AAA -- ASCII Adjust after Addition

Operation

 
 
 IF ((AL AND 0FH) > 9) OR (AF = 1)
 THEN
    AL := (AL + 6) AND 0FH;
    AH := AH + 1;
    AF := 1;
    CF := 1;
 ELSE
    CF := 0;
    AF := 0;
 FI;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

AAD -- ASCII Adjust AX before Division

Operation

 
 
 AL := AH * 10 + AL;
 AH := 0;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

AAM -- ASCII Adjust AX after Multiply

Operation

 
 
 AH := AL / 10;
 AL := AL MOD 10;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

AAS -- ASCII Adjust AL after Subtraction

Operation

 
 
 IF (AL AND 0FH) > 9 OR AF = 1
 THEN
    AL := AL - 6;
    AL := AL AND 0FH;
    AH := AH - 1;
    AF := 1;
    CF := 1;
 ELSE
    CF := 0;
    AF := 0;
 FI;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

ADC -- Add with Carry

Operation

 
 
 DEST := DEST + SRC + CF;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

ADD -- Add

Operation

 
 
 DEST := DEST + SRC;
 

Description

When an immediate byte is added to a word or doubleword operand, the immediate value is sign-extended to the size of the word or doubleword operand.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

AND -- Logical AND

Operation

 
 
 DEST := DEST AND SRC;
 CF := 0;
 OF := 0;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

ARPL -- Adjust RPL Field of Selector

Operation

 
 
 IF RPL bits(0,1) of DEST < RPL bits(0,1) of SRC
 THEN
    ZF := 1;
    RPL bits(0,1) of DEST := RPL bits(0,1) of SRC;
 ELSE
    ZF := 0;
 FI;
 

Description

ARPL appears in operating system software, not in application programs. It is used to guarantee that a selector parameter to a subroutine does not request more privilege than the caller is allowed. The second operand of ARPL is normally a register that contains the CS selector value of the caller.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

BOUND -- Check Array Index Against Bounds

Operation

 
 
 IF (LeftSRC < [RightSRC] OR LeftSRC > [RightSRC + OperandSize/8])
    (* Under lower bound or over upper bound *)
 THEN Interrupt 5;
 FI;
 

Description

The bounds limit data structure is usually placed just before the array itself, making the limits addressable via a constant offset from the beginning of the array.

Flags Affected

Protected Mode Exceptions

The second operand must be a memory operand, not a register. If BOUND is executed with a ModRM byte representing a register as the second operand, #UD occurs.

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

BSF -- Bit Scan Forward

Notes

Operation

 
 
 IF r/m = 0
 THEN
    ZF := 1;
    register := UNDEFINED;
 ELSE
    temp := 0;
    ZF := 0;
    WHILE BIT[r/m, temp = 0]
    DO
       temp := temp + 1;
       register := temp;
    OD;
 FI;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

BSR -- Bit Scan Reverse

Operation

 
 
 IF r/m = 0
 THEN
    ZF := 1;
    register := UNDEFINED;
 ELSE
    temp := OperandSize - 1;
    ZF := 0;
    WHILE BIT[r/m, temp] = 0
    DO
       temp := temp - 1;
       register := temp;
    OD;
 FI;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

BT -- Bit Test

Operation

 
 
 CF := BIT[LeftSRC, RightSRC];
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

When accessing a bit in memory, the 80386 may access four bytes starting from the memory address given by:

 
 
    Effective Address + (4 * (BitOffset DIV 32))
 

 
 
    Effective Address + (2 * (BitOffset DIV 16))
 

BTC -- Bit Test and Complement

Operation

 
 
 CF := BIT[LeftSRC, RightSRC];
 BIT[LeftSRC, RightSRC] := NOT BIT[LeftSRC, RightSRC];
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

When accessing a bit in memory, the 80386 may access four bytes starting from the memory address given by:

 
 
    Effective Address + (4 * (BitOffset DIV 32))
 

 
 
    Effective Address + (2 * (BitOffset DIV 16))
 

BTR -- Bit Test and Reset

Operation

 
 
 CF := BIT[LeftSRC, RightSRC];
 BIT[LeftSRC, RightSRC] := 0;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

When accessing a bit in memory, the 80386 may access four bytes starting from the memory address given by:

 
 
    Effective Address + 4 * (BitOffset DIV 32)
 

 
 
    Effective Address + 2 * (BitOffset DIV 16)
 

BTS -- Bit Test and Set

Operation

 
 
 CF := BIT[LeftSRC, RightSRC];
 BIT[LeftSRC, RightSRC] := 1;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

When accessing a bit in memory, the processor may access four bytes starting from the memory address given by:

 
 
    Effective Address + (4 * (BitOffset DIV 32))
 

 
 
    Effective Address + (2 * (BitOffset DIV 16))
 

CALL -- Call Procedure

 
 
                              New Task
               386 TSS         386 TSS         286 TSS
   Old         VM = 0          VM = 1
   Task                     Via Task Gate?
 
               N     Y         N     Y         N     Y
 
 386          300   309       217   226       273   282
 TSS VM=0
 
 286          298   307       217   226       273   282
 TSS
 

Operation

 
 
 IF rel16 or rel32 type of call
 THEN (* near relative call *)
    IF OperandSize = 16
    THEN
       Push(IP);
       EIP := (EIP + rel16) AND 0000FFFFH;
    ELSE (* OperandSize = 32 *)
       Push(EIP);
       EIP := EIP + rel32;
    FI;
 FI;
 
 IF r/m16 or r/m32 type of call
 THEN (* near absolute call *)
    IF OperandSize = 16
    THEN
       Push(IP);
       EIP := [r/m16] AND 0000FFFFH;
    ELSE (* OperandSize = 32 *)
       Push(EIP);
       EIP := [r/m32];
    FI;
 FI;
 
 IF (PE = 0 OR (PE = 1 AND VM = 1))
 (* real mode or virtual 8086 mode *)
    AND instruction = far CALL
    (* i.e., operand type is m16:16, m16:32, ptr16:16, ptr16:32 *)
 THEN
    IF OperandSize = 16
    THEN
       Push(CS);
       Push(IP); (* address of next instruction; 16 bits *)
    ELSE
       Push(CS); (* padded with 16 high-order bits *)
       Push(EIP); (* address of next instruction; 32 bits *)
    FI;
    IF operand type is m16:16 or m16:32
    THEN (* indirect far call *)
       IF OperandSize = 16
       THEN
          CS:IP := [m16:16];
          EIP := EIP AND 0000FFFFH; (* clear upper 16 bits *)
       ELSE (* OperandSize = 32 *)
          CS:EIP := [m16:32];
       FI;
    FI;
    IF operand type is ptr16:16 or ptr16:32
    THEN (* direct far call *)
       IF OperandSize = 16
       THEN
          CS:IP := ptr16:16;
          EIP := EIP AND 0000FFFFH; (* clear upper 16 bits *)
       ELSE (* OperandSize = 32 *)
          CS:EIP := ptr16:32;
       FI;
    FI;
 FI;
 
 IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *)
    AND instruction = far CALL
 THEN
    If indirect, then check access of EA doubleword;
       #GP(0) if limit violation;
    New CS selector must not be null else #GP(0);
    Check that new CS selector index is within its
       descriptor table limits; else #GP(new CS selector);
    Examine AR byte of selected descriptor for various legal values;
       depending on value:
       go to CONFORMING-CODE-SEGMENT;
       go to NONCONFORMING-CODE-SEGMENT;
       go to CALL-GATE;
       go to TASK-GATE;
       go to TASK-STATE-SEGMENT;
    ELSE #GP(code segment selector);
 FI;
 
