I

2.1 8086/88 CPU Architecture

2.2 Segmented Memory
2.3 Addressing Modes
2.4 Data Transfer Instructions
2.5 String Instructions
2.6 Logical Instructions
2.7 Arithmetic Instructions
2.8 Transfer of Control Instructions
2.9 Processor Control Instructions

2.1 8086/88 CPU ARCHITECTURE

As mentioned in Chap. 1, the microprocessor functions as the CPU in the stored program
model of the digital computer. Its job is to generate all system timing signals and syn¬
chronize the transfer of data between memory, I/O, and itself. It accomplishes this task
via the three-bus system architecture discussed in that chapter.
The microprocessor also has a software function. It must recognize, decode, and
execute program instructions fetched from the memory unit. This requires an arithmetic-
logic unit (ALU) within the CPU to perform arithmetic and logical (AND, OR, NOT,
compare, etc.) functions.
Figure 2.1 is a model of the 8086 CPU. It is organized as two separate processors,
called the bus interface unit (BIU) and the execution unit (EU). The BIU provides hardware
functions, including generation of the memory and I/O addresses for the transfer of data
between the outside world—outside the CPU, that is—and the EU.
The EU receives program instruction codes and data from the BIU, executes these
instructions, and stores the results in the general registers. By passing the data back to
the BIU, data can also be stored in a memory location or written to an output device.
Note that the EU has no connection to the system buses. It receives and outputs all its
data through the BIU.
The only difference between an 8088 microprocessor and an 8086 microprocessor
is the BIU. In the 8088, the BIU data bus path is 8 bits wide versus the 8086’s 16-bit
data bus. Another difference is that the 8088 instruction queue (explained in the next
section) is four bytes long instead of six.
The important point to note, however, is that because the EU is the same for each
processor, the programming instructions are exactly the same for each. Programs written
for the 8086 can be run on the 8088 without any changes.

Fetch and Execute

Although the 8086/88 still functions as a stored program computer (described in Chap. 1),
organization of the CPU into a separate BIU and EU allows the fetch and execute cycles
to overlap. To see this, consider what happens when the 8086 or 8088 is first started.

1. The BIU outputs the contents of the instruction pointer register (IP) onto the address Figure 2.1 CPU model for the 8086 microprocessor. A separate execution unit (EU)
bus, causing the selected byte or word to be read into the BIU. and bus interface unit (BIU) are provided.

Sec. 2.1 8086/88 CPU Architecture 29 30 8086/88 CPU Architecture and Instruction Set Chap. 2
 2. Register IP is incremented by 1 to prepare for the next instruction fetch.
3. Once inside the BIU, the instruction is passed to the queue. This is a first-in, first-
out storage register sometimes likened to a “pipeline.”
4. Assuming that the queue is initially empty, the EU immediately draws this instruc¬
tion from the queue and begins execution.
5. While the EU is executing this instruction, the BIU proceeds to fetch a new in¬
struction. Depending on the execution time of the first instruction, the BIU may
fill the queue with several new instructions before the EU is ready to draw its next
instruction.
"3 3
C
3 O
The BIU is programmed to fetch a new instruction whenever the queue has room x:
X3

u
■*—*
for one (with the 8088) or two (with the 8086) additional bytes. The advantage of this ,<u C/5
C
pipelined architecture is that the EU can execute instructions almost continually instead 3 -3o
U
c
of having to wait for the BIU to fetch a new instruction. This is shown schematically in <D 2

Fig. 2.2. CT C
05 <D

There are three conditions that will cause the EU to enter a “wait” mode. The first 03 -4—1
3
05 o
CDX
occurs when an instruction requires access to a memory location not in the queue. The £
o 3

BIU must suspend fetching instructions and output the address of this memory location.
to D
After waiting for the memory access, the EU can resume executing instruction codes w
£ S
from the queue (and the BIU can resume filling the queue). u -S
8 S
The second condition occurs when the instruction to be executed is a “jump” i=!
0* °
>

instruction. In this case control is to be transferred to a new (nonsequential) address. The u a

