cmpxchg8b

Compare and Exchange 8 Bytes

CMPXCHG8B m64

Atomically compares EDX:EAX with memory; swaps if equal.

Details

Atomically compares the 64-bit value in EDX:EAX with the 64-bit memory operand; if equal, the instruction exchanges the value in ECX:EBX with memory and clears ZF, otherwise it loads memory into EDX:EAX and sets ZF. The operation is atomic at the memory bus level on single-processor systems and uses locked semantics on multiprocessor systems. All arithmetic flags (OF, SF, ZF, AF, CF, PF) are updated based on the compare result; other flags are undefined.

Pseudocode Operation

value_memory ← [dest];
if (EDX:EAX == value_memory) {
  [dest] ← ECX:EBX;
  ZF ← 1;
} else {
  EDX:EAX ← value_memory;
  ZF ← 0;
}
OF, SF, AF, CF, PF undefined;

Example

CMPXCHG8B [rbp-8]

Encoding

Binary Layout

ModRM

Format Legacy

Opcode 0F C7 /1

Extension Base

Operands

dest
64-bit memory operand (quadword)

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
0F C7 /1	CMPXCHG8B m64	M	Valid		Valid* Compare EDX:EAX with m64. If equal, set ZF and load ECX:EBX into m64. Else, clear ZF and load m64 into EDX:EAX.
REX.W + 0F C7 /1	CMPXCHG16B m128	M	Valid N.E.		Compare RDX:RAX with m128. If equal, set ZF and load RCX:RBX into m128. Else, clear ZF and load m128 into RDX:RAX.

Description

Compares the 64-bit value in EDX:EAX (or 128-bit value in RDX:RAX if operand size is 128 bits) with the operand (destination operand). If the values are equal, the 64-bit value in ECX:EBX (or 128-bit value in RCX:RBX) is stored in the destination operand. Otherwise, the value in the destination operand is loaded into EDX:EAX (or RDX:RAX). The destination operand is an 8-byte memory location (or 16-byte memory location if operand size is 128 bits). For the EDX:EAX and ECX:EBX register pairs, EDX and ECX contain the high-order 32 bits and EAX and EBX contain the low-order 32 bits of a 64-bit value. For the RDX:RAX and RCX:RBX register pairs, RDX and RCX contain the highorder 64 bits and RAX and RBX contain the low-order 64bits of a 128-bit value. This instruction can be used with a LOCK prefix to allow the instruction to be executed atomically. To simplify the interface to the processor’s bus, the destination operand receives a write cycle without regard to the result of the comparison. The destination operand is written back if the comparison fails; otherwise, the source operand is written into the destination. (The processor never produces a locked read without also producing a locked write.) In 64-bit mode, default operation size is 64 bits. Use of the REX.W prefix promotes operation to 128 bits. Note that CMPXCHG16B requires that the destination (memory) operand be 16-byte aligned. See the summary chart at the beginning of this section for encoding data and limits. For information on the CPUID flag that indicates CMPXCHG16B, see Chapter 21 in the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1. IA-32 Architecture Compatibility This instruction encoding is not supported on Intel processors earlier than the Pentium processors. CMPXCHG8B/CMPXCHG16B—Compare and Exchange Bytes Vol. 2A 3-196

Operation

IF (64-Bit Mode and OperandSize = 64)
THEN
TEMP128 := DEST
IF (RDX:RAX = TEMP128)
THEN
ZF := 1;
DEST := RCX:RBX;
ELSE
ZF := 0;
RDX:RAX := TEMP128;
DEST := TEMP128;
FI;
FI
ELSE
TEMP64 := DEST;
IF (EDX:EAX = TEMP64)
THEN
ZF := 1;
DEST := ECX:EBX;
ELSE
ZF := 0;
EDX:EAX := TEMP64;
DEST := TEMP64;
FI;
FI;
FI;

Flags Affected

The ZF flag is set if the destination operand and EDX:EAX are equal; otherwise it is cleared. The CF, PF, AF, SF, and OF flags are unaffected.

Exceptions

Protected Mode Exceptions

#UD If the destination is not a memory operand. #GP(0) If the destination is located in a non-writable segment. If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. If the DS, ES, FS, or GS register contains a NULL segment selector. #SS(0) If a memory operand effective address is outside the SS segment limit. #PF(fault-code) If a page fault occurs. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3.

Real-Address Mode Exceptions

#UD If the destination operand is not a memory location. #GP If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. #SS If a memory operand effective address is outside the SS segment limit. CMPXCHG8B/CMPXCHG16B—Compare and Exchange Bytes Vol. 2A 3-197

Virtual-8086 Mode Exceptions

#UD If the destination operand is not a memory location. #GP(0) If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. #SS(0) If a memory operand effective address is outside the SS segment limit. #PF(fault-code) If a page fault occurs. #AC(0) If alignment checking is enabled and an unaligned memory reference is made.

Compatibility Mode Exceptions

Same exceptions as in protected mode.

64-Bit Mode Exceptions

#SS(0) If a memory address referencing the SS segment is in a non-canonical form. #GP(0) If the memory address is in a non-canonical form. If memory operand for CMPXCHG16B is not aligned on a 16-byte boundary. If CPUID.01H:ECX.CMPXCHG16B[13] = 0. #UD If the destination operand is not a memory location. #PF(fault-code) If a page fault occurs. #AC(0) If alignment checking is enabled and an unaligned memory reference is made while the current privilege level is 3. CMPXCHG8B/CMPXCHG16B—Compare and Exchange Bytes Vol. 2A 3-198