CHAPTER 8086 INSTRUCTIONS SET AND PROGRAMMING

Transcription

1 3 CHAPTER 886 INSTRUCTIONS SET AN PROGRAMMING 84

2 3.1. INSTRUCTION FORMAT The instruction format of 886 has one or more number of fields associated with it. The first filled is called operation code field or opcode field, which indicates the type of operation. The instruction format also contains other fields known as operand fields. There are six general formats of instructions in 886 instruction set. The length of an instruction may vary from one byte to sic bytes. a) One byte Instruction : This format is only one byte long and may have the implied data or register operands. The least significant 3 bits of the opcode are used for specifying the register operand, if any. Otherwise, all the eight bits form an opcode and the operands are implied. For example: F 8 H CLC : clear carry This is an operation without any operand, which clear the carry flag bit. Exchange register with accumulator 11 reg epending on the register (reg = RRR), the contents of the specified register will be exchanged with the accumulator. This operation is having one operand which is specified in a register. ASC Adjust for addition AAA H Here the operand to this instruction is implicit and it take the contents of register AL. b) Register to Register : This format is 2 bytes long. The first byte of the code specifies the operation code and the width of the operand specifies by w bit. The second byte of the opcode shows the register operands and RIM field OP COE d w 1 1 REG R/M The register represented by the REG field is one of the operands. The RIM field specifies another register or memory location, ie., the other operand. The register specified by REG is a source operand if, else it is a destination operand. For example: MOV : data transfer operation from Register to Register. Op-code is 1 1 d w 1 1 R E G C 1 H H 85

3 REG = REG = 1 indicates Register AL indicates Register CL w d indicates it is a byte operation (8 bit) indicates AL is a source register. This instruction indicates MOV CL, AL, i.e CL AL C) Register to/from memory with no displacement : This format is also 2 bytes long and similar to the register to register format except for the MO field OP COE d w MO REG R/M The MO field shows the MO of addressing. In case of no displacement. MO = For example : MOV : ata transfer Register/memory to/from register. 1 1 d w mod reg rim This format is similar to register to register transfer. The difference is in mood field. For register to register, mod = 11 For register to/from memory with no displacement, mod =. When mod =, the r/m fields indicates the address to memory location. As for example r/m = indicates (Bx) The instruction indicates the instruction MOV AX, [BX] In hexadecimal, the instruction is 8A O H H Here the data is present in a memory location in S whose offset address is in BX. The effective address of the data is given as 1H S BX There d 1 indicates AX is a destination register so it moves the data from memory to register. d) Register to/from Memory with isplacement : This type of instruction format contains one or two additional bytes for displacement along with 2-byte the format of the register to/from memory without displacement. 86

4 opcode High byte of displacement MO REG R/M Low byte of displacement MO = 1 indicates displacement of 8 bytes (instruction is of size 3 bytes) MO = 1 indicates displacement of 16 bytes. (instruction is of size 4 bytes) Already we have seen the other two options of MO MO = 1 1 indicates register to register transfer MO = indicates memory without displacement In this case, R/M fields indicates a memory when MO is not 1 1 R/M = indicates (BX) When MO = 1, the offset address is BX 8 8 When MO = 1, the offset address is BX 16 e) Immediate operand to register In this format, the first byte as well as the 3 bites from the second byte which are used for REG field in case of register to register format are used for opcode. It also contains one or two bytes of immediate data Op code w 1 1 op code R/M Lower byte ATA Higher byte ATA When w, the size of immediate data is 8 bits and the size of instruction is 3 bytes. When w 1, the size of immediate data is 16 bits and the size of instruction is 4 bytes. f) immediate operand to memory with 16-bit displacement : This type of instruction format requires 5 to 6 bytes for coding. The first two bytes contain the information regarding OPCOE, MO and R/M fields. The remaining 4 bytes contain 2 bytes of displacement and 2 bytes of data. 8

5 Op code w MO op code R/M Higher byte of The REG code of the different registers (either a source or destination operands) in the opcode byte are assigned with binary code. - w bit Register code (3 bit) Registers Segment register code (2 bit) Segment register - A L - E S 1 CL 1 C S 1 L 1 S S 1 1 BL 1 1 S 1 AH 1 1 CH 1 1 H BH 1 AX 1 1 CX 1 1 X BX 1 1 SP BP SI I Coding of different registers. Addressing Modes of 886 : Lower byte of ATA Higher byte of The different addressing modes of the 886 instructions along with corresponding MO, REG and R/M field are given in the table. operands Memory operands Register operands No isplacement isplacement 8 bits isplacement 16 bits MO RIM w w 1 BX SI BX SI 8 8 BX SI 16 - AL AX 1 BX I BX I 8 8 BX I 16 CL CX 88

