instruction set of 8086

Microprocessors IAssembly Language1

Dr. Martin LandHadassah CollegeSpring 2009

8086 Instruction Set



Data Movement ⎯ Abbreviations

src = source (מקור)dest = destination (י ע ד)acc = accumulator (AL or AX)PTR = pointer ( מצבי ע)DWORD = double word (32 bits). = concatenation (AX = AH.AL)



Data Movement ⎯ Conventions

AX ← BXCopy BX to AX

AL ← [1000]Copy memory byte at address 1000 to AL

AL ← [BX]Copy memory byte at address stored in BX to AL

←⎯⎯⎯⎯⎯⎯REGS[AX] REGS[BX]16-bits

←⎯⎯⎯⎯⎯REGS[AL] MEM[1000]8-bits

←⎯⎯⎯⎯⎯REGS[AL] MEM[ REGS[BX] ]8-bits



Data Movement ⎯ Scope

BYTE PTR[1000]Memory byte at address 1000

WORD PTR[1000]Memory word (2 bytes) at address 1000 and address 1001

DWORD PTR[1000]Memory dword (4 bytes) at addresses

1000, 1001, 1002, 1003AX ← [BX]

AX ← WORD PTR[BX]AL ← [BX] and AH ← [BX+1]

REGS[AL] ←8 MEM[ REGS[BX] ]REGS[AH] ←8 MEM[ REGS[BX] + 1 ]



How are Assembly Instructions Used?Instructions

MOV dest, src ; dest ← srcADD dest, src ; dest ← dest + src

Program set-up by Operating System1. Load program and data into memory2. Set CS, DS, SS, ES, IP, SP to program locations3. Set AX = BX = CX = DX = SI = DI = BP = 04. Load and run program from CS:IP



Simple Assembly ProgramInstructions written as list

MOV DX, 1122 ; DX ← 1122MOV AX, [3344] ; AX ← [DS:3344]ADD AX, DX ; AX ← AX + DXMOV BX, 5566 ; BX ← 5566MOV SI, 0008 ; SI ← 0008ADD AX, [BX+SI] ; AX ← AX + [DS:BX+SI]MOV [BX], AX ; [DS:BX] ← AX

CPU Fetches next instruction in listDecodes fetched instructionExecutes decoded instruction



MOV←

←⎯⎯⎯⎯⎯

←⎯⎯⎯⎯⎯

←⎯⎯⎯⎯⎯

←⎯⎯⎯⎯⎯

←⎯ ⎯

MOV dest, src dest src

MOV AX, 1234 REGS[AX] 123416-bitsMOV AX, BX REGS[AX] REGS[BX]16-bitsMOV AX, [1234] REGS[AX] MEM[1234]16-bits

REGS[AL] MEM[1234] 8-bitsREGS[AH] 8-bits⎯⎯⎯

←⎯⎯⎯⎯⎯

←⎯⎯⎯⎯⎯

←⎯⎯⎯⎯⎯

MEM[1235]

MOV AL, [1234] REGS[AL] MEM[1234] 8-bitsMOV AX, [BX] REGS[AX] MEM[ REGS[BX] ]16-bitsMOV AX, [BX+SI] REGS[AX] MEM[ REGS[BX] + REGS[SI] ]16-bitsMOV AX, [BX+SI+1234] REGS[AX ←⎯⎯⎯⎯⎯] MEM[ REGS[BX] + REGS[SI] + 1234 ]16-bits



