--@samp{%r15d}. |
| 751 | |
| 752 | @item |
| 753 | the 8 16-bit low ends of the extended registers: @samp{%r8w}--@samp{%r15w}. |
| 754 | |
| 755 | @item |
| 756 | the 8 8-bit low ends of the extended registers: @samp{%r8b}--@samp{%r15b}. |
| 757 | |
| 758 | @item |
| 759 | the 4 8-bit registers: @samp{%sil}, @samp{%dil}, @samp{%bpl}, @samp{%spl}. |
| 760 | |
| 761 | @item |
| 762 | the 8 debug registers: @samp{%db8}--@samp{%db15}. |
| 763 | |
| 764 | @item |
| 765 | the 8 128-bit SSE registers: @samp{%xmm8}--@samp{%xmm15}. |
| 766 | @end itemize |
| 767 | |
| 768 | With the AVX extensions more registers were made available: |
| 769 | |
| 770 | @itemize @bullet |
| 771 | |
| 772 | @item |
| 773 | the 16 256-bit SSE @samp{%ymm0}--@samp{%ymm15} (only the first 8 |
| 774 | available in 32-bit mode). The bottom 128 bits are overlaid with the |
| 775 | @samp{xmm0}--@samp{xmm15} registers. |
| 776 | |
| 777 | @end itemize |
| 778 | |
| 779 | The AVX2 extensions made in 64-bit mode more registers available: |
| 780 | |
| 781 | @itemize @bullet |
| 782 | |
| 783 | @item |
| 784 | the 16 128-bit registers @samp{%xmm16}--@samp{%xmm31} and the 16 256-bit |
| 785 | registers @samp{%ymm16}--@samp{%ymm31}. |
| 786 | |
| 787 | @end itemize |
| 788 | |
| 789 | The AVX512 extensions added the following registers: |
| 790 | |
| 791 | @itemize @bullet |
| 792 | |
| 793 | @item |
| 794 | the 32 512-bit registers @samp{%zmm0}--@samp{%zmm31} (only the first 8 |
| 795 | available in 32-bit mode). The bottom 128 bits are overlaid with the |
| 796 | @samp{%xmm0}--@samp{%xmm31} registers and the first 256 bits are |
| 797 | overlaid with the @samp{%ymm0}--@samp{%ymm31} registers. |
| 798 | |
| 799 | @item |
| 800 | the 8 mask registers @samp{%k0}--@samp{%k7}. |
| 801 | |
| 802 | @end itemize |
| 803 | |
| 804 | @node i386-Prefixes |
| 805 | @section Instruction Prefixes |
| 806 | |
| 807 | @cindex i386 instruction prefixes |
| 808 | @cindex instruction prefixes, i386 |
| 809 | @cindex prefixes, i386 |
| 810 | Instruction prefixes are used to modify the following instruction. They |
| 811 | are used to repeat string instructions, to provide section overrides, to |
| 812 | perform bus lock operations, and to change operand and address sizes. |
| 813 | (Most instructions that normally operate on 32-bit operands will use |
| 814 | 16-bit operands if the instruction has an ``operand size'' prefix.) |
| 815 | Instruction prefixes are best written on the same line as the instruction |
| 816 | they act upon. For example, the @samp{scas} (scan string) instruction is |
| 817 | repeated with: |
| 818 | |
| 819 | @smallexample |
| 820 | repne scas %es:(%edi),%al |
| 821 | @end smallexample |
| 822 | |
| 823 | You may also place prefixes on the lines immediately preceding the |
| 824 | instruction, but this circumvents checks that @code{@value{AS}} does |
| 825 | with prefixes, and will not work with all prefixes. |
| 826 | |
| 827 | Here is a list of instruction prefixes: |
| 828 | |
| 829 | @cindex section override prefixes, i386 |
| 830 | @itemize @bullet |
| 831 | @item |
| 832 | Section override prefixes @samp{cs}, @samp{ds}, @samp{ss}, @samp{es}, |
| 833 | @samp{fs}, @samp{gs}. These are automatically added by specifying |
| 834 | using the @var{section}:@var{memory-operand} form for memory references. |
| 835 | |
| 836 | @cindex size prefixes, i386 |
| 837 | @item |
| 838 | Operand/Address size prefixes @samp{data16} and @samp{addr16} |
| 839 | change 32-bit operands/addresses into 16-bit operands/addresses, |
