
   8086 Instruction Set Reference, BETA revision 1

-------------------------------------------------------------------------------

1. Description

 This document attempts to describe the instruction set of the Intel 8086 and
8088 CPUs with as much accuracy as possible. Corrections and additions are
greatly appreciated.

 Both CPUs share the same execution unit and therefore instruction set,
commonly known as the 8086 instruction set. As such, unless otherwise noted,
all comments about the 8086 also apply to the 8088.

 NEC produced pin-compatible clones of the 8086 and 8088, the V30 and V20
respectively, with improved performance and an extended instruction set. As
computers using the Intel CPUs were easily upgraded by swapping in one of these
faster variants, this document attempts to describe the subset of operations
compatible with both.

 CPUs and instructions that are not compatible with the 8086 or 8088 are not
included, except for the sake of forward compatibilty.

 Timing information for the 8088 and V20 is included. As a general rule of
thumb the 8086 and V30 differ only in fetching aligned words faster and having
longer prefetch queues.

-------------------------------------------------------------------------------

2. Instruction Format

 8086 instructions have up to five parts, encoded in the following order:

  Prefix  Opcode  MOD R/M  Displacement  Immediate

 All but the opcode are optional.

2.1. Prefix

 The following prefix bytes may precede the opcode of an instruction:

     | Prefix
 ----+---------------
  26 | SEGES
  2E | SEGCS
  36 | SEGSS
  3E | SEGDS
  F0 | LOCK
  F2 | REPNZ/REPNE
  F3 | REP/REPZ/REPE
 --------------------

 See the instruction list for details.

2.2. Opcode

 The opcode bytes(s) of each instruction are listed under the first column of
the instruction's encoding table, in hex.

 Some instructions encode an operand in the low 3 bits of the opcode. These
encodings are indicated by appending a `+` sign to the affected opcode byte.
For all instructions but ESC, the operand will be of 'r8' or 'r16' type and
will be encoded as per the REG field of the MOD R/M byte; such instructions do
not have a MOD R/M byte.

 Some instructions use the REG field of the MOD R/M byte to encode additional
opcode bits instead of an operand. These encodings are indicated by appending a
`/` sign and the value of the REG field to the last opcode byte.

2.3. Operands

 The addressing modes of each instruction are listed under the 'Operands'
column of the instruction's encoding table.

 The 8086 has eight 16-bit general-purpose registers, of which four are divided
into pairs of individually accessible 8-bit registers:

     | High  Low  Special uses
 ----+---------------------------------------
  AX | AH    AL   Accumulator
  BX | BH    BL   Pointer
  CX | CH    CL   Counter
  DX | DH    DL   High word of 32-bit values
  SI | -     -    Source index
  DI | -     -    Destination index
  SP | -     -    Stack pointer
  BP | -     -    Frame pointer
 --------------------------------------------

 The 8086 encodes memory addresses as segment:offset pairs of 16-bit words.
Segment:offset pairs are converted to 20-bit physical addresses by adding the
offset to sixteen times the segment.

 Indirect memory accesses take the offset from one of the 16-bit
general-purpose registers and the segment from one of four dedicated registers:

     | Name
 ----+---------------
  CS | Code Segment
  DS | Data Segment
  ES | Extra Segment
  SS | Stack Segment
 --------------------

 Memory accesses are represented by placing the segment:offset address in
square brackets. All 16-bit words are stored low byte first. All segment:offset
pairs are stored offset first.

 Addressing modes describe each operand as follows:

                     | 8-bit  16-bit  segment:offset
 --------------------+-------------------------------
  Register           | r8     r16     -
  Segment register   | -      seg     -
  Memory location    | -      m16     m16:16
  Register or memory | r/m8   r/m16   -
  Immediate constant | imm8   imm16   imm16:16
  Relative constant  | rel8   rel16   -
 ----------------------------------------------------

 The encoding of these operands is described in the following sections.

2.4. MOD R/M Byte

 The MOD R/M byte is broken into three bitfields:

        | 7-6  5-3  2-0
 -------+---------------
  Field | MOD  REG  R/M
 -----------------------

 The MOD and R/M fields together encode an 'r/m8' or 'r/m16' operand. The MOD
field is encoded as per the column of the following table and the R/M field is
encoded as per the row.

 An 'm16' operand is encoded as an 'r/m16' operand, but must not be a register.

 An 'm16:16' operand is encoded as an 'm16' operand, but indicates the
instruction will access two words instead of one.

 The REG field encodes an 'r8' or 'r16' operand as per column 3 of the table.

 A 'disp16' in the table indicates a 16-bit constant displacement follows the
MOD R/M byte.

 A 'disp8' in the table indicates an 8-bit constant displacement follows the
MOD R/M byte. The byte will be sign-extended.

 The segment registers shown in the table are the default segment register used
for the given combination. They can be overridden with a segment prefix.

    | 0            1                 2                  3
 ---+---------------------------------------------------------
  0 | [DS:BX+SI]   [DS:BX+SI+disp8]  [DS:BX+SI+disp16]  AL/AX
  1 | [DS:BX+DI]   [DS:BX+DI+disp8]  [DS:BX+DI+disp16]  CL/CX
  2 | [SS:BP+SI]   [SS:BP+SI+disp8]  [SS:BP+SI+disp16]  DL/DX
  3 | [SS:BP+DI]   [SS:BP+DI+disp8]  [SS:BP+DI+disp16]  BL/BX
  4 | [DS:SI]      [DS:SI+disp8]     [DS:SI+disp16]     AH/SP
  5 | [DS:DI]      [DS:DI+disp8]     [DS:DI+disp16]     CH/BP
  6 | [DS:disp16]  [SS:BP+disp8]     [SS:BP+disp16]     DH/SI
  7 | [DS:BX]      [DS:BX+disp8]     [DS:BX+disp16]     BH/DI
 -------------------------------------------------------------

 A 'seg' operand represents a segment register and uses the following encodings
for REG:

    |
 ---+----
  0 | ES
  1 | CS
  2 | SS
  3 | DS
 --------

 Note that CS is read-only.

 The presence of any of the above in an instruction's 'Operands column implies
the presence of a MOD R/M byte in that encoding, except for the use of 'r8' and
'r16' to represent operands encoded in the opcode byte as described above.

2.5. Immediate operand

 An 'imm8' or 'imm16' operand in an instruction's encoding table indicates that
an 8-bit or 16-bit immediate value follows the instruction.

A 'imm16:16' operand in an instruction's encoding table indicates that two
16-bit immediate values follow the instruction, forming a segment:offset pair.