•3 <u

queue, however, assumes that instructions will always be executed in sequence and thus cu
o
<D
will be holding the “wrong” instruction codes. The EU must wait while the instruction X! ob
O
u. 3
at the jump address is fetched. Note that any bytes presently in the queue must be discarded 3 Cc
T3 4— o
(they are overwritten). <D ,<D»
C <+H

One other condition can cause the BIU to suspend fetching instructions. This occurs "a3 C
a. _o
’-4-4
'EL O
during execution of instructions that are slow to execute. For example, the instruction C/3 ?
03
00 -*—*
A AM (ASCII adjust for multiplication) requires 83 clock cycles to complete. At four D
o> oo c
D Co
C7
clock cycles per instruction fetch, the queue will be completely filled during the execution 0)
00

of this single instruction. The BIU will thus have to wait for the EU to pull one or two C "3
bytes from the queue before resuming the fetch cycle. - £
O —, 3
c £. o
A subtle advantage to the pipelined architecture should be mentioned. Because the 03 o
+-•
03 3 C/5

next several instructions are usually in the queue, the BIU can access memory at a “D CJ 1,3
C/5
O >4
somewhat “leisurely” pace. This means that slow-memory parts can be used without co
<u

affecting overall system performance. In Chap. 7 we discuss memory access times in

<1)
13 3 -o
03
o-
* J*
detail.
“O ^
0) 00
i-
0)
ID
~o
i—
03
DCT Oo
o
Programming Model CO
O 03
L_
C

o V'oa
**U C
03
■M
03 O D
i—
As a programmer of the 8086 or 8088 you must become familiar with the various registers CO
0)
+->
D
Sw
co
> S C
in the EU and BIU. Figure 2.3 places these registers (originally presented in Fig. 2.1) -Q C
*“ Q.
0)
CO •= E
into logical groups to form a programming model. 03
D
»—<
The data group consists of the accumulator and the BX, CX, and DX registers. CD

Note that each can be accessed as a byte or a word. Thus BX refers to the 16-bit base

Sec. 2.1 8086/88 CPU Architecture 31 32

AX AH AL Accumulator

BX BH BL Base
► Data group
CX CH CL Count

DX DH DL Data
1004H

Stack pointer

Base pointer
K Pointer and
Source index
index group
Destination index

Instruction pointer
Figure 2.4 Register SI is “pointing at”
memory location 1000H.

F lagsH FlagsL Status and control flags the nomenclature for expressing the contents of a word versus a byte. As you will see,
the 8086/88 always stores words with the high-order byte in the fjigh-order word address.
Register IP is included in the pointer and index group, but this register has only
one function—to point to the next instruction to be fetched to the BIU. Register IP is
"\

Extra physically part of the BIU and not under direct control of the programmer as are the
other pointer registers (see Fig. 2.1).
Code
► Segment group Figure 2.5 shows the bit definitions for the 16-bit flag register. Six of the flags are
Data
status indicators, reflecting properties of the result of the last arithmetic or logical in¬
Stack Figure 2.3 8086/88 programming model. struction. For example, if register AL = 7FH and the instruction ADD AL,1 is given
(add 1 to AL), the following results:

register but BH refers only to the high-order 8 bits of this register. The data registers are
normally used for storing temporary results that will be acted on by subsequent AL = 80 H ;7FH + 1 = 80H
instructions. CF = 0 ;There is no carry out of bit 7
The pointer and index group are all 16-bit registers (you cannot access the low or PF = 0 ;80H has an odd number of logic 1's
high bytes alone). These registers are used as memory pointers. For example, the in¬ AF = 1 ;There is a carry out of bit 3 into bit 4
ZF = 0 ;The result is not 0
struction MOV AH,[SI] has the word interpretation “Move the byte whose address is
SF = 1 ; Bit 7 is set
contained in register SI to register AH.” SI thus “points” at the desired memory location.
OF = 1 ;The result ( + 128) exceeds the capacity
The brackets around SI are used to indicate the contents of memory pointed to by SI, not
of (signed) register AL
the value of SI itself.