6 1 BP SI BP SI 8 8 BP SI 16 L X 1 1 BP I BP I 8 8 BP I 16 BL BX 1 SI SI 8 8 SI 16 AH SP 1 1 I I 8 8 I 16 CH BP BP 8 8 BP 16 H SS BX BX 8 8 BX 16 BH I 8 and 16 represent 8 and 16 bit displacement respectively. The default segment for the addressing modes using BP and SP is SS. For all other addressing modes the default segments are S or ES ARESSING MOES efinition: An instruction acts on any number of operands. The way an instruction accesses its operands is called its Addressing modes. Operands may be of three types: o o o Implicit Explicit Both Implicit and Explicit. Implicit operands mean that the instruction by definition has some specific operands. The programmers do NOT select these operands. Example: Implicit operands XLAT; automatically takes AL and BX as operands AAM; it operates on the contents of AX. Explicit operands mean the instruction operates on the operands specified by the programmer. Example: Explicit operands MOV AX, BX; it takes AX and BX as operands XCHG SI, I; it takes SI and I as operands 89

7 Implicit and explicit operands Example: Implicit/Explicit operands MUL BX; automatically multiply BX explicitly times AX The location of an operand value in memory space is called the Effective Address (EA) We can classify the addressing modes of 886 into four groups: Immediate addressing Register addressing Memory addressing I/O port addressing The first three Addressing modes are clearly explained Immediate Addressing Mode In this addressing mode, the operand is stored as part of the instruction. The immediate operand, which is stored along with the instruction, resides in the code segment -- not in the data segment. This addressing mode is also faster to execute an instruction because the operand is read with the instruction from memory. Here are some examples: Register addressing mode In this addressing mode, the operands may be: Example: Immediate Operands MOV AL, 2 ; move the constant 2 into register AL A AX, 5 ; add constant 5 to register EAX MOV X, offset msg ; move the address of message to register X reg16: 16-bit general registers: AX, BX, CX, X, SI, I, SP or BP. reg8 : 8-bit general registers: AH, BH, CH, H, AL, BL, CL, or L. Sreg : segment registers: CS, S, ES, or SS. There is an exception: CS cannot be a destination. For register addressing modes, there is no need to compute the effective address. The operand is in a register and to get the operand there is no memory access involved. Example: Operands Register 9

8 Some rules in register addressing modes: MOV AX, BX ; mov reg16, reg16 A AX, SI ; add reg16, reg16 MOV S, AX ; mov Sreg, reg16 1. You may not specify CS as the destination operand. Example: mov CS, 2h > wrong 2. Only one of the operands can be a segment register. You cannot move data from one segment register to another with a single mov instruction. To copy the value of cs to ds, you would have to use some sequence like: Movds,cs->wrong movax,cs mov ds, ax -> the way we do it You should never use the segment registers as data registers to hold arbitrary values. They should only contain segment addresses Memory Addressing Modes Memory (RAM) is the main component of a computer to store temporary data and machine instructions. In a program, programmers many times need to read from and write into memory locations. There are different forms of memory addressing modes 1. irect Addressing 2. Register indirect addressing 3. Based addressing 4. Indexed addressing 5. Based indexed addressing 6. Based indexed with displacement. irect Addressing Mode & Register Indirect Addressing Mode irect Addressing Mode The instruction mov al,ds:[888h] loads the AL register with a copy of the byte at memory location 888h. Likewise, the instruction mov ds:[1234h],dl stores the value in the dl register to memory location 1234h. By default, all displacement-only values provide offsets into the data segment. If you want to provide an offset into a different segment, you must use a segment override prefix before your address. For example, to access location 1234h in the extra segment (es) you would use an instruction of the form mov ax,es:[1234h]. Likewise, to access this location in the code segment you would use the instruction mov ax, cs:[1234h]. The ds: prefix in the previous examples is not a segment override. 91

9 The instruction mov al,ds:[888h] is same as mov al, [888h]. If not mentioned S register is taken by default Register Indirect Addressing Mode The 8x86 CPUs let you access memory indirectly through a register using the register indirect addressing modes. There are four forms of this addressing mode on the 886, best demonstrated by the following instructions: mov al, [bx] mov al, [bp] mov al, [si] mov al, [di] Code Example MOV BX, 1H MOV AL, [BX] The [bx], [si], and [di] modes use the ds segment by default. The [bp] addressing mode uses the stack segment (ss) by default. You can use the segment override prefix symbols if you wish to access data in different segments. The following instructions demonstrate the use of these overrides: mov al, cs:[bx] mov al, ds:[bp] mov al, ss:[si] mov al, es:[di] 92