 CONFORMING-CODE-SEGMENT:
    DPL must be <= CPL ELSE #GP(code segment selector);
    Segment must be present ELSE #NP(code segment selector);
    Stack must be big enough for return address ELSE #SS(0);
    Instruction pointer must be in code segment limit ELSE #GP(0);
    Load code segment descriptor into CS register;
    Load CS with new code segment selector;
    Load EIP with zero-extend(new offset);
    IF OperandSize=16 THEN EIP := EIP AND 0000FFFFH; FI;
 
 NONCONFORMING-CODE-SEGMENT:
    RPL must be <= CPL ELSE #GP(code segment selector)
    DPL must be = CPL ELSE #GP(code segment selector)
    Segment must be present ELSE #NP(code segment selector)
    Stack must be big enough for return address ELSE #SS(0)
    Instruction pointer must be in code segment limit ELSE #GP(0)
    Load code segment descriptor into CS register
    Load CS with new code segment selector
    Set RPL of CS to CPL
    Load EIP with zero-extend(new offset);
    IF OperandSize=16 THEN EIP := EIP AND 0000FFFFH; FI;
 
 CALL-GATE:
    Call gate DPL must be >= CPL ELSE #GP(call gate selector)
    Call gate DPL must be >= RPL ELSE #GP(call gate selector)
    Call gate must be present ELSE #NP(call gate selector)
    Examine code segment selector in call gate descriptor:
       Selector must not be null ELSE #GP(0)
       Selector must be within its descriptor table
          limits ELSE #GP(code segment selector)
    AR byte of selected descriptor must indicate code
       segment ELSE #GP(code segment selector)
    DPL of selected descriptor must be <= CPL ELSE
       #GP(code segment selector)
    IF non-conforming code segment AND DPL < CPL
    THEN go to MORE-PRIVILEGE
    ELSE go to SAME-PRIVILEGE
    FI;
 
 MORE-PRIVILEGE:
    Get new SS selector for new privilege level from TSS
       Check selector and descriptor for new SS:
          Selector must not be null ELSE #TS(0)
          Selector index must be within its descriptor
             table limits ELSE #TS(SS selector)
          Selector's RPL must equal DPL of code segment
             ELSE #TS(SS selector)
          Stack segment DPL must equal DPL of code
             segment ELSE #TS(SS selector)
          Descriptor must indicate writable data segment
             ELSE #TS(SS selector)
          Segment present ELSE #SS(SS selector)
       IF OperandSize=32
       THEN
          New stack must have room for parameters plus 16 bytes
             ELSE #SS(0)
          EIP must be in code segment limit ELSE #GP(0)
          Load new SS:eSP value from TSS
          Load new CS:EIP value from gate
       ELSE
          New stack must have room for parameters plus 8 bytes ELSE #SS(0)
          IP must be in code segment limit ELSE #GP(0)
          Load new SS:eSP value from TSS
          Load new CS:IP value from gate
       FI;
       Load CS descriptor
       Load SS descriptor
       Push long pointer of old stack onto new stack
       Get word count from call gate, mask to 5 bits
       Copy parameters from old stack onto new stack
       Push return address onto new stack
       Set CPL to stack segment DPL
       Set RPL of CS to CPL
 
 SAME-PRIVILEGE:
    IF OperandSize=32
    THEN
       Stack must have room for 6-byte return address (padded to 8 bytes)
          ELSE #SS(0)
       EIP must be within code segment limit ELSE #GP(0)
       Load CS:EIP from gate
    ELSE
       Stack must have room for 4-byte return address ELSE #SS(0)
       IP must be within code segment limit ELSE #GP(0)
       Load CS:IP from gate
    FI;
    Push return address onto stack
    Load code segment descriptor into CS register
    Set RPL of CS to CPL
 
 TASK-GATE:
    Task gate DPL must be >= CPL ELSE #TS(gate selector)
    Task gate DPL must be >= RPL ELSE #TS(gate selector)
    Task Gate must be present ELSE #NP(gate selector)
    Examine selector to TSS, given in Task Gate descriptor:
       Must specify global in the local/global bit ELSE #TS(TSS selector)
       Index must be within GDT limits ELSE #TS(TSS selector)
       TSS descriptor AR byte must specify nonbusy TSS
          ELSE #TS(TSS selector)
       Task State Segment must be present ELSE #NP(TSS selector)
    SWITCH-TASKS (with nesting) to TSS
    IP must be in code segment limit ELSE #TS(0)
 
 TASK-STATE-SEGMENT:
    TSS DPL must be >= CPL else #TS(TSS selector)
    TSS DPL must be >= RPL ELSE #TS(TSS selector)
    TSS descriptor AR byte must specify available TSS
       ELSE #TS(TSS selector)
    Task State Segment must be present ELSE #NP(TSS selector)
    SWITCH-TASKS (with nesting) to TSS
    IP must be in code segment limit ELSE #TS(0)
 

Description

The action of the different forms of the instruction are described below.

Near calls are those with destinations of type r/m16, r/m32, rel16, rel32; changing or saving the segment register value is not necessary. The CALL rel16 and CALL rel32 forms add a signed offset to the address of the instruction following CALL to determine the destination. The rel16 form is used when the instruction's operand-size attribute is 16 bits; rel32 is used when the operand-size attribute is 32 bits. The result is stored in the 32-bit EIP register. With rel16, the upper 16 bits of EIP are cleared, resulting in an offset whose value does not exceed 16 bits. CALL r/m16 and CALL r/m32 specify a register or memory location from which the absolute segment offset is fetched. The offset fetched from r/m is 32 bits for an operand-size attribute of 32 (r/m32), or 16 bits for an operand-size of 16 (r/m16). The offset of the instruction following CALL is pushed onto the stack. It will be popped by a near RET instruction within the procedure. The CS register is not changed by this form of CALL.

The far calls, CALL ptr16:16 and CALL ptr16:32, use a four-byte or six-byte operand as a long pointer to the procedure called. The CALL m16:16 and m16:32 forms fetch the long pointer from the memory location specified (indirection). In Real Address Mode or Virtual 8086 Mode, the long pointer provides 16 bits for the CS register and 16 or 32 bits for the EIP register (depending on the operand-size attribute). These forms of the instruction push both CS and IP or EIP as a return address.

In Protected Mode, both long pointer forms consult the AR byte in the descriptor indexed by the selector part of the long pointer. Depending on the value of the AR byte, the call will perform one of the following types of control transfers:

• A far call to the same protection level
• An inter-protection level far call
• A task switch

Flags Affected

Protected Mode Exceptions

For near direct calls: #GP(0) if procedure location is beyond the code segment limits; #SS(0) if pushing the return address exceeds the bounds of the stack segment; #PF (fault-code) for a page fault For a near indirect call: #GP(0) for an illegal memory operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; #GP(0) if the indirect offset obtained is beyond the code segment limits; #PF(fault-code) for a page fault

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

CBW/CWDE -- Convert Byte to Word/Convert Word to Doubleword

Operation

 
 
 IF OperandSize = 16 (* instruction = CBW *)
 THEN AX := SignExtend(AL);
 ELSE (* OperandSize = 32, instruction = CWDE *)
    EAX := SignExtend(AX);
 FI;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CLC -- Clear Carry Flag

Operation

 
 
 CF := 0;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CLD -- Clear Direction Flag

Operation

 
 
 DF := 0;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CLI -- Clear Interrupt Flag

Operation

 
 
 IF := 0;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CLTS -- Clear Task-Switched Flag in CR0

Operation

 
 
 TS Flag in CR0 := 0;
 

Description

• Every execution of an ESC instruction is trapped if the TS flag is set.
• Execution of a WAIT instruction is trapped if the MP flag and the TS flag are both set.