Stack Organization

8086 provides user stackLast In First Out (LIFO) buffer

SS:SP points to top of stackLast filled location in stack

Stack expands downFills from higher to lower addresses

PUSH srccopies scr to top of stack

POP destmoves top of stack to dest

12 34 56 78 9A

SP → BC

Full Part of

Stack

SS →

Empty Part of

Stack

←←⎯⎯⎯⎯16-bits

SP SP - 2SS:SP src

←⎯⎯⎯⎯

←16-bitsdest SS:SP

SP SP + 2



PUSHDS = 1122ES = 3344

PUSH DS SP ← SP – 2[SS:SP] ← DS

12 34 56 78 9A BC 11

SP → 22

Full Part of

Stack

SS →

Empty Part of

Stack



PUSHDS = 1122ES = 3344

PUSH DS SP ← SP – 2MEM[SS:SP] ← DS

PUSH ES SP ← SP – 2MEM[SS:SP] ← ES

12 34 56 78 9A BC 11 22 33

SP → 44

Full Part of

Stack

SS →

Empty Part of

Stack



POPDS = 1122ES = 3344

POP CS CS ← [SS:SP] SP ← SP + 2

CS = 3344

12 34 56 78 9A BC 11

SP → 22

Full Part of

Stack

33 44

SS →

Empty Part of

Stack



PUSHA / POPAPUSHA

Saves registers to stackEquivalent to executing

PUSH AXPUSH CXPUSH DXPUSH BXPUSH SP (value of SP

before PUSH AX)

PUSH BPPUSH SIPUSH DI

POPARestores registersEquivalent to executing

POP DIPOP SIPOP BPPOP SP (value is

discarded)POP BXPOP DXPOP CXPOP AX



Segment Override

CS: MOV [BP],CX CS:[BP] ← CX ES: MOV [BP],CX ES:[BP] ← CX DS: MOV [BP],CX DS:[BP] ← CX SS: MOV [BP],CX SS:[BP] ← CX



Bitwise Logical Operations

NOT dest dest ← not dest NOT 11001111 → 00110000

AND dest, src dest ← dest AND src 10110000 AND 11001111 → 10000000

OR dest, src dest ← dest OR src 10110000 OR 11001111 → 11111111

XOR dest, src dest ← dest XOR src 10110000 XOR 11001111 → 01111111

TEST dest, src dest AND src ; update flags



Using Boolean Operations

XOR AX,AX ; AX ← 0

MOV AX,1122 ; AX ← 1122AND AX,00FF ; AX ← 0022

MOV AX,1122 ; AX ← 1122TEST AX,8000 ; ZF ← 1 (tests high

order bit)

MOV AX,0001 ; AX ← 0001NOT AX ; AX ← FFFE



Unsigned Integersn-bit number is usual binary representationRepresents value from 0 to 2n-1Integers determined modulo 2nOverflow

a + b > 2n-1Carry Flag is set

n=3 7 111 6 110 5 101 4 100 3 011 2 010 1 001 0 000

CF 3-Bit Integer 0 111

+ 001 1 000

CF 3-Bit Integer 0 000

- 001 1 111



Signed Numbers ⎯ 1

n-bit number (2’s complement)Represents value from -2n-1 to +2n-1-1Integers determined modulo 2nOverflow

Carry-in not equal to carry-out at highest orderOverflow Flag is set




Upper bit = 0 for positive numbersUpper bit = 1 for negative numbers

n=3

+3 011 +2 010 +1 001 0 000 -1 111 -2 110 -3 101 -4 100

n=4 +7 0111 … … +3 0011 +2 0010 +1 0001 0 0000 -1 1111 -2 1110 -3 1101 -4 1100 … … -8 1000




OF CO CI 3-Bit Integer Decimal 111

+ 001 -1

+ 1 0 1 1 000 0


- 001 -1

- 1 0 0 0 110 -2


+ 001 3

+ 1 1 0 1 100 4



Data Conversion

CBW — convert byte to word with sign extensionCWD — convert word to double with sign extension

If AL < 80H, then AH ← 0 00000000 0xxxxxxx ← xxxxxxxx 0xxxxxxx

CBW If AL > 7F, then AH ← FFH 11111111 1xxxxxxx ← xxxxxxxx 1xxxxxxx If AX < 8000H, then DX ← 0

CWD If AX > 7FFFH. then DX ← FFFFH



Add/Subtract

ADD dest, src dest ← dest + src ADC dest, src dest ← dest + src + CF SUB dest ,src dest ← dest - src SBB dest ,src dest ← dest - src - CF INC dest dest ← dest + 1 DEC dest dest ← dest - 1 NEG dest dest ← 0 - dest CMP dest ,src dest - src; update flags