 The ESC instruction has a unique 'imm6' operand. The high 3 bits of the
operand are encoded in the low 3 bits of the opcode, and the low 3 bits of the
operand are encoded in the REG field of the MOD R/M byte.

 A 'rel8' or 'rel16' operand is encoded an 'imm8' or 'imm16' operand, but
specifies a relative offset to be added to the address of the next instruction.
A 'rel8' will be sign-extended prior to the addition.

2.6. Flags

 The 8086 flags are arranged into a 16-bit register:

       | 15  14  13  12  11  10   9   8   7   6   5   4   3   2   1   0
 ------+----------------------------------------------------------------
  Flag |  -   -   -   -   O   D   I   T   S   Z   -   A   -   P   -   C
 -----------------------------------------------------------------------

 The low byte of this register contains flags carried over from the 8080:

    |  #  8080 flag
 ---+----------------------
  C |  0  Carry
  P |  2  Parity
  A |  4  Auxiliary carry
  Z |  6  Zero
  S |  7  Sign
 ---------------------------

 The parity flag is set if the result of an operation has an even number of set
bits. The zero flag is set if the result of an operation is zero. The sign flag
is set if the topmost bit of a result is set, which indicates a negative number
in two's complement arithmetic.

 The carry flag is set if addition produces a carry or subtraction produces a
borrow out of the topmost bit, and is re-used for similar meanings in other
contexts. The auxiliary carry flag is used for implementing BCD arithmetic; it
is set if there is carry or borrow between bits 3 and 4.

 The high byte contains flags new to the 8086:

    |  #  8086 flag
 ---+----------------------
  T |  8  Trap
  I |  9  Interrupt enable
  D | 10  Direction
  O | 11  Overflow
 ---------------------------

 The trap flag is used for single-stepping; it causes INT 1 to be triggered
after every instruction. The interrupt enable flag masks IRQs if cleared. The
direction flag controls the operation of string instructions. The overflow flag
is set to indicate overflow of two's complement arithmetic operations.

 The remaining bits of the flags register are reserved.

 Each instruction lists its effects on these nine flags using the following
abbreviations:

    | Meaning
 ---+----------------
  - | Unchanged
  * | Changed
  0 | Always cleared
  1 | Always set
  ? | Undefined
 --------------------

2.6 Timings

 The '8088' column of each instruction's encoding table shows the number of
cycles an 8088 CPU requires to execute each instruction form.

 Values separated by a `/` character indicate separate timings for register and
memory versions of the r/m operand.

 Two timings are also given for branch instructions; the first is for branch
untaken and the second is for branch taken.

 EA depends on MOD and R/M:

    | 0  1   2
 ---+-----------
  0 | 7  11  11
  1 | 8  12  12
  2 | 8  12  12
  3 | 7  11  11
  4 | 5  9   9
  5 | 5  9   9
  6 | 6  9   9
  7 | 5  9   9
 ---------------

 TODO: describe prefetching.

-------------------------------------------------------------------------------

3. Opcode Matrix

     | +0       +1       +2       +3       +4       +5       +6       +7
 ----+------------------------------------------------------------------------
  00 | ADD      ADD      ADD      ADD      ADD      ADD      PUSH ES  POP ES
  08 | OR       OR       OR       OR       OR       OR       PUSH CS  -
  10 | ADC      ADC      ADC      ADC      ADC      ADC      PUSH SS  POP SS
  18 | SBB      SBB      SBB      SBB      SBB      SBB      PUSH DS  POP DS
  20 | AND      AND      AND      AND      AND      AND      SEGES    DAA
  28 | SUB      SUB      SUB      SUB      SUB      SUB      SEGCS    DAS
  30 | XOR      XOR      XOR      XOR      XOR      XOR      SEGSS    AAA
  38 | CMP      CMP      CMP      CMP      CMP      CMP      SEGDS    AAS
 ----+------------------------------------------------------------------------
  40 | INC AX   INC CX   INC DX   INC BX   INC SP   INC BP   INC SI   INC DI
  48 | DEC AX   DEC CX   DEC DX   DEC BX   DEC SP   DEC BP   DEC SI   DEC DI
  50 | PUSH AX  PUSH CX  PUSH DX  PUSH BX  PUSH SP  PUSH BP  PUSH SI  PUSH DI
  58 | POP AX   POP CX   POP DX   POP BX   POP SP   POP BP   POP SI   POP DI
  60 | -        -        -        -        -        -        -        -
  68 | -        -        -        -        -        -        -        -
  70 | JO       JNO      JB/JNAE  JNB/JAE  JZ/JE    JNZ/JNE  JNA/JBE  JA/JNBE
  78 | JS       JNS      JP/JPE   JNP/JPO  JL/JNGE  JNL/JGE  JNG/JLE  JG/JNLE
 ----+------------------------------------------------------------------------
  80 | <80>     <80>     <82>     <82>     TEST     TEST     XCHG     XCHG
  88 | MOV      MOV      MOV      MOV      MOV      LEA      MOV      POP
  90 | NOP      XCHG CX  XCHG DX  XCHG BX  XCHG SP  XCHG BP  XCHG SI  XCHG DI
  98 | CBW      CWD      CALL     WAIT     PUSHF    POPF     SAHF     LAHF
  A0 | MOV      MOV      MOV      MOV      MOVSB    MOVSW    CMPSB    CMPSW
  A8 | TEST     TEST     STOSB    STOSW    LODSB    LODSW    SCASB    SCASW
  B0 | MOV AL   MOV CL   MOV DL   MOV BL   MOV AH   MOV CH   MOV DH   MOV BH
  B8 | MOV AX   MOV CX   MOV DX   MOV BX   MOV SP   MOV BP   MOV SI   MOV DI
 ----+------------------------------------------------------------------------
  C0 | -        -        RETN     RETN     LES      LDS      MOV      MOV
  C8 | -        -        RETF     RETF     INT3     INT      INTO     IRET
  D0 | <D0>     <D0>     <D0>     <D0>     AAM      AAD      -        XLAT
  D8 | ESC      ESC      ESC      ESC      ESC      ESC      ESC      ESC
  E0 | LOOPNZ   LOOPZ    LOOP     JCXZ     IN       IN       OUT      OUT
  E8 | CALL     JMP      JMP      JMP      IN       IN       OUT      OUT
  F0 | LOCK     -        REPNZ    REPZ     HLT      CMC      <F6>     <F6>
  F8 | CLC      STC      CLI      STI      CLD      STD      <FE>     <FF>
 -----------------------------------------------------------------------------

 REG field for subinstructions:

    | <80>  <82>  <D0>  <F6>  <FE>  <FF>
 ---+------------------------------------
  0 | ADD   ADD   ROL   TEST  INC   INC
  1 | OR    -     ROR   -     DEC   DEC
  2 | ADC   ADC   RCL   NOT   -     CALL
  3 | SBB   SBB   RCR   NEG   -     CALL
  4 | AND   -     SHL   MUL   -     JMP
  5 | SUB   SUB   SHR   IMUL  -     JMP
  6 | XOR   -     -     DIV   -     PUSH
  7 | CMP   CMP   SAR   IDIV  -     -
 ----------------------------------------

-------------------------------------------------------------------------------

4. Instruction List

-------------------------------------------------------------------------------

 AAA - ASCII adjust after addition                           O D I T S Z A P C
                                                             ? - - - ? ? * ? *

 Convert the number in the low 4 bits of AL into an unpacked BCD number in
AH:AL.

