   This file documents NASM, the Netwide Assembler: an assembler
targetting the Intel x86 series of processors, with portable source.

   Copyright 2002 The NASM Development Team

   All rights reserved. This document is redistributable under the
licence given in the file "COPYING" distributed in the NASM archive.

B.4.249. `PREFETCHh': Prefetch Data Into Caches
-----------------------------------------------

     PREFETCHNTA m8                ; 0F 18 /0        [KATMAI]
     PREFETCHT0 m8                 ; 0F 18 /1        [KATMAI]
     PREFETCHT1 m8                 ; 0F 18 /2        [KATMAI]
     PREFETCHT2 m8                 ; 0F 18 /3        [KATMAI]

   The `PREFETCHh' instructions fetch the line of data from memory that
contains the specified byte. It is placed in the cache according to
rules specified by locality hints `h':

   The hints are:

   * `T0' (temporal data) - prefetch data into all levels of the cache
     hierarchy.

   * `T1' (temporal data with respect to first level cache) - prefetch
     data into level 2 cache and higher.

   * `T2' (temporal data with respect to second level cache) - prefetch
     data into level 2 cache and higher.

   * `NTA' (non-temporal data with respect to all cache levels) -
     prefetch data into non-temporal cache structure and into a
     location close to the processor, minimizing cache pollution.

   Note that this group of instructions doesn't provide a guarantee
that the data will be in the cache when it is needed. For more details,
see the Intel IA32 Software Developer Manual, Volume 2.

B.4.250. `PSADBW': Packed Sum of Absolute Differences
-----------------------------------------------------

     PSADBW mm1,mm2/m64            ; 0F F6 /r        [KATMAI,MMX]
     PSADBW xmm1,xmm2/m128         ; 66 0F F6 /r     [WILLAMETTE,SSE2]

   `PSADBW' The PSADBW instruction computes the absolute value of the
difference of the packed unsigned bytes in the two source operands.
These differences are then summed to produce a word result in the lower
16-bit field of the destination register; the rest of the register is
cleared. The destination operand is an `MMX' or an `XMM' register. The
source operand can either be a register or a memory operand.

B.4.251. `PSHUFD': Shuffle Packed Doublewords
---------------------------------------------

     PSHUFD xmm1,xmm2/m128,imm8    ; 66 0F 70 /r ib  [WILLAMETTE,SSE2]

   `PSHUFD' shuffles the doublewords in the source (second) operand
according to the encoding specified by imm8, and stores the result in
the destination (first) operand.

   Bits 0 and 1 of imm8 encode the source position of the doubleword to
be copied to position 0 in the destination operand. Bits 2 and 3 encode
for position 1, bits 4 and 5 encode for position 2, and bits 6 and 7
encode for position 3. For example, an encoding of 10 in bits 0 and 1
of imm8 indicates that the doubleword at bits 64-95 of the source
operand will be copied to bits 0-31 of the destination.

B.4.252. `PSHUFHW': Shuffle Packed High Words
---------------------------------------------

     PSHUFHW xmm1,xmm2/m128,imm8   ; F3 0F 70 /r ib  [WILLAMETTE,SSE2]

   `PSHUFW' shuffles the words in the high quadword of the source
(second) operand according to the encoding specified by imm8, and stores
the result in the high quadword of the destination (first) operand.

   The operation of this instruction is similar to the `PSHUFW'
instruction, except that the source and destination are the top
quadword of a 128-bit operand, instead of being 64-bit operands. The
low quadword is copied from the source to the destination without any
changes.

B.4.253. `PSHUFLW': Shuffle Packed Low Words
--------------------------------------------

     PSHUFLW xmm1,xmm2/m128,imm8   ; F2 0F 70 /r ib  [WILLAMETTE,SSE2]

   `PSHUFLW' shuffles the words in the low quadword of the source
(second) operand according to the encoding specified by imm8, and stores
the result in the low quadword of the destination (first) operand.

   The operation of this instruction is similar to the `PSHUFW'
instruction, except that the source and destination are the low
quadword of a 128-bit operand, instead of being 64-bit operands. The
high quadword is copied from the source to the destination without any
changes.

B.4.254. `PSHUFW': Shuffle Packed Words
---------------------------------------

     PSHUFW mm1,mm2/m64,imm8       ; 0F 70 /r ib     [KATMAI,MMX]

   `PSHUFW' shuffles the words in the source (second) operand according
to the encoding specified by imm8, and stores the result in the
destination (first) operand.

   Bits 0 and 1 of imm8 encode the source position of the word to be
copied to position 0 in the destination operand. Bits 2 and 3 encode
for position 1, bits 4 and 5 encode for position 2, and bits 6 and 7
encode for position 3.  For example, an encoding of 10 in bits 0 and 1
of imm8 indicates that the word at bits 32-47 of the source operand
will be copied to bits 0-15 of the destination.

B.4.255. `PSLLx': Packed Data Bit Shift Left Logical
----------------------------------------------------

     PSLLW mm1,mm2/m64             ; 0F F1 /r             [PENT,MMX]
     PSLLW mm,imm8                 ; 0F 71 /6 ib          [PENT,MMX]

     PSLLW xmm1,xmm2/m128          ; 66 0F F1 /r     [WILLAMETTE,SSE2]
     PSLLW xmm,imm8                ; 66 0F 71 /6 ib  [WILLAMETTE,SSE2]

     PSLLD mm1,mm2/m64             ; 0F F2 /r             [PENT,MMX]
     PSLLD mm,imm8                 ; 0F 72 /6 ib          [PENT,MMX]

     PSLLD xmm1,xmm2/m128          ; 66 0F F2 /r     [WILLAMETTE,SSE2]
     PSLLD xmm,imm8                ; 66 0F 72 /6 ib  [WILLAMETTE,SSE2]

     PSLLQ mm1,mm2/m64             ; 0F F3 /r             [PENT,MMX]
     PSLLQ mm,imm8                 ; 0F 73 /6 ib          [PENT,MMX]

     PSLLQ xmm1,xmm2/m128          ; 66 0F F3 /r     [WILLAMETTE,SSE2]
     PSLLQ xmm,imm8                ; 66 0F 73 /6 ib  [WILLAMETTE,SSE2]

     PSLLDQ xmm1,imm8              ; 66 0F 73 /7 ib  [PENT,MMX]

   `PSLLx' performs logical left shifts of the data elements in the
destination (first) operand, moving each bit in the separate elements
left by the number of bits specified in the source (second) operand,
clearing the low-order bits as they are vacated.