10 Intel refers to [bx] and [bp] as base addressing modes and bx and bp as base registers (in fact, bp stands for base pointer). Intel refers to the [si] and [di] addressing modes as indexed addressing modes (si stands for source index, di stands for destination index). However, these addressing modes are functionally equivalent. This text will call these forms register indirect modes to be consistent Based Addressing Mode 8-bit or 16-bit instruction operand is added to the contents of a base register (BX or BP), the resulting value is a pointer to location where data resides. Mov al, [bx],[si] Mov bl, [bp],[di] Mov cl, [bp],[di] Code Example If bx=1h si=88h Mov AL, [1+88] Mov AL,[188] Indexed Addressing Modes The indexed addressing modes use the following syntax: mov al, [bx+disp] mov al, [bp+disp] mov al, [si+disp] mov al, [di+disp] Code Example MOV BX, 1H MOV AL, [BX + 15] MOV AL, [BX + 16] If bx contains 1h, then the instruction mov cl, [bx+2h] will load cl from memory location ds:12h. Likewise, if bp contains 22h, mov dh, [bp+1h] will load dh from location ss:32. The offsets generated by these addressing modes are the sum of the constant and the specified register. The addressing modes involving bx, si, and di all use the data segment, the [bp+disp] addressing mode uses the stack segment by default. As with the register indirect addressing modes, you can use the segment override prefixes to specify a different segment: mov al, ss:[bx+disp] mov al, es:[bp+disp] mov al, cs:[si+disp] mov al, ss:[di+disp] Example: MOV AX, [I + 1] 93

11 8. ased Indexed Addressing Modes & Based Indexed Plus isplacement Addressing Mode Based Indexed Addressing Modes The based indexed addressing modes are simply combinations of the register indirect addressing modes. These addressing modes form the offset by adding together a base register (bx or bp) and an index register (si or di). The allowable forms for these addressing modes are: mov al, [bx+si] mov al, [bx+di] mov al, [bp+si] mov al, [bp+di] Code Example MOV BX, 1H MOV SI, 2H MOV AL, [BX + SI] INC BX INC SI Suppose that bx contains 1h and si contains 88h. Then the instruction mov al,[bx][si] would load al from location S:188h. Likewise, if bp contains 1598h and di contains 14, mov ax,[bp+di] will load the 16 bits in ax from locations SS:259C and SS:259. The addressing modes that do not involve bp use the data segment by default. Those that have bp as an operand use the stack segment by default Based Indexed Plus isplacement Addressing Mode These addressing modes are a slight modification of the base/indexed addressing modes with the addition of an eight bit or sixteen bit constant. The following are some examples of these addressing modes mov al, disp[bx][si] mov al, disp[bx+di] mov al, [bp+si+disp] mov al, [bp][di][disp] 94

12 Code Example MOV BX, 1H MOV SI, 2H MOV AL, [BX + SI +1H] INC BX INC SI 3.3. INSTRUCTION SET Here are the most important instructions (in my opinion) that have been available on all Intel processors since the 886. ifferent assemblers may have minor variations in how these instructions are represented in assembly code; I give the NASM form here. Throughout this section, when specifying the valid forms of operands, I will write reg8 to stand for any 8-bit register, reg16 for any of the eight general- and special-purpose 16-bit registers, mem8 for a memory reference to a single byte, mem16 for a memory reference to a word (with the low-order byte at the given address), imm8 for an 8-bit immediate value, and imm16 for a 16-bit immediate value. If an operand may be either a register or memory reference, I will write r/m8 or r/m16; if it may also be an immediate value, then I will write r/m/i8 or r/m/i16. A segment register as an operand will be written segreg ata Transfer Group The fundamental data movement operation is MOV dest, source, which copies a byte or a word from the source location to the destination. In general, either the source or the destination must be a register (you can't copy directly from one memory location to another with MOV); the only exception is that an immediate value may be moved straight to memory (however, there is no way to put an immediate value into a segment register in one operation). Here are the accepted forms: MOV MOV MOV reg8, r/m/i8 mem8, reg8 mem8, BYTE imm8 MOV MOV MOV reg16, r/m/i16 mem16, reg16 mem16, WOR imm16 MOV MOV r/m16, segreg segreg, r/m16 95