Long Integer Add/Sub

Long integers in DX.AX and DI.SI

ADD AX, SI AX ← AX + SICF ← carry

ADC DX, DI DX ← DX + DI + CFCF ← overflow

SUB AX, SI AX ← AX - SICF ← borrow

SBB DX, DI DX ← DX - DI - CFCF ← overflow



Multiplication / Division

MUL BL AX ← AL*BL MUL source MUL CX DX.AX ← AX*CX IMUL BL AX ← AL*BL IMUL source IMUL CX DX.AX ← AX*CX

DIV BL AL ← AX / BL AH ← AX % BL DIV source

DIV CX AX ← DX.AX / CX DX ← DX.AX % CX

IDIV BL AL ← AX / BL AH ← AX % BL IDIV source

IDIV CX AX ← DX.AX / CX DX ← DX.AX % CX



Small ProgramMOV AX,1122MOV BX,3344SUB BX,AXMOV CX,0003IMUL CX

AX=0000 BX=0000 CX=0000MOV AX,1122 AX=1122 BX=0000 CX=0000MOV BX,3344 AX=1122 BX=3344 CX=0000SUB BX,AX AX=1122 BX=2222 CX=0000MOV CX,0003 AX=1122 BX=2222 CX=0003IMUL CX AX=3366 BX=2222 CX=0003



Shift InstructionsSHR

Shift Right

SARShift Arithmetic RightShift bits right with

sign preservation

SALShift Arithmetic LeftShift left, sign bit to CFOF = 1 if sign bit changes



Rotate Instructions

ROL — Rotate Left

ROR — rotate right

RCL — rotate carry left

RCR — rotate carry right



String Instructions ⎯ 1

ES:[DI] ← AL If DF = 0, DI ← DI+1 STOSB

Store String Byte If DF = 1, DI ← DI-1

ES:[DI] ← AL; ES:[DI+1] ← AH If DF = 0, DI ← DI+2 STOSW

Store String Word If DF = 1, DI ← DI-2

AL ← DS:[SI] If DF = 0, SI ← SI+1 LODSB

Load String Byte If DF = 1, SI ← SI-1.

AL ← DS:[SI]: AH ← DS:[SI+1] LODSW

Load String Word If DF = 0, SI ← SI+2;