   * `PSLLW' shifts word sized elements.

   * `PSLLD' shifts doubleword sized elements.

   * `PSLLQ' shifts quadword sized elements.

   * `PSLLDQ' shifts double quadword sized elements.

B.4.256. `PSRAx': Packed Data Bit Shift Right Arithmetic
--------------------------------------------------------

     PSRAW mm1,mm2/m64             ; 0F E1 /r             [PENT,MMX]
     PSRAW mm,imm8                 ; 0F 71 /4 ib          [PENT,MMX]

     PSRAW xmm1,xmm2/m128          ; 66 0F E1 /r     [WILLAMETTE,SSE2]
     PSRAW xmm,imm8                ; 66 0F 71 /4 ib  [WILLAMETTE,SSE2]

     PSRAD mm1,mm2/m64             ; 0F E2 /r             [PENT,MMX]
     PSRAD mm,imm8                 ; 0F 72 /4 ib          [PENT,MMX]

     PSRAD xmm1,xmm2/m128          ; 66 0F E2 /r     [WILLAMETTE,SSE2]
     PSRAD xmm,imm8                ; 66 0F 72 /4 ib  [WILLAMETTE,SSE2]

   `PSRAx' performs arithmetic right shifts of the data elements in the
destination (first) operand, moving each bit in the separate elements
right by the number of bits specified in the source (second) operand,
setting the high-order bits to the value of the original sign bit.

   * `PSRAW' shifts word sized elements.

   * `PSRAD' shifts doubleword sized elements.

B.4.257. `PSRLx': Packed Data Bit Shift Right Logical
-----------------------------------------------------

     PSRLW mm1,mm2/m64             ; 0F D1 /r             [PENT,MMX]
     PSRLW mm,imm8                 ; 0F 71 /2 ib          [PENT,MMX]

     PSRLW xmm1,xmm2/m128          ; 66 0F D1 /r     [WILLAMETTE,SSE2]
     PSRLW xmm,imm8                ; 66 0F 71 /2 ib  [WILLAMETTE,SSE2]

     PSRLD mm1,mm2/m64             ; 0F D2 /r             [PENT,MMX]
     PSRLD mm,imm8                 ; 0F 72 /2 ib          [PENT,MMX]

     PSRLD xmm1,xmm2/m128          ; 66 0F D2 /r     [WILLAMETTE,SSE2]
     PSRLD xmm,imm8                ; 66 0F 72 /2 ib  [WILLAMETTE,SSE2]

     PSRLQ mm1,mm2/m64             ; 0F D3 /r             [PENT,MMX]
     PSRLQ mm,imm8                 ; 0F 73 /2 ib          [PENT,MMX]

     PSRLQ xmm1,xmm2/m128          ; 66 0F D3 /r     [WILLAMETTE,SSE2]
     PSRLQ xmm,imm8                ; 66 0F 73 /2 ib  [WILLAMETTE,SSE2]

     PSRLDQ xmm1,imm8              ; 66 0F 73 /3 ib  [WILLAMETTE,SSE2]

   `PSRLx' performs logical right shifts of the data elements in the
destination (first) operand, moving each bit in the separate elements
right by the number of bits specified in the source (second) operand,
clearing the high-order bits as they are vacated.

   * `PSRLW' shifts word sized elements.

   * `PSRLD' shifts doubleword sized elements.

   * `PSRLQ' shifts quadword sized elements.

   * `PSRLDQ' shifts double quadword sized elements.

B.4.258. `PSUBx': Subtract Packed Integers
------------------------------------------

     PSUBB mm1,mm2/m64             ; 0F F8 /r             [PENT,MMX]
     PSUBW mm1,mm2/m64             ; 0F F9 /r             [PENT,MMX]
     PSUBD mm1,mm2/m64             ; 0F FA /r             [PENT,MMX]
     PSUBQ mm1,mm2/m64             ; 0F FB /r        [WILLAMETTE,SSE2]

     PSUBB xmm1,xmm2/m128          ; 66 0F F8 /r     [WILLAMETTE,SSE2]
     PSUBW xmm1,xmm2/m128          ; 66 0F F9 /r     [WILLAMETTE,SSE2]
     PSUBD xmm1,xmm2/m128          ; 66 0F FA /r     [WILLAMETTE,SSE2]
     PSUBQ xmm1,xmm2/m128          ; 66 0F FB /r     [WILLAMETTE,SSE2]

   `PSUBx' subtracts packed integers in the source operand from those in
the destination operand. It doesn't differentiate between signed and
unsigned integers, and doesn't set any of the flags.

   * `PSUBB' operates on byte sized elements.

   * `PSUBW' operates on word sized elements.

   * `PSUBD' operates on doubleword sized elements.

   * `PSUBQ' operates on quadword sized elements.