CLTS appears in operating system software, not in application programs. It is a privileged instruction that can only be executed at privilege level 0.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CMC -- Complement Carry Flag

Operation

 
 
 CF := NOT CF;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CMP -- Compare Two Operands

Operation

 
 
 LeftSRC - SignExtend(RightSRC);
 (* CMP does not store a result; its purpose is to set the flags *)
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CMPS/CMPSB/CMPSW/CMPSD -- Compare String Operands

Operation

 
 
 IF (instruction = CMPSD) OR
    (instruction has operands of type DWORD)
 THEN OperandSize := 32;
 ELSE OperandSize := 16;
 FI;
 IF AddressSize = 16
 THEN
    use SI for source-index and DI for destination-index
 ELSE (* AddressSize = 32 *)
    use ESI for source-index and EDI for destination-index;
 FI;
 IF byte type of instruction
 THEN
    [source-index] - [destination-index]; (* byte comparison *)
    IF DF = 0 THEN IncDec := 1 ELSE IncDec := -1; FI;
 ELSE
    IF OperandSize = 16
    THEN
       [source-index] - [destination-index]; (* word comparison *)
       IF DF = 0 THEN IncDec := 2 ELSE IncDec := -2; FI;
    ELSE (* OperandSize = 32 *)
       [source-index] - [destination-index]; (* dword comparison *)
       IF DF = 0 THEN IncDec := 4 ELSE IncDec := -4; FI;
    FI;
 FI;
 source-index := source-index + IncDec;
 destination-index := destination-index + IncDec;
 

Description

If the address-size attribute of this instruction is 16 bits, SI and DI will be used for source- and destination-index registers; otherwise ESI and EDI will be used. Load the correct index values into SI and DI (or ESI and EDI) before executing CMPS.

The comparison is done by subtracting the operand indexed by the destination-index register from the operand indexed by the source-index register.

Note that the direction of subtraction for CMPS is [SI] - [DI] or [ESI] - [EDI]. The left operand (SI or ESI) is the source and the right operand (DI or EDI) is the destination. This is the reverse of the usual Intel convention in which the left operand is the destination and the right operand is the source.

The result of the subtraction is not stored; only the flags reflect the change. The types of the operands determine whether bytes, words, or doublewords are compared. For the first operand (SI or ESI), the DS register is used, unless a segment override byte is present. The second operand (DI or EDI) must be addressable from the ES register; no segment override is possible.

After the comparison is made, both the source-index register and destination-index register are automatically advanced. If the direction flag is 0 (CLD was executed), the registers increment; if the direction flag is 1 (STD was executed), the registers decrement. The registers increment or decrement by 1 if a byte is compared, by 2 if a word is compared, or by 4 if a doubleword is compared.

CMPSB, CMPSW and CMPSD are synonyms for the byte, word, and doubleword CMPS instructions, respectively.

CMPS can be preceded by the REPE or REPNE prefix for block comparison of CX or ECX bytes, words, or doublewords. Refer to the description of the REP instruction for more information on this operation.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

CWD/CDQ -- Convert Word to Doubleword/Convert Doubleword to Quadword

Operation

 
 
 IF OperandSize = 16 (* CWD instruction *)
 THEN
    IF AX < 0 THEN DX := 0FFFFH; ELSE DX := 0; FI;
 ELSE (* OperandSize = 32, CDQ instruction *)
    IF EAX < 0 THEN EDX := 0FFFFFFFFH; ELSE EDX := 0; FI;
 FI;
 

Description

Flags Affected

DAA -- Decimal Adjust AL after Addition

Operation

 
 
 IF ((AL AND 0FH) > 9) OR (AF = 1)
 THEN
    AL := AL + 6;
    AF := 1;
 ELSE
    AF := 0;
 FI;
 IF (AL > 9FH) OR (CF = 1)
 THEN
    AL := AL + 60H;
    CF := 1;
 ELSE CF := 0;
 FI;
 

Description

Flags Affected

DAS -- Decimal Adjust AL after Subtraction

Operation

 
 
 IF (AL AND 0FH) > 9 OR AF = 1
 THEN
    AL := AL - 6;
    AF := 1;
 ELSE
    AF := 0;
 FI;
 IF (AL > 9FH) OR (CF = 1)
 THEN
    AL := AL - 60H;
    CF := 1;
 ELSE CF := 0;
 FI;
 

Description

Flags Affected

DEC -- Decrement by 1

Operation

 
 
 DEST := DEST - 1;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

DIV -- Unsigned Divide

Operation

 
 
 temp := dividend / divisor;
 IF temp does not fit in quotient
 THEN Interrupt 0;
 ELSE
    quotient := temp;
    remainder := dividend MOD (r/m);
 FI;
 

Description

 
 
 
     Size    Dividend     Divisor   Quotient   Remainder
     byte    AX           r/m8       AL          AH
     word    DX:AX        r/m16      AX          DX
     dword   EDX:EAX      r/m32      EAX         EDX
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

ENTER -- Make Stack Frame for Procedure Parameters

Operation

 
 
 level := level MOD 32
 IF OperandSize = 16 THEN Push(BP) ELSE Push (EBP) FI;
    (* Save stack pointer *)
 frame-ptr := eSP
 IF level > 0
 THEN (* level is rightmost parameter *)
    FOR i := 1 TO level - 1
    DO
       IF OperandSize = 16
       THEN
          BP := BP - 2;
          Push[BP]
       ELSE (* OperandSize = 32 *)
          EBP := EBP - 4;
          Push[EBP];
       FI;
    OD;
    Push(frame-ptr)
 FI;
 IF OperandSize = 16 THEN BP := frame-ptr ELSE EBP := frame-ptr; FI;
 IF StackAddrSize = 16
 THEN SP := SP - First operand;
 ELSE ESP := ESP - ZeroExtend(First operand);
 FI;
 

Description

If the operand-size attribute is 16 bits, the processor uses BP as the frame pointer and SP as the stack pointer. If the operand-size attribute is 32 bits, the processor uses EBP for the frame pointer and ESP for the stack pointer.

If the second operand is 0, ENTER pushes the frame pointer (BP or EBP) onto the stack; ENTER then subtracts the first operand from the stack pointer and sets the frame pointer to the current stack-pointer value.

For example, a procedure with 12 bytes of local variables would have an ENTER 12,0 instruction at its entry point and a LEAVE instruction before every RET. The 12 local bytes would be addressed as negative offsets from the frame pointer.

Flags Affected

Protected Mode Exceptions

HLT -- Halt

Operation

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

IDIV -- Signed Divide

Operation

 
 
 temp := dividend / divisor;
 IF temp does not fit in quotient
 THEN Interrupt 0;
 ELSE
    quotient := temp;
    remainder := dividend MOD (r/m);
 FI;
 

Description

 
 
 Size     Divisor    Quotient    Remainder  Dividend
 byte     r/m8        AL           AH       AX
 word     r/m16       AX           DX       DX:AX
 dword    r/m32       EAX          EDX      EDX:EAX
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

IMUL -- Signed Multiply

 
 
   Actual clock = if m <> 0 then max(ceiling(log{2}(m)), 3) + 6 clocks  
   Actual clock = if m = 0 then 9 clocks   
   (where m is the multiplier)
 

Operation

 
 
 result := multiplicand * multiplier;
 

Description

Description

IMUL clears the overflow and carry flags under the following conditions:

 
 
    Instruction Form    Condition for Clearing CF and OF
    r/m8                AL := sign-extend of AL to 16 bits
    r/m16               AX := sign-extend of AX to 32 bits
    r/m32               EDX:EAX := sign-extend of EAX to 32 bits
    r16,r/m16           Result exactly fits within r16
    r/32,r/m32          Result exactly fits within r32
    r16,r/m16,imm16     Result exactly fits within r16
    r32,r/m32,imm32     Result exactly fits within r32
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

IN -- Input from Port

 
 