If DF = 1, SI ← SI-2




MOVSB Move String Byte

ES:[DI] ← DS:[SI] If DF = 0, DI ← DI+1 SI ← SI+1 If DF = 1, DI ← DI-1 SI ← SI-1

MOVSW Move String Word

ES:[DI] ← DS:[SI] ES:[DI+1] ← DS:[SI+1] If DF = 0, DI ← DI+2 SI ← Sl+2 If DF = 1, DI ← DI-2 SI ← SI-2

SCASB Scan String Byte

AL-ES:[DI]; update flags If DF = 0, DI ← DI+1 If DF = 1, DI ← DI-1




SCASW Scan

String Word

AX-ES:[DI+l:DI]; Update flags If DF = 0, DI ← DI+2 If DF = I, DI ← DI-2

CMPSB Compare String Byte

DS:[SI]-ES:[DI]; Update flags If DF = 0, DI ← DI+I

SI ← SI+1 If DF = 1 , DI ← DI-1

SI ← SI-1

CMPSW Compare String Word

DS:[SI+I:SI]-ES:[DI+1:DI]; Update flags If DF = 0, DI ← DI+2

SI ← SI+2 If DF = 1, DI ← DI-2

SI ← SI-2




REP STOSB STOSB CX ← CX - 1 Repeat until CX = 0

REP STOSW STOSW CX ←CX - 1 Repeat until CX = 0

REP MOVSB MOVSB CX ← CX - 1 Repeat until CX = 0

REP MOVSW MOVSW CX ← CX - 1 Repeat until CX = 0



Working with Strings

PUSH ES ; SP ← SP – 2; [SS:SP] ← ES

PUSH DS ; SP ← SP – 2; [SS:SP] ← DS

POP ES ; ES ← DS; SP ← SP + 2

MOV SI,0000 ; SI ← 0MOV DI,1000 ; DI ← 1000MOV CX,200 ; CX ← 200REP MOVSB ; COPY 200 H BYTES FROM

; DS:0000 – DS:01FF TO ; DS:1000 – DS:11FF



Branch InstructionsChanges program execution order

Changes default IP to new IP under program control

Used to build for, while, if, switch, … blocks

TargetNew IP after branch is executed

Fall-throughInstruction below branch in program

listingDefault IP points to fall-through

DisplacementDisplacement = Target IP – Fall-through IPDisplacement > 0 is forward jumpDisplacement < 0 is backward jump

branch

short target

near target

far target

shortjump

nearjump

farjump

fall through



Jump DistanceDisplacement = Target IP – Fall-through IP

Near ShortTarget in same code segment Displacement is byte

Near JumpTarget in same code segment Displacement is word (2 bytes)

Far JumpTarget in different code segmentPointer is double word (4 bytes)

branch

short target

near target

far target

shortjump

nearjump

farjump

fall through

≤ ≤10 10-128 = 80 displacement 7F = 127

≤ ≤10 10-32,768 = 8000 displacement 7FFF = 32,767



Jump InstructionJMP target ⇒ JMP near target (assembler chooses near or short)JMP FAR

JMP 1024 IP ←16 1024 JMP NEAR [1024] IP ←16 [1024] JMP target JMP NEAR [SI] IP ←16 [SI] JMP FAR 1122:3344 CS ←16 1122

IP ←16 3344 JMP FAR [1024] CS ←16 [1026]

IP ←16 [1024] JMP far target

JMP FAR [SI] CS ←16 [SI+2] IP ←16 [SI]



Conditional Jumps

ALU operations set flags in the status wordConditional jumps test the flags and jump if flag is setTakes short target

Mnemonic Condition Test JC Carry CF = 1 JE/JZ Equal/zero ZF = 1 JP/JPE Parity / parity even PF = 1 JNC Not carry CF = 0 JNE/JNZ Not equal/not zero ZF = 0 JNP/JPO Not Parity / parity odd PF = 0



Unsigned Compare ⎯ 1

A < B ⇒ CF =1A ≤ B ⇒ (ZF XOR CF) = 1A = B ⇒ ZF = 1A ≥ B ⇒ CF = 0A > B ⇒ (ZF XOR CF) = 0

(ZF = CF = 1 is impossible)

COMP ZF CF A < B 0 1 A = B 1 0 A > B 0 0



Unsigned Compare ⎯ 2

Mnemonic Condition

(Unsigned Operations) Test

JA/JNBE Above/not below nor equal (CF XOR ZF) = 0 JAE/JNB Above or equal/not below CF = 0 JB/JNAE Below/not above nor equal CF = 1 JBE/JNA Below or equal/not above CF XOR ZF = 1



Signed Compare

Mnemonic Condition

(Signed Operations) Test

JG/JNLE Greater/not less nor equal (SF XOR OF) + ZF) = 0 JGE/JNL Greater or equal/not less (SF XOR OF) = 0 JL/JNGE Less/not greater nor equal (SF XOR OF) = 1 JLE/JNG Less or equal/not greater ((SF XOR OF) + ZF) = 1 JO Overflow OF = 1 JS Sign SF = 1 JNO Not overflow OF = 0 JNS Not sign SF = 0



Simple Loop0100 XOR AX,AX ; zero accumulator (AX ← 0)0102 MOV BX,0001 ; BX ← 10105 ADD AX,BX ; add BX to accumulator0107 INC BX ; BX++0108 CMP BX,0005 ; set SF, ZF, OF according to value

; of BX – 5 010B JLE 0105 ; loop if ((SF XOR OF) + ZF) = 1

; (BX ≤ 5)