 If AF is set or the low 4 bits of AL are greater than 9 then add 6 to AL, add
1 to AH and set AF and CF. Otherwise clear AF and CF. In either case clear the
high 4 bits of AL.

 NOTE: the 80286 and newer add 6 to AX instead of AL, potentially causing carry
into AH for some (invalid) inputs.

        | Operands           8088
 -------+----------------------------
  37    | AAA                4
 ------------------------------------

-------------------------------------------------------------------------------

 AAD - ASCII adjust before division                          O D I T S Z A P C
                                                             ? - - - * * ? * ?

 Convert the unpacked BCD number in AX to binary in AL, by adding AH times 10
to AL and zeroing AH.

        | Operands           8088
 -------+----------------------------
  D5 0A | AAD                60
 ------------------------------------

-------------------------------------------------------------------------------

 AAM - ASCII adjust after multiplication                     O D I T S Z A P C
                                                             ? - - - * * ? * ?

 Convert the binary number in AL to an unpacked BCD number in AX. AH is set to
AL divided by 10 and AL is reduced modulo 10.

        | Operands           8088
 -------+----------------------------
  D4 0A | AAM                83
 ------------------------------------

-------------------------------------------------------------------------------

 AAS - ASCII adjust after subtraction                        O D I T S Z A P C
                                                             ? - - - ? ? * ? *

 If AF is set or the low 4 bits of AL are greater than 9 then subtract 6 from
AL, subtract 1 from AH and set AF and CF. Otherwise clear AF and CF. In either
case clear the high 4 bits of AL.

        | Operands           8088
 -------+----------------------------
  3F    | AAS                4
 ------------------------------------

-------------------------------------------------------------------------------

 ADC - Addition with carry                                   O D I T S Z A P C
                                                             * - - - * * * * *

 Add the source plus the carry flag to the destination.

        | Operands           8088
 -------+----------------------------
  10    | ADC r/m8, r8       3/16+EA
  11    | ADC r/m16, r16     3/24+EA
  12    | ADC r8, r/m8       3/9+EA
  13    | ADC r16, r/m16     3/13+EA
  14    | ADC AL, imm8       4
  15    | ADC AX, imm16      4
  80/2  | ADC r/m8, imm8     4/17+EA
  81/2  | ADC r/m16, imm16   4/25+EA
  83/2  | ADC r/m16, imm8    4/25+EA
 ------------------------------------

-------------------------------------------------------------------------------

 ADD - Addition                                              O D I T S Z A P C
                                                             * - - - * * * * *

 Add the source to the destination.

        | Operands           8088
 -------+----------------------------
  00    | ADD r/m8, r8       3/16+EA
  01    | ADD r/m16, r16     3/24+EA
  02    | ADD r8, r/m8       3/9+EA
  03    | ADD r16, r/m16     3/13+EA
  04    | ADD AL, imm8       4
  05    | ADD AX, imm16      4
  80/0  | ADD r/m8, imm8     4/17+EA
  81/0  | ADD r/m16, imm16   4/25+EA
  83/0  | ADD r/m16, imm8    4/25+EA
 ------------------------------------

-------------------------------------------------------------------------------

 AND - Logical AND                                           O D I T S Z A P C
                                                             0 - - - * * ? * 0

 Set each bit of the destination if the corresponding bits in both operands are
set. Otherwise clear them.

        | Operands           8088
 -------+----------------------------
  20    | AND r/m8, r8       3/16+EA
  21    | AND r/m16, r16     3/24+EA
  22    | AND r8, r/m8       3/9+EA
  23    | AND r16, r/m16     3/13+EA
  24    | AND AL, imm8       4
  25    | AND AX, imm16      4
  80/4  | AND r/m8, imm8     4/17+EA
  81/4  | AND r/m16, imm16   4/25+EA
 ------------------------------------

-------------------------------------------------------------------------------

 CALL - Call subroutine                                      O D I T S Z A P C
                                                             - - - - - - - - -

 For a far call, push CS, then IP, then load CS:IP from the operand.

 For a near call, push IP, then load it from the operand.

        | Operands           8088
 -------+----------------------------
  9A    | CALL imm16:16      36
  E8    | CALL rel16         23
  FF/2  | CALL r/m16         24/29+EA
  FF/3  | CALL m16:16        53+EA
 ------------------------------------

-------------------------------------------------------------------------------

 CBW - Convert byte to word                                  O D I T S Z A P C
                                                             - - - - - - - - -

 Copy bit 7 of AL into all bits of AH.

        | Operands           8088
 -------+----------------------------
  98    | CBW                2
 ------------------------------------

-------------------------------------------------------------------------------

 CLC - Clear carry flag                                      O D I T S Z A P C
                                                             - - - - - - - - 0

        | Operands           8088
 -------+----------------------------
  F8    | CLC                2
 ------------------------------------

-------------------------------------------------------------------------------

 CLD - Clear direction flag                                  O D I T S Z A P C
                                                             - 0 - - - - - - -

 Making string instructions increment SI and DI.

        | Operands           8088
 -------+----------------------------
  FC    | CLD                2
 ------------------------------------

-------------------------------------------------------------------------------

 CLI - Clear interrupt enable flag                           O D I T S Z A P C
                                                             - - 0 - - - - - -

 Mask IRQs.

        | Operands           8088
 -------+----------------------------
  FA    | CLI                2
 ------------------------------------

-------------------------------------------------------------------------------

 CMC - Complement cary flag                                  O D I T S Z A P C
                                                             - - - - - - - - *

        | Operands           8088
 -------+----------------------------
  F5    | CMC                2
 ------------------------------------

-------------------------------------------------------------------------------

 CMP - Comparison                                            O D I T S Z A P C
                                                             * - - - * * * * *

 Subtract the source from the destination and discard the result, changing only
flags.