    *If CPL <= IOPL
   **If CPL > IOPL or if in virtual 8086 mode
 

Operation

 
 
 IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL))
 THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *)
    IF NOT I-O-Permission (SRC, width(SRC))
    THEN #GP(0);
    FI;
 FI;
 DEST := [SRC]; (* Reads from I/O address space *)
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

INC -- Increment by 1

Operation

 
 
 DEST := DEST + 1;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

INS/INSB/INSW/INSD -- Input from Port to String

 
 
    *If CPL <= IOPL
   **If CPL > IOPL or if in virtual 8086 mode
 

Operation

 
 
 IF AddressSize = 16
 THEN use DI for dest-index;
 ELSE (* AddressSize = 32 *)
    use EDI for dest-index;
 FI;
 IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL))
 THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *)
    IF NOT I-O-Permission (SRC, width(SRC))
    THEN #GP(0);
    FI;
 FI;
 IF byte type of instruction
 THEN
    ES:[dest-index] := [DX]; (* Reads byte at DX from I/O address space *)
    IF DF = 0 THEN IncDec := 1 ELSE IncDec := -1; FI;
 FI;
 IF OperandSize = 16
 THEN
    ES:[dest-index] := [DX]; (* Reads word at DX from I/O address space *)
    IF DF = 0 THEN IncDec := 2 ELSE IncDec := -2; FI;
 FI;
 IF OperandSize = 32
 THEN
    ES:[dest-index] := [DX]; (* Reads dword at DX from I/O address space *)
    IF DF = 0 THEN IncDec := 4 ELSE IncDec := -4; FI;
 FI;
 dest-index := dest-index + IncDec;
 

Description

INS does not allow the specification of the port number as an immediate value. The port must be addressed through the DX register value. Load the correct value into DX before executing the INS instruction.

The destination address is determined by the contents of the destination index register. Load the correct index into the destination index register before executing INS.

After the transfer is made, DI or EDI advances automatically. If the direction flag is 0 (CLD was executed), DI or EDI increments; if the direction flag is 1 (STD was executed), DI or EDI decrements. DI increments or decrements by 1 if a byte is input, by 2 if a word is input, or by 4 if a doubleword is input.

INSB, INSW and INSD are synonyms of the byte, word, and doubleword INS instructions. INS can be preceded by the REP prefix for block input of CX bytes or words. Refer to the REP instruction for details of this operation.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

INT/INTO -- Call to Interrupt Procedure

 
 
                             New Task
 
 Old Task       386 TSS       386 TSS       286 TSS
                VM = 0        VM = 1
 
 386
 TSS VM=0         309           226           282
 
 386
 TSS VM=1         314           231           287
 
 286
 TSS              307           224           280
 

Operation

 
 
 IF PE = 0
 THEN GOTO REAL-ADDRESS-MODE;
 ELSE GOTO PROTECTED-MODE;
 FI;
 
 REAL-ADDRESS-MODE:
    Push (FLAGS);
    IF = 0; (* Clear interrupt flag *)
    TF = 0; (* Clear trap flag *)
    Push(CS);
    Push(IP);
    (* No error codes are pushed *)
    CS := IDT[Interrupt number * 4].selector;
    IP := IDT[Interrupt number * 4].offset;
 
 PROTECTED-MODE:
    Interrupt vector must be within IDT table limits,
       else #GP(vector number * 8+2+EXT);
    Descriptor AR byte must indicate interrupt gate, trap gate, or task gate,
       else #GP(vector number * 8+2+EXT);
    IF software interrupt (* i.e. caused by INT n, INT 3, or INTO *)
    THEN
       IF gate descriptor DPL < CPL
       THEN #GP(vector number * 8+2+EXT);
       FI;
    FI;
    Gate must be present, else #NP(vector number * 8+2+EXT);
    IF trap gate OR interrupt gate
    THEN GOTO TRAP-GATE-OR-INTERRUPT-GATE;
    ELSE GOTO TASK-GATE;
    FI;
 
 TRAP-GATE-OR-INTERRUPT-GATE:
    Examine CS selector and descriptor given in the gate descriptor;
    Selector must be non-null, else #GP (EXT);
    Selector must be within its descriptor table limits
       ELSE #GP(selector+EXT);
    Descriptor AR byte must indicate code segment
       ELSE #GP(selector + EXT);
    Segment must be present, else #NP(selector+EXT);
    IF code segment is non-conforming AND DPL < CPL
    THEN GOTO INTERRUPT-TO-INNER-PRIVILEGE;
    ELSE
       IF code segment is conforming OR code segment DPL = CPL
       THEN GOTO INTERRUPT-TO-SAME-PRIVILEGE-LEVEL;
       ELSE #GP(CS selector + EXT);
       FI;
    FI;
 
 INTERRUPT-TO-INNER-PRIVILEGE:
    Check selector and descriptor for new stack in current TSS;
       Selector must be non-null, else #GP(EXT);
       Selector index must be within its descriptor table limits
          ELSE #TS(SS selector+EXT);
       Selector's RPL must equal DPL of code segment, else #TS(SS
          selector+EXT);
       Stack segment DPL must equal DPL of code segment, else #TS(SS
          selector+EXT);
       Descriptor must indicate writable data segment, else #TS(SS
          selector+EXT);
       Segment must be present, else #SS(SS selector+EXT);
    IF 32-bit gate
    THEN New stack must have room for 20 bytes else #SS(0)
    ELSE New stack must have room for 10 bytes else #SS(0)
    FI;
    Instruction pointer must be within CS segment boundaries else #GP(0);
    Load new SS and eSP value from TSS;
    IF 32-bit gate
    THEN CS:EIP := selector:offset from gate;
    ELSE CS:IP := selector:offset from gate;
    FI;
    Load CS descriptor into invisible portion of CS register;
    Load SS descriptor into invisible portion of SS register;
    IF 32-bit gate
    THEN
       Push (long pointer to old stack) (* 3 words padded to 4 *);
       Push (EFLAGS);
       Push (long pointer to return location) (* 3 words padded to 4*);
    ELSE
       Push (long pointer to old stack) (* 2 words *);
       Push (FLAGS);
       Push (long pointer to return location) (* 2 words *);
    FI;
    Set CPL to new code segment DPL;
    Set RPL of CS to CPL;
    IF interrupt gate THEN IF = 0 (* interrupt flag to 0 (disabled) *); FI;
    TF := 0;
    NT := 0;
 
 INTERRUPT-FROM-V86-MODE:
    TempEFlags := EFLAGS;
    VM := 0;
    TF := 0;
    IF service through Interrupt Gate THEN IF = 0;
    TempSS := SS;
    TempESP := ESP;
    SS := TSS.SS0; (* Change to level 0 stack segment *)
    ESP := TSS.ESP0; (* Change to level 0 stack pointer *)
    Push(GS); (* padded to two words *)
    Push(FS); (* padded to two words *)
    Push(DS); (* padded to two words *)
    Push(ES); (* padded to two words *)
    GS := 0;
    FS := 0;
    DS := 0;
    ES := 0;
    Push(TempSS); (* padded to two words *)
    Push(TempESP);
    Push(TempEFlags);
    Push(CS); (* padded to two words *)
    Push(EIP);
    CS:EIP := selector:offset from interrupt gate;
    (* Starts execution of new routine in 80386 Protected Mode *)
 