| 840 | while @samp{data32} and @samp{addr32} change 16-bit ones (in a |
| 841 | @code{.code16} section) into 32-bit operands/addresses. These prefixes |
| 842 | @emph{must} appear on the same line of code as the instruction they |
| 843 | modify. For example, in a 16-bit @code{.code16} section, you might |
| 844 | write: |
| 845 | |
| 846 | @smallexample |
| 847 | addr32 jmpl *(%ebx) |
| 848 | @end smallexample |
| 849 | |
| 850 | @cindex bus lock prefixes, i386 |
| 851 | @cindex inhibiting interrupts, i386 |
| 852 | @item |
| 853 | The bus lock prefix @samp{lock} inhibits interrupts during execution of |
| 854 | the instruction it precedes. (This is only valid with certain |
| 855 | instructions; see a 80386 manual for details). |
| 856 | |
| 857 | @cindex coprocessor wait, i386 |
| 858 | @item |
| 859 | The wait for coprocessor prefix @samp{wait} waits for the coprocessor to |
| 860 | complete the current instruction. This should never be needed for the |
| 861 | 80386/80387 combination. |
| 862 | |
| 863 | @cindex repeat prefixes, i386 |
| 864 | @item |
| 865 | The @samp{rep}, @samp{repe}, and @samp{repne} prefixes are added |
| 866 | to string instructions to make them repeat @samp{%ecx} times (@samp{%cx} |
| 867 | times if the current address size is 16-bits). |
| 868 | @cindex REX prefixes, i386 |
| 869 | @item |
| 870 | The @samp{rex} family of prefixes is used by x86-64 to encode |
| 871 | extensions to i386 instruction set. The @samp{rex} prefix has four |
| 872 | bits --- an operand size overwrite (@code{64}) used to change operand size |
| 873 | from 32-bit to 64-bit and X, Y and Z extensions bits used to extend the |
| 874 | register set. |
| 875 | |
| 876 | You may write the @samp{rex} prefixes directly. The @samp{rex64xyz} |
| 877 | instruction emits @samp{rex} prefix with all the bits set. By omitting |
| 878 | the @code{64}, @code{x}, @code{y} or @code{z} you may write other |
| 879 | prefixes as well. Normally, there is no need to write the prefixes |
| 880 | explicitly, since gas will automatically generate them based on the |
| 881 | instruction operands. |
| 882 | @end itemize |
| 883 | |
| 884 | @node i386-Memory |
| 885 | @section Memory References |
| 886 | |
| 887 | @cindex i386 memory references |
| 888 | @cindex memory references, i386 |
| 889 | @cindex x86-64 memory references |
| 890 | @cindex memory references, x86-64 |
| 891 | An Intel syntax indirect memory reference of the form |
| 892 | |
| 893 | @smallexample |
| 894 | @var{section}:[@var{base} + @var{index}*@var{scale} + @var{disp}] |
| 895 | @end smallexample |
| 896 | |
| 897 | @noindent |
| 898 | is translated into the AT&T syntax |
| 899 | |
| 900 | @smallexample |
| 901 | @var{section}:@var{disp}(@var{base}, @var{index}, @var{scale}) |
| 902 | @end smallexample |
| 903 | |
| 904 | @noindent |
| 905 | where @var{base} and @var{index} are the optional 32-bit base and |
| 906 | index registers, @var{disp} is the optional displacement, and |
| 907 | @var{scale}, taking the values 1, 2, 4, and 8, multiplies @var{index} |
| 908 | to calculate the address of the operand. If no @var{scale} is |
| 909 | specified, @var{scale} is taken to be 1. @var{section} specifies the |
| 910 | optional section register for the memory operand, and may override the |
| 911 | default section register (see a 80386 manual for section register |
| 912 | defaults). Note that section overrides in AT&T syntax @emph{must} |
| 913 | be preceded by a @samp{%}. If you specify a section override which |