Example 2.1
The 8086/88 has several instructions that can be used to transfer program control
If SI= 1000H in Fig. 2.4, what is the contents of register AH after the instruction MOV to a new memory location based on the state of the flags. For example, the instruction
AH,[SI] is executed? sequence
Solution Study Fig. 2.4 and you will see SI pointing at the byte 26H. Thus AH will store
26H. ADD AL,1 ;Add 1 to register AL
JNZ 0100H ;Jump to location 0100H if
Sometimes a pointer register will be interpreted as pointing at a memory byte and ;the result is not zero (ZF = 0)
at other times a memory word. In Fig. 2.4, [SI] = 26H but [SI+ 1:SI] = 3A26H. Note

Sec. 2.1 8086/88 CPU Architecture 33 34 8086/88 CPU Architecture and Instruction Set Chap. 2
 F lagsH FlagsL display all the CPU registers and flags is stored there. Setting TF therefore causes the
processor to operate in a software single-stepping mode, pausing after each instruction
X X X X OF DF IF TF SF ZF X AF X PF X* CF
is executed. This is very useful for program debugging.
*Bits marked X are undefined.
When IF (the interrupt flag) js set, external interrupt requests on the 8086/88 INTR
input line will be enabled. When INTR is driven high (i.e., an interrupt occurs), control
is transferred to an interrupt service routine. When this routine has' finished, it normally
executes an IRET (interrupt return) instruction and control is transferred back to the
Bit
instruction in the main program that was executing when the interrupt occurred. Software
position Name Function interrupts are discussed in Sec. 2.8 and hardware interrupts in Chap. 8.
Carry flag: Set on high-order bit carry The last control flag is DF (the direction flag). This flag is used with the block
0 CF
or borrow; cleared otherwise move (also called “string”) instructions. When DF is set the block memory pointer will
t

Parity flag: Set if low-order 8 bits automatically decrement; if reset, the pointer will increment. The block instructions are
2 PF of result contain an even number discussed in Sec. 2.5.
of 1-bits; cleared otherwise
The final group of registers in Fig. 2.3 are called the segment group. These registers
Set on carry from or borrow to the
4 AF low-order 4 bits of AL; cleared are used by the BIU to determine the memory address output by the CPU when it is
otherwise reading or writing from the memory unit. To fully understand these registers, we must
Zero flag: Set if result is zero; first study the way the 8086/88 divides its memory into segments. This is done in the
6 ZF
cleared otherwise
next section.
Sign flag: Set equal to high-order bit
7 SF
of result (0 is positive, 1 if negative)

Single step flag: Once set, a single-step

interrupt occurs after the next
SELF-REVIEW 2.1 (answers on page 108)
8 TF
instruction executes; TF is cleared
by the single-step interrupt
2.1.1. The CPU of the 8086 or 8088 microprocessor is divided into an_unit
Interrupt-enable flag: When set, and a__unit.
maskable interrupts will cause
9 IF the CPU to transfer control to 2.1.2. The pipelined architecture of the 8086/88 allows the fetch and execute cycles to
an interrupt vector specified
location
2.1.3. What are the conditions that will cause the BIU to suspend fetching instructions?
Direction flag: Causes string instructions 2.1.4. What is the word interpretation of the 8086/88 instruction MOV CH,[DI]?
to auto decrement the appropriate
10 DF
index register when set; clearing DF 2.1.5. If register DI = 1002H, what is [DI+ EDI] in Fig. 2.4?
2.1.6. The 8086/88 can be single-stepped if the_flag is set.
causes auto increment

Overflow flag: Set if the signed result

cannot be expressed within the
2.1.7. If register AL = FFH and the instruction ADD AL,1 is given, specify the contents of the
11 OF six status flags.
number of bits in the destination
operand; cleared otherwise

