a2nr
/
velxio
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
velxio/test/test_intel/autosearch/15_8086_authoritative_spec.md

11 KiB
Raw Blame History

8086 Authoritative Spec (for Velxio Emulator)

Primary source: Intel, The 8086 Family User's Manual, October 1979 (order 9800722-03), located at pdfs/iapx_86_88_users_manual.pdf in this folder. All page citations use the PDF page index in parentheses followed by the manual section number that appears on the page (Intel uses chapter-relative numbering like "2-25", "4-2"). Where the manual is silent or ambiguous, the iAPX 86,88 User's Manual, 1981 edition (a superset) is consulted by reference; no disagreements were found in the parts that overlap.

1. Pin Contract — 40-pin DIP, Minimum Mode (MN/MX = Vcc)

From figure 4-1 (PDF p.240, manual p.4-2). All 40 pins of the 8086 are listed.

Common pins (both modes)

Pin Name Type Function
2-16, 39 AD15-AD0 Bidirectional, 3-state Time-multiplexed address (T1) / data (T2-T4)
35-38 A19/S6 - A16/S3 Output, 3-state Upper address bits in T1; status thereafter
34 BHE/S7 Output, 3-state Bus High Enable in T1 (low = upper byte valid)
33 MN/MX Input Strap: Vcc = minimum mode, GND = maximum
32 RD Output, 3-state Read strobe (active low)
23 TEST Input WAIT instruction polls this (active low)
22 READY Input Wait-state insertion (sampled in T3)
21 RESET Input Active high; min 4 CLK cycles (50 µs at power-up)
17 NMI Input Rising edge, vector 2
18 INTR Input Level, maskable by IF
19 CLK Input 33% duty, 5/8/10 MHz
40 Vcc / 1, 20 GND Power

Min-mode-only pins (24-31) — Table 4-1 (PDF p.249, manual p.4-11):

Pin Min Mode Maximum-mode alias
31 HOLD RQ/GT0
30 HLDA RQ/GT1
29 WR LOCK
28 M/IO S2
27 DT/R S1
26 DEN S0
25 ALE QS0
24 INTA QS1

ALE pulses high once per bus cycle, valid trailing edge in T1 (PDF p.245, manual p.4-7). DEN gates the bidirectional bus transceiver; DT/R selects direction (1 = transmit/write, 0 = receive/read). M/IO is high for memory, low for I/O on the 8086 (the 8088 inverts this signal as IO/M, PDF p.249).

2. Reset State

From "System Reset" (PDF p.51, manual p.2-29) and Table 2-4 referenced there. RESET must be held high for ≥ 4 CLK cycles (≥ 50 µs at power-up). When RESET goes low, the CPU initializes:

Component Value at reset
Flags clear (0x0000; reserved bits per Fig 2-9 are 1, see §5)
IP 0x0000
CS 0xFFFF
DS 0x0000
SS 0x0000
ES 0x0000
Instruction queue empty

First fetched physical address = CS:IP = FFFF:0000 → physical 0xFFFF0 (PDF p.51 / manual p.2-29). Typical ROM holds an inter-segment JMP there. NMI/INTR/HOLD are ignored while RESET is active. HOLD is honored immediately after RESET deasserts if asserted (PDF p.252, manual p.4-14).

3. Bus Cycle T1-T4 (Minimum Mode)

From "Bus Operation" (PDF pp.244-247, manual pp.4-6 to 4-9), figures 4-7 through 4-10. One bus cycle = 4 CLK states T1, T2, T3, T4. Wait states Tw are inserted between T3 and T4 when READY is sampled low in T3 (PDF p.244).

State AD15-AD0 A19/S6-A16/S3 ALE RD/WR DT/R DEN M/IO
T1 20-bit address out (with BHE) address out high pulse inactive set early inactive valid
T2 float (read) or write data out status S3-S6 low RD or WR active stable active held
T3 data sampled (read) or held (write) status low active stable active held
Tw bus held; READY polled status low active stable active held
T4 bus released status low inactive — inactive inactive

Status lines S3-S4 indicate which segment was used (Table 2-7, PDF p.52): 00 = ES, 01 = SS, 10 = CS or none, 11 = DS. S5 mirrors IF, S6 = 0 (8086).

