Appendix D: Instruction Set Reference
real
This section provides encodings and approximate cycle times for all instructions that you would nor-
mode on an Intel processor. Missing are the special instructions on the 80286 and
mally execute in
later processors that manipulate page tables, segment descriptors, and other instructions that only an oper-
ating system should use. The cycle times are approximate. To determine exact execution times, you will
need to run an experiment. The cycle times are given for comparison purposes only.
Key to special bits in encodings:
x:
s:
rrr:
Other Notes:
[disp]
[imm]
[mod-reg-r/m]:
reg,reg
Don’t care. Can be zero or one.
Sign extension bit for immediate operands. If zero, immediate operand is 16 or 32 bits depend-
ing on destination operand size. If s bit is one, then the immediate operand is eight bits and the
CPU sign extends to 16 or 32 bits, as appropriate.
Same as reg field in [mod-reg-r/m] byte.
bit in the instruction
s
bit contains zero and the destination operand
s
This field can be zero, one, two, or four bytes long as required by the instruction.
This field is one byte long if the operand is an eight bit operand or if the
opcode is one. It is two or four bytes long if the
is 16 or 32 bits, respectively.
Instructions that have a mod-reg-r/m byte may have a scaled index byte (sib) and a zero, one,
two, or four byte displacement. See Appendix E for details concerning the encoding of this por-
tion of the instruction.
bit in the
Many instructions allow two operands using a [mod-reg-r/m] byte. A single
opcode determines whether the instruction treats the
operand as the destination or the mod-
r/m operand as the destination (e.g., mov reg,mem vs. mov mem,reg). Such instructions also
allow two register operands. It turns out there are two encodings for each such reg-reg instruc-
tion. That is, you can encode an instruction like mov ax, bx with ax encoded in the reg field and
bx encoded in the mod-r/m field, or you can encode it with bx encoded in the reg field and ax
encoded in the mod-r/m field. Such instructions always have an
bit in the opcode. If the
bit
x
x
bit is one, the desti-
is zero, the destination is the register specified by the mod-r/m field. If the
x
nation is the register specified by the reg field. Other types of instructions support multiple
encodings for similar reasons.
reg
direction
a
Table 97: 80x86 Instruction Set Reference
Instruction
Encoding
b
(bin)
c
Execution Time in Cycles
8088
8086
80286
80386
80486
Pentium
aaa
aad
aam
aas
adc reg8, reg8
adc reg16, reg16
0011 0111
1101 0101
0000 1010
1101 0100
0000 1010
0011 1111
0001 00x0
[11-reg-r/m]
0001 00x1
[11-reg-r/m]
8
60
83
8
3
3
8
60
83
8
‘3
3
3
14
16
3
2
2
4
19
17
4
2
2
3
14
15
3
1
1
3
10
18
3
1
1
Thi d
d i h F
M k
4 0 2
Page 1361
Appendix D
Instruction
adc reg32, reg32