| 914 | coincides with the default section register, @code{@value{AS}} does @emph{not} |
| 915 | output any section register override prefixes to assemble the given |
| 916 | instruction. Thus, section overrides can be specified to emphasize which |
| 917 | section register is used for a given memory operand. |
| 918 | |
| 919 | Here are some examples of Intel and AT&T style memory references: |
| 920 | |
| 921 | @table @asis |
| 922 | @item AT&T: @samp{-4(%ebp)}, Intel: @samp{[ebp - 4]} |
| 923 | @var{base} is @samp{%ebp}; @var{disp} is @samp{-4}. @var{section} is |
| 924 | missing, and the default section is used (@samp{%ss} for addressing with |
| 925 | @samp{%ebp} as the base register). @var{index}, @var{scale} are both missing. |
| 926 | |
| 927 | @item AT&T: @samp{foo(,%eax,4)}, Intel: @samp{[foo + eax*4]} |
| 928 | @var{index} is @samp{%eax} (scaled by a @var{scale} 4); @var{disp} is |
| 929 | @samp{foo}. All other fields are missing. The section register here |
| 930 | defaults to @samp{%ds}. |
| 931 | |
| 932 | @item AT&T: @samp{foo(,1)}; Intel @samp{[foo]} |
| 933 | This uses the value pointed to by @samp{foo} as a memory operand. |
| 934 | Note that @var{base} and @var{index} are both missing, but there is only |
| 935 | @emph{one} @samp{,}. This is a syntactic exception. |
| 936 | |
| 937 | @item AT&T: @samp{%gs:foo}; Intel @samp{gs:foo} |
| 938 | This selects the contents of the variable @samp{foo} with section |
| 939 | register @var{section} being @samp{%gs}. |
| 940 | @end table |
| 941 | |
| 942 | Absolute (as opposed to PC relative) call and jump operands must be |
| 943 | prefixed with @samp{*}. If no @samp{*} is specified, @code{@value{AS}} |
| 944 | always chooses PC relative addressing for jump/call labels. |
| 945 | |
| 946 | Any instruction that has a memory operand, but no register operand, |
| 947 | @emph{must} specify its size (byte, word, long, or quadruple) with an |
| 948 | instruction mnemonic suffix (@samp{b}, @samp{w}, @samp{l} or @samp{q}, |
| 949 | respectively). |
| 950 | |
| 951 | The x86-64 architecture adds an RIP (instruction pointer relative) |
| 952 | addressing. This addressing mode is specified by using @samp{rip} as a |
| 953 | base register. Only constant offsets are valid. For example: |
| 954 | |
| 955 | @table @asis |
| 956 | @item AT&T: @samp{1234(%rip)}, Intel: @samp{[rip + 1234]} |
| 957 | Points to the address 1234 bytes past the end of the current |
| 958 | instruction. |
| 959 | |
| 960 | @item AT&T: @samp{symbol(%rip)}, Intel: @samp{[rip + symbol]} |
| 961 | Points to the @code{symbol} in RIP relative way, this is shorter than |
| 962 | the default absolute addressing. |
| 963 | @end table |
| 964 | |
| 965 | Other addressing modes remain unchanged in x86-64 architecture, except |
| 966 | registers used are 64-bit instead of 32-bit. |
| 967 | |
| 968 | @node i386-Jumps |
| 969 | @section Handling of Jump Instructions |
| 970 | |
| 971 | @cindex jump optimization, i386 |
| 972 | @cindex i386 jump optimization |
| 973 | @cindex jump optimization, x86-64 |
| 974 | @cindex x86-64 jump optimization |
| 975 | Jump instructions are always optimized to use the smallest possible |
| 976 | displacements. This is accomplished by using byte (8-bit) displacement |
| 977 | jumps whenever the target is sufficiently close. If a byte displacement |
| 978 | is insufficient a long displacement is used. We do not support |
| 979 | word (16-bit) displacement jumps in 32-bit mode (i.e. prefixing the jump |