B.4.259. `PSUBSxx', `PSUBUSx': Subtract Packed Integers With Saturation
-----------------------------------------------------------------------

     PSUBSB mm1,mm2/m64            ; 0F E8 /r             [PENT,MMX]
     PSUBSW mm1,mm2/m64            ; 0F E9 /r             [PENT,MMX]

     PSUBSB xmm1,xmm2/m128         ; 66 0F E8 /r     [WILLAMETTE,SSE2]
     PSUBSW xmm1,xmm2/m128         ; 66 0F E9 /r     [WILLAMETTE,SSE2]

     PSUBUSB mm1,mm2/m64           ; 0F D8 /r             [PENT,MMX]
     PSUBUSW mm1,mm2/m64           ; 0F D9 /r             [PENT,MMX]

     PSUBUSB xmm1,xmm2/m128        ; 66 0F D8 /r     [WILLAMETTE,SSE2]
     PSUBUSW xmm1,xmm2/m128        ; 66 0F D9 /r     [WILLAMETTE,SSE2]

   `PSUBSx' and `PSUBUSx' subtracts packed integers in the source
operand from those in the destination operand, and use saturation for
results that are outside the range supported by the destination operand.

   * `PSUBSB' operates on signed bytes, and uses signed saturation on
     the results.

   * `PSUBSW' operates on signed words, and uses signed saturation on
     the results.

   * `PSUBUSB' operates on unsigned bytes, and uses signed saturation on
     the results.

   * `PSUBUSW' operates on unsigned words, and uses signed saturation on
     the results.

B.4.260. `PSUBSIW': MMX Packed Subtract with Saturation to Implied Destination
------------------------------------------------------------------------------

     PSUBSIW mm1,mm2/m64           ; 0F 55 /r             [CYRIX,MMX]

   `PSUBSIW', specific to the Cyrix extensions to the MMX instruction
set, performs the same function as `PSUBSW', except that the result is
not placed in the register specified by the first operand, but instead
in the implied destination register, specified as for `PADDSIW' (see
Section B.4.200).

B.4.261. `PSWAPD': Swap Packed Data
-----------------------------------

     PSWAPD mm1,mm2/m64            ; 0F 0F /r BB     [PENT,3DNOW]

   `PSWAPD' swaps the packed doublewords in the source operand, and
stores the result in the destination operand.

   In the `K6-2' and `K6-III' processors, this opcode uses the mnemonic
`PSWAPW', and it swaps the order of words when copying from the source
to the destination.

   The operation in the `K6-2' and `K6-III' processors is

        dst[0-15]  = src[48-63];
        dst[16-31] = src[32-47];
        dst[32-47] = src[16-31];
        dst[48-63] = src[0-15].

   The operation in the `K6-x+', `ATHLON' and later processors is:

        dst[0-31]  = src[32-63];
        dst[32-63] = src[0-31].

B.4.262. `PUNPCKxxx': Unpack and Interleave Data
------------------------------------------------

     PUNPCKHBW mm1,mm2/m64         ; 0F 68 /r             [PENT,MMX]
     PUNPCKHWD mm1,mm2/m64         ; 0F 69 /r             [PENT,MMX]
     PUNPCKHDQ mm1,mm2/m64         ; 0F 6A /r             [PENT,MMX]

     PUNPCKHBW xmm1,xmm2/m128      ; 66 0F 68 /r     [WILLAMETTE,SSE2]
     PUNPCKHWD xmm1,xmm2/m128      ; 66 0F 69 /r     [WILLAMETTE,SSE2]
     PUNPCKHDQ xmm1,xmm2/m128      ; 66 0F 6A /r     [WILLAMETTE,SSE2]
     PUNPCKHQDQ xmm1,xmm2/m128     ; 66 0F 6D /r     [WILLAMETTE,SSE2]

     PUNPCKLBW mm1,mm2/m32         ; 0F 60 /r             [PENT,MMX]
     PUNPCKLWD mm1,mm2/m32         ; 0F 61 /r             [PENT,MMX]
     PUNPCKLDQ mm1,mm2/m32         ; 0F 62 /r             [PENT,MMX]

     PUNPCKLBW xmm1,xmm2/m128      ; 66 0F 60 /r     [WILLAMETTE,SSE2]
     PUNPCKLWD xmm1,xmm2/m128      ; 66 0F 61 /r     [WILLAMETTE,SSE2]
     PUNPCKLDQ xmm1,xmm2/m128      ; 66 0F 62 /r     [WILLAMETTE,SSE2]
     PUNPCKLQDQ xmm1,xmm2/m128     ; 66 0F 6C /r     [WILLAMETTE,SSE2]

   `PUNPCKxx' all treat their operands as vectors, and produce a new
vector generated by interleaving elements from the two inputs. The
`PUNPCKHxx' instructions start by throwing away the bottom half of each
input operand, and the `PUNPCKLxx' instructions throw away the top half.

   The remaining elements, are then interleaved into the destination,
alternating elements from the second (source) operand and the first
(destination) operand: so the leftmost part of each element in the
result always comes from the second operand, and the rightmost from the
destination.

   * `PUNPCKxBW' works a byte at a time, producing word sized output
     elements.

   * `PUNPCKxWD' works a word at a time, producing doubleword sized
     output elements.

   * `PUNPCKxDQ' works a doubleword at a time, producing quadword sized
     output elements.

   * `PUNPCKxQDQ' works a quadword at a time, producing double quadword
     sized output elements.

   So, for example, for `MMX' operands, if the first operand held
`0x7A6A5A4A3A2A1A0A' and the second held `0x7B6B5B4B3B2B1B0B', then:

   * `PUNPCKHBW' would return `0x7B7A6B6A5B5A4B4A'.

   * `PUNPCKHWD' would return `0x7B6B7A6A5B4B5A4A'.

   * `PUNPCKHDQ' would return `0x7B6B5B4B7A6A5A4A'.

   * `PUNPCKLBW' would return `0x3B3A2B2A1B1A0B0A'.

   * `PUNPCKLWD' would return `0x3B2B3A2A1B0B1A0A'.