13 The CS segment register may not be used as a destination (you wouldn't want to do this anyway, since it would change where the next instruction comes from; to get this effect, you need to use a proper flow control instruction such as JMP). To perform a swap of two locations instead of a one-way copy, there is also an exchange operation: XCHG reg8, r/m8 XCHG reg16, r/m16 As a special case of this that does nothing except occupy space and take up processor time, the instruction to exchange the accumulator with itself (XCHG AX, AX) is given the special "no-operation'' mnemonic: NOP For the special purpose of copying a far pointer (that is, a pointer that includes a segment address, so that it can refer to a location outside the current segment) from memory into registers, there are the LS and LES instructions. Here are the accepted forms: LS reg16, mem32 LES reg16, mem32 For example, the instruction LS SI, [2h] is equivalent to the pair of instructions MOV SI, [2h] and MOV S, [22h]. The 886 only supports loading the pointer into the S or ES segment register. An operation that is frequently useful when setting up pointers is to load the "effective address'' of a memory reference. That is, this instruction does the displacement plus base plus index calculation, but just stores the resulting address in the destination register, rather than actually fetching the data from the address. Here is the only form allowed on the 886: LEA reg16, mem To push and pop data from the stack, the 886 provides the following instructions. The top of stack is located at offset SP within the stack segment, so PUSH AX, for example, is equivalent to SUB SP, 2 (recall that the stack grows downward) followed by MOV [SS:SP], AX (except that [SS:SP] isn't a valid form of memory reference). PUSH r/m16 PUSH segreg POP r/m16 POP segreg As with MOV, you are not allowed to POP into the CS register (although you may PUSH CS). Although they were not provided on the original 886, the instructions to push and pop the FLAGS register (as mentioned earlier) are available in Virtual-886 mode on the Pentium (they were actually introduced in the 8186): PUSHF POPF 96

14 Here are the other ways of reading or modifying the FLAGS register (apart from setting flags as the result of an arithmetic operation, or testing them with a conditional branch, of course). The Carry, irection, and Interrupt Enable flags may be cleared and set: CLC CL CLI STC ST STI The Carry flag may also be complemented, or "toggled'' between and 1: CMC Finally, the bottom eight bits of the FLAGS register (containing the Carry, Parity, Auxiliary Carry, Zero, and Sign flags, as described above) may be transferred to and from the AH register: LAHF SAHF Arithmetic and Logical Instructions All of the two-operand arithmetic and logical instructions offer the same range of addressing modes. For example, here are the valid forms of the A operation: A A A reg8, r/m/i8 mem8, reg8 mem8, BYTE imm8 A reg16, r/m/i16 A mem16, reg16 A mem16, WOR imm16 Just as with the MOV instruction, the first operand is the destination and the second is the source; the result of performing the operation on the two operands is stored in the destination (if it gets stored anywhere). Unlike MOV, most of these instructions also set or clear the appropriate status flags to reflect the result of the operation (for some of the instructions, this is their only effect). To add two numbers, use the A instruction. To continue adding further bytes or words of a multi-part number, use the AC instruction to also add one if the Carry flag is set (indicating a carry-over from the previous byte or word). For example, to add the 32-bit immediate value h to the 32-bit double word stored at location 5h, do A [5h], 568h followed by AC [52h], 1234h. Subtraction is analogous: use the SUB instruction to subtract a single pair of bytes or words, and then use the SBB ("Subtract with Borrow'') instruction to take the Carry into account for further bytes or words. An important use of subtraction is in comparing two numbers; in this case, we are not interested in the exact value of their difference, only in whether it is zero or negative, or whether there was a carry or overflow. The CMP ("Compare'') instruction performs this task; it subtracts the source from the destination and adjusts the status flags accordingly, but throws away the result. This is exactly what is needed to get 9

15 conditions such as LE to work; after doing CMP AX, 1, for example, the status flags will be set in such a way that the LE condition is true precisely when the value in AX (treated as a signed integer) is less than or equal to 1. The two-operand logical instructions are AN, OR, XOR, and TEST. The first three perform the expected bitwise operations; for example, the nth bit of the destination after the AN operation will be 1 (set, true) if the nth bit of both the source and the destination were 1 before the operation, otherwise it will be (clear, false). The TEST instruction is to AN as CMP is to SUB; it performs a bitwise and operation, but the result is only reflected in the flags. For example, after the instruction TEST [321h], BYTE 12h, the Zero flag will be set if neither bit 1 nor bit 4 (12h is 11 in binary, indicating that bits 1 and 4 are to be tested) of the byte at address 321h were 1, otherwise it will be clear. Multiplication and division are also binary operations, but the corresponding instructions on the 886 only allow one of the operands to be specified (and it can only be a register or memory reference, not an immediate value). The other operand is implicitly contained in the accumulator (and sometimes also the X register). The MUL and IV instructions operate on unsigned numbers, while IMUL and IIV operate on two's-complement signed numbers. Here are the valid forms for MUL; the others are analogous: MUL MUL reg8 BYTE mem8 MUL reg16 MUL WOR mem16 For 8-bit multiplication, the quantity in AL is multiplied by the given operand and the 16-bit result is placed in AX. For 16-bit multiplication, the 32-bit product of AX and the operand is split, with the low word in AX and the high word in X. In both cases, if the result spills into the high-order byte/word, then the Carry and Overflow flags will be set, otherwise they will be clear. The other flags will have garbage in them; in particular, you will not get correct information from the Zero or Sign flags (if you want that information, follow the multiplication with CMP AX,, for example). For division, the process is reversed. An 8-bit operand will be divided into the number in AX, with the quotient stored in AL and the remainder left in AH. A 16-bit operand will be divided into the 32-bit quantity whose high word is in X and whose low word is in AX; the quotient will be in AX and the remainder will be in X after the operation. None of the status flags are defined after a division. Also, if the division results in an error (division by zero, or a quotient that is too large), the processor will trigger interrupt zero (as if it had executed INT ). The CBW and CW instructions, which take no operands, will sign-extend AL into AX or AX into X, respectively, just as needed before performing a signed division. For example, if AL contains 11111, then after CBW the AH register will contain (and AL will be unchanged). Multiplication and division by powers of two are frequently performed by shifting the bits to the left or right. There are several varieties of shift and rotate instructions, all of which allow the following forms: RCL reg8, 1 RCL reg8, CL RCL BYTE mem8, 1 RCL BYTE mem8, CL 98