| 980 | instruction with the @samp{data16} instruction prefix), since the 80386 |
| 981 | insists upon masking @samp{%eip} to 16 bits after the word displacement |
| 982 | is added. (See also @pxref{i386-Arch}) |
| 983 | |
| 984 | Note that the @samp{jcxz}, @samp{jecxz}, @samp{loop}, @samp{loopz}, |
| 985 | @samp{loope}, @samp{loopnz} and @samp{loopne} instructions only come in byte |
| 986 | displacements, so that if you use these instructions (@code{@value{GCC}} does |
| 987 | not use them) you may get an error message (and incorrect code). The AT&T |
| 988 | 80386 assembler tries to get around this problem by expanding @samp{jcxz foo} |
| 989 | to |
| 990 | |
| 991 | @smallexample |
| 992 | jcxz cx_zero |
| 993 | jmp cx_nonzero |
| 994 | cx_zero: jmp foo |
| 995 | cx_nonzero: |
| 996 | @end smallexample |
| 997 | |
| 998 | @node i386-Float |
| 999 | @section Floating Point |
| 1000 | |
| 1001 | @cindex i386 floating point |
| 1002 | @cindex floating point, i386 |
| 1003 | @cindex x86-64 floating point |
| 1004 | @cindex floating point, x86-64 |
| 1005 | All 80387 floating point types except packed BCD are supported. |
| 1006 | (BCD support may be added without much difficulty). These data |
| 1007 | types are 16-, 32-, and 64- bit integers, and single (32-bit), |
| 1008 | double (64-bit), and extended (80-bit) precision floating point. |
| 1009 | Each supported type has an instruction mnemonic suffix and a constructor |
| 1010 | associated with it. Instruction mnemonic suffixes specify the operand's |
| 1011 | data type. Constructors build these data types into memory. |
| 1012 | |
| 1013 | @cindex @code{float} directive, i386 |
| 1014 | @cindex @code{single} directive, i386 |
| 1015 | @cindex @code{double} directive, i386 |
| 1016 | @cindex @code{tfloat} directive, i386 |
| 1017 | @cindex @code{float} directive, x86-64 |
| 1018 | @cindex @code{single} directive, x86-64 |
| 1019 | @cindex @code{double} directive, x86-64 |
| 1020 | @cindex @code{tfloat} directive, x86-64 |
| 1021 | @itemize @bullet |
| 1022 | @item |
| 1023 | Floating point constructors are @samp{.float} or @samp{.single}, |
| 1024 | @samp{.double}, and @samp{.tfloat} for 32-, 64-, and 80-bit formats. |
| 1025 | These correspond to instruction mnemonic suffixes @samp{s}, @samp{l}, |
| 1026 | and @samp{t}. @samp{t} stands for 80-bit (ten byte) real. The 80387 |
| 1027 | only supports this format via the @samp{fldt} (load 80-bit real to stack |
| 1028 | top) and @samp{fstpt} (store 80-bit real and pop stack) instructions. |
| 1029 | |
| 1030 | @cindex @code{word} directive, i386 |
| 1031 | @cindex @code{long} directive, i386 |
| 1032 | @cindex @code{int} directive, i386 |
| 1033 | @cindex @code{quad} directive, i386 |
| 1034 | @cindex @code{word} directive, x86-64 |
| 1035 | @cindex @code{long} directive, x86-64 |
| 1036 | @cindex @code{int} directive, x86-64 |
| 1037 | @cindex @code{quad} directive, x86-64 |
| 1038 | @item |
| 1039 | Integer constructors are @samp{.word}, @samp{.long} or @samp{.int}, and |
| 1040 | @samp{.quad} for the 16-, 32-, and 64-bit integer formats. The |
| 1041 | corresponding instruction mnemonic suffixes are @samp{s} (single), |
| 1042 | @samp{l} (long), and @samp{q} (quad). As with the 80-bit real format, |
| 1043 | the 64-bit @samp{q} format is only present in the @samp{fildq} (load |
| 1044 | quad integer to stack top) and @samp{fistpq} (store quad integer and pop |
| 1045 | stack) instructions. |
| 1046 | @end itemize |
| 1047 | |