   * `PUNPCKLDQ' would return `0x3B2B1B0B3A2A1A0A'.

B.4.263. `PUSH': Push Data on Stack
-----------------------------------

     PUSH reg16                    ; o16 50+r             [8086]
     PUSH reg32                    ; o32 50+r             [386]

     PUSH r/m16                    ; o16 FF /6            [8086]
     PUSH r/m32                    ; o32 FF /6            [386]

     PUSH CS                       ; 0E                   [8086]
     PUSH DS                       ; 1E                   [8086]
     PUSH ES                       ; 06                   [8086]
     PUSH SS                       ; 16                   [8086]
     PUSH FS                       ; 0F A0                [386]
     PUSH GS                       ; 0F A8                [386]

     PUSH imm8                     ; 6A ib                [186]
     PUSH imm16                    ; o16 68 iw            [186]
     PUSH imm32                    ; o32 68 id            [386]

   `PUSH' decrements the stack pointer (`SP' or `ESP') by 2 or 4, and
then stores the given value at `[SS:SP]' or `[SS:ESP]'.

   The address-size attribute of the instruction determines whether `SP'
or `ESP' is used as the stack pointer: to deliberately override the
default given by the `BITS' setting, you can use an `a16' or `a32'
prefix.

   The operand-size attribute of the instruction determines whether the
stack pointer is decremented by 2 or 4: this means that segment
register pushes in `BITS 32' mode will push 4 bytes on the stack, of
which the upper two are undefined. If you need to override that, you
can use an `o16' or `o32' prefix.

   The above opcode listings give two forms for general-purpose
register push instructions: for example, `PUSH BX' has the two forms
`53' and `FF F3'. NASM will always generate the shorter form when given
`PUSH BX'. NDISASM will disassemble both.

   Unlike the undocumented and barely supported `POP CS', `PUSH CS' is
a perfectly valid and sensible instruction, supported on all processors.

   The instruction `PUSH SP' may be used to distinguish an 8086 from
later processors: on an 8086, the value of `SP' stored is the value it
has _after_ the push instruction, whereas on later processors it is the
value _before_ the push instruction.

B.4.264. `PUSHAx': Push All General-Purpose Registers
-----------------------------------------------------

     PUSHA                         ; 60                   [186]
     PUSHAD                        ; o32 60               [386]
     PUSHAW                        ; o16 60               [186]

   `PUSHAW' pushes, in succession, `AX', `CX', `DX', `BX', `SP', `BP',
`SI' and `DI' on the stack, decrementing the stack pointer by a total
of 16.

   `PUSHAD' pushes, in succession, `EAX', `ECX', `EDX', `EBX', `ESP',
`EBP', `ESI' and `EDI' on the stack, decrementing the stack pointer by
a total of 32.

   In both cases, the value of `SP' or `ESP' pushed is its _original_
value, as it had before the instruction was executed.

   `PUSHA' is an alias mnemonic for either `PUSHAW' or `PUSHAD',
depending on the current `BITS' setting.

   Note that the registers are pushed in order of their numeric values
in opcodes (see Section B.2.1).

   See also `POPA' (see Section B.4.245).

B.4.265. `PUSHFx': Push Flags Register
--------------------------------------

     PUSHF                         ; 9C                   [8086]
     PUSHFD                        ; o32 9C               [386]
     PUSHFW                        ; o16 9C               [8086]

   * `PUSHFW' pops a word from the stack and stores it in the bottom 16
     bits of the flags register (or the whole flags register, on
     processors below a 386).

   * `PUSHFD' pops a doubleword and stores it in the entire flags
     register.

   `PUSHF' is an alias mnemonic for either `PUSHFW' or `PUSHFD',
depending on the current `BITS' setting.

   See also `POPF' (see Section B.4.246).

B.4.266. `PXOR': MMX Bitwise XOR
--------------------------------

     PXOR mm1,mm2/m64              ; 0F EF /r             [PENT,MMX]
     PXOR xmm1,xmm2/m128           ; 66 0F EF /r     [WILLAMETTE,SSE2]

   `PXOR' performs a bitwise XOR operation between its two operands
(i.e.  each bit of the result is 1 if and only if exactly one of the
corresponding bits of the two inputs was 1), and stores the result in
the destination (first) operand.

B.4.267. `RCL', `RCR': Bitwise Rotate through Carry Bit
-------------------------------------------------------

     RCL r/m8,1                    ; D0 /2                [8086]
     RCL r/m8,CL                   ; D2 /2                [8086]
     RCL r/m8,imm8                 ; C0 /2 ib             [186]
     RCL r/m16,1                   ; o16 D1 /2            [8086]
     RCL r/m16,CL                  ; o16 D3 /2            [8086]
     RCL r/m16,imm8                ; o16 C1 /2 ib         [186]
     RCL r/m32,1                   ; o32 D1 /2            [386]
     RCL r/m32,CL                  ; o32 D3 /2            [386]
     RCL r/m32,imm8                ; o32 C1 /2 ib         [386]

     RCR r/m8,1                    ; D0 /3                [8086]
     RCR r/m8,CL                   ; D2 /3                [8086]
     RCR r/m8,imm8                 ; C0 /3 ib             [186]
     RCR r/m16,1                   ; o16 D1 /3            [8086]
     RCR r/m16,CL                  ; o16 D3 /3            [8086]
     RCR r/m16,imm8                ; o16 C1 /3 ib         [186]
     RCR r/m32,1                   ; o32 D1 /3            [386]
     RCR r/m32,CL                  ; o32 D3 /3            [386]
     RCR r/m32,imm8                ; o32 C1 /3 ib         [386]

   `RCL' and `RCR' perform a 9-bit, 17-bit or 33-bit bitwise rotation
operation, involving the given source/destination (first) operand and
the carry bit. Thus, for example, in the operation `RCL AL,1', a 9-bit
rotation is performed in which `AL' is shifted left by 1, the top bit
of `AL' moves into the carry flag, and the original value of the carry
flag is placed in the low bit of `AL'.

