Original 8086/8088 instructions

Original 8086/8088 instruction set

Instruction
Meaning
Notes
Opcode
used with unpacked
AAA
ASCII adjust AL after addition
0x37
binary coded decimal
8086/8088 datasheet
documents only base 10
version of the AAD
instruction (opcode
0xD5 0x0A), but any
other base will work.
Later Intel's
documentation has the
AAD
ASCII adjust AX before division
0xD5
generic form too. NEC
V20 and V30 (and
possibly other NEC Vseries CPUs) always
use base 10, and ignore
the argument, causing a
number of
incompatibilities
Only base 10 version
ASCII adjust AX after
(Operand is 0xA) is
AAM
0xD4
multiplication
documented, see notes
for AAD
AAS
ASCII adjust AL after subtraction
0x3f
ADC

Add with carry

ADD

Add

AND

Logical AND

CALL

Call procedure

destination :=
destination +
source + carry_flag

0x100x15,
0x80/20x83/2

(1) r/m += r/imm; (2) 0x000x05,

r += m/imm;
0x80/00x83/0
(1) r/m &= r/imm; (2) 0x200x25,
r &= m/imm;
0x80/40x83/4
push eip; eip
points to the
0x9A, 0xE8,
instruction
directly after the 0xFF/2, 0xFF/3
call

CBW
CLC
CLD
CLI
CMC

Convert byte to word

Clear carry flag
Clear direction flag
Clear interrupt flag
Complement carry flag

CMP

Compare operands

CMPSB

Compare bytes in memory

CF = 0;
DF = 0;
IF = 0;

0x98
0xF8
0xFC
0xFA
0xF5
0x380x3D,
0x80/70x83/7
0xA6

Original 8086/8088 instruction set

Instruction
Meaning
Notes
CMPSW
Compare words
CWD
Convert word to doubleword
(used with packed
DAA
Decimal adjust AL after addition
binary coded decimal)
DAS
Decimal adjust AL after subtraction
DEC

Decrement by 1

DIV

Unsigned divide

ESC
HLT

Used with floating-point unit

Enter halt state

IDIV

Signed divide

IMUL

Signed multiply

DX:AX = DX:AX /
r/m; resulting DX ==
remainder

Input from port

INC

Increment by 1

INT
INTO
IRET

Call to interrupt
Call to interrupt if overflow
Return from interrupt

Jcc

Jump if condition

JCXZ

Jump if CX is zero

JMP

Jump

LAHF
LDS
LEA
LES
LOCK

Load FLAGS into AH register

Load pointer using DS
Load Effective Address
Load ES with pointer
Assert BUS LOCK# signal

0x27
0x2F
0x48, 0xFE/1,
0xFF/1
0xF6/6, 0xF7/6
0xF4

DX:AX = DX:AX /
r/m; resulting DX ==
remainder

(1) DX:AX = AX *
r/m; (2) AX = AL *
r/m

IN

Opcode
0xA7
0x99

0xF6/7, 0xF7/7
0x69, 0x6B,
0xF6/5, 0xF7/5,
0x0FAF

(1) AL = port[imm];
0xE4, 0xE5,
(2) AL = port[DX];
0xEC, 0xED
(3) AX = port[DX];
0x40, 0xFE/0,
0xFF/0
0xCD
0xCE
0xCF
(JA, JAE, JB, JBE,
JC, JE, JG, JGE,
JL, JLE, JNA, JNAE,
JNB, JNBE, JNC,
JNE, JNG, JNGE,
JNL, JNLE, JNO,
JNP, JNS, JNZ, JO,
JP, JPE, JPO, JS,
JZ)

(for multiprocessing)

0x700x7F,
0xE3, 0x0F83,
0x0F87

0xE3
0xE90xEB,
0xFF/4, 0xFF/5
0x9F
0xC5
0x8D
0xC4
0xF0

Original 8086/8088 instruction set

Instruction
Meaning
Notes
Opcode
if (DF==0) AL = *SI+
LODSB
Load string byte
0xAC
+; else AL = *SI--;
if (DF==0) AX = *SI+
LODSW
Load string word
0xAD
+; else AX = *SI--;
(LOOPE, LOOPNE,
LOOPNZ, LOOPZ) if (x 0xE0..0xE2
LOOP/LOOPx Loop control
&& --CX) goto lbl;
copies data from one
location to another, (1)
MOV
Move
r/m = r; (2) r = r/m;