| 1048 | Register to register operations should not use instruction mnemonic suffixes. |
| 1049 | @samp{fstl %st, %st(1)} will give a warning, and be assembled as if you |
| 1050 | wrote @samp{fst %st, %st(1)}, since all register to register operations |
| 1051 | use 80-bit floating point operands. (Contrast this with @samp{fstl %st, mem}, |
| 1052 | which converts @samp{%st} from 80-bit to 64-bit floating point format, |
| 1053 | then stores the result in the 4 byte location @samp{mem}) |
| 1054 | |
| 1055 | @node i386-SIMD |
| 1056 | @section Intel's MMX and AMD's 3DNow! SIMD Operations |
| 1057 | |
| 1058 | @cindex MMX, i386 |
| 1059 | @cindex 3DNow!, i386 |
| 1060 | @cindex SIMD, i386 |
| 1061 | @cindex MMX, x86-64 |
| 1062 | @cindex 3DNow!, x86-64 |
| 1063 | @cindex SIMD, x86-64 |
| 1064 | |
| 1065 | @code{@value{AS}} supports Intel's MMX instruction set (SIMD |
| 1066 | instructions for integer data), available on Intel's Pentium MMX |
| 1067 | processors and Pentium II processors, AMD's K6 and K6-2 processors, |
| 1068 | Cyrix' M2 processor, and probably others. It also supports AMD's 3DNow!@: |
| 1069 | instruction set (SIMD instructions for 32-bit floating point data) |
| 1070 | available on AMD's K6-2 processor and possibly others in the future. |
| 1071 | |
| 1072 | Currently, @code{@value{AS}} does not support Intel's floating point |
| 1073 | SIMD, Katmai (KNI). |
| 1074 | |
| 1075 | The eight 64-bit MMX operands, also used by 3DNow!, are called @samp{%mm0}, |
| 1076 | @samp{%mm1}, ... @samp{%mm7}. They contain eight 8-bit integers, four |
| 1077 | 16-bit integers, two 32-bit integers, one 64-bit integer, or two 32-bit |
| 1078 | floating point values. The MMX registers cannot be used at the same time |
| 1079 | as the floating point stack. |
| 1080 | |
| 1081 | See Intel and AMD documentation, keeping in mind that the operand order in |
| 1082 | instructions is reversed from the Intel syntax. |
| 1083 | |
| 1084 | @node i386-LWP |
| 1085 | @section AMD's Lightweight Profiling Instructions |
| 1086 | |
| 1087 | @cindex LWP, i386 |
| 1088 | @cindex LWP, x86-64 |
| 1089 | |
| 1090 | @code{@value{AS}} supports AMD's Lightweight Profiling (LWP) |
| 1091 | instruction set, available on AMD's Family 15h (Orochi) processors. |
| 1092 | |
| 1093 | LWP enables applications to collect and manage performance data, and |
| 1094 | react to performance events. The collection of performance data |
| 1095 | requires no context switches. LWP runs in the context of a thread and |
| 1096 | so several counters can be used independently across multiple threads. |
| 1097 | LWP can be used in both 64-bit and legacy 32-bit modes. |
| 1098 | |
| 1099 | For detailed information on the LWP instruction set, see the |
| 1100 | @cite{AMD Lightweight Profiling Specification} available at |
| 1101 | @uref{http://developer.amd.com/cpu/LWP,Lightweight Profiling Specification}. |
| 1102 | |
| 1103 | @node i386-BMI |
| 1104 | @section Bit Manipulation Instructions |
| 1105 | |
| 1106 | @cindex BMI, i386 |
| 1107 | @cindex BMI, x86-64 |
| 1108 | |
| 1109 | @code{@value{AS}} supports the Bit Manipulation (BMI) instruction set. |
| 1110 | |
| 1111 | BMI instructions provide several instructions implementing individual |
| 1112 | bit manipulation operations such as isolation, masking, setting, or |
| 1113 | resetting. |
| 1114 | |
| 1115 | @c Need to add a specification citation here when available. |
| 1116 | |
| 1117 | @node i386-TBM |
| 1118 | @section AMD's Trailing Bit Manipulation Instructions |
| 1119 | |
| 1120 | @cindex TBM, i386 |