 INTERRUPT-TO-SAME-PRIVILEGE-LEVEL:
    IF 32-bit gate
    THEN Current stack limits must allow pushing 10 bytes, else #SS(0);
    ELSE Current stack limits must allow pushing 6 bytes, else #SS(0);
    FI;
    IF interrupt was caused by exception with error code
    THEN Stack limits must allow push of two more bytes;
    ELSE #SS(0);
    FI;
    Instruction pointer must be in CS limit, else #GP(0);
    IF 32-bit gate
    THEN
       Push (EFLAGS);
       Push (long pointer to return location); (* 3 words padded to 4 *)
       CS:EIP := selector:offset from gate;
    ELSE (* 16-bit gate *)
       Push (FLAGS);
       Push (long pointer to return location); (* 2 words *)
       CS:IP := selector:offset from gate;
    FI;
    Load CS descriptor into invisible portion of CS register;
    Set the RPL field of CS to CPL;
    Push (error code); (* if any *)
    IF interrupt gate THEN IF = 0; FI;
    TF := 0;
    NT := 0;
 
 TASK-GATE:
    Examine selector to TSS, given in task gate descriptor;
       Must specify global in the local/global bit, else #TS(TSS selector);
       Index must be within GDT limits, else #TS(TSS selector);
       AR byte must specify available TSS (bottom bits 00001),
          else #TS(TSS selector;
       TSS must be present, else #NP(TSS selector);
    SWITCH-TASKS with nesting to TSS;
    IF interrupt was caused by fault with error code
    THEN
       Stack limits must allow push of two more bytes, else #SS(0);
       Push error code onto stack;
    FI;
    Instruction pointer must be in CS limit, else #GP(0);
 

Description

The INTO conditional software instruction is identical to the INT interrupt instruction except that the interrupt number is implicitly 4, and the interrupt is made only if the 80386 overflow flag is set.

The first 32 interrupts are reserved by Intel for system use. Some of these interrupts are use for internally generated exceptions.

INT n generally behaves like a far call except that the flags register is pushed onto the stack before the return address. Interrupt procedures return via the IRET instruction, which pops the flags and return address from the stack.

In Real Address Mode, INT n pushes the flags, CS, and the return IP onto the stack, in that order, then jumps to the long pointer indexed by the interrupt number.

Flags Affected

Protected Mode Exceptions

Operation

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

IRET/IRETD -- Interrupt Return

 
 
                             New Task
 
 Old Task       386 TSS       386 TSS       286 TSS
                VM = 0        VM = 1
 
 386
 TSS VM=0         275           224           271
 
 286
 TSS              265           214           232
 

Operation

 
 
 IF PE = 0
 THEN (* Real-address mode *)
    IF OperandSize = 32 (* Instruction = IRETD *)
    THEN EIP := Pop();
    ELSE (* Instruction = IRET *)
       IP := Pop();
    FI;
    CS := Pop();
    IF OperandSize = 32 (* Instruction = IRETD *)
    THEN EFLAGS := Pop();
    ELSE (* Instruction = IRET *)
       FLAGS := Pop();
    FI;
 ELSE (* Protected mode *)
    IF VM = 1
    THEN #GP(0);
    ELSE
       IF NT = 1
       THEN GOTO TASK-RETURN;
       ELSE
          IF VM = 1 in flags image on stack
          THEN GO TO STACK-RETURN-TO-V86;
          ELSE GOTO STACK-RETURN;
          FI;
       FI;
    FI;
 FI;STACK-RETURN-TO-V86: (* Interrupted procedure was in V86 mode *)
    IF return CS selector RPL < > 3
    THEN #GP(Return selector);
    FI;
    IF top 36 bytes of stack not within limits
    THEN #SS(0);
    FI;
    Examine return CS selector and associated descriptor:
       IF selector is null, THEN #GP(0); FI;
       IF selector index not within its descriptor table limits;
       THEN #GP(Return selector);
       FI;
       IF AR byte does not indicate code segment
       THEN #GP(Return selector);
       FI;
       IF code segment DPL not = 3;
       THEN #GP(Return selector);
       FI;
       IF code segment not present
       THEN #NP(Return selector);
       FI;
 
    Examine return SS selector and associated descriptor:
       IF selector is null THEN #GP(0); FI;
       IF selector index not within its descriptor table limits
       THEN #GP(SS selector);
       FI;
       IF selector RPL not = RPL of return CS selector
       THEN #GP(SS selector);
       FI;
       IF AR byte does not indicate a writable data segment
       THEN #GP(SS selector);
       FI;
       IF stack segment DPL not = RPL of return CS selector
       THEN #GP(SS selector);
       FI;
       IF SS not present
       THEN #NP(SS selector);
       FI;
 
    IF instruction pointer not within code segment limit  THEN #GP(0);
    FI;
    EFLAGS := SS:[eSP + 8]; (* Sets VM in interrupted routine *)
    EIP := Pop();
    CS := Pop(); (* CS behaves as in 8086, due to VM = 1 *)
    throwaway := Pop(); (* pop away EFLAGS already read *)
    ES := Pop(); (* pop 2 words; throw away high-order word *)
    DS := Pop(); (* pop 2 words; throw away high-order word *)
    FS := Pop(); (* pop 2 words; throw away high-order word *)
    GS := Pop(); (* pop 2 words; throw away high-order word *)
    IF CS.RPL > CPL
    THEN
       TempESP := Pop();
       TempSS := Pop();
       SS:ESP := TempSS:TempESP;
    FI;
 
    (* Resume execution in Virtual 8086 mode *)
 
 TASK-RETURN:
    Examine Back Link Selector in TSS addressed by the current task
       register:
       Must specify global in the local/global bit, else #TS(new TSS
          selector);
       Index must be within GDT limits, else #TS(new TSS selector);
       AR byte must specify TSS, else #TS(new TSS selector);
       New TSS must be busy, else #TS(new TSS selector);
       TSS must be present, else #NP(new TSS selector);
    SWITCH-TASKS without nesting to TSS specified by back link selector;
    Mark the task just abandoned as NOT BUSY;
    Instruction pointer must be within code segment limit ELSE #GP(0);
 
 STACK-RETURN:
    IF OperandSize=32
    THEN Third word on stack must be within stack limits, else #SS(0);
    ELSE Second word on stack must be within stack limits, else #SS(0);
    FI;
    Return CS selector RPL must be >= CPL, else #GP(Return selector);
    IF return selector RPL = CPL
    THEN GOTO RETURN-SAME-LEVEL;
    ELSE GOTO RETURN-OUTER-LEVEL;
    FI;
 
 RETURN-SAME-LEVEL:
    IF OperandSize=32
    THEN
       Top 12 bytes on stack must be within limits, else #SS(0);
       Return CS selector (at eSP+4) must be non-null, else #GP(0);
    ELSE
       Top 6 bytes on stack must be within limits, else #SS(0);
       Return CS selector (at eSP+2) must be non-null, else #GP(0);
    FI;
    Selector index must be within its descriptor table limits, else #GP
       (Return selector);
    AR byte must indicate code segment, else #GP(Return selector);
    IF non-conforming
    THEN code segment DPL must = CPL;
    ELSE #GP(Return selector);
    FI;
    IF conforming
    THEN code segment DPL must be <= CPL, else #GP(Return selector);
    Segment must be present, else #NP(Return selector);
    Instruction pointer must be within code segment boundaries, else #GP(0);
    FI;
    IF OperandSize=32
    THEN
       Load CS:EIP from stack;
       Load CS-register with new code segment descriptor;
       Load EFLAGS with third doubleword from stack;
       Increment eSP by 12;
    ELSE
       Load CS-register with new code segment descriptor;
       Load FLAGS with third word on stack;
       Increment eSP by 6;
    FI;
 
