NEG

NEG replaces its operand with 0 minus the operand, the two’s complement, and sets the flags as that subtraction would. Two consequences are easy to miss:

• CF tells whether the operand was nonzero. Subtracting anything but 0 from 0 borrows, so NEG sets CF for every operand except 0.
• The most negative number stays as it is. For 64 bits, -2^63 has no positive counterpart, so NEG leaves it unchanged and sets OF; that is the only operand for which OF is set.

In compiled code#

GCC 14 and Clang 23 at -O2 compile -x to a NEG, and use its flags in three places:

• Absolute value. labs(x) becomes mov rax, rdi, neg rax and cmovs rax, rdi: when the negated value is negative, x was positive and is kept. For the most negative x both values are the same, and so is the result, which C leaves undefined.
• A mask from “nonzero”. Both compilers end x ? -1 : 0 with neg edi and sbb eax, eax: SBB of a register from itself turns the CF that NEG set into all ones or all zeros, without a branch.
• Wide negation. For an __int128, NEG negates the low half and its CF is the borrow into the high half: both compilers emit xor edx, edx, neg rax and sbb rdx, rsi, which subtracts the high half and the borrow from 0.

NEG also appears in the idioms of other instructions: x & -x, which keeps the lowest set bit, is NEG and AND (or BLSI), and an atomic_fetch_sub whose old value is used becomes NEG and LOCK XADD, since x86 has no exchanging subtraction. NOT differs from NEG by one: ~x equals -x - 1.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

a = dest.read()                  # with LOCK: one atomic read-modify-write
if not nf:                       # NF=1 (APX) leaves the flags as they were
    flags = sub_flags(0, a)      # as 0 - a: CF is 1 unless a is 0
dest.write(-a)                   # the smallest negative number stays as it
                                 # is, with OF set

a = src.read()
if not nf:                       # NF=1 leaves the flags as they were
    flags = sub_flags(0, a)      # as 0 - a: CF is 1 unless a is 0
dest.write(-a)                   # the new destination: bits 63:OSIZE
                                 # cleared, even for 8 and 16 bits

Operands

Flags

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

EVEX forms

APX-EVEX-INT

Attributes

What else XED records about the forms. How to read.

Legacy memory forms without LOCK

accepts a LOCK prefix

LOCK forms

locked: atomic read-modify-write; accepts XACQUIRE; accepts XRELEASE

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• JECXZ
• JMP
• JRCXZ
• LDS
• LEA
• LEAVE
• LES
• LFS
• LGS
• LODS
• LOOP
• LOOPE
• LOOPNE
• LSS
• MOV
• MOVS
• MOVSX
• MOVSXD
• MOVZX
• MUL
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB

All 109 General-purpose instructions

More APX instructions

• ENQCMDS
• IDIV
• IMUL
• INC
• INVEPT
• INVPCID
• INVVPID
• JMPABS
• KMOVB
• KMOVD
• KMOVQ
• KMOVW
• LDTILECFG
• LZCNT
• MOVBE
• MOVDIR64B
• MOVDIRI
• MOVRS
• MUL
• MULX
• NOT
• OR
• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• RDMSR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB

All 88 APX instructions