16 RCL reg16, 1 RCL reg16, CL RCL WOR mem16, 1 RCL WOR mem16, CL The second operand specifies how many bit positions the result should be shifted by: either one or the number in the CL register. For example, the accumulator may be multiplied by 2 with SHL AX, 1; if CL contains the number 4, the accumulator may be multiplied by 16 with SHL AX, CL. There are three shift instructions---sar, SHR, and SHL. The "shift-left'' instruction, SHL, shifts the highest bit of the operand into the Carry flag and fills in the lowest bit with zero. The "shift-right'' instruction, SHR, does the opposite, moving zero in from the top and shifting the lowest bit out into the Carry; this is appropriate for an unsigned division, with the Carry flag giving a 1-bit remainder. On the other hand, the "shift-arithmetic-right'' instruction, SAR, leaves a copy of the highest bit in place as it shifts; this is appropriate for a signed division, since it preserves the sign bit. For example, -53 is represented in 8-bit two's-complement by the binary number After a SHL by one position, it will be 1111, which represents -16. After a SAR, it will be 11111, which represents -2. After a SHR, it will be 1111, which represents +11 in decimal; this corresponds to the interpretation of the original bits as the unsigned number 23 (which yields 11 when divided by 2). When shifting multiple words by one bit, the Carry can serve as the bridge from one word to the next. For example, suppose we want to multiply the double word (4 bytes) starting at address 123h by 2; the instruction SHL WOR [123], 1 will shift the low-order word, putting its highest bit into the Carry flag. Now we need an instruction that will shift the Carry into the lowest bit of the word at 1232h; if we wanted to continue the process, we would also need it to shift the highest bit of that word back out into the Carry. The effect here is that the bits in the operand plus the Carry have been rotated one position to the left. The desired instruction is RCL WOR [1232], 1 ("rotate-carry-left''). There is a corresponding "rotate-carryright'' instruction, RCR; there are also two rotate instructions which directly shift the highest bit down to the lowest and vice versa, called ROL and ROR. There are four unary arithmetic and logical instructions. The increment and decrement operations, INC and EC, add or subtract one from their operand; they do not affect the Carry bit. The negation instruction, NEG, takes the two's-complement of its operand, while the NOT instruction takes the one's-complement (flip each bit from 1 to or to 1). NEG affects all the usual flags, but NOT does not affect any of them. The valid forms of operand are the same for all of these instructions; here are the forms for INC: INC INC reg8 BYTE mem8 INC INC reg16 WOR mem String Instructions The string instructions facilitate operations on sequences of bytes or words. None of them take an explicit operand; instead, they all work implicitly on the source and/or destination strings. The current element 99