 RETURN-OUTER-LEVEL:
    IF OperandSize=32
    THEN Top 20 bytes on stack must be within limits, else #SS(0);
    ELSE Top 10 bytes on stack must be within limits, else #SS(0);
    FI;
    Examine return CS selector and associated descriptor:
       Selector must be non-null, else #GP(0);
       Selector index must be within its descriptor table limits;
          ELSE #GP(Return selector);
       AR byte must indicate code segment, else #GP(Return selector);
       IF non-conforming
       THEN code segment DPL must = CS selector RPL;
       ELSE #GP(Return selector);
       FI;
       IF conforming
       THEN code segment DPL must be > CPL;
       ELSE #GP(Return selector);
       FI;
       Segment must be present, else #NP(Return selector);
    Examine return SS selector and associated descriptor:
       Selector must be non-null, else #GP(0);
       Selector index must be within its descriptor table limits
          ELSE #GP(SS selector);
       Selector RPL must equal the RPL of the return CS selector
          ELSE #GP(SS selector);
       AR byte must indicate a writable data segment, else #GP(SS selector);
       Stack segment DPL must equal the RPL of the return CS selector
          ELSE #GP(SS selector);
       SS must be present, else #NP(SS selector);
 
    Instruction pointer must be within code segment limit ELSE #GP(0);
    IF OperandSize=32
    THEN
       Load CS:EIP from stack;
       Load EFLAGS with values at (eSP+8);
    ELSE
       Load CS:IP from stack;
       Load FLAGS with values at (eSP+4);
    FI;
    Load SS:eSP from stack;
    Set CPL to the RPL of the return CS selector;
    Load the CS register with the CS descriptor;
    Load the SS register with the SS descriptor;
    FOR each of ES, FS, GS, and DS
    DO;
       IF the current value of the register is not valid for the outer level;
       THEN zero the register and clear the valid flag;
       FI;
       To be valid, the register setting must satisfy the following
          properties:
          Selector index must be within descriptor table limits;
          AR byte must indicate data or readable code segment;
          IF segment is data or non-conforming code,
          THEN DPL must be >= CPL, or DPL must be >= RPL;
    OD;
 

Description

In Protected Mode, the action of IRET depends on the setting of the nested task flag (NT) bit in the flag register. When popping the new flag image from the stack, the IOPL bits in the flag register are changed only when CPL equals 0.

If NT equals 0, IRET returns from an interrupt procedure without a task switch. The code returned to must be equally or less privileged than the interrupt routine (as indicated by the RPL bits of the CS selector popped from the stack). If the destination code is less privileged, IRET also pops the stack pointer and SS from the stack.

If NT equals 1, IRET reverses the operation of a CALL or INT that caused a task switch. The updated state of the task executing IRET is saved in its task state segment. If the task is reentered later, the code that follows IRET is executed.

Flags Affected

Protected Mode Exceptions

Operation

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Jcc -- Jump if Condition is Met

Operation

 
 
 IF condition
 THEN
    EIP := EIP + SignExtend(rel8/16/32);
    IF OperandSize = 16
    THEN EIP := EIP AND 0000FFFFH;
    FI;
 FI;
 

Description

If the given condition is true, a jump is made to the location provided as the operand. Instruction coding is most efficient when the target for the conditional jump is in the current code segment and within -128 to +127 bytes of the next instruction's first byte. The jump can also target -32768 thru +32767 (segment size attribute 16) or -2^(31) thru +2^(31) -1 (segment size attribute 32) relative to the next instruction's first byte. When the target for the conditional jump is in a different segment, use the opposite case of the jump instruction (i.e., JE and JNE), and then access the target with an unconditional far jump to the other segment. For example, you cannot code--

 
 
 JZ FARLABEL;
 

 
 
    JNZ BEYOND;
    JMP FARLABEL;
 BEYOND:
 

JCXZ differs from other conditional jumps because it tests the contents of the CX or ECX register for 0, not the flags. JCXZ is useful at the beginning of a conditional loop that terminates with a conditional loop instruction (such as LOOPNE TARGET LABEL). The JCXZ prevents entering the loop with CX or ECX equal to zero, which would cause the loop to execute 64K or 32G times instead of zero times.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

JMP -- Jump

Note

 
 
                                New Task
 
                 386 TSS       386 TASK       286 TSS
                 VM = 0        VM = 1
 
 Old Task                   Via Task Gate?
 
                 N     Y       N      Y       N     Y
 386
 TSS VM=0       303   312     220    229     276   285
 
 286
 TSS            301   310     218    227     274   283
 

Operation

 
 
 IF instruction = relative JMP
    (* i.e. operand is rel8, rel16, or rel32 *)
 THEN
    EIP := EIP + rel8/16/32;
    IF OperandSize = 16
    THEN EIP := EIP AND 0000FFFFH;
    FI;
 FI;
 IF instruction = near indirect JMP
    (* i.e. operand is r/m16 or r/m32 *)
 THEN
    IF OperandSize = 16
    THEN
       EIP := [r/m16] AND 0000FFFFH;
    ELSE (* OperandSize = 32 *)
       EIP := [r/m32];
    FI;
 FI;
 
 IF (PE = 0 OR (PE = 1 AND VM = 1)) (* real mode or V86 mode *)
    AND instruction = far JMP
    (* i.e., operand type is m16:16, m16:32, ptr16:16, ptr16:32 *)
 THEN GOTO REAL-OR-V86-MODE;
    IF operand type = m16:16 or m16:32
    THEN (* indirect *)
       IF OperandSize = 16
       THEN
          CS:IP := [m16:16];
          EIP := EIP AND 0000FFFFH; (* clear upper 16 bits *)
       ELSE (* OperandSize = 32 *)
          CS:EIP := [m16:32];
       FI;
    FI;
    IF operand type = ptr16:16 or ptr16:32
    THEN
       IF OperandSize = 16
       THEN
          CS:IP := ptr16:16;
          EIP := EIP AND 0000FFFFH; (* clear upper 16 bits *)
       ELSE (* OperandSize = 32 *)
          CS:EIP := ptr16:32;
       FI;
    FI;
 FI;
 
 IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *)
    AND instruction = far JMP
 THEN
    IF operand type = m16:16 or m16:32
    THEN (* indirect *)
       check access of EA dword;
       #GP(0) or #SS(0) IF limit violation;
    FI;
    Destination selector is not null ELSE #GP(0)
    Destination selector index is within its descriptor table limits ELSE
 #GP(selector)
    Depending on AR byte of destination descriptor:
       GOTO CONFORMING-CODE-SEGMENT;
       GOTO NONCONFORMING-CODE-SEGMENT;
       GOTO CALL-GATE;
       GOTO TASK-GATE;
       GOTO TASK-STATE-SEGMENT;
    ELSE #GP(selector); (* illegal AR byte in descriptor *)
 FI;
 
 CONFORMING-CODE-SEGMENT:
    Descriptor DPL must be <= CPL ELSE #GP(selector);
    Segment must be present ELSE #NP(selector);
    Instruction pointer must be within code-segment limit ELSE #GP(0);
    IF OperandSize = 32
    THEN Load CS:EIP from destination pointer;
    ELSE Load CS:IP from destination pointer;
    FI;
    Load CS register with new segment descriptor;
 
 NONCONFORMING-CODE-SEGMENT:
    RPL of destination selector must be <= CPL ELSE #GP(selector);
    Descriptor DPL must be = CPL ELSE #GP(selector);
    Segment must be present ELSE # NP(selector);
    Instruction pointer must be within code-segment limit ELSE #GP(0);
    IF OperandSize = 32
    THEN Load CS:EIP from destination pointer;
    ELSE Load CS:IP from destination pointer;
    FI;
    Load CS register with new segment descriptor;
    Set RPL field of CS register to CPL;
 