adc reg8, mem8
adc reg16, mem16
adc reg32, mem32
adc mem8, reg8
adc mem16, reg16
adc mem32, reg32
adc reg8, imm8
adc reg16, imm16
adc reg32, imm32
adc mem8, imm8
adc mem16, imm16
adc mem32, imm32
adc al, imm
adc ax, imm
adc eax, imm
add reg8, reg8
add reg16, reg16
add reg32, reg32
Page 1362
a
Table 97: 80x86 Instruction Set Reference
Encoding
b
(bin)
0110 0110
0001 00x1
[11-reg-r/m]
0001 0010
[mod-reg-r/m]
0001 0011
[mod-reg-r/m]
0110 0110
0001 0011
[mod-reg-r/m]
0001 0000
[mod-reg-r/m]
0001 0001
[mod-reg-r/m]
0110 0110
0001 0001
[mod-reg-r/m]
1000 00x0
[11-010-r/m]
[imm]
1000 00s0
[11-010-r/m]
[imm]
0110 0110
1000 00s0
[11-010-r/m]
[imm]
1000 00x0
[mod-010-r/m]
[imm]
1000 00s1
[mod-010-r/m]
[imm]
0110 0110
1000 00s1
[mod-010-r/m]
[imm]
0001 0100
[imm]
0001 0101
[imm]
0110 0110
0001 0101
[imm]
0000 00x0
[11-reg-r/m]
0000 00x1
[11-reg-r/m]
0110 0110
0000 00x1
[11-reg-r/m]
8088
3
8086
3
9+EA
9+EA
13+EA
9+EA
-
-
16+EA
16+EA
24+EA
16+EA
-
4
4
4
-
4
4
4
17+EA
17+EA
23+EA
17+EA
-
4
4
-
3
3
3
-
4
4
-
‘3
3
3
c
Execution Time in Cycles
80286
80386
80486
Pentium
2
7
7
-
7
7
-
3
3
3
7
7
-
3
3
-
2
2
2
2
6
6
6
7
7
7
2
2
2
7
7
7
2
2
2
2
2
2
1
2
2
2
3
3
3
1
1
1
3
3
3
1
1
1
1
1
1
1
2
2
2
3
3
3
1
1
1
3
3
3
1
1
1
1
1
1
Instruction
add reg8, mem8
add reg16, mem16
add reg32, mem32
add mem8, reg8
add mem16, reg16
add mem32, reg32
add reg8, imm8
add reg16, imm16
add reg32, imm32
add mem8, imm8
add mem16, imm16
add mem32, imm32
add al, imm
add ax, imm
add eax, imm
and reg8, reg8
and reg16, reg16
and reg32, reg32
and reg8, mem8
a
Table 97: 80x86 Instruction Set Reference
Appendices
Encoding
b
(bin)
0000 0010
[mod-reg-r/m]
0000 0011
[mod-reg-r/m]
0110 0110
0000 0011
[mod-reg-r/m]
0000 0000
[mod-reg-r/m]
0000 0001
[mod-reg-r/m]
0110 0110
0000 0001
[mod-reg-r/m]
1000 00x0
[11-000-r/m]
[imm]
1000 00s0
[11-000-r/m]
[imm]
0110 0110
1000 00s0
[11-000-r/m]
[imm]
1000 00x0
[mod-000-r/m]
[imm]
1000 00s1
[mod-000-r/m]
[imm]
0110 0110
1000 00s1
[mod-000-r/m]
[imm]
0000 0100
[imm]
0000 0101
[imm]
0110 0110
0000 0101
[imm]
0010 00x0
[11-reg-r/m]
0010 00x1
[11-reg-r/m]
0110 0110
0010 00x1
[11-reg-/rm]
0010 0010
[mod-reg-r/m]
8088
9+EA
8086
9+EA
13+EA
9+EA
-
-
16+EA
16+EA
24+EA
16+EA
-
4
4
4
-
4
4
4
17+EA
17+EA
23+EA
17+EA
-
4
4
-
3
3
3
-
4
4
-
‘3
3
3
9+EA
9+EA
c
Execution Time in Cycles
80286
80386
80486
Pentium
7
7
-
7
7
-
3
3
3
7
7
-
3
3
-
2
2
2
7
6
6
6
7
7
7
2
2
2
7
7
7
2
2
2
2
2
2
6
2
2
2
3
3
3
1
1
1
3
3
3
1
1
1
1
1
1
2
2
2
2
3
3
3
1
1
1
3
3
3
1
1
1
1
1
1
2
Page 1363
Appendix D
a
Table 97: 80x86 Instruction Set Reference
8088
13+EA
8086
9+EA
-
-
16+EA
16+EA
24+EA
16+EA
-
4
4
4
-
4
4
4
17+EA
17+EA
23+EA
17+EA
-
4
4
-
-
4
4
-
c
Execution Time in Cycles
80286
80386
80486
Pentium
7
-
7
7
-
3
3
3
7
7
-
3
3
-
6
6
7
7
7
2
2
2
7
7
7
2
2
2
10
13
(values
within
range)
10
(values
within
range)
10+3*n
n= first set
bit.