17 (byte or word) of the source string is at S:SI, and the current element of the destination string is at ES:I. Each instruction works on one element and then automatically adjusts SI and/or I; if the irection flag is clear, then the index is incremented, otherwise it is decremented (when working with overlapping strings it is sometimes necessary to work from back to front, but usually you should leave the irection flag clear and work on strings from front to back). To work on an entire string at a time, each string instruction can be accompanied by a repeat prefix, either REP or one of REPE and REPNE (or their synonyms REPZ and REPNZ). These cause the instruction to be repeated the number of times in the count register, CX; for REPE and REPNE, the Zero flag is tested at the end of each operation and the loop is stopped if the condition (Equal or Not Equal to zero) fails. The MOVSB and MOVSW instructions have the following forms: MOVSB REP MOVSB MOVSW REP MOVSW The first form copies a single byte from the source string, at address S:SI, to the destination string, at address ES:I, then increments (or decrements, if the irection flag is set) both SI and I. The second form performs this operation and then decrements CX; if CX is not zero, the operation is repeated. The effect is equivalent to the following pseudo-c code: while (CX!= ) { *(ES*16 + I) = *(S*16 + SI); SI++; I++; CX--; } (recall that ES*16 + I is the physical address corresponding to the segment and offset ES:I). The remaining two forms move a word at a time, instead of a single byte; correspondingly, SI and I are incremented or decremented by 2 each time through the loop. The STOSB and STOSW instructions are similar to MOVSB and MOVSW, except the source byte or word comes from AL or AX instead of the memory address in S:SI. For example, the following is a very fast way to initialize the block of memory from ES:1h to ES:4FFFh with zeroes: MOV I, 1h ;Starting address MOV CX, 2h ;Number of words MOV AX, ;Word to store at each location CL ;Make sure direction is increasing REP STOSW ;Perform the initialization Correspondingly, the LOSB and LOSW instructions are variations on the move instructions where the destination is the accumulator (instead of the memory address in ES:I). These are not very useful operations with the repeat prefix; instead, they are used as part of larger loops to perform more complex string processing. For example, here is a program fragment that will convert the NUL-terminated string 1

18 starting at the address in X to be all lower-case (there is a faster way to do the conversion of each character, using the XLATB instruction, but that is not the point here): MOV SI, X ;Initialize source MOV I, X ; and destination indices MOV AX, S ;Copy S (source segment) MOV ES, AX ; into ES (destination segment) CL NextCh LOSB ;Load next character into AL CMP AL, 'A' JB NotUC ;Jump if below 'A' CMP AL, 'Z' JA NotUC ; or above 'Z' A AL, 'a' - 'A' ;Convert UC to lc NotUC STOSB ;Store modified character back CMP AL, JNE NextCh ;o next character if not at end of string None of the preceding string operations have any effect on the status flags. By contrast, the remaining two string operations are executed solely for their effect on the status flags, just like the CMP operation on numbers. The CMPSB and CMPSW operations compare the current bytes or words of the source and destination strings by subtracting the destination from the source and recording the properties of the result in FLAGS. The SCASB and SCASW operations are the variants of this that use the accumulator (AL or AX) for the source. Each of these may be preceded by either of the repeat prefixes REPE or REPNE, which cause the operation to be repeated up to CX times, as long as the condition holds true after each iteration. Here is the corresponding pseudo-c for REPE CMPSB: while (CX!= ) { SetFlags(*(S*16 + SI) - *(ES*16 + I)); SI++; I++; CX--; if (!ZeroFlag) break; } A common use of the REPNE SCASB instruction is to find the length of a NUL-terminated string. Here is an example: MOV I, X ;Starting address in X (assume ES = S) MOV AL, ;Byte to search for (NUL) MOV CX, -1 ;Start count at FFFFh CL ;Increment I after each character REPNE SCASB ;Scan string for NUL, decrementing CX for each char MOV AX, -2 ;CX will be -2 for length, -3 for length 1,... SUB AX, CX ;Length in AX 11

19 Program Flow Instructions All of the previous instructions execute sequentially; that is, when one instruction finishes, the next instruction is taken from the very next memory location. This is the default operation for the instruction pointer, IP---after each byte of instruction is fetched, the IP is incremented in preparation for the next fetch. The program flow instructions provide the facilities to modify the course of execution, allowing conditional execution (by jumping over parts of the code if certain conditions are met) and looping (by jumping backwards in the code). The unconditional jump instruction, JMP, causes IP (and sometimes CS) to be modified so that the next instruction is fetched from the location given in the operand (the target). Here are the valid forms: JMP SHORT imm8 JMP imm16 JMP imm16:imm16 JMP r/m16 JMP FAR mem32 The short version saves space when the target of the jump is within a few dozen instructions forward or backward; the assembler computes the difference between the new address and the next address sequentially, and just stores this difference as one (signed) byte. The second (and most common) version allows a jump to any location in the current code segment, while the third allows a jump to any location in memory by also specifying an immediate value to be loaded into CS. The fourth version will take the target address from a register or memory location; since this address is only 16 bits, the target has to be within the segment. Finally, the far version fetches both the offset and the segment from four consecutive bytes in memory (compare to the LS and LES instructions; JMP FAR mem32 could have been called "LCS IP, mem32''). The conditional jump instructions, Jcc, where cc is one of the condition codes listed earlier (E, NE,...), perform a short jump if the condition is true, based on the current contents of the status flags. For example, the code sample that was given in the discussion of LOSB, to convert a string to lower-case, used the JA and JB instructions; these made their jump if the result of the previous comparison found that the current character was above 'Z' or below 'A'. Since a conditional jump can only be to a nearby target, it is sometimes necessary to combine conditional and unconditional jumps as follows: JNLE NoJLE JMP target NoJLE: This will have the same effect as JLE target, except there is no restriction on how far away the target may be (within the code segment). There are two specialized versions of conditional jump that are particularly useful when executing a loop a fixed number of times. The looping statements LOOP imm8 LOOPE imm8 LOOPNE imm8 (as usual, the synonyms LOOPZ and LOOPNZ are also available) are very similar to the REP, REPE, and REPNE prefixes from the string instructions. The LOOP instruction decrements CX and makes a short 12