 CALL-GATE:
    Descriptor DPL must be >= CPL ELSE #GP(gate selector);
    Descriptor DPL must be >= gate selector RPL ELSE #GP(gate selector);
    Gate must be present ELSE #NP(gate selector);
    Examine selector to code segment given in call gate descriptor:
       Selector must not be null ELSE #GP(0);
       Selector must be within its descriptor table limits ELSE
          #GP(CS selector);
       Descriptor AR byte must indicate code segment
          ELSE #GP(CS selector);
       IF non-conforming
       THEN code-segment descriptor, DPL must = CPL
       ELSE #GP(CS selector);
       FI;
       IF conforming
       THEN code-segment descriptor DPL must be <= CPL;
       ELSE #GP(CS selector);
       Code segment must be present ELSE #NP(CS selector);
       Instruction pointer must be within code-segment limit ELSE #GP(0);
       IF OperandSize = 32
       THEN Load CS:EIP from call gate;
       ELSE Load CS:IP from call gate;
       FI;
    Load CS register with new code-segment descriptor;
    Set RPL of CS to CPL
 
 TASK-GATE:
    Gate descriptor DPL must be >= CPL ELSE #GP(gate selector);
    Gate descriptor DPL must be >= gate selector RPL ELSE #GP(gate
      selector);
    Task Gate must be present ELSE #NP(gate selector);
    Examine selector to TSS, given in Task Gate descriptor:
    Must specify global in the local/global bit ELSE #GP(TSS selector);
    Index must be within GDT limits ELSE #GP(TSS selector);
    Descriptor AR byte must specify available TSS (bottom bits 00001);
       ELSE #GP(TSS selector);
    Task State Segment must be present ELSE #NP(TSS selector);
 SWITCH-TASKS (without nesting) to TSS;
 Instruction pointer must be within code-segment limit ELSE #GP(0);
 
 TASK-STATE-SEGMENT:
    TSS DPL must be >= CPL ELSE #GP(TSS selector);
    TSS DPL must be >= TSS selector RPL ELSE #GP(TSS selector);
    Descriptor AR byte must specify available TSS (bottom bits 00001)
       ELSE #GP(TSS selector);
    Task State Segment must be present ELSE #NP(TSS selector);
    SWITCH-TASKS (without nesting) to TSS;
    Instruction pointer must be within code-segment limit ELSE #GP(0);
 

Description

The action of the various forms of the instruction are shown below.

Jumps with destinations of type r/m16, r/m32, rel16, and rel32 are near jumps and do not involve changing the segment register value.

The JMP rel16 and JMP rel32 forms of the instruction add an offset to the address of the instruction following the JMP to determine the destination. The rel16 form is used when the instruction's operand-size attribute is 16 bits (segment size attribute 16 only); rel32 is used when the operand-size attribute is 32 bits (segment size attribute 32 only). The result is stored in the 32-bit EIP register. With rel16, the upper 16 bits of EIP are cleared, which results in an offset whose value does not exceed 16 bits.

JMP r/m16 and JMP r/m32 specifies a register or memory location from which the absolute offset from the procedure is fetched. The offset fetched from r/m is 32 bits for an operand-size attribute of 32 bits (r/m32), or 16 bits for an operand-size attribute of 16 bits (r/m16).

The JMP ptr16:16 and ptr16:32 forms of the instruction use a four-byte or six-byte operand as a long pointer to the destination. The JMP and forms fetch the long pointer from the memory location specified (indirection). In Real Address Mode or Virtual 8086 Mode, the long pointer provides 16 bits for the CS register and 16 or 32 bits for the EIP register (depending on the operand-size attribute). In Protected Mode, both long pointer forms consult the Access Rights (AR) byte in the descriptor indexed by the selector part of the long pointer.

Depending on the value of the AR byte, the jump will perform one of the following types of control transfers:

• A jump to a code segment at the same privilege level
• A task switch

Flags Affected

Protected Mode Exceptions

Near direct jumps: #GP(0) if procedure location is beyond the code segment limits.

Near indirect jumps: #GP(0) for an illegal memory operand effective address in the CS, DS, ES, FS, or GS segments: #SS(0) for an illegal address in the SS segment; #GP if the indirect offset obtained is beyond the code segment limits; #PF(fault-code) for a page fault.

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LAHF -- Load Flags into AH Register

Operation

 
 
 AH := SF:ZF:xx:AF:xx:PF:xx:CF;
 

Description

Flags Affected

LAR -- Load Access Rights Byte

Description

If the 32-bit operand size is specified, the entire 32-bit value is loaded into the 32-bit destination register. If the 16-bit operand size is specified, the lower 16-bits of this value are stored in the 16-bit destination register.

All code and data segment descriptors are valid for LAR.

The valid special segment and gate descriptor types for LAR are given in the following table:

 
 
 Type   Name                     Valid/Invalid
 
   0    Invalid                  Invalid
   1    Available 80286 TSS      Valid
   2    LDT                      Valid
   3    Busy 80286 TSS           Valid
   4    80286 call gate          Valid
   5    80286/80386 task gate    Valid
   6    80286 trap gate          Valid
   7    80286 interrupt gate     Valid
   8    Invalid                  Invalid
   9    Available 80386 TSS      Valid
   A    Invalid                  Invalid
   B    Busy 80386 TSS           Valid
   C    80386 call gate          Valid
   D    Invalid                  Invalid
   E    80386 trap gate          Valid
   F    80386 interrupt gate     Valid
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LEA -- Load Effective Address

Operation

 
 
 IF OperandSize = 16 AND AddressSize = 16
 THEN r16 := Addr(m);
 ELSE
    IF OperandSize = 16 AND AddressSize = 32
    THEN
       r16 := Truncate_to_16bits(Addr(m));   (* 32-bit address *)
    ELSE
       IF OperandSize = 32 AND AddressSize = 16
       THEN
          r32 := Truncate_to_16bits(Addr(m));
       ELSE
          IF OperandSize = 32 AND AddressSize = 32
          THEN  r32 := Addr(m);
          FI;
       FI;
    FI;
 FI;
 

Description

 
 
 Operand Size  Address Size  Action Performed
 
     16            16        16-bit effective address is calculated and
                             stored in requested 16-bit register
                             destination.
 
     16            32        32-bit effective address is calculated. The
                             lower 16 bits of the address are stored in
                             the requested 16-bit register destination.
 
     32            16        16-bit effective address is calculated. The
                             16-bit address is zero-extended and stored
                             in the requested 32-bit register destination.
 
     32            32        32-bit effective address is calculated and
                             stored in the requested 32-bit register
                             destination.
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LEAVE -- High Level Procedure Exit

Operation

 
 
 IF StackAddrSize = 16
 THEN
    SP := BP;
 ELSE (* StackAddrSize = 32 *)
    ESP := EBP;
 FI;
 IF OperandSize = 16
 THEN
    BP := Pop();
 ELSE (* OperandSize = 32 *)
    EBP := Pop();
 FI;
 

Description

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LGDT/LIDT -- Load Global/Interrupt Descriptor Table Register

Operation

 
 
 IF instruction = LIDT
 THEN
    IF OperandSize = 16
    THEN IDTR.Limit:Base := m16:24 (* 24 bits of base loaded *)
    ELSE IDTR.Limit:Base := m16:32
    FI;
 ELSE (* instruction = LGDT *)
    IF OperandSize = 16
    THEN GDTR.Limit:Base := m16:24 (* 24 bits of base loaded *)
    ELSE GDTR.Limit:Base := m16:32;
    FI;
 FI;
 

Description

The SGDT and SIDT instructions always store into all 48 bits of the six-byte data operand. With the 80286, the upper eight bits are undefined after SGDT or SIDT is executed. With the 80386, the upper eight bits are written with the high-order eight address bits, for both a 16-bit operand and a 32-bit operand. If LGDT or LIDT is used with a 16-bit operand to load the register stored by SGDT or SIDT, the upper eight bits are stored as zeros.

