Instructions

Data Movement Instructions
The fundamental data movement operation is MOV dest, source, which copies a byte or a word from the source location to the destination. In general, either the source or the destination must be a register (you can't copy directly from one memory location to another with MOV); the only exception is that an immediate value may be moved straight to memory (however, there is no way to put an immediate value into a segment register in one operation). Here are the accepted forms:

        MOV     reg8, r/m/i8
        MOV     mem8, reg8
        MOV     mem8, BYTE imm8


        MOV     reg16, r/m/i16
        MOV     mem16, reg16
        MOV     mem16, WORD imm16


        MOV     r/m16, segreg
        MOV     segreg, r/m16

To perform a swap of two locations instead of a one-way copy, there is also an exchange operation:

        XCHG    reg8, r/m8
        XCHG    reg16, r/m16

        NOP

        LDS     reg16, mem32
        LES     reg16, mem32

An operation that is frequently useful when setting up pointers is to load the "effective address'' of a memory reference. That is, this instruction does the displacement plus base plus index calculation, but just stores the resulting address in the destination register, rather than actually fetching the data from the address. Here is the only form allowed on the 8086:

        LEA     reg16, mem

        PUSH    r/m16
        PUSH    segreg


        POP     r/m16
        POP     segreg

Although they were not provided on the original 8086, the instructions to push and pop the FLAGS register (as mentioned earlier) are available in Virtual-8086 mode on the Pentium (they were actually introduced in the 80186):

        PUSHF
        POPF

        CLC
        CLD
        CLI
        STC
        STD
        STI

        CMC

        LAHF
        SAHF

        ADD     reg8, r/m/i8
        ADD     mem8, reg8
        ADD     mem8, BYTE imm8


        ADD     reg16, r/m/i16
        ADD     mem16, reg16
        ADD     mem16, WORD imm16

To add two numbers, use the ADD instruction. To continue adding further bytes or words of a multi-part number, use the ADC instruction to also add one if the Carry flag is set (indicating a carry-over from the previous byte or word). For example, to add the 32-bit immediate value 12345678h to the 32-bit double word stored at location 500h, do ADD [500h], 5678h followed by ADC [502h], 1234h.

Subtraction is analogous: use the SUB instruction to subtract a single pair of bytes or words, and then use the SBB ("Subtract with Borrow'') instruction to take the Carry into account for further bytes or words.

An important use of subtraction is in comparing two numbers; in this case, we are not interested in the exact value of their difference, only in whether it is zero or negative, or whether there was a carry or overflow. The CMP ("Compare'') instruction performs this task; it subtracts the source from the destination and adjusts the status flags accordingly, but throws away the result. This is exactly what is needed to get conditions such as LE to work; after doing CMP AX, 10, for example, the status flags will be set in such a way that the LE condition is true precisely when the value in AX (treated as a signed integer) is less than or equal to 10.

The two-operand logical instructions are AND, OR, XOR, and TEST. The first three perform the expected bitwise operations; for example, the nth bit of the destination after the AND operation will be 1 (set, true) if the nth bit of both the source and the destination were 1 before the operation, otherwise it will be 0 (clear, false). The TEST instruction is to AND as CMP is to SUB; it performs a bitwise and operation, but the result is only reflected in the flags. For example, after the instruction TEST [321h], BYTE 12h, the Zero flag will be set if neither bit 1 nor bit 4 (12h is 00010010 in binary, indicating that bits 1 and 4 are to be tested) of the byte at address 321h were 1, otherwise it will be clear.

Multiplication and division are also binary operations, but the corresponding instructions on the 8086 only allow one of the operands to be specified (and it can only be a register or memory reference, not an immediate value). The other operand is implicitly contained in the accumulator (and sometimes also the DX register). The MUL and DIV instructions operate on unsigned numbers, while IMUL and IDIV operate on two's-complement signed numbers. Here are the valid forms for MUL; the others are analogous:

        MUL     reg8
        MUL     BYTE mem8


        MUL     reg16
        MUL     WORD mem16

For division, the process is reversed. An 8-bit operand will be divided into the number in AX, with the quotient stored in AL and the remainder left in AH. A 16-bit operand will be divided into the 32-bit quantity whose high word is in DX and whose low word is in AX; the quotient will be in AX and the remainder will be in DX after the operation. None of the status flags are defined after a division. Also, if the division results in an error (division by zero, or a quotient that is too large), the processor will trigger interrupt zero (as if it had executed INT 0).

The CBW and CWD instructions, which take no operands, will sign-extend AL into AX or AX into DX, respectively, just as needed before performing a signed division. For example, if AL contains 11010110, then after CBW the AH register will contain 11111111 (and AL will be unchanged).