20 jump if the count has not reached zero. The LOOPE instruction adds the condition that it will only take the jump if the Zero flag is set (usually indicating that the last comparison had equal operands); the LOOPNE will only take the jump if the Zero flag is clear. The string operation REP MOVSB, for example, could have been performed with Repeat MOVSB LOOP Repeat (except this would have been considerably slower, since it requires repeatedly fetching and decoding the two instructions instead of just fetching and decoding the single REP MOVSB instruction once). After looping or repetitive string operations, it is occasionally necessary to test whether the count register reached zero (to check whether the loop ran for the full count or whether it exited early because the Zero flag changed). The instruction JCXZ imm8 serves exactly this purpose; it takes a short jump if the CX register contains zero. It is short for performing CMP CX, followed by JZ imm8. All of the above branching instructions are variations on the infamous GOTO statement; they cause a permanent change in the course of execution. To perform an operation more like a function or subroutine call, where the flow of control will eventually return to pick up with the next instruction, the 886 provides two mechanisms: CALL/RET and INT/IRET. The CALL instruction offers a similar range of addressing modes to the JMP instruction, except there is no "short'' call: CALL imm16 CALL imm16:imm16 CALL r/m16 CALL FAR mem32 A call is the same as a jump, except the instruction pointer is first pushed onto the stack (in the second and fourth versions, which include a new segment, the current CS register is also pushed). To reverse the effect of a CALL, when the subroutine is done it should execute a RET or RETF instruction; this pops the return address off of the stack and back into IP (and RETF also pops the saved value of CS, to return from a far call). After the return, the next instruction that will be fetched will be from the next location after the CALL. There is an optional 16-bit immediate operand that may be specified with a return instruction; this value is added to the stack pointer after popping off the return address, to recover however many bytes had been pushed onto the stack with parameters before the call. For example, here is one way to implement a subroutine to print a character, where the calling code first pushes the character (as the low byte of a word, since there is no option to push a single byte) before making the call: PutChar PUSH BP ;Save current values of registers that we'll modify PUSH AX PUSH X MOV BP, SP ;Copy stack pointer to BP MOV AH, 2 ;OS function code for printing a character MOV L, [BP + 8] ;Fetch character parameter from stack ;Stack contains (from tos) X, AX, BP, return address, and parameter 13

21 INT 21h ;Call OS function POP X ;Restore modified registers POP AX POP BP RET 2 ;Return and pop 2 byte parameter For completeness, here is what a typical call might look like (in fact, this is a complete routine to print a NUL-terminated string, assuming that the string starts at S:SI): NextCh LOSB ;Load next character into AL CMP AL, JE one ;Quit if NUL PUSH AX ;Set up parameter for call CALL PutChar JMP NextCh ;Continue with next character one: This is just one of several common conventions for passing parameters to subroutines; even more common is to just specify that, for example, the character will be passed directly in the L register. The other function-call-like mechanism is the interrupt. We have been using this all along to call the standard OS services, such as printing a character or a '$'-terminated string. The INT instruction behaves much like the CALL FAR instruction except for two things: it pushes the FLAGS register before pushing CS and IP (the idea is that an interrupt should be able to completely restore the state of the processor when it is finished, since this is also the mechanism used for handling hardware interrupts from the rest of the system---they can happen at any time, independent of what the processor might be working on, and they should occur as transparently to the current process as possible), and it gets the target address from a standard table of interrupt handler vectors kept at the bottom of memory. When the processor executes INT n, where n is an 8-bit immediate value, it fetches a far pointer (that is, a 4-byte combination of segment and offset) from the memory address :4n; this is the target address for the interrupt call. For example, the address of the OS interrupt handler, the routine called when INT 21h is executed, is stored at locations :84 through :8; the first two bytes give the offset, to load into IP, and the second two bytes give the segment, to load into CS ASSEMBLER IRECTIVES ASSUME irective - The ASSUME directive is used to tell the assembler that the name of the logical segment should be used for a specified segment. The 886 works directly with only 4 physical segments: a Code segment, a data segment, a stack segment, and an extra segment. Example: ASUME CS:COE ;This tells the assembler that the logical segment named COE contains the instruction statements for the program and should be treated as a code segment. ASUME S:ATA ;This tells the assembler that for any instruction which refers to a data in the data segment, data will found in the logical segment ATA. B - B directive is used to declare a bytetype variable or to store a byte in memory location. Example: a. PRICE B 49h, 98h, 29h ;eclare an array of 3 bytes, named as PRICE and initialize. b. NAME B ABCEF ;eclare an array of 6 bytes and initialize with ASCII code for letters 14

