SUB

SUB subtracts its source from its destination and sets the flags from the difference, the same flags that CMP sets without writing anything. CF is the borrow, set when the destination is below the source as unsigned numbers, and OF the signed overflow, so one SUB answers both questions:

• __builtin_sub_overflow on two unsigned longs compiles, in GCC 14 and Clang 23 at -O2, to sub rdi, rsi and setb al, and on two longs to the same SUB and seto al.
• For the saturating a > b ? a - b : 0, Clang subtracts once and keeps the difference with cmovae only when there was no borrow; GCC adds a separate CMP.

Immediates#

An 8-bit immediate is sign-extended and reaches from -128 to 127, so 128 does not fit but -128 does. Both compilers exploit the asymmetry: *p += 128 on a long becomes sub qword ptr [rdi], -128 (4 bytes) instead of an ADD with a 32-bit immediate (7 bytes), and *p -= 128 becomes add qword ptr [rdi], -128. In registers they compute x - 128 with an LEA, which can write a different register.

SUB has no reversed form, so 10 - x takes mov eax, 10 and sub rax, rdi. The stack pointer is a frequent destination: a function that needs a frame reserves it with sub rsp and an immediate (see stack frames).

Zeroing and fusion#

SUB of a register from itself gives 0, and Intel’s Optimization Reference Manual (Section 3.5.1.7) and AMD’s guide for Zen 5 (Section 2.9.2) list it beside XOR as an idiom that does not wait for the register’s old value; compilers use the XOR. A SUB followed by a conditional jump can be fused into one operation: Intel’s Table 3-1 (Sandy Bridge) allows it for the carry, zero, above and signed conditions but not for O, S and P, and AMD lists SUB among the instructions that fuse on Zen 5 (Section 2.9.3).

Atomic subtraction#

With LOCK, SUB subtracts from memory atomically. Both compilers use lock sub for an atomic_fetch_sub whose result is unused; when the old value is needed, they negate the operand and use XADD, and when only reaching 0 matters, they test ZF after lock sub (GCC) or DEC (Clang).

In the optimization guide

What the optimization guide says about SUB, a line per claim. Each links to the claim in the guide, with its sources and where they differ.

Out of order

• Zeroing and dependency-breaking idioms: xor eax, eax and sub eax, eax give zero whatever EAX held, and every core here recognizes them as it renames: the result needs no execution unit and does not wait for the old value, so the idiom also ends any chain through the register.
• Move elimination: Golden Cove goes further: Agner Fog found that adding a small constant to a register sometimes takes no time, and LLVM’s model gives add and sub of an 8-bit immediate to a 64-bit register no micro-op at all (Golden Cove).

Golden Cove and Raptor Cove

• Integer execution: Register-to-register moves and zeroing idioms are handled when micro-ops are renamed, and adding a small constant to a register sometimes takes no cycle either.

Skylake to Cooper Lake

• Integer execution: xor, sub and the vector pxor, xorps, pandn, psub and pcmpgt of a register with itself zero it without an execution unit, four a cycle, for 32-bit and 64-bit and all vector registers.

Forms

Latency and throughput

Operation

What the forms do, in pseudocode that our tests run against results recorded on real processors. How to read.

a = dest.read()                  # with LOCK: one atomic read-modify-write
b = sext(src)                    # an immediate is sign-extended to OSIZE
if not nf:                       # NF=1 (APX) leaves the flags as they were
    flags = sub_flags(a, b)
dest.write(a - b)                # a 32-bit register: bits 63:32 cleared

a = src1.read()
b = sext(src2)                   # an immediate is sign-extended to OSIZE
if not nf:                       # NF=1 leaves the flags as they were
    flags = sub_flags(a, b)
dest.write(a - b)                # the new destination: bits 63:OSIZE
                                 # cleared, even for 8 and 16 bits

Operands

Flags

Exceptions

The exception class is XED's name for the set of exception conditions that a form follows. How to read.

Legacy forms

none in XED

EVEX forms

APX-EVEX-INT

Attributes

What else XED records about the forms. How to read.

SUB m8, imm8 SUB m8, r8 SUB m16/32/64, imm16/32 SUB m16/32/64, imm8 SUB m16/32/64, r16/32/64

accepts a LOCK prefix

LOCK forms

locked: atomic read-modify-write; accepts XACQUIRE; accepts XRELEASE

CPUID and processors

Each form belongs to an XED ISA set. A form can be used when the processor reports every CPUID bit of one of its ISA set's alternatives.

More General-purpose instructions

• NEG
• NOP
• NOT
• OR
• OUT
• OUTS
• PAUSE
• POP
• POPA
• POPF
• PUSH
• PUSHA
• PUSHF
• RCL
• RCR
• RET
• ROL
• ROR
• SALC
• SAR
• SBB
• SCAS
• SETcc
• SHL
• SHLD
• SHR
• SHRD
• STC
• STD
• STI
• STOS
• TEST
• UD0
• UD1
• UD2
• UDB
• XADD
• XCHG
• XLAT
• XOR

All 109 General-purpose instructions

More APX instructions

• PDEP
• PEXT
• POP2
• POP2P
• POPCNT
• POPP
• PUSH2
• PUSH2P
• PUSHP
• RCL
• RCR
• RDMSR
• ROL
• ROR
• RORX
• SAR
• SARX
• SBB
• SETcc
• SHL
• SHLD
• SHLX
• SHR
• SHRD
• SHRX
• STTILECFG
• TILELOADD
• TILELOADDRS
• TILELOADDRST1
• TILELOADDT1
• TILESTORED
• TZCNT
• URDMSR
• UWRMSR
• WRMSRNS
• WRSSD
• WRSSQ
• WRUSSD
• WRUSSQ
• XOR

All 88 APX instructions