How to read and write x86 flags registers directly?

by

Some flags can be set or cleared directly with specific instructions:

  • CLC, STC, and CMC: clear, set, and complement the carry flag
  • CLI and STI: clear and set the interrupt flag (which should be done atomically)
  • CLD and STD: clear and set the direction flag

For reading and writing the sign, zero, auxiliary carry, parity, and carry flags, you can use LAHF to load the lower 8 bits (those 5 flags plus 3 indeterminate bits) into the AH register, and you can use SAHF to store those values from AH back into the flags register.

You can also use the PUSHF instruction to push the flags onto the stack, read and modify them on the stack, and then use the POPF1 instruction to store them back into the flags register.

Note that you cannot set the VM and RF flags with POPF — they retain their previous values. Similarly, you can only change the I/O privilege level when executing at privilege level 0, and the interrupt flag can only be changed when executing at a privilege level at least as privileged as the I/O privilege level.

Footnote 1:

Note that popf is quite slow on modern CPUs; see Agner Fog’s optimization guide and instruction tables. It’s microcoded because in kernel mode it’s able to change IF and AC, and IO privilege level. We suffer the penalty regardless of mode on current CPUs because the decoders aren’t mode-sensitive.

If possible, use lahf/sahf instead of pushf/popf for performance, or save a single flag you care about like setc al then later add al, 255 to set CF = (AL!=0). Or setnc al / sub al, 1 or whatever. Sequences to set or clear SF or OF based on a 0 or 1 register are also straightforward, with/without inverting the flag.

More Related Contents:

  1. Assembly – JG/JNLE/JL/JNGE after CMP
  2. Carry Flag, Auxiliary Flag and Overflow Flag in Assembly
  3. Arithmetic identities and EFLAGS
  4. Micro fusion and addressing modes
  5. Why doesn’t GCC use partial registers?
  6. Custom bootloader booted via USB drive produces incorrect output on some computers
  7. rbp not allowed as SIB base?
  8. What does cltq do in assembly?
  9. Bomb lab phase 5 – 6 char string, movzbl load, and $0xf, %ecx, and index an array with that?
  10. execve shellcode writing segmentation fault
  11. double condition checking in assembly
  12. Printing hex values in x86 assembly
  13. What does the dollar sign ($) mean in x86 assembly when calculating string lengths like “$ – label”? [duplicate]
  14. Why not store function parameters in XMM vector registers?
  15. How to interpret objdump disassembly output columns?
  16. x86 LOCK question on multi-core CPUs
  17. 8086 random number generator (not just using the system time)?
  18. Why are x86 registers named the way they are?
  19. What is instruction fusion in contemporary x86 processors?
  20. call subroutines conditionally in assembly
  21. Using 8-bit registers in x86-64 indexed addressing modes
  22. Is there a specification of x86 I/O port assignment?
  23. Can PTEST be used to test if two registers are both zero or some other condition?
  24. Cannot move 8 bit address to 16 bit register
  25. Is a mov to a segmentation register slower than a mov to a general purpose register?
  26. What is callq instruction?
  27. MUL function in assembly
  28. How is POPCNT implemented in hardware?
  29. Solution needed for building a static IDT and GDT at assemble/compile/link time
  30. What is register %eiz?

Leave a Comment