22 c. TEMP B 1 UP(?) ;Set 1 bytes of storage in memory and give it the name as TEMP, but leave the 1 bytes uninitialized. Program instructions will load values into these locations. W - The W directive is used to define a variable of type word or to reserve storage location of type word in memory. Example: 1. MULTIPLIER W 43Ah ; this declares a variable of type word and named it as MULTIPLIER. This variable is initialized with the value 43Ah when it is loaded into memory to run. 2. EXP1 W 1234h, 3456h, 568h ; this declares an array of 3 words and initialized with specified values. 3. STOR1 W 1 UP(); Reserve an array of 1 words of memory and initialize all words with 4..Array is named as STOR1. EN - EN directive is placed after the last statement of a program to tell the assembler that this is the end of the program module. The assembler will ignore any statement after an EN directive. Carriage return is required after the EN directive. ENP - ENP directive is used along with the name of the procedure to indicate the end of a procedure to the assembler Example: SQUARE_NUM PROCE ; It start the procedure ;Some steps to find the square root of a number SQUARE_NUM ENP ;Hear it is the End for the procedure ENS - This ENS directive is used with name of the segment to indicate the end of that logic segment. Example: COE SEGMENT ;Hear it Start the logic ;segment containing code ; Some instructions statements to perform the logical ;operation COE ENS ;End of segment named as ;COE EQU - This EQU directive is used to give a name to some value or to a symbol. Each time the assembler finds the name in the program, it will replace the name with the value or symbol you given to that name. Example: FACTOR EQU 3H ; you has to write this statement at the starting of your program and later in the program you can use this as follows A AL, FACTOR ; When it codes this instruction the assembler will code it as AAL, 3H ;The advantage of using EQU in this manner is, if FACTOR is used many no of times in a program and you want to change the value, all you had to do is change the EQU statement at beginning, it will changes the rest of all. 15

23 EVEN - This EVEN directive instructs the assembler to increment the location of the counter to the next even address if it is not already in the even address. If the word is at even address 886 can read a memory in 1 bus cycle. If the word starts at an odd address, the 886 will take 2 bus cycles to get the data. A series of words can be read much more quickly if they are at even address. When EVEN is used the location counter will simply incremented to next address and NOP instruction is inserted in that incremented location. Example: ATA1 SEGMENT ; Location counter will point to 9 after assembler reads ;next statement SALES B 9 UP(?) ;declare an array of 9 bytes EVEN ; increment location counter to AH RECOR W 1 UP( ) ;Array of 1 words will start ;from an even address for quicker read ATA1 ENS GROUP - The GROUP directive is used to group the logical segments named after the directive into one logical group segment. INCLUE - This INCLUE directive is used to insert a block of source code from the named file into the current source module. PROC - The PROC directive is used to identify the start of a procedure. The term near or far is used to specify the type of the procedure. Example: SMART PROC FAR ; This identifies that the start of a procedure named as SMART and instructs the assembler that the procedure is far. SMART ENP This PROC is used with ENP to indicate the break of the procedure PTR - This PTR operator is used to assign a specific type of a variable or to a label. Example: INC [BX] ; This instruction will not know whether to increment the byte pointed to by BX or a word pointed to by BX. INC BYTE PTR [BX] ;increment the byte ;pointed to by BX This PTR operator can also be used to override the declared type of variable. If we want to access the a byte in an array WORS W 43Ah, B9h, MOV AL, BYTE PTR WORS PUBLIC - The PUBLIC directive is used to instruct the assembler that a specified name or label will be accessed from other modules. Example: 16

24 PUBLIC IVISOR, IVIEN ;these two variables are public so these are available to all modules. If an instruction in a module refers to a variable in another assembly module, we can access that module by declaring as EXTRN directive TYPE - TYPE operator instructs the assembler to determine the type of a variable and determines the number of bytes specified to that variable. Example: Byte type variable assembler will give a value 1 Word type variable assembler will give a value 2 ouble word type variable assembler will give a value 4 A BX, TYPE WOR_ ARRAY ; hear we want to increment BX to point to next word in an array of words. OS Function Calls AH H : Terminate a Program AH 1H : Read the Keyboard AH 2H : Write to a Standard Output evice AH 8H : Read a Standard Input without Echo AH 9H : isplay a Character String AH AH : Buffered keyboard Input INT 21H : Call OS Function 1