        | Operands           8088
 -------+----------------------------
  38    | CMP r/m8, r8       3/9+EA
  39    | CMP r/m16, r16     3/13+EA
  3A    | CMP r8, r/m8       3/9+EA
  3B    | CMP r16, r/m16     3/13+EA
  3C    | CMP AL, imm8       4
  3D    | CMP AX, imm16      4
  80/7  | CMP r/m8, imm8     4/10+EA
  81/7  | CMP r/m16, imm16   4/14+EA
  83/7  | CMP r/m16, imm8    4/14+EA
 ---------------------------------

-------------------------------------------------------------------------------

 CMPS - Compare string                                       O D I T S Z A P C
                                                             * - - - * * * * *

 Compare the byte or word at [DS:SI] with [ES:DI], then advance SI and DI to
point at the next byte or word. The direction of advancement depends on the
direction flag.

        | Operands           8088
 -------+----------------------------
  A6    | CMPSB              22
  A7    | CMPSW              30
 ------------------------------------

-------------------------------------------------------------------------------

 CWD - Convert word to doubleword                            O D I T S Z A P C
                                                             - - - - - - - - -

 Copy bit 15 of AX into all bits of DX.

        | Operands           8088
 -------+----------------------------
  99    | CWD                5
 ------------------------------------

-------------------------------------------------------------------------------

 DAA - Decimal adjust after addition                         O D I T S Z A P C
                                                             ? - - - * * * * *

 If AF is set or the low 4 bits of AL are greater than 9 then add 6 to AL and
set AF. Otherwise clear AF.

 If CF is set or the high 4 bits of AL are greater than 9 then add 60H to AL
and set CF. Otherwise clear CF.

        | Operands           8088
 -------+----------------------------
  27    | DAA                4
 ------------------------------------

-------------------------------------------------------------------------------

 DAS - Decimal adjust after subtraction                      O D I T S Z A P C
                                                             ? - - - * * * * *

 If AF is set or the low 4 bits of AL are greater than 9 then subtract 6 from
AL and set AF. Otherwise clear AF.

 If CF is set or the high 4 bits of AL are greater than 9 then subtract 60H
from AL and set CF. Otherwise clear CF.

        | Operands           8088
 -------+----------------------------
  2F    | DAS                4
 ------------------------------------

-------------------------------------------------------------------------------

 DEC - Decrement                                             O D I T S Z A P C
                                                             * - - - * * * * -

 Subtract one from the destination, without changing the carry flag.

        | Operands           8088
 -------+----------------------------
  48+   | DEC r16            2
  FE/1  | DEC r/m8           2/15+EA
  FF/1  | DEC r/m16          2/23+EA
 ------------------------------------

-------------------------------------------------------------------------------

 DIV - Unsigned division                                     O D I T S Z A P C
                                                             ? - - - ? ? ? ? ?

 For 8-bit operands, set AL to the quotient of dividing AX by the operand and
set AH to the remainder.

 For 16-bit operands, set AX to the quotient of dividing DX:AX by the operand
and set DX to the remainder.

 If the operand is zero or the quotient is too large to fit in the destination
then INT 0 is triggered.

        | Operands           8088
 -------+----------------------------
  F6/6  | DIV r/m8           80-90/(86-96)+EA
  F7/6  | DIV r/m16          144-162/(154-172)+EA
 ------------------------------------

-------------------------------------------------------------------------------

 ESC - Escape to external device                             O D I T S Z A P C
                                                             - - - - - - - - -

 ESC is a dummy instruction used to control an external coprocessor. The
coprocessor monitors the bus for ESC instructions and the addresses accessed by
the CPU during their execution, and performs an action of its own in response.

 The 8086 requires manual WAIT instructions to synchronize with a coprocessor.
The 80286 and newer do so automatically.

 Since ESC is most commonly used to control an 8087 or newer FPU, most
assemblers have dedicated mnemonics for FPU instructions and this one is not
available.

        | Operands           8088
 -------+----------------------------
  D8+   | ESC imm6, r/m8     2/7+EA
 ------------------------------------

 NOTE: timing taken from 8086; assumes 8088 does only one dummy memory access.

-------------------------------------------------------------------------------

 HLT - Halt                                                  O D I T S Z A P C
                                                             - - - - - - - - -

 Pause execution until a reset, NMI or unmasked IRQ occurs.

        | Operands           8088
 -------+----------------------------
  F4    | HLT                2
 ------------------------------------

-------------------------------------------------------------------------------

 IDIV - Signed division                                      O D I T S Z A P C
                                                             ? - - - ? ? ? ? ?

 For 8-bit operands, set AL to the quotient of dividing AX by the operand and
set AH to the remainder.

 For 16-bit operands, set AX to the quotient of dividing DX:AX by the operand
and set DX to the remainder.

 All values are represented using two's complement and the quotient is rounded
toward zero.

 If the operand is zero or the quotient is too large to fit in the destination
then INT 0 is triggered.

 NOTE: the 8086 considers the largest negative number (80H or 8000H) too large
and triggers INT 0, while the 80286 and newer do not.

        | Operands           8088
 -------+----------------------------
  F6/7  | IDIV r/m8          101-112/(107-118)+EA
  F7/7  | IDIV r/m16         165-184/(175-194)+EA
 ------------------------------------

-------------------------------------------------------------------------------

 IMUL - Signed multiplication                                O D I T S Z A P C
                                                             * - - - ? ? ? ? *

 For 8-bit operands, set AX to the product of AL and the operand. If AH
contains any significant figures of the result, set CF and OF. Otherwise clear
them.

 For 16-bit operands, set DX:AX to the product of AX and the operand. If DX
contains any significant figures of the result, set CF and OF. Otherwise clear
them.

 All values are represented using two's complement.

        | Operands           8088
 -------+----------------------------
  F6/5  | IMUL r/m8          80-98/(86-104)+EA
  F7/5  | IMUL r/m16         128-154/(138-164)+EA
 ------------------------------------

 TODO: define significant figures.

-------------------------------------------------------------------------------

 IN - Input                                                  O D I T S Z A P C
                                                             - - - - - - - - -

 Read a byte or word from the port specified by the source operand into AL or
AX.

        | Operands           8088
 -------+----------------------------
  E4    | IN AL, imm8        10
  E5    | IN AX, imm8        14
  EC    | IN AL, DX          8
  ED    | IN AX, DX          12
 ------------------------------------

-------------------------------------------------------------------------------

 INC - Increment                                             O D I T S Z A P C
                                                             * - - - * * * * -

 Add one to the destination, without changing the carry flag.

        | Operands           8088
 -------+----------------------------
  40+   | INC r16            2
  FE/0  | INC r/m8           2/15+EA
  FF/0  | INC r/m16          2/23+EA
 ------------------------------------

-------------------------------------------------------------------------------

 INT - Interrupt                                             O D I T S Z A P C
                                                             - - 0 0 - - - - -

 Push the flags, then CS, then IP, clear the interrupt enable and trap flags,
and load CS:IP from [0:N*4], where N is the interrupt number.