LGDT and LIDT appear in operating system software; they are not used in application programs. They are the only instructions that directly load a linear address (i.e., not a segment relative address) in 80386 Protected Mode.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LGS/LSS/LDS/LES/LFS -- Load Full Pointer

Operation

 
 
 CASE instruction OF
    LSS: Sreg is SS; (* Load SS register *)
    LDS: Sreg is DS; (* Load DS register *)
    LES: Sreg is ES; (* Load ES register *)
    LFS: Sreg is FS; (* Load FS register *)
    LGS: Sreg is DS; (* Load GS register *)
 ESAC;
 IF (OperandSize = 16)
 THEN
    r16 := [Effective Address]; (* 16-bit transfer *)
    Sreg := [Effective Address + 2]; (* 16-bit transfer *)
    (* In Protected Mode, load the descriptor into the segment register *)
 ELSE (* OperandSize = 32 *)
    r32 := [Effective Address]; (* 32-bit transfer *)
    Sreg := [Effective Address + 4]; (* 16-bit transfer *)
    (* In Protected Mode, load the descriptor into the segment register *)
 FI;
 

Description

When an assignment is made to one of the segment registers, the descriptor is also loaded into the segment register. The data for the register is obtained from the descriptor table entry for the selector given.

A null selector (values 0000-0003) can be loaded into DS, ES, FS, or GS registers without causing a protection exception. (Any subsequent reference to a segment whose corresponding segment register is loaded with a null selector to address memory causes a #GP(0) exception. No memory reference to the segment occurs.)

The following is a listing of the Protected Mode checks and actions taken in the loading of a segment register:

 
 
 IF SS is loaded:
    IF selector is null THEN #GP(0); FI;
    Selector index must be within its descriptor table limits ELSE
       #GP(selector);
    Selector's RPL must equal CPL ELSE #GP(selector);
    AR byte must indicate a writable data segment ELSE #GP(selector);
    DPL in the AR byte must equal CPL ELSE #GP(selector);
    Segment must be marked present ELSE #SS(selector);
    Load SS with selector;
    Load SS with descriptor;
 IF DS, ES, FS, or GS is loaded with non-null selector:
    Selector index must be within its descriptor table limits ELSE
       #GP(selector);
    AR byte must indicate data or readable code segment ELSE
       #GP(selector);
    IF data or nonconforming code
    THEN both the RPL and the CPL must be less than or equal to DPL in
       AR byte;
    ELSE #GP(selector);
    Segment must be marked present ELSE #NP(selector);
 Load segment register with selector and RPL bits;
 Load segment register with descriptor;
 IF DS, ES, FS or GS is loaded with a null selector:
    Clear descriptor valid bit;
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LLDT -- Load Local Descriptor Table Register

Operation

 
 
 LDTR := SRC;
 

Description

The selector operand can be 0; if so, the LDTR is marked invalid. All descriptor references (except by the LAR, VERR, VERW or LSL instructions) cause a #GP fault.

LLDT is used in operating system software; it is not used in application programs.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LMSW -- Load Machine Status Word

Operation

 
 
 MSW := r/m16; (* 16 bits is stored in the machine status word *)
 

Description

LMSW is used only in operating system software. It is not used in application programs.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

LOCK -- Assert LOCK# Signal Prefix

Description

The LOCK prefix functions only with the following instructions:

 
 
 BT, BTS, BTR, BTC                   mem, reg/imm
 XCHG                                reg, mem
 XCHG                                mem, reg
 ADD, OR, ADC, SBB, AND, SUB, XOR    mem, reg/imm
 NOT, NEG, INC, DEC                  mem
 

XCHG always asserts LOCK# regardless of the presence or absence of the LOCK prefix.

The integrity of the LOCK is not affected by the alignment of the memory field. Memory locking is observed for arbitrarily misaligned fields.

Locked access is not assured if another 80386 processor is executing an instruction concurrently that has one of the following characteristics:

• Is not preceded by a LOCK prefix
• Is not one of the instructions in the preceding list
• Specifies a memory operand that does not exactly overlap the destination operand. Locking is not guaranteed for partial overlap, even if one memory operand is wholly contained within another.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LODS/LODSB/LODSW/LODSD -- Load String Operand

Operation

 
 
 IF AddressSize = 16
 THEN use SI for source-index
 ELSE (* AddressSize = 32 *)
    use ESI for source-index;
 FI;
 IF byte type of instruction
 THEN
    AL := [source-index]; (* byte load *)
    IF DF = 0 THEN IncDec := 1 ELSE IncDec := -1; FI;
 ELSE
    IF OperandSize = 16
    THEN
       AX := [source-index]; (* word load *)
       IF DF = 0 THEN IncDec := 2 ELSE IncDec := -2; FI;
    ELSE (* OperandSize = 32 *)
       EAX := [source-index]; (* dword load *)
       IF DF = 0 THEN IncDec := 4 ELSE IncDec := -4; FI;
    FI;
 FI;
 source-index := source-index + IncDec
 

Description

If the address-size attribute for this instruction is 16 bits, SI is used for the source-index register; otherwise the address-size attribute is 32 bits, and the ESI register is used. The address of the source data is determined solely by the contents of ESI/SI. Load the correct index value into SI before executing the LODS instruction. LODSB, LODSW, LODSD are synonyms for the byte, word, and doubleword LODS instructions.

LODS can be preceded by the REP prefix; however, LODS is used more typically within a LOOP construct, because further processing of the data moved into EAX, AX, or AL is usually necessary.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LOOP/LOOPcond -- Loop Control with CX Counter

Operation

 
 
 IF AddressSize = 16 THEN CountReg is CX ELSE CountReg is ECX; FI;
 CountReg := CountReg - 1;
 IF instruction <> LOOP
 THEN
    IF (instruction = LOOPE) OR (instruction = LOOPZ)
    THEN BranchCond := (ZF = 1) AND (CountReg <> 0);
    FI;
    IF (instruction = LOOPNE) OR (instruction = LOOPNZ)
    THEN BranchCond := (ZF = 0) AND (CountReg <> 0);
    FI;
 FI;
 
 IF BranchCond
 THEN
    IF OperandSize = 16
    THEN
       IP := IP + SignExtend(rel8);
    ELSE (* OperandSize = 32 *)
       EIP := EIP + SignExtend(rel8);
    FI;
 FI;
 

Description

The LOOP instructions provide iteration control and combine loop index management with conditional branching. Use the LOOP instruction by loading an unsigned iteration count into the count register, then code the LOOP at the end of a series of instructions to be iterated. The destination of LOOP is a label that points to the beginning of the iteration.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LSL -- Load Segment Limit

Description

The 32-bit forms of this instruction store the 32-bit byte granular limit in the 16-bit destination register.

Code and data segment descriptors are valid for LSL.

The valid special segment and gate descriptor types for LSL are given in the following table:

 
 
 Type   Name                      Valid/Invalid
 
   0    Invalid                   Invalid
   1    Available 80286 TSS       Valid
   2    LDT                       Valid
   3    Busy 80286 TSS            Valid
   4    80286 call gate           Invalid
   5    80286/80386 task gate     Invalid
   6    80286 trap gate           Invalid
   7    80286 interrupt gate      Invalid
   8    Invalid                   Valid
   9    Available 80386 TSS       Valid
   A    Invalid                   Invalid
   B    Busy 80386 TSS            Valid
   C    80386 call gate           Invalid
   D    Invalid                   Invalid
   E    80386 trap gate           Invalid
   F    80386 interrupt gate      Invalid
 

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

LTR -- Load Task Register

Description

LTR is used only in operating system software; it is not used in application programs.

Flags Affected

Protected Mode Exceptions

Real Address Mode Exceptions

Virtual 8086 Mode Exceptions

Notes

Оставьте свой комментарий !
Ваше имя: Комментарий: Оба поля являются обязательными  Автор   Комментарий к данной статье