Multiplication and division by powers of two are frequently performed by shifting the bits to the left or right. There are several varieties of shift and rotate instructions, all of which allow the following forms:

        RCL     reg8, 1
        RCL     reg8, CL
        RCL     BYTE mem8, 1
        RCL     BYTE mem8, CL


        RCL     reg16, 1
        RCL     reg16, CL
        RCL     WORD mem16, 1
        RCL     WORD mem16, CL

There are three shift instructions---SAR, SHR, and SHL. The "shift-left'' instruction, SHL, shifts the highest bit of the operand into the Carry flag and fills in the lowest bit with zero. The "shift-right'' instruction, SHR, does the opposite, moving zero in from the top and shifting the lowest bit out into the Carry; this is appropriate for an unsigned division, with the Carry flag giving a 1-bit remainder. On the other hand, the "shift-arithmetic-right'' instruction, SAR, leaves a copy of the highest bit in place as it shifts; this is appropriate for a signed division, since it preserves the sign bit.

For example, -53 is represented in 8-bit two's-complement by the binary number 11001011. After a SHL by one position, it will be 10010110, which represents -106. After a SAR, it will be 11100101, which represents -27. After a SHR, it will be 01100101, which represents +101 in decimal; this corresponds to the interpretation of the original bits as the unsigned number 203 (which yields 101 when divided by 2).

When shifting multiple words by one bit, the Carry can serve as the bridge from one word to the next. For example, suppose we want to multiply the double word (4 bytes) starting at address 1230h by 2; the instruction SHL WORD [1230], 1 will shift the low-order word, putting its highest bit into the Carry flag. Now we need an instruction that will shift the Carry into the lowest bit of the word at 1232h; if we wanted to continue the process, we would also need it to shift the highest bit of that word back out into the Carry. The effect here is that the bits in the operand plus the Carry have been rotated one position to the left. The desired instruction is RCL WORD [1232], 1 ("rotate-carry-left''). There is a corresponding "rotate-carry-right'' instruction, RCR; there are also two rotate instructions which directly shift the highest bit down to the lowest and vice versa, called ROL and ROR.

There are four unary arithmetic and logical instructions. The increment and decrement operations, INC and DEC, add or subtract one from their operand; they do not affect the Carry bit. The negation instruction, NEG, takes the two's-complement of its operand, while the NOT instruction takes the one's-complement (flip each bit from 1 to 0 or 0 to 1). NEG affects all the usual flags, but NOT does not affect any of them. The valid forms of operand are the same for all of these instructions; here are the forms for INC:

        INC     reg8
        INC     BYTE mem8


        INC     reg16
        INC     WORD mem16

The string instructions facilitate operations on sequences of bytes or words. None of them take an explicit operand; instead, they all work implicitly on the source and/or destination strings. The current element (byte or word) of the source string is at DS:SI, and the current element of the destination string is at ES:DI. Each instruction works on one element and then automatically adjusts SI and/or DI; if the Direction flag is clear, then the index is incremented, otherwise it is decremented (when working with overlapping strings it is sometimes necessary to work from back to front, but usually you should leave the Direction flag clear and work on strings from front to back).

To work on an entire string at a time, each string instruction can be accompanied by a repeat prefix, either REP or one of REPE and REPNE (or their synonyms REPZ and REPNZ). These cause the instruction to be repeated the number of times in the count register, CX; for REPE and REPNE, the Zero flag is tested at the end of each operation and the loop is stopped if the condition (Equal or Not Equal to zero) fails.

The MOVSB and MOVSW instructions have the following forms:

        MOVSB
        REP MOVSB


        MOVSW
        REP MOVSW

while (CX != 0) {
        *(ES*16 + DI) = *(DS*16 + SI);
        SI++;
        DI++;
        CX--;
}

The STOSB and STOSW instructions are similar to MOVSB and MOVSW, except the source byte or word comes from AL or AX instead of the memory address in DS:SI. For example, the following is a very fast way to initialize the block of memory from ES:1000h to ES:4FFFh with zeroes:

        MOV     DI, 1000h       ;Starting address
        MOV     CX, 2000h       ;Number of words
        MOV     AX, 0           ;Word to store at each location
        CLD                     ;Make sure direction is increasing
        REP STOSW               ;Perform the initialization

        MOV     SI, DX          ;Initialize source
        MOV     DI, DX          ;  and destination indices
        MOV     AX, DS          ;Copy DS (source segment)
        MOV     ES, AX          ;  into ES (destination segment)
        CLD
NextCh  LODSB                   ;Load next character into AL
        CMP     AL, 'A'
        JB      NotUC           ;Jump if below 'A'
        CMP     AL, 'Z'
        JA      NotUC           ;  or above 'Z'
        ADD     AL, 'a' - 'A'   ;Convert UC to lc
NotUC   STOSB                   ;Store modified character back
        CMP     AL, 0
        JNE     NextCh          ;Do next character if not at end of string

while (CX != 0) {
        SetFlags(*(DS*16 + SI) - *(ES*16 + DI));
        SI++;
        DI++;
        CX--;
        if (!ZeroFlag) break;
}