Figure 2.5 8086/88 flag word. DF, IF, and TF can be set or reset to control the operation
of the processor. The remaining flags are status indicators. 2.2 SEGMENTED MEMORY

will transfer control to location 0100H if the result of the ADD AL, 1 instruction is not
zero. If it is desired to test for the zero condition, the JZ (jump if zero) instruction can
be used. Section 2.8 covers these transfer-of-control instructions in more detail.
Three of the flags can be set or reset directly by the programmer and are used to
control the operation of the processor. These are TF, IF, and DF.
When TF (the trap flag) is set, control is passed to a special address (previously
defined by the programmer) after each instruction is executed. Normally, a program to
Even though the 8086 is considered a 16-bit microprocessor, (it has a 16-bit data bus
width) its memory is still thought of in bytes. At first this might seem a disadvantage—
why saddle a 16-bit microprocessor with an 8-bit memory? Actually, there are a couple
of good reasons. First, it allows the processor to work on bytes as well as words.'This
is especially important with I/O devices such as printers, terminals, and modems, all of
which are designed to transfer ASCII-encoded (7- or 8-bit) data.
Second, many of the 8086’s (and 8088’s) operation codes are single bytes. Other
instructions may require anywhere from two to seven bytes. By being able to access
individual bytes, these odd-lengthed instructions can be handled.

Sec. 2.1 8086/88 CPU Architecture 35 36 8086/88 CPU Architecture and Instruction Set Chap. 2
 We have already seen that the 8086/88 has a 20-bit address bus, allowing it to Even Odd
bank bank
output 2 , or 1,048,576, different memory addresses. Figure 2.6 shows how this memory
1048574 1048575
space is typically drawn on paper. As you can see, 524,287 words can also be visualized.
As mentioned in Chap. 1, the 8086 reads 16 bits from memory by simultaneously
reading an odd-addressed byte and an even-addressed byte. For this reason the 8086
organizes its memory into an evep-addressed bank and an odd-addressed bank, as shown A_ A_
in Fig. 2.7(a). If you are curious as to how this works, note that the 8086 provides control
bus signals that can be decoded by the memory to determine if a byte or a word is to be
accessed. We provide the details in Chaps. 6 and 7.
With regard to Fig. 2.7(a), you might wonder if all words must begin at an even
address. For example, is it possible to read the word stored in bytes 5 and 6? The answer
is yes, as you can see in Fig. 2.7(b). However, there is a penalty to be paid. The CPU
must perform two memory read cycles: one to fetch the low-order byte and a second to
fetch the high-order byte. This slows down the processor but is transparent to the pro¬
grammer. Word starting at
an odd address

(b)

Figure 2.7 (a) By reading from an even-addressed bank and an odd-addressed bank the
8086 can read two bytes from memory simultaneously, (b) If a 16-bit word begins at an
odd address, the 8086 (and 8088) will require two memory read or write cycles.

The last few paragraphs apply only to the 8086. The 8088 with its 8-bit data bus
interfaces to the 1MB of memory as a single bank. When it is necessary to access a word
(whether on an even- or an odd-addressed boundary) two memory read (or write) cycles
are performed. In effect, the 8088 pays a performance penalty with every word access.
Fortunately for the programmer, except for the slightly slower performance of the 8088,
there is no difference between the two processors.

Memory Map

Figure 2.6 The memory space of the
8086/88 microprocessor consists of
1,048,576 bytes or 524,288 words.
Still another view of the 8086/88 memory space is shown in Fig. 2.8. There are 16
64K-byte blocks beginning at hex address 00000 and ending at address FFFFFH. This
division into 64K-byte blocks is an arbitrary but convenient choice. This is because the
most significant hex digit increments by 1 with each additional block. That is, address
20000H is 65,536 bytes higher in memory than address 10000H. Be sure to note that
five hex digits are required to represent a memory address.
The diagram in Fig. 2.8 is also called a memory map. This is because, like a road

Sec. 2.2 Segmented Memory 37 38 8086/88 CPU Architecture and Instruction Set Chap. 2
 FFFFFH FFFFFH
a
FFFFOH Reserved products. If you make use of these memory locations, you risk incompatibility with these
FOOOOH FFFFBH future products.
16 bytes
EOOOOH Dedicated Segment Registers