Loop Instruction

LOOP short target LOOP 1024 CX ← CX - 1 IF CX ≠ 0, JMP SHORT target LOOPZ short target LOOPZ 1024 CX ← CX - 1 IF (CX ≠ 0) AND (ZF = 1),

JMP SHORT target LOOPNZ short target LOOPNZ 1024 CX ← CX - 1 IF (CX ≠ 0) AND (ZF = 0),

JMP SHORT target

0100 XOR AX,AX ; zero accumulator0102 MOV CX,0005 ; CX ← 50105 ADD AX,CX ; add CX to accumulator0107 LOOP 0105 ; CX-- and loop if CX > 0



Call and Return

CALL near target SP ← SP-2; [SP] ← IP; IP ← target CALL 1024 SP ← SP-2; [SP] ← IP; IP ← 1024 CALL [SI] SP ← SP-2; [SP] ← IP; IP ← [SI]

CALL far target SP ← SP-2; [SP] ← CS; CS ← SEG; SP ← SP-2; [SP] ← IP; IP ← OFF CALL 1122:3344 SP ← SP-2; [SP] ← CS; CS ← 1122 SP ← SP-2; [SP] ← IP; IP ← 3344 CALL [SI] SP ← SP-2; [SP] ← CS; CS ← [SI+2] SP ← SP-2; [SP] ← IP; IP ← [SI]

RET IP ← [SP]; SP ← SP+2 RETF IP ← [SP]; SP ← SP+2; CS ← [SP]; SP ← SP+2



Indirect Far Call

stackSP

CSIP fall-through

CALL [SI]

DSSI

44332211

stack

SP

CS = 3344IP = 1122

fall-throughCALL [SI]

DSSI

44332211

fall-through CSfall-through IP



Software Interrupt (Trap)

Interrupts Program FlowTransfers control to Interrupt Service Routine (ISR)ISR can be stored anywhere in memory

Pointer to ISR stored in Interrupt Vector Table Tablestarts at 00000Each Vector is 4 bytes long (2×CS+2×IP)Vector 0 is at physical address 00000Vector 1 is at physical address 00004Vector 2 is at physical address 00008

ISR vector address is: INT_type×4Vector is: IP(L), IP(H), CS(L), CS(H)



Software Interrupt Instructions

INT type INT 20H SP ← SP-2; [SP] ← flags IF ← 0; TF ← 0; SP ← SP-2; [SP] ← CS; CS ← [00083H:00082H]; SP ← SP-2; [SP] ← IP; IP ← [00081H:00080H] IRET none IRET IP ← [SP];

SP ← SP+2; CS ← [SP]; SP ← SP+2; flags ← [SP]; SP ← SP+2



Interrupt

stackSP

CSIP fall-through

INT 21

0000000084

44332211

stack

SP

CS = 3344IP = 1122

fall-throughINT 21

0000000084

44332211

flagsfall-through CSfall-through IP



Hardware Interrupts

INTR line on chip causes interruptINT_type is on address lines A0 to A7

NMI line on chip causes non-maskable interruptCannot be masked (turned off)Always points to INT type 4

CPU

INTR

A7A6A5A4A3A2A1A0

8086

NMI



Processor Control Instructions

STC CF ← I Set carry flag CLC CF ← 0 Clear carry flag CMC CF ← not(CF) Complement carry flag STD DF ← 1 Set direction flag CLD DF ← 0 Clear direction flag STI IF ← I Set interrupt flag CLI IF ← 0 Clear interrupt flag HLT None Halt WAIT None Enter wait state NOP None No operation



More Data Movement Instructions

↔↔↔↔

←⎯⎯⎯

←⎯⎯⎯8-bits

8-bits

XCHG dest, src dest srcXCHG AX, BX AX BXXCHG AL, AH AL AHXCHG AX, [SI] AX [SI]

LAHF AH flags (low byte)SAHF flags (low byte) AH



Translate — XLATReplaces AL with (AL+1)st value in a tableUses AL as index into 256 byte table beginning at [BX]

XLAT AL ← [BX+AL]