   The number of bits to rotate by is given by the second operand. Only
the bottom five bits of the rotation count are considered by processors
above the 8086.

   You can force the longer (286 and upwards, beginning with a `C1'
byte) form of `RCL foo,1' by using a `BYTE' prefix: `RCL foo,BYTE 1'.
Similarly with `RCR'.

B.4.268. `RCPPS': Packed Single-Precision FP Reciprocal
-------------------------------------------------------

     RCPPS xmm1,xmm2/m128          ; 0F 53 /r        [KATMAI,SSE]

   `RCPPS' returns an approximation of the reciprocal of the packed
single-precision FP values from xmm2/m128. The maximum error for this
approximation is: |Error| <= 1.5 x 2^-12

B.4.269. `RCPSS': Scalar Single-Precision FP Reciprocal
-------------------------------------------------------

     RCPSS xmm1,xmm2/m128          ; F3 0F 53 /r     [KATMAI,SSE]

   `RCPSS' returns an approximation of the reciprocal of the lower
single-precision FP value from xmm2/m32; the upper three fields are
passed through from xmm1. The maximum error for this approximation is:
|Error| <= 1.5 x 2^-12

B.4.270. `RDMSR': Read Model-Specific Registers
-----------------------------------------------

     RDMSR                         ; 0F 32                [PENT,PRIV]

   `RDMSR' reads the processor Model-Specific Register (MSR) whose index
is stored in `ECX', and stores the result in `EDX:EAX'. See also
`WRMSR' (see Section B.4.329).

B.4.271. `RDPMC': Read Performance-Monitoring Counters
------------------------------------------------------

     RDPMC                         ; 0F 33                [P6]

   `RDPMC' reads the processor performance-monitoring counter whose
index is stored in `ECX', and stores the result in `EDX:EAX'.

   This instruction is available on P6 and later processors and on MMX
class processors.

B.4.272. `RDSHR': Read SMM Header Pointer Register
--------------------------------------------------

     RDSHR r/m32                   ; 0F 36 /0        [386,CYRIX,SMM]

   `RDSHR' reads the contents of the SMM header pointer register and
saves it to the destination operand, which can be either a 32 bit memory
location or a 32 bit register.

   See also `WRSHR' (see Section B.4.330).

B.4.273. `RDTSC': Read Time-Stamp Counter
-----------------------------------------

     RDTSC                         ; 0F 31                [PENT]

   `RDTSC' reads the processor's time-stamp counter into `EDX:EAX'.

B.4.274. `RET', `RETF', `RETN': Return from Procedure Call
----------------------------------------------------------

     RET                           ; C3                   [8086]
     RET imm16                     ; C2 iw                [8086]

     RETF                          ; CB                   [8086]
     RETF imm16                    ; CA iw                [8086]

     RETN                          ; C3                   [8086]
     RETN imm16                    ; C2 iw                [8086]

   * `RET', and its exact synonym `RETN', pop `IP' or `EIP' from the
     stack and transfer control to the new address. Optionally, if a
     numeric second operand is provided, they increment the stack
     pointer by a further `imm16' bytes after popping the return
     address.

   * `RETF' executes a far return: after popping `IP'/`EIP', it then
     pops `CS', and _then_ increments the stack pointer by the optional
     argument if present.

B.4.275. `ROL', `ROR': Bitwise Rotate
-------------------------------------

     ROL r/m8,1                    ; D0 /0                [8086]
     ROL r/m8,CL                   ; D2 /0                [8086]
     ROL r/m8,imm8                 ; C0 /0 ib             [186]
     ROL r/m16,1                   ; o16 D1 /0            [8086]
     ROL r/m16,CL                  ; o16 D3 /0            [8086]
     ROL r/m16,imm8                ; o16 C1 /0 ib         [186]
     ROL r/m32,1                   ; o32 D1 /0            [386]
     ROL r/m32,CL                  ; o32 D3 /0            [386]
     ROL r/m32,imm8                ; o32 C1 /0 ib         [386]

     ROR r/m8,1                    ; D0 /1                [8086]
     ROR r/m8,CL                   ; D2 /1                [8086]
     ROR r/m8,imm8                 ; C0 /1 ib             [186]
     ROR r/m16,1                   ; o16 D1 /1            [8086]
     ROR r/m16,CL                  ; o16 D3 /1            [8086]
     ROR r/m16,imm8                ; o16 C1 /1 ib         [186]
     ROR r/m32,1                   ; o32 D1 /1            [386]
     ROR r/m32,CL                  ; o32 D3 /1            [386]
     ROR r/m32,imm8                ; o32 C1 /1 ib         [386]

   `ROL' and `ROR' perform a bitwise rotation operation on the given
source/destination (first) operand. Thus, for example, in the operation
`ROL AL,1', an 8-bit rotation is performed in which `AL' is shifted
left by 1 and the original top bit of `AL' moves round into the low bit.

   The number of bits to rotate by is given by the second operand. Only
the bottom five bits of the rotation count are considered by processors
above the 8086.

   You can force the longer (286 and upwards, beginning with a `C1'
byte) form of `ROL foo,1' by using a `BYTE' prefix: `ROL foo,BYTE 1'.
Similarly with `ROR'.

B.4.276. `RSDC': Restore Segment Register and Descriptor
--------------------------------------------------------

     RSDC segreg,m80               ; 0F 79 /r        [486,CYRIX,SMM]

   `RSDC' restores a segment register (DS, ES, FS, GS, or SS) from
mem80, and sets up its descriptor.