 For INT3, the interrupt number is 3, for INTO the interrupt number is 4, and
for INT the interrupt number is given by the immediate operand.

 INTO performs no operation if the overflow flag is clear.

        | Operands           8088
 -------+----------------------------
  CC    | INT3               79
  CD    | INT imm8           78
  CE    | INTO               4 or 80
 ------------------------------------

-------------------------------------------------------------------------------

 IRET - Return from interrupt                                O D I T S Z A P C
                                                             * * * * * * * * *

 Pop IP, then CS, then the flags.

        | Operands           8088
 -------+----------------------------
  CF    | IRET               44
 ------------------------------------

-------------------------------------------------------------------------------

 Jcc - Conditional jump                                      O D I T S Z A P C
                                                             - - - - - - - - -

 Perform a jump if a specified condition is met.

 Relative mnemonics describe the meaning of the given flag combination after
executing CMP or SUB. 'Above' and 'below' describe unsigned comparisons while
'greater' and 'less' describe two's complement comparisons.

       | Alias    Condition           Meaning
 ------+---------------------------------------------------------
  JCXZ | -        CX = 0              CX is Zero
  JO   | -        OF = 1              Overflow
  JNO  | -        OF = 0              No Overflow
  JS   | -        SF = 1              Sign
  JNS  | -        SF = 0              No Sign
  JP   | JPE      PF = 1              Parity, Parity Even
  JNP  | JPO      PF = 0              Not Parity, Parity Odd
 ------+---------------------------------------------------------
  JZ   | JE       ZF = 1              Zero, Equal
  JNZ  | JNE      ZF = 0              Not Zero, Not Equal
  JB   | JNAE/JC  CF = 1              Below, Not Above or Equal, Carry
  JNB  | JAE/JNC  CF = 0              Not Below, Above or Equal, No Carry
  JA   | JNBE     ZF = 0 and CF = 0   Above, Not Below or Equal
  JNA  | JBE      ZF = 1 or CF = 1    Not Above, Below or Equal
  JL   | JNGE     SF /= OF            Less, Not Greater or Equal
  JNL  | JGE      SF = OF             Not Less, Greater or Equal
  JG   | JNLE     ZF = 0 and SF = OF  Greater, Not Less or Equal
  JNG  | JLE      ZF = 1 or SF /= OF  Not Greater, Less or Equal
 ----------------------------------------------------------------

        | Operands           8088
 -------+----------------------------
  70    | JO rel8            4 or 16
  71    | JNO rel8           4 or 16
  72    | JB rel8            4 or 16
  73    | JNB rel8           4 or 16
  74    | JZ rel8            4 or 16
  75    | JNZ rel8           4 or 16
  76    | JNA rel8           4 or 16
  77    | JA rel8            4 or 16
  78    | JS rel8            4 or 16
  79    | JNS rel8           4 or 16
  7A    | JP rel8            4 or 16
  7B    | JNP rel8           4 or 16
  7C    | JL rel8            4 or 16
  7D    | JNL rel8           4 or 16
  7E    | JNG rel8           4 or 16
  7F    | JG rel8            4 or 16
  E3    | JCXZ rel8          5 or 17
 ------------------------------------

-------------------------------------------------------------------------------

 JMP - Jump                                                  O D I T S Z A P C
                                                             - - - - - - - - -

 Load IP and optionally CS from the given operand.

        | Operands           8088
 -------+----------------------------
  E9    | JMP rel16          15
  EA    | JMP imm16:16       15
  EB    | JMP rel8           15
  FF/4  | JMP r/m16          12/19+EA
  FF/5  | JMP m16:16         32+EA
 ------------------------------------

-------------------------------------------------------------------------------

 LAHF - Load AH from flags                                   O D I T S Z A P C
                                                             - - - - - - - - -

 Copy the low 8 bits of the flags into AH.

        | Operands           8088
 -------+----------------------------
  9F    | LAHF               4
 ------------------------------------

-------------------------------------------------------------------------------

 LDS - Load DS                                               O D I T S Z A P C
                                                             - - - - - - - - -

 Load the low word of the source into the destination and the high word into
DS.

        | Operands           8088
 -------+----------------------------
  C5    | LDS r16, m16:16    24+EA
 ------------------------------------

-------------------------------------------------------------------------------

 LEA - Load effective address                                O D I T S Z A P C
                                                             - - - - - - - - -

 Set the destination to the address of the source, without actually accessing
memory.

        | Operands           8088
 -------+----------------------------
  8D    | LEA r16, m16       2+EA
 ------------------------------------

-------------------------------------------------------------------------------

 LES - Load ES                                               O D I T S Z A P C
                                                             - - - - - - - - -

 Load the low word of the source into the destination and the high word into
ES.

        | Operands           8088
 -------+----------------------------
  C4    | LES r16, m16:16    24+EA
 ------------------------------------

-------------------------------------------------------------------------------

 LOCK - Lock prefix                                          O D I T S Z A P C
                                                             - - - - - - - - -

 Lock the bus while performing the next instruction, preventing other bus
masters from interfering.

 The LOCK prefix should only be used XCHG, MOV and MOVS.

        | Operands           8088
 -------+----------------------------
  F0    | LOCK               2
 ------------------------------------

 TODO: confirm list of appropriate instructions.