2
2
3
3
3
1
1
1
3
3
3
1
1
1
7
7
2
2
3
3
3
1
1
1
3
3
3
1
1
1
8
8
6-42
6-34
Encoding
b
(bin)
0010 0011
[mod-reg-r/m]
0110 0110
0010 0011
[mod-reg-r/m]
0010 0000
[mod-reg-r/m]
0010 0001
[mod-reg-r/m]
0110 0110
0010 0001
[mod-reg-r/m]
1000 00x0
[11-100-r/m]
[imm]
1000 00s1
[11-100-r/m]
[imm]
0110 0110
1000 00s1
[11-100-r/m]
[imm]
1000 00x0
[mod-100-r/m]
[imm]
1000 00s1
[mod-100-r/m]
[imm]
0110 0110
1000 00s1
[mod-100-r/m]
[imm]
0010 0100
[imm]
0010 0101
[imm]
0110 0110
0010 0101
[imm]
0110 0010
[mod-reg-r/m]
0110 0110
0110 0010
[mod-reg-r/m]
0000 1111
1011 1100
[11-reg-r/m]
Instruction
and reg16, mem16
and reg32, mem32
and mem8, reg8
and mem16, reg16
and mem32, reg32
and reg8, imm8
and reg16, imm16
and reg32, imm32
and mem8, imm8
and mem16, imm16
and mem32, imm32
and al, imm
and ax, imm
and eax, imm
bound reg16, mem32
bound reg32, mem64
bsf reg16, reg16
Page 1364
a
Table 97: 80x86 Instruction Set Reference
Appendices
Instruction
bsf reg32, reg32
bsf reg16, mem16
bsf reg32, mem32
bsr reg16, reg16
bsr reg32, reg32
bsr reg16, mem16
bsr reg32, mem32
bswap reg32
bt reg16, reg16
bt reg32, reg32
bt mem16, reg16
bt mem32, reg32
bt reg16, imm
bt reg32, imm
bt mem16, imm
Encoding
b
(bin)
0110 0110
0000 1111
1011 1100
[11-reg-r/m]
0000 1111
1011 1100
[mod-reg-r/m]
0110 0110
0000 1111
1011 1100
[mod-reg-r/m]
0000 1111
1011 1101
[11-reg-r/m]
0110 0110
0000 1111
1011 1101
[11-reg-r/m]
0000 1111
1011 1101
[mod-reg-r/m]
0110 0110
0000 1111
1011 1101
[mod-reg-r/m]
0000 1111
11001rrr
0000 1111
1010 0011
[11-reg-r/m]
0110 0110
0000 1111
1010 0011
[11-reg-r/m]
0000 1111
1010 0011
[mod-reg-r/m]
0110 0110
0000 1111
1010 0011
[mod-reg-r/m]
0000 1111
1011 1010
[11-100-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[11-100-r/m]
[imm8]
0000 1111
1011 1010
[mod-100-r/m]
c
Execution Time in Cycles
8088
8086
80286
80386
80486
Pentium
6-42
6-42
7-43
6-35
7-43
6-43
7-100
7-39
8-100
7-71
7-101
7-40
8-101
7-72
10+3*n
n= first set
bit.
10+3*n
n= first set
bit.
10+3*n
n= first set
bit.
10+3*n
n= first set
bit.
10+3*n
n= first set
bit.
10+3*n
n= first set
bit.
10+3*n
n= first set
bit.
3
3
12
12
3
3
6
1
3
3
8
8
3
3
3
1
4
4
9
9
4
4
4
Page 1365
Appendix D
a
Table 97: 80x86 Instruction Set Reference
c
Execution Time in Cycles
8088
8086
80286
80386
80486
Pentium
6
6
6
13
13
6
6
8
8
6
6
13
13
3
6
6
13
13
6
6
8
8
6
6
13
13
4
7
7
13
13
7
7
8
8
7
7
13
13
Encoding
b
(bin)
0110 0110
0000 1111
1011 1010
[mod-100-r/m]
0000 1111
1011 1011
[11-reg-r/m]
0110 0110
0000 1111
1011 1011
[11-reg-r/m]
0000 1111
1011 1011
[mod-reg-r/m]
0110 0110
0000 1111
1011 1011
[mod-reg-r/m]
0000 1111
1011 1010
[11-111-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[11-111-r/m]
[imm8]
0000 1111
1011 1010
[mod-111-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[mod-111-r/m]