B.4.277. `RSLDT': Restore Segment Register and Descriptor
---------------------------------------------------------

     RSLDT m80                     ; 0F 7B /0        [486,CYRIX,SMM]

   `RSLDT' restores the Local Descriptor Table (LDTR) from mem80.

B.4.278. `RSM': Resume from System-Management Mode
--------------------------------------------------

     RSM                           ; 0F AA                [PENT]

   `RSM' returns the processor to its normal operating mode when it was
in System-Management Mode.

B.4.279. `RSQRTPS': Packed Single-Precision FP Square Root Reciprocal
---------------------------------------------------------------------

     RSQRTPS xmm1,xmm2/m128        ; 0F 52 /r        [KATMAI,SSE]

   `RSQRTPS' computes the approximate reciprocals of the square roots of
the packed single-precision floating-point values in the source and
stores the results in xmm1. The maximum error for this approximation
is: |Error| <= 1.5 x 2^-12

B.4.280. `RSQRTSS': Scalar Single-Precision FP Square Root Reciprocal
---------------------------------------------------------------------

     RSQRTSS xmm1,xmm2/m128        ; F3 0F 52 /r     [KATMAI,SSE]

   `RSQRTSS' returns an approximation of the reciprocal of the square
root of the lowest order single-precision FP value from the source, and
stores it in the low doubleword of the destination register. The upper
three fields of xmm1 are preserved. The maximum error for this
approximation is: |Error| <= 1.5 x 2^-12

B.4.281. `RSTS': Restore TSR and Descriptor
-------------------------------------------

     RSTS m80                      ; 0F 7D /0        [486,CYRIX,SMM]

   `RSTS' restores Task State Register (TSR) from mem80.

B.4.282. `SAHF': Store AH to Flags
----------------------------------

     SAHF                          ; 9E                   [8086]

   `SAHF' sets the low byte of the flags word according to the contents
of the `AH' register.

   The operation of `SAHF' is:

      AH --> SF:ZF:0:AF:0:PF:1:CF

   See also `LAHF' (see Section B.4.131).

B.4.283. `SAL', `SAR': Bitwise Arithmetic Shifts
------------------------------------------------

     SAL r/m8,1                    ; D0 /4                [8086]
     SAL r/m8,CL                   ; D2 /4                [8086]
     SAL r/m8,imm8                 ; C0 /4 ib             [186]
     SAL r/m16,1                   ; o16 D1 /4            [8086]
     SAL r/m16,CL                  ; o16 D3 /4            [8086]
     SAL r/m16,imm8                ; o16 C1 /4 ib         [186]
     SAL r/m32,1                   ; o32 D1 /4            [386]
     SAL r/m32,CL                  ; o32 D3 /4            [386]
     SAL r/m32,imm8                ; o32 C1 /4 ib         [386]

     SAR r/m8,1                    ; D0 /7                [8086]
     SAR r/m8,CL                   ; D2 /7                [8086]
     SAR r/m8,imm8                 ; C0 /7 ib             [186]
     SAR r/m16,1                   ; o16 D1 /7            [8086]
     SAR r/m16,CL                  ; o16 D3 /7            [8086]
     SAR r/m16,imm8                ; o16 C1 /7 ib         [186]
     SAR r/m32,1                   ; o32 D1 /7            [386]
     SAR r/m32,CL                  ; o32 D3 /7            [386]
     SAR r/m32,imm8                ; o32 C1 /7 ib         [386]

   `SAL' and `SAR' perform an arithmetic shift operation on the given
source/destination (first) operand. The vacated bits are filled with
zero for `SAL', and with copies of the original high bit of the source
operand for `SAR'.

   `SAL' is a synonym for `SHL' (see Section B.4.290). NASM
will assemble either one to the same code, but NDISASM will always
disassemble that code as `SHL'.

   The number of bits to shift by is given by the second operand. Only
the bottom five bits of the shift count are considered by processors
above the 8086.

   You can force the longer (286 and upwards, beginning with a `C1'
byte) form of `SAL foo,1' by using a `BYTE' prefix: `SAL foo,BYTE 1'.
Similarly with `SAR'.

B.4.284. `SALC': Set AL from Carry Flag
---------------------------------------

     SALC                          ; D6                  [8086,UNDOC]

   `SALC' is an early undocumented instruction similar in concept to
`SETcc' (see Section B.4.287). Its function is to set `AL' to zero
if the carry flag is clear, or to `0xFF' if it is set.

B.4.285. `SBB': Subtract with Borrow
------------------------------------

     SBB r/m8,reg8                 ; 18 /r                [8086]
     SBB r/m16,reg16               ; o16 19 /r            [8086]
     SBB r/m32,reg32               ; o32 19 /r            [386]

     SBB reg8,r/m8                 ; 1A /r                [8086]
     SBB reg16,r/m16               ; o16 1B /r            [8086]
     SBB reg32,r/m32               ; o32 1B /r            [386]

     SBB r/m8,imm8                 ; 80 /3 ib             [8086]
     SBB r/m16,imm16               ; o16 81 /3 iw         [8086]
     SBB r/m32,imm32               ; o32 81 /3 id         [386]

     SBB r/m16,imm8                ; o16 83 /3 ib         [8086]
     SBB r/m32,imm8                ; o32 83 /3 ib         [386]

     SBB AL,imm8                   ; 1C ib                [8086]
     SBB AX,imm16                  ; o16 1D iw            [8086]
     SBB EAX,imm32                 ; o32 1D id            [386]

   `SBB' performs integer subtraction: it subtracts its second operand,
plus the value of the carry flag, from its first, and leaves the result
in its destination (first) operand. The flags are set according to the
result of the operation: in particular, the carry flag is affected and
can be used by a subsequent `SBB' instruction.