-------------------------------------------------------------------------------

 LODS - Load string                                          O D I T S Z A P C
                                                             - - - - - - - - -

 Load the byte or word at [DS:SI] into AL or AX, then advance SI to point to
the next byte or word. The direction of advancement depends on the direction
flag.

        | Operands           8088
 -------+----------------------------
  AC    | LODSB              12
  AD    | LODSW              16
 ------------------------------------

-------------------------------------------------------------------------------

 LOOP - Loop                                                 O D I T S Z A P C
                                                             - - - - - - - - -

 Decrement CX, then jump if a specified condition is met.

         | Alias   Condition
 --------+----------------------------
  LOOP   | -       CX <> 0
  LOOPZ  | LOOPE   CX <> 0 and ZF = 1
  LOOPNZ | LOOPNE  CX <> 0 and ZF = 0
 -------------------------------------

        | Operands           8088
 -------+----------------------------
  EO    | LOOPNZ rel8        5 or 19
  E1    | LOOPZ rel8         5 or 19
  E2    | LOOP rel8          5 or 17
 ------------------------------------

-------------------------------------------------------------------------------

 MOV - Move                                                  O D I T S Z A P C
                                                             - - - - - - - - -

 Copy the source into the destination.

        | Operands           8088
 -------+----------------------------
  88    | MOV r/m8, r8       2/9+EA
  89    | MOV r/m16, r16     2/13+EA
  8A    | MOV r8, r/m8       2/8+EA
  8B    | MOV r16, r/m16     2/12+EA
  8C    | MOV r/m16, seg     2/13+EA
  8E    | MOV seg, r/m16     2/12+EA
  A0    | MOV AL, [imm16]    10
  A1    | MOV AX, [imm16]    14
  A2    | MOV [imm16], AL    10
  A3    | MOV [imm16], AX    14
  B0+   | MOV r8, imm8       4
  B8+   | MOV r16, imm16     4
  C6/0  | MOV r/m8, imm8     4/10+EA
  C7/0  | MOV r/m16, imm16   4/14+EA
 ------------------------------------

-------------------------------------------------------------------------------

 MOVS - Move String                                          O D I T S Z A P C
                                                             - - - - - - - - -

 Copy the byte or word at [DS:SI] to [ES:DI], then advance SI and DI to point
at the next byte or word. The direction of advancement depends on the direction
flag.

        | Operands           8088
 -------+----------------------------
  A4    | MOVSB              17
  A5    | MOVSW              25
 ------------------------------------

-------------------------------------------------------------------------------

 MUL - Unsigned multiplication                               O D I T S Z A P C
                                                             * - - - ? ? ? ? *

 For 8-bit operands, set AX to the product of AL and the operand. If AH
contains any significant digits of the result, set CF and OF. Otherwise clear
them.

 For 16-bit operands, set DX:AX to the product of AX and the operand. If DX
contains any significant digits of the result, set CF and OF. Otherwise clear
them.

        | Operands           8088
 -------+----------------------------
  F6/4  | MUL r/m8           70-77/(76-83)+EA
  F7/4  | MUL r/m16          118-133/(128-143)+EA
 ------------------------------------

 TODO: define significant digits (probably set bits).

-------------------------------------------------------------------------------

 NEG - Negate                                                O D I T S Z A P C
                                                             * - - - * * * * *

 Set the destination to its two's complement negation.

 If the operand is zero, the carry flag is cleared. Otherwise the carry flag is
set.

 If an 8-bit operand is -128 or a 16-bit operand is -32768, the result is
unchanged and the overflow flag is set. Otherwise the overflow flag is cleared.

        | Operands           8088
 -------+----------------------------
  F6/3  | NEG r/m8           3/16+EA
  F7/3  | NEG r/m16          3/24+EA
 ------------------------------------

-------------------------------------------------------------------------------

 NOP - No operation                                          O D I T S Z A P C
                                                             - - - - - - - - -

        | Operands           8088
 -------+----------------------------
  90    | NOP                3
 ------------------------------------

-------------------------------------------------------------------------------

 NOT - Logical NOT                                           O D I T S Z A P C
                                                             - - - - - - - - -

 Set the destination to its one's complement negation.

        | Operands           8088
 -------+----------------------------
  F6/2  | NOT r/m8           3/16+EA
  F7/2  | NOT r/m16          3/24+EA
 ------------------------------------

-------------------------------------------------------------------------------

 OR - Logical inclusive OR                                   O D I T S Z A P C
                                                             0 - - - * * ? * 0

 Set each bit of the destination if the corresponding bit in either operand is
set. Otherwise clear them.

        | Operands           8088
 -------+----------------------------
  08    | OR r/m8, r8        3/16+EA
  09    | OR r/m16, r16      3/24+EA
  0A    | OR r8, r/m8        3/9+EA
  0B    | OR r16, r/m16      3/13+EA
  0C    | OR AL, imm8        4
  0D    | OR AX, imm16       4
  80/1  | OR r/m8, imm8      4/17+EA
  81/1  | OR r/m16, imm16    4/25+EA
 ------------------------------------

-------------------------------------------------------------------------------

 OUT - Output                                                O D I T S Z A P C
                                                             - - - - - - - - -

 Write a byte or word from AL or AX to the port specified by the destination
operand.

        | Operands           8088
 -------+----------------------------
  E6    | OUT imm8, AL       10
  E7    | OUT imm8, AX       14
  EE    | OUT DX, AL         8
  EF    | OUT DX, AX         12
 ------------------------------------

-------------------------------------------------------------------------------

 POP - Pop                                                   O D I T S Z A P C
                                                             - - - - - - - - -

 Load the word at [SS:SP] into the operand, then add 2 to SP.

        | Operands           8088
 -------+----------------------------
  07    | POP ES             12
  17    | POP SS             12
  1F    | POP DS             12
  58+   | POP r16            12
  8F/0  | POP r/m16          12/25+EA
 ------------------------------------

-------------------------------------------------------------------------------

 POPF - Pop flags                                            O D I T S Z A P C
                                                             * * * * * * * * *

 Load the word at [SS:SP] into the flags, then add 2 to SP.

        | Operands           8088
 -------+----------------------------
  9D    | POPF               12
 ------------------------------------

-------------------------------------------------------------------------------

 PUSH - Push                                                 O D I T S Z A P C
                                                             - - - - - - - - -

 Subtract 2 from SP, then store the operand into the word at [SS:SP].

 NOTE: PUSH SP will push the value of SP from before the decrement on the 80286
and newer.

        | Operands           8088
 -------+----------------------------
  06    | PUSH ES            14
  0E    | PUSH CS            14
  16    | PUSH SS            14
  1E    | PUSH DS            14
  50+   | PUSH r16           14
  FF/6  | PUSH r/m16         14/24+EA
 ------------------------------------

-------------------------------------------------------------------------------

 PUSHF - Push flags                                          O D I T S Z A P C
                                                             - - - - - - - - -

 Subtract 2 from SP, then store the flags into the word at [SS:SP].

        | Operands           8088
 -------+----------------------------
  9C    | PUSHF              14
 ------------------------------------

-------------------------------------------------------------------------------

 RCL - Rotate left through carry                             O D I T S Z A P C
                                                             * - - - - - - - *

 Shift all bits of the destination operand left. The top bit of the operand is
shifted into the carry flag and the old value of the carry flag is shifted into
the bottom bit of the operand.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be set to the XOR of the top
two bits of the original destination operand. Otherwise the overflow flag is
undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/2  | RCL r/m8, 1        2/15+EA
  D1/2  | RCL r/m16, 1       2/23+EA
  D2/2  | RCL r/m8, CL       8+4*N/20+EA+4*N
  D3/2  | RCL r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 RCR - Rotate right through carry                            O D I T S Z A P C
                                                             * - - - - - - - *

 Shift all bits of the destination operand right. The bottom bit of the operand
is shifted into the carry flag and the old value of the carry flag is shifted
into the top bit of the operand.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be set to the XOR of the top
two bits of the result. Otherwise the overflow flag is undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/3  | RCR r/m8, 1        2/15+EA
  D1/3  | RCR r/m16, 1       2/23+EA
  D2/3  | RCR r/m8, CL       8+4*N/20+EA+4*N
  D3/3  | RCR r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 REP - Repeat prefix

 Repeat the following string instruction while a specified condition holds.