[imm8]
0000 1111
1011 0011
[11-reg-r/m]
0110 0110
0000 1111
1011 0011
[11-reg-r/m]
0000 1111
1011 0011
[mod-reg-r/m]
0110 0110
0000 1111
1011 0011
[mod-reg-r/m]
Instruction
bt mem32, imm
btc reg16, reg16
btc reg32, reg32
btc mem16, reg16
btc mem32, reg32
btc reg16, imm
btc reg32, imm
btc mem16, imm
btc mem32, imm
btr reg16, reg16
btr reg32, reg32
btr mem16, reg16
btr mem32, reg32
Page 1366
a
Table 97: 80x86 Instruction Set Reference
Appendices
Instruction
btr reg16, imm
btr reg32, imm
btr mem16, imm
btr mem32, imm
bts reg16, reg16
bts reg32, reg32
bts mem16, reg16
bts mem32, reg32
bts reg16, imm
bts reg32, imm
bts mem16, imm
bts mem32, imm
call near
Encoding
b
(bin)
0000 1111
1011 1010
[11-110-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[11-110-r/m]
[imm8]
0000 1111
1011 1010
[mod-110-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[mod-110-r/m]
[imm8]
0000 1111
1010 1011
[11-reg-r/m]
0110 0110
0000 1111
1010 1011
[11-reg-r/m]
0000 1111
1010 1011
[mod-reg-r/m]
0110 0110
0000 1111
1010 1011
[mod-reg-r/m]
0000 1111
1011 1010
[11-101-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[11-101-r/m]
[imm8]
0000 1111
1011 1010
[mod-101-r/m]
[imm8]
0110 0110
0000 1111
1011 1010
[mod-101-r/m]
[imm8]
1110 1000
[disp16]
c
Execution Time in Cycles
8088
8086
80286
80386
80486
Pentium
6
6
8
8
6
6
13
13
6
6
8
8
23
19
7-10
7-10
6
6
8
8
6
6
13
13
6
6
8
8
3
7
7
8
8
7
7
13
13
7
7
8
8
1
Page 1367
a
Table 97: 80x86 Instruction Set Reference
8088
8086
36
20
28
16
c
Execution Time in Cycles
80286
13-16
80386
17-20
7-10
7-10
29+EA
21+EA
11-14
10-13
53+EA
37+EA
16-19
22-25
2
2
2
2
2
3
3
3
2
2
2
2
2
‘3
3
3
9+EA
9+EA
13+EA
9+EA
-
-
9+EA
9+EA
13+EA
9+EA
-
4
4
4
-
4
4
4
10+EA
10+EA
2
2
2
3
2
2
2
2
7
7
-
7
7
-
3
3
3
6
3
2
2
2
2
2
2
2
6
6
6
6
6
6
2
2
2
5
Encoding
b
(bin)
1001 1010
[offset]
[segment]
1111 1111
[11-010-r/m]
1111 1111
[mod-010-r/m]
1111 1111
[mod-011-r/m]
1001 1000
0110 0110
1001 1001
1111 1000
1111 1100
1111 1010
1111 0101
0011 10x0
[11-reg-r/m]
0011 10x1
[11-reg-r/m]
0110 0110
0011 10x1
[11-reg-/rm]
0011 1010
[mod-reg-r/m]
0011 1011
[mod-reg-r/m]
0110 0110
0011 1011
[mod-reg-r/m]
0011 1000
[mod-reg-r/m]
0011 1001
[mod-reg-r/m]
0110 0110
0011 1001
[mod-reg-r/m]
1000 00x0
[11-111-r/m]
[imm]
1000 00s0
[11-111-r/m]
[imm]
0110 0110
1000 00s0
[11-111-r/m]
[imm]
1000 00x0
[mod-111-r/m]
[imm]
80486
Pentium
18
5
5
17
3
2
2
2
5
2
1
1
1
2
2
2
2
2
2
1
1
1
2
4
2
2
5
3
2
2
2
7
2
1
1
1
2
2
2
2
2
2
1
1
1
2
Appendix D
Instruction
call far
call reg16
call mem16
call mem32
cbw
cdq
clc
cld
cli
cmc
cmp reg8, reg8
cmp reg16, reg16
cmp reg32, reg32
cmp reg8, mem8
cmp reg16, mem16
cmp reg32, mem32
cmp mem8, reg8
cmp mem16, reg16
cmp mem32, reg32
cmp reg8, imm8
cmp reg16, imm16
cmp reg32, imm32
cmp mem8, imm8
Page 1368