   In the forms with an 8-bit immediate second operand and a longer
first operand, the second operand is considered to be signed, and is
sign- extended to the length of the first operand. In these cases, the
`BYTE' qualifier is necessary to force NASM to generate this form of
the instruction.

   To subtract one number from another without also subtracting the
contents of the carry flag, use `SUB' (see Section B.4.305).

B.4.286. `SCASB', `SCASW', `SCASD': Scan String
-----------------------------------------------

     SCASB                         ; AE                   [8086]
     SCASW                         ; o16 AF               [8086]
     SCASD                         ; o32 AF               [386]

   `SCASB' compares the byte in `AL' with the byte at `[ES:DI]' or
`[ES:EDI]', and sets the flags accordingly. It then increments or
decrements (depending on the direction flag: increments if the flag is
clear, decrements if it is set) `DI' (or `EDI').

   The register used is `DI' if the address size is 16 bits, and `EDI'
if it is 32 bits. If you need to use an address size not equal to the
current `BITS' setting, you can use an explicit `a16' or `a32' prefix.

   Segment override prefixes have no effect for this instruction: the
use of `ES' for the load from `[DI]' or `[EDI]' cannot be overridden.

   `SCASW' and `SCASD' work in the same way, but they compare a word to
`AX' or a doubleword to `EAX' instead of a byte to `AL', and increment
or decrement the addressing registers by 2 or 4 instead of 1.

   The `REPE' and `REPNE' prefixes (equivalently, `REPZ' and `REPNZ')
may be used to repeat the instruction up to `CX' (or `ECX' - again, the
address size chooses which) times until the first unequal or equal byte
is found.

B.4.287. `SETcc': Set Register from Condition
---------------------------------------------

     SETcc r/m8                    ; 0F 90+cc /2          [386]

   `SETcc' sets the given 8-bit operand to zero if its condition is not
satisfied, and to 1 if it is.

B.4.288. `SFENCE': Store Fence
------------------------------

     SFENCE                 ; 0F AE /7               [KATMAI]

   `SFENCE' performs a serialising operation on all writes to memory
that were issued before the `SFENCE' instruction. This guarantees that
all memory writes before the `SFENCE' instruction are visible before any
writes after the `SFENCE' instruction.

   `SFENCE' is ordered respective to other `SFENCE' instruction,
`MFENCE', any memory write and any other serialising instruction (such
as `CPUID').

   Weakly ordered memory types can be used to achieve higher processor
performance through such techniques as out-of-order issue,
write-combining, and write-collapsing. The degree to which a consumer
of data recognizes or knows that the data is weakly ordered varies
among applications and may be unknown to the producer of this data. The
`SFENCE' instruction provides a performance-efficient way of insuring
store ordering between routines that produce weakly-ordered results and
routines that consume this data.

   `SFENCE' uses the following ModRM encoding:

               Mod (7:6)        = 11B
               Reg/Opcode (5:3) = 111B
               R/M (2:0)        = 000B

   All other ModRM encodings are defined to be reserved, and use of
these encodings risks incompatibility with future processors.

   See also `LFENCE' (see Section B.4.137) and `MFENCE' (see
Section B.4.151).

B.4.289. `SGDT', `SIDT', `SLDT': Store Descriptor Table Pointers
----------------------------------------------------------------

     SGDT mem                      ; 0F 01 /0             [286,PRIV]
     SIDT mem                      ; 0F 01 /1             [286,PRIV]
     SLDT r/m16                    ; 0F 00 /0             [286,PRIV]

   `SGDT' and `SIDT' both take a 6-byte memory area as an operand: they
store the contents of the GDTR (global descriptor table register) or
IDTR (interrupt descriptor table register) into that area as a 32-bit
linear address and a 16-bit size limit from that area (in that order).
These are the only instructions which directly use _linear_ addresses,
rather than segment/offset pairs.

   `SLDT' stores the segment selector corresponding to the LDT (local
descriptor table) into the given operand.

   See also `LGDT', `LIDT' and `LLDT' (see Section B.4.138).

B.4.290. `SHL', `SHR': Bitwise Logical Shifts
---------------------------------------------

     SHL r/m8,1                    ; D0 /4                [8086]
     SHL r/m8,CL                   ; D2 /4                [8086]
     SHL r/m8,imm8                 ; C0 /4 ib             [186]
     SHL r/m16,1                   ; o16 D1 /4            [8086]
     SHL r/m16,CL                  ; o16 D3 /4            [8086]
     SHL r/m16,imm8                ; o16 C1 /4 ib         [186]
     SHL r/m32,1                   ; o32 D1 /4            [386]
     SHL r/m32,CL                  ; o32 D3 /4            [386]
     SHL r/m32,imm8                ; o32 C1 /4 ib         [386]

     SHR r/m8,1                    ; D0 /5                [8086]
     SHR r/m8,CL                   ; D2 /5                [8086]
     SHR r/m8,imm8                 ; C0 /5 ib             [186]
     SHR r/m16,1                   ; o16 D1 /5            [8086]
     SHR r/m16,CL                  ; o16 D3 /5            [8086]
     SHR r/m16,imm8                ; o16 C1 /5 ib         [186]
     SHR r/m32,1                   ; o32 D1 /5            [386]
     SHR r/m32,CL                  ; o32 D3 /5            [386]
     SHR r/m32,imm8                ; o32 C1 /5 ib         [386]

   `SHL' and `SHR' perform a logical shift operation on the given
source/destination (first) operand. The vacated bits are filled with
zero.

   A synonym for `SHL' is `SAL' (see Section B.4.283). NASM
will assemble either one to the same code, but NDISASM will always
disassemble that code as `SHL'.

   The number of bits to shift by is given by the second operand. Only
the bottom five bits of the shift count are considered by processors
above the 8086.