 The value of CX is checked before each repetition. If CX is zero then then all
further operations are skipped. Otherwise CX is decremented.

 The value of ZF is checked after each repetition, and only for CMPS and SCAS.

 NOTE: for flag effects see the entry for the prefixed string instruction.

        | Alias   Condition
 -------+---------------------------
  REP   | -      CX <> 0
  REPZ  | REPE   CX <> 0 and ZF = 1
  REPNZ | REPNE  CX <> 0 and ZF = 0
 -----------------------------------

        | Operands           8088
 -------+----------------------------
  F2 A6 | REPNZ CMPSB        9+22*N
  F2 A7 | REPNZ CMPSW        9+30*N
  F2 AE | REPNZ SCASB        9+15*N
  F2 AF | REPNZ SCASW        9+19*N
  F3 A4 | REP MOVSB          9+17*N
  F3 A5 | REP MOVSW          9+25*N
  F3 A6 | REPZ CMPSB         9+22*N
  F3 A7 | REPZ CMPSW         9+30*N
  F3 AA | REP STOSB          9+10*N
  F3 AB | REP STOSW          9+14*N
  F3 AC | REP LODSB          9+12*N
  F3 AD | REP LODSW          9+16*N
  F3 AE | REPZ SCASB         9+15*N
  F3 AF | REPZ SCASW         9+19*N
 ------------------------------------

-------------------------------------------------------------------------------

 RET - Return from subroutine                                O D I T S Z A P C
                                                             - - - - - - - - -

 For RETF, pop IP, then CS, then add the operand, if any, to SP.

 For RETN, pop IP, then add the operand, if any, to SP.

        | Operands           8088
 -------+----------------------------
  C2    | RETN imm16         24
  C3    | RETN               20
  CA    | RETF imm16         33
  CB    | RETF               34
 ------------------------------------

-------------------------------------------------------------------------------

 ROL - Rotate left                                           O D I T S Z A P C
                                                             * - - - - - - - *

 Shift all bits of the destination operand left. The top bit of the operand is
shifted into the bottom bit, and also copied into the carry flag.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be set to the XOR of the top
two bits of the original destination operand. Otherwise the overflow flag is
undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/0  | ROL r/m8, 1        2/15+EA
  D1/0  | ROL r/m16, 1       2/23+EA
  D2/0  | ROL r/m8, CL       8+4*N/20+EA+4*N
  D3/0  | ROL r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 ROR - Rotate right                                          O D I T S Z A P C
                                                             * - - - - - - - *

 Shift all bits of the destination operand right. The bottom bit of the operand
is shifted into the top bit, and also copied into the carry flag.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be set to the XOR of the top
two bits of the result. Otherwise the overflow flag is undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/1  | ROR r/m8, 1        2/15+EA
  D1/1  | ROR r/m16, 1       2/23+EA
  D2/1  | ROR r/m8, CL       8+4*N/20+EA+4*N
  D3/1  | ROR r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 SAHF - Store AH to flags                                    O D I T S Z A P C
                                                             - - - - * * * * *

Copy AH into the low 8 bits of the flags.

        | Operands           8088
 -------+----------------------------
  9E    | SAHF               4
 ------------------------------------

-------------------------------------------------------------------------------

 SAR - Arithmetic shift right                                O D I T S Z A P C
                                                             * - - - * * ? * *

 Shift all bits of the destination operand right. The top bit of the operand is
unchanged, and the bottom bit is copied into the carry flag.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be cleared. Otherwise the
overflow flag is undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/7  | SAR r/m8, 1        2/15+EA
  D1/7  | SAR r/m16, 1       2/23+EA
  D2/7  | SAR r/m8, CL       8+4*N/20+EA+4*N
  D3/7  | SAR r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 SBB - Subtract with borrow                                  O D I T S Z A P C
                                                             * - - - * * * * *

 Subtract the source operand and the carry flag from the destination.

        | Operands           8088
 -------+----------------------------
  18    | SBB r/m8, r8       3/16+EA
  19    | SBB r/m16, r16     3/24+EA
  1A    | SBB r8, r/m8       3/9+EA
  1B    | SBB r16, r/m16     3/13+EA
  1C    | SBB AL, imm8       4
  1D    | SBB AX, imm16      4
  80/3  | SBB r/m8, imm8     4/17+EA
  81/3  | SBB r/m16, imm16   4/25+EA
  83/3  | SBB r/m16, imm8    4/25+EA
 ---------------------------------

-------------------------------------------------------------------------------

 SCAS - Scan string                                          O D I T S Z A P C
                                                             * - - - * * * * *

 Compare the byte or word at [DS:SI] with AL or AX, then advance SI to point at
the next byte or word.

 The direction of advancement depends on the direction flag.

        | Operands           8088
 -------+----------------------------
  AE    | SCASB              15
  AF    | SCASW              19
 ------------------------------------

-------------------------------------------------------------------------------

 SEGss - Segment override prefix

 TODO

        | Operands           8088
 -------+----------------------------
  26    | SEGES              2
  2E    | SEGCS              2
  36    | SEGSS              2
  3E    | SEGDS              2
 ------------------------------------

-------------------------------------------------------------------------------

 SHL - Shift left                                            O D I T S Z A P C
                                                             * - - - * * ? * *

 Shift all bits of the destination operand left. The top bit of the operand is
copied into the carry flag and the bottom bit is set to zero.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be set to the XOR of the top
two bits of the original destination operand. Otherwise the overflow flag is
undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/4  | SHL r/m8, 1        2/15+EA
  D1/4  | SHL r/m16, 1       2/23+EA
  D2/4  | SHL r/m8, CL       8+4*N/20+EA+4*N
  D3/4  | SHL r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 SHR - Shift right                                           O D I T S Z A P C
                                                             * - - - * * ? * *

 Shift all bits of the destination operand right. The top bit of the operand is
set to zero and the bottom bit is copied into the carry flag.

