x86 "Flag" Bits

CS 301 Lecture, Dr. Lawlor

The "EFLAGS" register on x86 stores a bunch of flags, as shown on page 73 of the Intel arch manual Volume 1. The important flags include:

ZF-- The "zero flag". Set whenever the previous arithmetic result was zero. Can be used by the "jz" (jump if last result was zero) or "jnz" instructions. "je" (jump if equal) and "jne" (jump if not equal) are just aliases of jz & jnz, because if the difference is zero, then the two values are equal. For example, this code checks if the input is equal to 5:
```
extern read_input
call read_input
sub eax,5 ; subtract five (also sets all the flags like "cmp eax,5"!)
je equal
add eax, 100 ; If not equal, add
equal: ret;  If equal, just return
```
(Try this in NetRun now!)
CF--The "carry flag". Contains the bit that carries out of an addition or subtraction. Can be used by the "jc" (jump if carry flag is set) instruction. Set by all the arithmetic instructions. Can be added into another arithmetic operation with "adc" (add with carry). For example, you can preserve the bit overflowing out of an add using a subsequent adc. For example, here we do a tiny 16-bit add between cx and si, that overflows. We can catch the overflow bit and fold it into the next higher add:
```
mov cx,0xf00d ; low 16 bits A
mov si,0x1111 ; low 16 bits of B
mov ax,0x00; high 16 bits of A
mov dx,0x00; high 16 bits of B
add cx,si ; A+=B (low 16 bits)
adc ax,dx ; A+=B (high 16 bits)
ret
```
(Try this in NetRun now!)

"adc" is used in the compiler's implementation of the 64-bit "long long" datatype, and in general in "multiple precision arithmetic" software, like the GNU Multiple Precision Arithmetic Library.
The carry flag (or overflow flag below) could also be used to implement overflow checking in a careful compiler, like Java!
The carry and zero flags are also used by the unsigned comparison instructions: "jb" (jump if unsigned below), "jbe" (jump if unsigned below or equal), "ja" (jump if unsigned above), and "jae" (jump if unsigned above or equal) in a fairly obvious way. For example, a carry means a negative result, so a<b. The zero flag means a==b.

SF-- The "sign flag", which indicates a negative *signed* result. Used together with OF to implement signed comparison.
OF-- The "overflow flag". Set by subtract, add, and compare, and used in the signed comparison instructions "jl" (jump if less than), "jle" (jump if less than or equal to), "jg" (jump if greater than), and "jge" (jump if greater than or equal to) instructions. If you stare at it hard enough, you can read the definitions, work out exactly what SF and OF do, and convince yourself they do the right thing. They do. For example:

jae: unsigned >=. Jumps if CF==0. OK, we've just computed a-b, and want to jump if a>=b. If a-b is positive (or zero), then CF==0 and a>=b, so we should jump, and do. If a-b is negative, we'd get a carry, CF==1, and we don't jump.

jge: signed >=. Jumps if SF==OF. Normally, we didn't overflow, so OF is zero, and this is exactly the same as the jae case above. Recall that this is a signed compare, so we may get a carry if we're comparing negative numbers, so it's not worth looking at CF. Curiously, if we overflowed, the sign bit is now wrong, so if OF is one, we compare SF against one, which flips the comparison back the right way again.

PF and AF are really bizarre ancient flags, holdovers from the 8 bit days. They both operate only on the low 8 bits of the result. PF returns odd parity, like for serial communication. AF indicates a carry from the low 4 bits up into the high 4 bits, which is used for the ancient technique of "binary coded decimal" (BCD), where "0x23" means decimal twenty-three, not thirty-five like normal hex. It's nasty, now gone, and good riddance!

You've also got to be aware of which instructions set which flags. For example, the "cmp", "and" (bitwise AND), "sub", and "add" instructions set all the flags; "inc" (increment by 1) and "dec" (decrement by 1) set everything but CF; while "mov" and the jump instructions don't mess with the flags. It's easy to accidentally overwrite flags you care about, if you leave too much stuff between the time the flag is set and the time it's read!

You can actually look at most flags with the "lahf" instruction, which copies the important bits of EFLAGS into register ah--that is, bits 8-16 of eax get EFLAGS(SF:ZF:0:AF:0:PF:1:CF). For example:

mov rax,2
add rax,-3 ; all arithmetic sets the flags
mov rax,0 ; zero high bits of rax
lahf ; load flags into bits 8-16 of rax
ret ; return the flags: SF:ZF:0:AF  :  0:PF:1:CF

(Try this in NetRun now!)

There are various funky jump instructions, like "jc" (jump if CF is set), "jo" (jump if OF is set), and "js" (jump if SF is set) that check these bits.

Note there's NO way to get at the flags, or to directly call the flag-using instructions in C! None!