S2-S0 in maximum mode encode the cycle type (Table 2-6, PDF p.52 / Table 4-2, PDF p.250): 000 = INTA, 001 = I/O read, 010 = I/O write, 011 = HALT, 100 = code fetch, 101 = mem read, 110 = mem write, 111 = passive.

4. 20-Bit Address Arithmetic

From "Physical Address Generation" (PDF pp.34-35, manual pp.2-12 to 2-13), figure 2-18:

physical = (segment << 4) + offset    (modulo 0x100000 — wraps at 1 MB)

The segment is shifted left 4 bits (multiplied by 16), then the 16-bit offset is added. Carry out of bit 19 wraps. Inside a single 64 KB segment, the offset arithmetic itself is modulo 0x10000 (PDF p.34, manual p.2-12: "addresses wrap around from the end of a segment to the beginning of the same segment").

5. Default Segments and Override Prefixes

From Table 2-2 "Logical Address Sources" (PDF p.35, manual p.2-13):

Reference type Default seg Offset Allowed overrides
Instruction fetch CS IP none
Stack push/pop, call/ret SS SP none
BP used as base reg SS EA CS, DS, ES
Data variable (other) DS EA CS, ES, SS
String source (SI) DS SI CS, ES, SS
String destination (DI) ES DI none

Override prefixes (one byte, applies to next instruction): 0x26 = ES:, 0x2E = CS:, 0x36 = SS:, 0x3E = DS: (manual p.2-13 and encoding table 4-12, PDF p.260+). The general SR encoding is 00=ES, 01=CS, 10=SS, 11=DS (Table 4-11, PDF p.259).

6. ModR/M Decode (Tables 4-8, 4-9, 4-10; PDF p.258, manual p.4-20)

The instruction's second byte is mod (2) | reg (3) | r/m (3).

MOD field (Table 4-8):

00 = memory mode, no displacement       (special: r/m=110 → 16-bit disp16 direct)
01 = memory mode, sign-extended 8-bit displacement
10 = memory mode, 16-bit displacement
11 = register mode (r/m selects the register)

REG field (Table 4-9) — w-bit selects byte vs word register:

REG w=0 w=1
000 AL AX
001 CL CX
010 DL DX
011 BL BX
100 AH SP
101 CH BP
110 DH SI
111 BH DI

R/M effective-address table (Table 4-10, manual p.4-20). When MOD ≠ 11:

R/M Effective address
000 (BX)+(SI)+disp
001 (BX)+(DI)+disp
010 (BP)+(SI)+disp (default seg = SS)
011 (BP)+(DI)+disp (default seg = SS)
100 (SI)+disp
101 (DI)+disp
110 (BP)+disp (default SS; if MOD=00 → disp16 absolute, default DS )
111 (BX)+disp

Default segment for any addressing mode that uses BP as a base is SS; all others default to DS. Segment-override prefix overrides this.

7. Flag Register Layout

From "Flags" (manual pp.2-7 to 2-8) and figure 2-9 (referenced PDF p.30, manual p.2-8). The 16-bit flag register is laid out as:

bit 15 14 13 12 11 10 9  8  7  6  5  4  3  2  1  0
     -  -  -  -  OF DF IF TF SF ZF -  AF -  PF -  CF

Bits 1, 3, 5, 12-15 are reserved; bit 1 reads as 1 on real hardware (the 1979 manual is silent on the reserved-bit encoding — a known disagreement: 8086tiny treats them as 0, MartyPC and the 8088 V2 SingleStepTests canonicalize bit 1 = 1, bits 12-15 = 1 on reset. Both agree all other bits clear at reset.)

Per-flag rules (PDF pp.57-58, manual pp.2-35 to 2-36):

  • CF: carry-out of MSB on add; borrow into MSB on sub. Used by ADC/SBB.
  • AF: carry-out of bit 3 on add; borrow into bit 3 on sub. Used only by decimal-adjust instructions.
  • SF: copy of bit 7/15 of result.
  • ZF: 1 if result == 0.
  • PF: even parity over the low 8 bits of the result.
  • OF: signed overflow (XOR of carry-into-MSB and carry-out-of-MSB).
  • DF: 0 = string ops auto-increment SI/DI; 1 = decrement.
  • IF: 1 = INTR enabled.
  • TF: 1 = single-step (INT 1 after each instruction).