 This operation is repeated the number of times specified by the source
operand. If the source operand is zero, no shifts are performed.

 If the shift count is one, the overflow flag will be set to the top bit of
the original destination operand. Otherwise the overflow flag is undefined.

 NOTE: the 80286 and newer reduce the shift count modulo 32.

        | Operands           8088
 -------+----------------------------
  D0/5  | SHR r/m8, 1        2/15+EA
  D1/5  | SHR r/m16, 1       2/23+EA
  D2/5  | SHR r/m8, CL       8+4*N/20+EA+4*N
  D3/5  | SHR r/m16, CL      8+4*N/28+EA+4*N
 ------------------------------------

-------------------------------------------------------------------------------

 STC - Set carry flag                                        O D I T S Z A P C
                                                             - - - - - - - - 1

        | Operands           8088
 -------+----------------------------
  F9    | STC                2
 ------------------------------------

-------------------------------------------------------------------------------

 STD - Set direction flag                                    O D I T S Z A P C
                                                             - 1 - - - - - - -

 Make string instructions decrement SI and DI.

        | Operands           8088
 -------+----------------------------
  FD    | STD                2
 ------------------------------------

-------------------------------------------------------------------------------

 STI - Set interrupt enable flag                             O D I T S Z A P C
                                                             - - 1 - - - - - -

 Unmask IRQs.

 Setting the interrupt enable flag does not take effect until after the next
instruction.

        | Operands           8088
 -------+----------------------------
  FB    | STI                2
 ------------------------------------

-------------------------------------------------------------------------------

 STOS - Store string                                         O D I T S Z A P C
                                                             - - - - - - - - -

 Store AL or AX into the byte or word at [ES:DI], then advance DI to the next
byte or word. The direction of advancement depends on the direction flag.

        | Operands           8088
 -------+----------------------------
  AA    | STOSB              12
  AB    | STOSW              16
 ------------------------------------

-------------------------------------------------------------------------------

 SUB - Subtraction                                           O D I T S Z A P C
                                                             * - - - * * * * *

 Subtract the source operand from the destination.

        | Operands           8088
 -------+----------------------------
  28    | SUB r/m8, r8       3/16+EA
  29    | SUB r/m16, r16     3/24+EA
  2A    | SUB r8, r/m8       3/9+EA
  2B    | SUB r16, r/m16     3/13+EA
  2C    | SUB AL, imm8       4
  2D    | SUB AX, imm16      4
  80/5  | SUB r/m8, imm8     4/17+EA
  81/5  | SUB r/m16, imm16   4/25+EA
  83/5  | SUB r/m16, imm8    4/25+EA
 ---------------------------------

-------------------------------------------------------------------------------

 TEST - Test                                                 O D I T S Z A P C
                                                             0 - - - * * ? * 0

 AND the source with the destination and discard the result, changing only the
flags.

        | Operands           8088
 -------+----------------------------
  84    | TEST r/m8, r8      3/9+EA
  85    | TEST r/m16, r16    3/13+EA
  A8    | TEST AL, imm8      4
  A9    | TEST AX, imm16     4
  F6/0  | TEST r/m8, imm8    4/10+EA
  F7/0  | TEST r/m16, imm16  4/14+EA
 ------------------------------------

-------------------------------------------------------------------------------

 WAIT - Wait                                                 O D I T S Z A P C
                                                             - - - - - - - - -

 Wait for the processor's TEST input to become active.

        | Operands           8088
 -------+----------------------------
  9B    | WAIT               3+5*N
 ------------------------------------

-------------------------------------------------------------------------------

 XCHG - Exchange                                             O D I T S Z A P C
                                                             - - - - - - - - -

 Swap the contents of the two operands.

        | Operands           8088
 -------+----------------------------
  86    | XCHG r/m8, r8      4/17+EA
  87    | XCHG r/m16, r16    4/25+EA
  90+   | XCHG AX, r16       3
 ------------------------------------

-------------------------------------------------------------------------------

 XLAT - Translate                                            O D I T S Z A P C
                                                             - - - - - - - - -

 Load AL with the byte at [DS:BX+AL].

        | Operands           8088
 -------+----------------------------
  D7    | XLATB              11
 ------------------------------------

-------------------------------------------------------------------------------

 XOR - Logical exclusive OR                                  O D I T S Z A P C
                                                             0 - - - * * * * 0

 Set each bit of the destination if the corresponding bits in both operands are
different. Otherwise clear them.

        | Operands           8088
 -------+----------------------------
  30    | XOR r/m8, r8       3/16+EA
  31    | XOR r/m16, r16     3/24+EA
  32    | XOR r8, r/m8       3/9+EA
  33    | XOR r16, r/m16     3/13+EA
  34    | XOR AL, imm8       4
  35    | XOR AX, imm16      4
  80/6  | XOR r/m8, imm8     4/17+EA
  81/6  | XOR r/m16, imm16   4/25+EA
 ------------------------------------

-------------------------------------------------------------------------------

5. Notes

 The reserved bits of the flags register vary between CPU models:

       | Constant bits
 ------+-------------------
  8086 | 1111xxxx xx0x0x1x
  V20  | x111xxxx xx0x0x1x
  286+ | 0xxxxxxx xx0x0x1x
 --------------------------

 The reserved bits in the low byte appear to be the same on all CPU models. The
top four bits are all used on at least one model and may have undesirable
effects if modified.

 Intel CPUs interpret the second byte of the AAM and AAD instructions as an 
'imm8' parameter specifying number base, which may be changed from 10 to any
other value. Clones ignore the second byte.

 The 8086 sets the return address of INT 0 to point to the instruction after
the division. The 80286 and newer set it to point to division.

 The JC and JNC aliases are not listed in official Intel documentation.

 A MOV to any segment register will disable interrupts on the 8086, 8088, V20,
and V30, while the 80286 and newer will only disable interrupts when loading
SS.

 A MOV to CS will cause an unconditional jump on the original 8086 and 8088, be
ignored on the 80C86, 80C88, V20 and V30, and trigger INT 6 on the 80286 and
newer.

 Opcode 0F is interpreted as POP CS and causes an unconditional jump on the
8086 and 8088, triggers INT 6 on the 80186, and serves as a prefix byte on the
V20, V30, and 80286 and newer.

-------------------------------------------------------------------------------

6. References

 * Ralf Brown's Interrupt List, Release 61
 * Intel MCS-86 Assembly Language Reference Guide, October 1978
 * Norton Guides, via http://www.x-hacker.org/ng/

EOF