MOVSB

Move byte from string to string

MOVSW

Move word from string to string

MUL

Unsigned multiply

NEG

Two's complement negation

if (DF==0)
*(byte*)DI++ =
*(byte*)SI++;
else
*(byte*)DI-- =
*(byte*)SI--;
if (DF==0)
*(word*)DI++ =
*(word*)SI++;
else
*(word*)DI-- =
*(word*)SI--;

0xA4

0xA5

(1) DX:AX = AX *
r/m; (2) AX = AL *
r/m;
r/m *= -1;

NOP

No operation

opcode equivalent to
XCHG EAX, EAX, but it
is never optimized to
0x90
"nothing happens",
always using a fixed
number of processor
ticks

NOT

Negate the operand, logical NOT

r/m ^= -1;

OR

Logical OR

OUT

Output to port

POP

Pop data from stack

(1) r/m |= r/imm; (2)

r |= m/imm;

(1) port[imm] = AL;

(2) port[DX] = AL;
(3) port[DX] = AX;
r/m = *SP++; POP CS
(opcode 0x0F) works
only on 8086/8088.

Original 8086/8088 instruction set

Instruction
Meaning
Notes
Opcode
Later CPUs use 0x0F as
a prefix for newer
instructions.
FLAGS = *SP++;
POPF
Pop FLAGS register from stack
0x9D
*--SP = r/m;
PUSH
Push data onto stack
*--SP = FLAGS;
PUSHF
Push FLAGS onto stack
0x9C
RCL
Rotate left (with carry)
RCR
Rotate right (with carry)
(REP, REPE, REPNE,
Repeat
REPxx
MOVS/STOS/CMPS/LODS/SCAS REPNZ, REPZ)
Not a real instruction.
The assembler will
translate these to a
RET
Return from procedure
RETN or a RETF
depending on the
memory model of the
target system.
RETN
Return from near procedure
RETF
Return from far procedure
ROL
Rotate left
ROR
Rotate right
SAHF
Store AH into FLAGS
0x9E
Shift Arithmetically left (signed
(1) r/m <<= 1; (2) r/m
SAL
<<= CL;
shift left)
Shift Arithmetically right (signed (1) (signed) r/m >>=
SAR
1; (2) (signed) r/m
shift right)
>>= CL;

SBB

Subtraction with borrow

SCASB
SCASW
SHL
SHR
STC
STD
STI
STOSB

Compare byte string

Compare word string
Shift left (unsigned shift left)
Shift right (unsigned shift right)
Set carry flag
Set direction flag
Set interrupt flag
Store byte in string

alternative 1-byte
encoding of
SBB AL, AL is
available via
undocumented SALC
instruction
0xAE
0xAF

0xF9
DF = 1;
0xFD
IF = 1;
0xFB
if (DF==0) *ES:DI++ 0xAA
CF = 1;

Original 8086/8088 instruction set

Meaning
Notes
= AL; else *ES:DI--

Instruction

Opcode

= AL;

STOSW

Store word in string

if (DF==0) *ES:DI++
= AX; else *ES:DI-- 0xAB
= AX;

SUB

Subtraction

(1) r/m -= r/imm; (2)

TEST

Logical compare (AND)

(1) r/m & r/imm; (2) r

WAIT

Wait until not busy

XCHG

Exchange data

XLAT

Table look-up translation

Waits until BUSY# pin

is inactive (used with 0x9B
floating-point unit)
r :=: r/m; A spinlock
typically uses xchg as
an atomic operation.
(coma bug).
behaves like MOV AL, 0xD7
[BX+AL]

XOR

Exclusive OR

(1) r/m ^= r/imm; (2)

r -= m/imm;
& m/imm;

r ^= m/imm;