   You can force the longer (286 and upwards, beginning with a `C1'
byte) form of `SHL foo,1' by using a `BYTE' prefix: `SHL foo,BYTE 1'.
Similarly with `SHR'.

B.4.291. `SHLD', `SHRD': Bitwise Double-Precision Shifts
--------------------------------------------------------

     SHLD r/m16,reg16,imm8         ; o16 0F A4 /r ib      [386]
     SHLD r/m16,reg32,imm8         ; o32 0F A4 /r ib      [386]
     SHLD r/m16,reg16,CL           ; o16 0F A5 /r         [386]
     SHLD r/m16,reg32,CL           ; o32 0F A5 /r         [386]

     SHRD r/m16,reg16,imm8         ; o16 0F AC /r ib      [386]
     SHRD r/m32,reg32,imm8         ; o32 0F AC /r ib      [386]
     SHRD r/m16,reg16,CL           ; o16 0F AD /r         [386]
     SHRD r/m32,reg32,CL           ; o32 0F AD /r         [386]

   * `SHLD' performs a double-precision left shift. It notionally places
     its second operand to the right of its first, then shifts the
     entire bit string thus generated to the left by a number of bits
     specified in the third operand. It then updates only the _first_
     operand according to the result of this. The second operand is not
     modified.

   * `SHRD' performs the corresponding right shift: it notionally places
     the second operand to the _left_ of the first, shifts the whole bit
     string right, and updates only the first operand.

   For example, if `EAX' holds `0x01234567' and `EBX' holds
`0x89ABCDEF', then the instruction `SHLD EAX,EBX,4' would update `EAX'
to hold `0x12345678'. Under the same conditions, `SHRD EAX,EBX,4' would
update `EAX' to hold `0xF0123456'.

   The number of bits to shift by is given by the third operand. Only
the bottom five bits of the shift count are considered.

B.4.292. `SHUFPD': Shuffle Packed Double-Precision FP Values
------------------------------------------------------------

     SHUFPD xmm1,xmm2/m128,imm8    ; 66 0F C6 /r ib  [WILLAMETTE,SSE2]

   `SHUFPD' moves one of the packed double-precision FP values from the
destination operand into the low quadword of the destination operand;
the upper quadword is generated by moving one of the double-precision
FP values from the source operand into the destination. The select
(third) operand selects which of the values are moved to the
destination register.

   The select operand is an 8-bit immediate: bit 0 selects which value
is moved from the destination operand to the result (where 0 selects
the low quadword and 1 selects the high quadword) and bit 1 selects
which value is moved from the source operand to the result. Bits 2
through 7 of the shuffle operand are reserved.

B.4.293. `SHUFPS': Shuffle Packed Single-Precision FP Values
------------------------------------------------------------

     SHUFPS xmm1,xmm2/m128,imm8    ; 0F C6 /r ib     [KATMAI,SSE]

   `SHUFPS' moves two of the packed single-precision FP values from the
destination operand into the low quadword of the destination operand;
the upper quadword is generated by moving two of the single-precision
FP values from the source operand into the destination. The select
(third) operand selects which of the values are moved to the
destination register.

   The select operand is an 8-bit immediate: bits 0 and 1 select the
value to be moved from the destination operand the low doubleword of
the result, bits 2 and 3 select the value to be moved from the
destination operand the second doubleword of the result, bits 4 and 5
select the value to be moved from the source operand the third
doubleword of the result, and bits 6 and 7 select the value to be moved
from the source operand to the high doubleword of the result.

B.4.294. `SMI': System Management Interrupt
-------------------------------------------

     SMI                           ; F1                   [386,UNDOC]

   `SMI' puts some AMD processors into SMM mode. It is available on some
386 and 486 processors, and is only available when DR7 bit 12 is set,
otherwise it generates an Int 1.

B.4.295. `SMINT', `SMINTOLD': Software SMM Entry (CYRIX)
--------------------------------------------------------

     SMINT                         ; 0F 38                [PENT,CYRIX]
     SMINTOLD                      ; 0F 7E                [486,CYRIX]

   `SMINT' puts the processor into SMM mode. The CPU state information
is saved in the SMM memory header, and then execution begins at the SMM
base address.

   `SMINTOLD' is the same as `SMINT', but was the opcode used on the
486.

   This pair of opcodes are specific to the Cyrix and compatible range
of processors (Cyrix, IBM, Via).

B.4.296. `SMSW': Store Machine Status Word
------------------------------------------

     SMSW r/m16                    ; 0F 01 /4             [286,PRIV]

   `SMSW' stores the bottom half of the `CR0' control register (or the
Machine Status Word, on 286 processors) into the destination operand.
See also `LMSW' (see Section B.4.139).

   For 32-bit code, this would use the low 16-bits of the specified
register (or a 16bit memory location), without needing an operand size
override byte.

B.4.297. `SQRTPD': Packed Double-Precision FP Square Root
---------------------------------------------------------

     SQRTPD xmm1,xmm2/m128         ; 66 0F 51 /r     [WILLAMETTE,SSE2]

   `SQRTPD' calculates the square root of the packed double-precision FP
value from the source operand, and stores the double-precision results
in the destination register.

B.4.298. `SQRTPS': Packed Single-Precision FP Square Root
---------------------------------------------------------

     SQRTPS xmm1,xmm2/m128         ; 0F 51 /r        [KATMAI,SSE]

   `SQRTPS' calculates the square root of the packed single-precision FP
value from the source operand, and stores the single-precision results
in the destination register.

B.4.299. `SQRTSD': Scalar Double-Precision FP Square Root
---------------------------------------------------------

     SQRTSD xmm1,xmm2/m128         ; F2 0F 51 /r     [WILLAMETTE,SSE2]

   `SQRTSD' calculates the square root of the low-order double-precision
FP value from the source operand, and stores the double-precision
result in the destination register. The high-quadword remains unchanged.