8. Variable-Length Instruction Format

From manual §4.2, "Machine Instruction Encoding" (PDF p.258+). Up to 6 bytes, in this order:

[ prefix ]*  opcode (1-2 bytes)  [ ModR/M ]  [ disp lo,hi ]  [ imm lo,hi ]

Prefix bytes: segment override (0x26/2E/36/3E), LOCK (0xF0), REP/REPE (0xF3), REPNE (0xF2). Multiple prefixes are allowed but the CPU "remembers" only one per category (PDF p.64, manual p.2-42); on interrupted REP+segov the segment override is dropped on resume.

Displacement encoding (Table 4-11 key, PDF p.259): little-endian; an 8-bit displacement is sign-extended to 16 bits before EA addition. Immediates likewise little-endian, with sign-extension controlled by the s bit in arithmetic encodings.

9. Decimal-Adjust and ASCII-Adjust Flag Rules

From PDF pp.57-58 (manual pp.2-35 to 2-37) and the instruction reference table 2-21 (PDF p.73, manual p.2-51) which gives the canonical "flags affected" mask ODITSZAPC (each letter = 1 flag) per instruction.

Insn Flags OF SF ZF AF PF CF
AAA OSZP undefined; AF, CF defined U U U X U X
AAS OSZP undefined; AF, CF defined U U U X U X
AAM OAC undefined; SZP defined U X X U X U
AAD OAC undefined; SZP defined U X X U X U
DAA OF undefined; AF/CF/PF/SF/ZF defined U X X X X X
DAS OF undefined; AF/CF/PF/SF/ZF defined U X X X X X
MUL SF/ZF/AF/PF undefined; OF=CF=(AH≠0) for byte, (DX≠0) for word X U U U U X
IMUL SF/ZF/AF/PF undefined; OF=CF=(sign-extend mismatch) X U U U U X
DIV all six arithmetic flags undefined U U U U U U
IDIV all six arithmetic flags undefined U U U U U U

DAA pseudocode (manual p.2-36, PDF p.58):

old_AL = AL;  old_CF = CF
if (AL & 0x0F) > 9 OR AF=1 :  AL += 6;  AF=1;  CF |= (AL overflowed)
if old_AL > 0x99 OR old_CF=1 : AL += 0x60;  CF=1

DAS is the symmetric subtract form. Adrian Cable's 8086tiny and Daniel Balsom's MartyPC both implement this exact pseudocode; they disagree only on flag-after-DAA OF (manual says undefined; tinyemus typically leave it unchanged).

10. String-Op + REP Flag/Counter Rules

From "String Instructions" (manual pp.2-41 to 2-43, PDF pp.63-65).

Each iteration:

  1. If CX = 0, fall through immediately (no flag/index changes).
  2. Execute one MOVS / CMPS / SCAS / LODS / STOS.
  3. Decrement CX by 1 (no flag effect from this decrement).
  4. Adjust SI/DI by ±1 (byte) or ±2 (word); sign = -1 if DF=1 else +1.
  5. For CMPS/SCAS only: check ZF — REPE/REPZ exits when ZF=0; REPNE/REPNZ exits when ZF=1.
  6. For MOVS/STOS/LODS: no ZF check; exit only when CX = 0.

Interruptibility: the CPU samples INTR between iterations (manual p.2-42); on interrupt, IP is rolled back to the prefix byte so the REP resumes after IRET, but only the last-seen prefix among LOCK/segov/REP survives — a known erratum quoted on PDF p.64.

Sources & Disagreements Flagged

  1. Reserved-flag-bit encoding: 1979 iAPX manual silent; SingleStepTests 8088 V2 suite canonicalizes bit 1 = 1.
  2. DAA effect on OF: manual says undefined; 8086tiny leaves OF unchanged, MartyPC follows the manual literally and writes a random value.
  3. POP CS (opcode 0x0F) is not documented in the 1979 manual but is a known real-hardware behavior on 8086 only (8088 ignores it differently). See 16_8086_reference_implementations.md §"Cross-checked edge cases".