| 1121 | @cindex TBM, x86-64 |
| 1122 | |
| 1123 | @code{@value{AS}} supports AMD's Trailing Bit Manipulation (TBM) |
| 1124 | instruction set, available on AMD's BDVER2 processors (Trinity and |
| 1125 | Viperfish). |
| 1126 | |
| 1127 | TBM instructions provide instructions implementing individual bit |
| 1128 | manipulation operations such as isolating, masking, setting, resetting, |
| 1129 | complementing, and operations on trailing zeros and ones. |
| 1130 | |
| 1131 | @c Need to add a specification citation here when available. |
| 1132 | |
| 1133 | @node i386-16bit |
| 1134 | @section Writing 16-bit Code |
| 1135 | |
| 1136 | @cindex i386 16-bit code |
| 1137 | @cindex 16-bit code, i386 |
| 1138 | @cindex real-mode code, i386 |
| 1139 | @cindex @code{code16gcc} directive, i386 |
| 1140 | @cindex @code{code16} directive, i386 |
| 1141 | @cindex @code{code32} directive, i386 |
| 1142 | @cindex @code{code64} directive, i386 |
| 1143 | @cindex @code{code64} directive, x86-64 |
| 1144 | While @code{@value{AS}} normally writes only ``pure'' 32-bit i386 code |
| 1145 | or 64-bit x86-64 code depending on the default configuration, |
| 1146 | it also supports writing code to run in real mode or in 16-bit protected |
| 1147 | mode code segments. To do this, put a @samp{.code16} or |
| 1148 | @samp{.code16gcc} directive before the assembly language instructions to |
| 1149 | be run in 16-bit mode. You can switch @code{@value{AS}} to writing |
| 1150 | 32-bit code with the @samp{.code32} directive or 64-bit code with the |
| 1151 | @samp{.code64} directive. |
| 1152 | |
| 1153 | @samp{.code16gcc} provides experimental support for generating 16-bit |
| 1154 | code from gcc, and differs from @samp{.code16} in that @samp{call}, |
| 1155 | @samp{ret}, @samp{enter}, @samp{leave}, @samp{push}, @samp{pop}, |
| 1156 | @samp{pusha}, @samp{popa}, @samp{pushf}, and @samp{popf} instructions |
| 1157 | default to 32-bit size. This is so that the stack pointer is |
| 1158 | manipulated in the same way over function calls, allowing access to |
| 1159 | function parameters at the same stack offsets as in 32-bit mode. |
| 1160 | @samp{.code16gcc} also automatically adds address size prefixes where |
| 1161 | necessary to use the 32-bit addressing modes that gcc generates. |
| 1162 | |
| 1163 | The code which @code{@value{AS}} generates in 16-bit mode will not |
| 1164 | necessarily run on a 16-bit pre-80386 processor. To write code that |
| 1165 | runs on such a processor, you must refrain from using @emph{any} 32-bit |
| 1166 | constructs which require @code{@value{AS}} to output address or operand |
| 1167 | size prefixes. |
| 1168 | |
| 1169 | Note that writing 16-bit code instructions by explicitly specifying a |
| 1170 | prefix or an instruction mnemonic suffix within a 32-bit code section |
| 1171 | generates different machine instructions than those generated for a |
| 1172 | 16-bit code segment. In a 32-bit code section, the following code |
| 1173 | generates the machine opcode bytes @samp{66 6a 04}, which pushes the |
| 1174 | value @samp{4} onto the stack, decrementing @samp{%esp} by 2. |
| 1175 | |
| 1176 | @smallexample |
| 1177 | pushw $4 |
| 1178 | @end smallexample |
| 1179 | |
| 1180 | The same code in a 16-bit code section would generate the machine |
| 1181 | opcode bytes @samp{6a 04} (i.e., without the operand size prefix), which |
| 1182 | is correct since the processor default operand size is assumed to be 16 |
| 1183 | bits in a 16-bit code section. |