        MOV     DI, DX          ;Starting address in DX (assume ES = DS)
        MOV     AL, 0           ;Byte to search for (NUL)
        MOV     CX, -1          ;Start count at FFFFh
        CLD                     ;Increment DI after each character
        REPNE SCASB             ;Scan string for NUL, decrementing CX for each char
        MOV     AX, -2          ;CX will be -2 for length 0, -3 for length 1, ...
        SUB     AX, CX          ;Length in AX

The unconditional jump instruction, JMP, causes IP (and sometimes CS) to be modified so that the next instruction is fetched from the location given in the operand (the target). Here are the valid forms:

        JMP SHORT imm8
        JMP     imm16
        JMP     imm16:imm16
        JMP     r/m16
        JMP FAR mem32

The conditional jump instructions, Jcc, where cc is one of the condition codes listed earlier (E, NE, ...), perform a short jump if the condition is true, based on the current contents of the status flags. For example, the code sample that was given in the discussion of LODSB, to convert a string to lower-case, used the JA and JB instructions; these made their jump if the result of the previous comparison found that the current character was above 'Z' or below 'A'. Since a conditional jump can only be to a nearby target, it is sometimes necessary to combine conditional and unconditional jumps as follows:

        JNLE    NoJLE
        JMP     target
NoJLE:

There are two specialized versions of conditional jump that are particularly useful when executing a loop a fixed number of times. The looping statements

        LOOP    imm8
        LOOPE   imm8
        LOOPNE  imm8

Repeat  MOVSB
        LOOP    Repeat

After looping or repetitive string operations, it is occasionally necessary to test whether the count register reached zero (to check whether the loop ran for the full count or whether it exited early because the Zero flag changed). The instruction

        JCXZ    imm8

All of the above branching instructions are variations on the infamous GOTO statement; they cause a permanent change in the course of execution. To perform an operation more like a function or subroutine call, where the flow of control will eventually return to pick up with the next instruction, the 8086 provides two mechanisms: CALL/RET and INT/IRET.

The CALL instruction offers a similar range of addressing modes to the JMP instruction, except there is no "short'' call:

        CALL    imm16
        CALL    imm16:imm16
        CALL    r/m16
        CALL FAR mem32

To reverse the effect of a CALL, when the subroutine is done it should execute a RET or RETF instruction; this pops the return address off of the stack and back into IP (and RETF also pops the saved value of CS, to return from a far call). After the return, the next instruction that will be fetched will be from the next location after the CALL. There is an optional 16-bit immediate operand that may be specified with a return instruction; this value is added to the stack pointer after popping off the return address, to recover however many bytes had been pushed onto the stack with parameters before the call. For example, here is one way to implement a subroutine to print a character, where the calling code first pushes the character (as the low byte of a word, since there is no option to push a single byte) before making the call:

PutChar PUSH    BP      ;Save current values of registers that we'll modify
        PUSH    AX
        PUSH    DX
        MOV     BP, SP  ;Copy stack pointer to BP
        MOV     AH, 2   ;DOS function code for printing a character
        MOV     DL, [BP + 8]    ;Fetch character parameter from stack
;Stack contains (from tos) DX, AX, BP, return address, and parameter
        INT     21h     ;Call DOS function
        POP     DX      ;Restore modified registers
        POP     AX
        POP     BP
        RET     2       ;Return and pop 2 byte parameter

NextCh  LODSB           ;Load next character into AL
        CMP     AL, 0
        JE      Done    ;Quit if NUL
        PUSH    AX      ;Set up parameter for call
        CALL    PutChar
        JMP     NextCh  ;Continue with next character
Done:

The other function-call-like mechanism is the interrupt. We have been using this all along to call the standard DOS services, such as printing a character or a '$'-terminated string. The INT instruction behaves much like the CALL FAR instruction except for two things: it pushes the FLAGS register before pushing CS and IP (the idea is that an interrupt should be able to completely restore the state of the processor when it is finished, since this is also the mechanism used for handling hardware interrupts from the rest of the system---they can happen at any time, independent of what the processor might be working on, and they should occur as transparently to the current process as possible), and it gets the target address from a standard table of interrupt handler vectors kept at the bottom of memory. When the processor executes INT n, where n is an 8-bit immediate value, it fetches a far pointer (that is, a 4-byte combination of segment and offset) from the memory address 0000:4n; this is the target address for the interrupt call. For example, the address of the DOS interrupt handler, the routine called when INT 21h is executed, is stored at locations 0000:0084 through 0000:0087; the first two bytes give the offset, to load into IP, and the second two bytes give the segment, to load into CS.

To return from an interrupt handler, the IRET instruction is used. It pops the IP, CS, and FLAGS registers, which causes the state of the machine to return to where it left off when the interrupt occurred.