A3 77 66 55 44 BX+AL → 33

22 11

BX → 00 97 54

MOV AL, 3 XLAT AL ← [BX+3] = 33

34 DS



LEALoad Effective Address

Similar to MOVCopies address (pointer) of memory locationDoes not access memory

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

16-bits

16-bits

16-bits

16-bits

16-bits

16-bits

LEA dest, [EA] dest EA

LEA AX, [1234] AX 1234REGS[AX] 1234

LEA CX, [SI+12] CX SI+12REGS[CX] REGS[SI]+12

LEA DX, [BX +DI] DX BX +DIR ←⎯⎯⎯⎯16-bitsEGS[DX] REGS[BX]+REGS[DI]



Moving Data AroundMOV SI,1122 ; SI ← 1122MOV [0000],SI ; [DS:0000] ← 1122MOV BX,3344 ; BX ← 3344MOV [BX],SI ; [DS:3344] ← 1122MOV [BX+SI],BX ; [DS:4466] ← 3344LEA BX,[BX+SI] ; BX ← 4466MOV CS,[BX] ; CS ← [DS:4466]MOV AX,[BX+2] ; AX ← [DS:4468]



LDS and LESLoads a 32-bit logical address of type DS:EA or ES:EA

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

←⎯⎯⎯⎯

16-bits

16-bits

16-bits

16-bits

16-bits

16-bits

LDS dest, [EA] dest [EA]DS [EA +2]

LDS BX, [SI] BX [SI]DS [SI+2]

LES dest, [EA] dest [EA]ES [EA +2]

11 22 33 44

DS ← 3344

55 SI → 66

BX ← 5566

77 88 99 AA

DS



Switching Data Tables/* DO ARITHMETIC WITH DS:BX = 1111:2222 *//* SWITCH DATA TABLES */MOV [SI], 4444 ; [SI] ← 4444MOV [SI+2], 3333 ; [SI+2] ← 3333PUSH DS ; SP ← SP – 2

; [SS:SP] ← 1111PUSH BX ; SP ← SP – 2

; [SS:SP] ← 2222LDS BX,[SI] ; BX ← 4444

; DS ← 3333/* DO ARITHMETIC WITH DS:BX = 3333:4444 *//* SWITCH BACK TO FIRST DATA TABLE */POP [SI] ; [SI] ← 2222

; SP ← SP + 2POP [SI+2] ; [SI+2] ← 1111

; SP ← SP + 2LDS BX,[SI] ; BX ← 2222

; DS ← 1111



Data Movement ⎯ I/O Operations ⎯ 1

80x86 processors control an I/O signal on the memory busI/O signal is off to select processor access to RAMI/O signal is on to select processor access to I/O busMOV selects RAM accessIN and OUT select I/O access

AL or AX are always src/dest for I/O instructionsI/O address is called a port

can range from 0000 H to FFFF Hdirect mode ⎯ 1 immediate byte addressindirect mode ⎯ 2 address bytes in DX



Data Movement ⎯ I/O Operations ⎯ 2

זיכרון מטמון

cache memory

ת החישוביהיד המרכזי

Central Processing Unit (CPU)

זיכרון ראשי

Main Memory

(RAM)

מתאם אפיקBus

Adapter

Memory Busאפיק זיכרון

I/O Busפלט /אפיק קלט

פלט/בקר קלטI/O Controller



Disk ממשק משתמש

רשת תקשורתcommunications

network

I/OData/Address



Data Movement ⎯ I/O Instructions ⎯ 3

IN AL,26H AL ← port 26H IN AX,26H AL ← port 26H;

AH ← port 27H input byte from port 0 ⎯ 255

IN AL,DX AL ← port DX IN acc, port

IN AX,DX AL ← port DX AH ← port DX+1

input byte from port 0 ⎯ 65,535 (address in DX)

OUT port, acc OUT DX,AX port DX ← AL port DX+1 ← AH

output byte to port 0 ⎯ 65,535 (address in DX)

instruction set of 8086

Education

Transcript of instruction set of 8086