| 1184 | |
| 1185 | @node i386-Arch |
| 1186 | @section Specifying CPU Architecture |
| 1187 | |
| 1188 | @cindex arch directive, i386 |
| 1189 | @cindex i386 arch directive |
| 1190 | @cindex arch directive, x86-64 |
| 1191 | @cindex x86-64 arch directive |
| 1192 | |
| 1193 | @code{@value{AS}} may be told to assemble for a particular CPU |
| 1194 | (sub-)architecture with the @code{.arch @var{cpu_type}} directive. This |
| 1195 | directive enables a warning when gas detects an instruction that is not |
| 1196 | supported on the CPU specified. The choices for @var{cpu_type} are: |
| 1197 | |
| 1198 | @multitable @columnfractions .20 .20 .20 .20 |
| 1199 | @item @samp{i8086} @tab @samp{i186} @tab @samp{i286} @tab @samp{i386} |
| 1200 | @item @samp{i486} @tab @samp{i586} @tab @samp{i686} @tab @samp{pentium} |
| 1201 | @item @samp{pentiumpro} @tab @samp{pentiumii} @tab @samp{pentiumiii} @tab @samp{pentium4} |
| 1202 | @item @samp{prescott} @tab @samp{nocona} @tab @samp{core} @tab @samp{core2} |
| 1203 | @item @samp{corei7} @tab @samp{l1om} @tab @samp{k1om} @samp{iamcu} |
| 1204 | @item @samp{k6} @tab @samp{k6_2} @tab @samp{athlon} @tab @samp{k8} |
| 1205 | @item @samp{amdfam10} @tab @samp{bdver1} @tab @samp{bdver2} @tab @samp{bdver3} |
| 1206 | @item @samp{bdver4} @tab @samp{znver1} @tab @samp{btver1} @tab @samp{btver2} |
| 1207 | @item @samp{generic32} @tab @samp{generic64} |
| 1208 | @item @samp{.mmx} @tab @samp{.sse} @tab @samp{.sse2} @tab @samp{.sse3} |
| 1209 | @item @samp{.ssse3} @tab @samp{.sse4.1} @tab @samp{.sse4.2} @tab @samp{.sse4} |
| 1210 | @item @samp{.avx} @tab @samp{.vmx} @tab @samp{.smx} @tab @samp{.ept} |
| 1211 | @item @samp{.clflush} @tab @samp{.movbe} @tab @samp{.xsave} @tab @samp{.xsaveopt} |
| 1212 | @item @samp{.aes} @tab @samp{.pclmul} @tab @samp{.fma} @tab @samp{.fsgsbase} |
| 1213 | @item @samp{.rdrnd} @tab @samp{.f16c} @tab @samp{.avx2} @tab @samp{.bmi2} |
| 1214 | @item @samp{.lzcnt} @tab @samp{.invpcid} @tab @samp{.vmfunc} @tab @samp{.hle} |
| 1215 | @item @samp{.rtm} @tab @samp{.adx} @tab @samp{.rdseed} @tab @samp{.prfchw} |
| 1216 | @item @samp{.smap} @tab @samp{.mpx} @tab @samp{.sha} @tab @samp{.prefetchwt1} |
| 1217 | @item @samp{.clflushopt} @tab @samp{.xsavec} @tab @samp{.xsaves} @tab @samp{.se1} |
| 1218 | @item @samp{.avx512f} @tab @samp{.avx512cd} @tab @samp{.avx512er} @tab @samp{.avx512pf} |
| 1219 | @item @samp{.avx512vl} @tab @samp{.avx512bw} @tab @samp{.avx512dq} @tab @samp{.avx512ifma} |
| 1220 | @item @samp{.avx512vbmi} @tab @samp{.avx512_4fmaps} @tab @samp{.avx512_4vnniw} |
| 1221 | @item @samp{.avx512_vpopcntdq} @tab @samp{.clwb} @tab @samp{.rdpid} @tab @samp{.ptwrite} |
| 1222 | @item @samp{.cet} |
| 1223 | @item @samp{.3dnow} @tab @samp{.3dnowa} @tab @samp{.sse4a} @tab @samp{.sse5} |
| 1224 | @item @samp{.syscall} @tab @samp{.rdtscp} @tab @samp{.svme} @tab @samp{.abm} |
| 1225 | @item @samp{.lwp} @tab @samp{.fma4} @tab @samp{.xop} @tab @samp{.cx16} |
| 1226 | @item @samp{.padlock} @tab @samp{.clzero} @tab @samp{.mwaitx} |
| 1227 | @end multitable |
| 1228 | |
| 1229 | Apart from the warning, there are only two other effects on |
| 1230 | @code{@value{AS}} operation; Firstly, if you specify a CPU other than |
| 1231 | @samp{i486}, then shift by one instructions such as @samp{sarl $1, %eax} |
| 1232 | will automatically use a two byte opcode sequence. The larger three |
| 1233 | byte opcode sequence is used on the 486 (and when no architecture is |
| 1234 | specified) because it executes faster on the 486. Note that you can |