DOOOOH FFFFOH Within the 1MB of memory space the 8086/88 defines four 64K-byte memory blocks
called the code segment, stack segment, data segment, and extra segment. Each of these
COOOOH blocks of memory is used differently by the processor.
The code segment holds the program instruction codes. The data segment stores
BOOOOH data for the program. The extra segment is an extra data segment (often used for shared
data). The stack segment is used to store interrupt and subroutine return addresses (ex¬
AOOOOH plained more fully in Sec. 2.8).
You should realize that the concept of a segmented memory is a unique one. Older-
90000H generation microprocessors such as the 8-bit 8085 or Z-80 could access only one 64-K¬
byte segment. This meant that the program instructions, data, and subroutine stack all
80000H had to share the same memory. This limited the amount of memory available for the
A
64 K bytes program itself and led to disaster if the stack should happen to overwrite the data or
70000H program areas.
The four segment registers shown in Figs. 2.1 and 2.3 (CS, DS, ES, and SS) are
60000H used to “point” at location 0 (the base address) of each segment. This is a little “tricky”
because the segment registers are only 16 bits wide, but the memory address is 20 bits
50000H wide. The BIU takes care of this problem by appending four 0’s to the low-order bits of
the segment register. In effect, this multiplies the segment register contents by 16. Fig.
40000H 2.9 shows an example.
The CS register contains B3FFH but is interpreted as pointing to address B3FF0H.
30000H 0007 FH The point to note is that the beginning segment address is not arbitrary—it must begin
M
at an address divisible by 16. Another way of saying this is that the low-order hex digit
20000H Reserved must be 0.
128 bytes Also note that the four segments need not be defined separately. In Fig. 2.9 the
10000 H 00013H stack and extra segments are partially overlapped. Indeed, it is allowable for all four
0007 FH Dedicated segments to completely overlap (CS = DS = ES = SS).
00000H 00000
Example 2.2
Figure 2.8 Memory map for the 8086/88 microprocessor. Some memory locations are Calculate the beginning and ending addresses for the data segment assuming that register
dedicated or reserved.
DS = E000H.

Solution The base address is found by appending four 0's. Base address: E0000H. The
ending address is found by adding FFFFH (64K). Ending address: E0000H + FFFFH =
map, it is a guide showing how the system memory is allocated. For example, it might EFFFFH.
show RAM (read/write memory) from 00000 to 3FFFFH, ROM (read-only memory)
from FF000H to FFFFFH, and the remainder of the memory space unused. This type of
Memory locations not defined to be within one of the current segments cannot be
information is vital to the programmer, who must know exactly where his or her programs
accessed by the 8086/88 without first redefining one of the segment registers to include
can be safely loaded.
that location. Thus at any given instant a maximum of 256K (64K x 4) bytes of memory
Note in Fig. 2.8 that some memory locations are marked reserved and others
can be utilized. As we will see, the contents of the segment registers can only be specified
dedicated. The dedicated locations are used for processing specific system interrupts and
via software. As you might imagine, instructions to load these registers should be among
the reset function. Intel has also reserved several locations for future hardware and software
the first given in any 8086/88 program.

Sec. 2.2 Segmented Memory 39

40 8086/88 CPU Architecture and Instruction Set Chap. 2
 FFFFF
^ Example 2.3
- EFFFF Calculate the physical address corresponding to logical address D470H in the extra segment.
Data
Repeat for logical address 2D90H in the stack segment. Assume the segment definitions
segment
- EOOOO shown in Fig. 2.9.

Solution For the extra segment

52B90H (base address)

+ D470H (offset)
Code segment C3FEF
Code 60000H
B 3 F F segment
B3FF0 and for the stack segment
Data segment
5D270H (base address)
E 0 0 0 + 2D9QH (offset)
60000H
Stack segment

5 D 2 7 The result of this example might be surprising. However, when two segments
Extra segment
overlap it is certainly possible for two different logical addresses to map to the same
physical address. This can have disastrous results when the data begins to overwrite the
5 2 B 9 6D26F subroutine stack area, or vice versa. For this reason you must be very careful when
^ Stack
segments are allowed to overlap. In Chaps. 3 and 4 we provide more detail on how these
segment YI 6288F
J 5D270
Extra segments are defined in a program.
> f segment
You should also be careful when writing addresses on paper to do so clearly. To
52B90
Figure 2.9 The 8086/88 divides its 1M bytes
specify the logical address 2D90H in the stack segment, use the convention SS:2D90H.
of memory address space into four segments, Similarly, the logical address D470H in the extra segment is written ES:D470H. As we
called the data, code, stack, and extra seg¬ have just seen, both addresses map to physical address 60000H. There should be no
ments. The four segment registers DS, CS, ambiguity here, as five hex digits are required to specify a physical address.
SS, and ES point to location 0 of the current
Now that we have seen the differences between physical and logical addresses, we
segment. In this example the stack and extra
segments are partially overlapped. (From J.
must dig a little deeper and see how the instruction set uses each of the four segments.
Uffenbeck, Microcomputers and Micropro¬ For example, if register IP = 1000H, where exactly is the next instruction fetch going
cessors: The 8080, 8085, andZ-80. Prentice- to come from? Or where will the instruction MOV [BP],AL—‘‘move a copy of register
00000 Hall, Englewood Cliffs, N.J., 1985.) AL to the memory location pointed to by register BP"—store register AL?
I