| 1235 | explicitly request the two byte opcode by writing @samp{sarl %eax}. |
| 1236 | Secondly, if you specify @samp{i8086}, @samp{i186}, or @samp{i286}, |
| 1237 | @emph{and} @samp{.code16} or @samp{.code16gcc} then byte offset |
| 1238 | conditional jumps will be promoted when necessary to a two instruction |
| 1239 | sequence consisting of a conditional jump of the opposite sense around |
| 1240 | an unconditional jump to the target. |
| 1241 | |
| 1242 | Following the CPU architecture (but not a sub-architecture, which are those |
| 1243 | starting with a dot), you may specify @samp{jumps} or @samp{nojumps} to |
| 1244 | control automatic promotion of conditional jumps. @samp{jumps} is the |
| 1245 | default, and enables jump promotion; All external jumps will be of the long |
| 1246 | variety, and file-local jumps will be promoted as necessary. |
| 1247 | (@pxref{i386-Jumps}) @samp{nojumps} leaves external conditional jumps as |
| 1248 | byte offset jumps, and warns about file-local conditional jumps that |
| 1249 | @code{@value{AS}} promotes. |
| 1250 | Unconditional jumps are treated as for @samp{jumps}. |
| 1251 | |
| 1252 | For example |
| 1253 | |
| 1254 | @smallexample |
| 1255 | .arch i8086,nojumps |
| 1256 | @end smallexample |
| 1257 | |
| 1258 | @node i386-Bugs |
| 1259 | @section AT&T Syntax bugs |
| 1260 | |
| 1261 | The UnixWare assembler, and probably other AT&T derived ix86 Unix |
| 1262 | assemblers, generate floating point instructions with reversed source |
| 1263 | and destination registers in certain cases. Unfortunately, gcc and |
| 1264 | possibly many other programs use this reversed syntax, so we're stuck |
| 1265 | with it. |
| 1266 | |
| 1267 | For example |
| 1268 | |
| 1269 | @smallexample |
| 1270 | fsub %st,%st(3) |
| 1271 | @end smallexample |
| 1272 | @noindent |
| 1273 | results in @samp{%st(3)} being updated to @samp{%st - %st(3)} rather |
| 1274 | than the expected @samp{%st(3) - %st}. This happens with all the |
| 1275 | non-commutative arithmetic floating point operations with two register |
| 1276 | operands where the source register is @samp{%st} and the destination |
| 1277 | register is @samp{%st(i)}. |
| 1278 | |
| 1279 | @node i386-Notes |
| 1280 | @section Notes |
| 1281 | |
| 1282 | @cindex i386 @code{mul}, @code{imul} instructions |
| 1283 | @cindex @code{mul} instruction, i386 |
| 1284 | @cindex @code{imul} instruction, i386 |
| 1285 | @cindex @code{mul} instruction, x86-64 |
| 1286 | @cindex @code{imul} instruction, x86-64 |
| 1287 | There is some trickery concerning the @samp{mul} and @samp{imul} |
| 1288 | instructions that deserves mention. The 16-, 32-, 64- and 128-bit expanding |
| 1289 | multiplies (base opcode @samp{0xf6}; extension 4 for @samp{mul} and 5 |
| 1290 | for @samp{imul}) can be output only in the one operand form. Thus, |
| 1291 | @samp{imul %ebx, %eax} does @emph{not} select the expanding multiply; |
| 1292 | the expanding multiply would clobber the @samp{%edx} register, and this |
| 1293 | would confuse @code{@value{GCC}} output. Use @samp{imul %ebx} to get the |
| 1294 | 64-bit product in @samp{%edx:%eax}. |
| 1295 | |
| 1296 | We have added a two operand form of @samp{imul} when the first operand |
| 1297 | is an immediate mode expression and the second operand is a register. |
| 1298 | This is just a shorthand, so that, multiplying @samp{%eax} by 69, for |
| 1299 | example, can be done with @samp{imul $69, %eax} rather than @samp{imul |
| 1300 | $69, %eax, %eax}. |
| 1301 | |