Logical and Physical Addresses
Addresses within a segment can range from address 0 to address FFFFH. This corresponds
to the 64K-byte length of the segment. An address within a segment is called an offset
or logical address. For example, logical address 0005H in the code segment shown in
Fig. 2.9 actually corresponds to the real address B3FF0H + 5 = B3FF5FF This “real”
address is called the physical address.
What is the difference between the physical and the logical address? The physical
address is 20 bits long and corresponds to the actual binary code output by the BIU on
the address bus lines. The logical address is an offset from location 0 of a given segment.
The answer is contained in Table 2.1. Every instruction that references memory
has a default segment register, as shown. Instruction fetches occur only from the code
segment, with IP supplying the offset or logical address. Similarly, register BP used as
a pointer defaults to the stack segment.
Table 2.1 is programmed into the BIU. If IP - 1000H and CS = B3FFH, the
BIU will form the physical address B3FF0H + 1000H = B4FF0H and fetch the byte
stored at this physical address.
Example 2.4
What physical memory location is accessed by the instruction MOV [BP],AL if BP =
2C30H? Assume the segment definitions shown in Fig. 2.9.
Solution Table 2.1 indicates that the stack segment will be used. The physical address is
5D270H
+ 2C30H
5FEA0H

Sec. 2.2 Segmented Memory 41

42 8086/88 CPU Architecture and Instruction Set Chap. 2
 TABLE 2.1 SEGMENT REGISTER ASSIGNMENTS

Type of Default Alternate Offset

memory reference segment segment (logical address)

Instruction fetch CS None IP

Stack operation ss None SP
General data DS CS, ES, SS Effective address
String source DS CS, ES, SS SI
String destination ES None cfi
BX used as pointer DS CS, ES, SS Effective address
BP used as pointer SS CS, ES, DS Effective address

Table 2.1 indicates that some memory references can have their segment definitions
changed. For example, BP can also be used as a pointer into the code, data, or extra
segments. On the other hand, instruction codes can only be stored in the code segment
with IP used as the offset. Similarly, string destinations always use the extra segment.
In Sec. 2.4 we show how the segment override is used to access these alternate segments.

Advantages of Segmented Memory

Segmented memory can seem confusing at first. What you must remember is that the
program op-codes will be fetched from the code segment, while program data variables
will be stored in the data and extra segments. Stack operations use registers BP or SP
and the stack segment. As we begin writing programs the consequences of these definitions
will become clearer.
An immediate advantage of having separate data and code segments is that one
program can work on several different sets of data. This is done by reloading register
DS to point to the new data.
Perhaps the greatest advantage of segmented memory is that programs that reference
logical addresses only can be loaded and run anywhere in memory. This is because the
logical addresses always range from 0000 to FFFFH, independent of the code segment
base.
Consider a multitasking environment in which the 8086/88 is doing several different
jobs at once. An inactive program can be temporarily saved on a magnetic disk and a
new program brought in to take its place—without concern for the physical location of
this new program. Such programs are said to be relocatable, meaning that they will run
at any location in memory. The requirements for writing relocatable programs are that
no references be made to physical addresses, and no changes to the segment registers
are allowed.

Defining Memory Locations

As a programmer you will seldom need to know the physical address of a memory
location. Usually, only the logical addresses are important. Indeed, as we have just seen,
the physical address depends on the contents of the segment registers even though the
logical address remains constant.

Sec. 2.2 Segmented Memory 43