Intel 8086/80186/80286/80386 CPU Reference

Overview

The Intel 8086 family represents the x86 architecture that became the foundation for modern PC computing. This implementation provides a unified CPU core supporting multiple processor models (8086, 80186, 80286, 80386) that can be used by PC/DOS emulation through the Memory8086 trait.

Implementation: crates/core/src/cpu_8086.rs, crates/core/src/cpu_8086_protected.rs

Supported Processor Models

The implementation supports the following CPU models via the CpuModel enum:

• Intel8086: Original 8086 processor (16-bit, real mode only)
• Intel80186: Enhanced 8086 with additional instructions
• Intel80286: Adds protected mode with 16-bit segments
• Intel80386: Adds 32-bit operations and extended registers (partial support)

Set the model when creating the CPU:

let mut cpu = Cpu8086::new(memory, CpuModel::Intel80286);

Architecture

Registers (Real Mode)

General Purpose Registers (16-bit)

• AX (Accumulator): Primary arithmetic register
  • AH: High byte of AX
  • AL: Low byte of AX
• BX (Base): Base pointer for memory access
  • BH: High byte of BX
  • BL: Low byte of BX
• CX (Count): Loop counter and shift operations
  • CH: High byte of CX
  • CL: Low byte of CX
• DX (Data): I/O operations and extended arithmetic
  • DH: High byte of DX
  • DL: Low byte of DX

Pointer and Index Registers (16-bit)

• SP (Stack Pointer): Points to top of stack
• BP (Base Pointer): Base pointer for stack frame
• SI (Source Index): String/memory operations source
• DI (Destination Index): String/memory operations destination

Segment Registers (16-bit)

• CS (Code Segment): Segment for instruction fetch
• DS (Data Segment): Default segment for data
• SS (Stack Segment): Segment for stack operations
• ES (Extra Segment): Additional data segment

Control Registers

• IP (Instruction Pointer): Offset of current instruction
• FLAGS: 16-bit processor status and control flags

32-bit Extensions (80386+)

When running in 80386 mode, registers can be accessed in 32-bit form:

• EAX, EBX, ECX, EDX: 32-bit versions of AX, BX, CX, DX
• ESP, EBP, ESI, EDI: 32-bit versions of SP, BP, SI, DI
• EIP: 32-bit instruction pointer (protected mode only)

FLAGS Register

ODIT SZ-A-P-C  (16-bit FLAGS)
││││ ││ │ │ │
││││ ││ │ │ └─ Carry Flag (CF)
││││ ││ │ └─── Parity Flag (PF)
││││ ││ └───── Auxiliary Carry Flag (AF)
││││ │└─────── Zero Flag (ZF)
││││ └──────── Sign Flag (SF)
│││└────────── Trap Flag (TF) - Single step
││└─────────── Interrupt Enable Flag (IF)
│└──────────── Direction Flag (DF) - String operations
└───────────── Overflow Flag (OF)

Additional flags in 80286+:

• IOPL (bits 12-13): I/O Privilege Level
• NT (bit 14): Nested Task
• RF (bit 16, 80386+): Resume Flag
• VM (bit 17, 80386+): Virtual 8086 Mode
• AC (bit 18, 80386+): Alignment Check

Memory Segmentation

The 8086 uses segmented memory addressing:

Physical Address = (Segment << 4) + Offset

Example:

• CS:IP = 0x1000:0x0234 → Physical = 0x10234
• Maximum addressable memory: 1MB (20-bit address space)

Usage

Systems using the 8086 must implement the Memory8086 trait:

pub trait Memory8086 {
    fn read(&self, addr: u32) -> u8;
    fn write(&mut self, addr: u32, val: u8);
    fn port_in(&mut self, port: u16) -> u8;
    fn port_out(&mut self, port: u16, val: u8);
}

Example

use emu_core::cpu_8086::{Cpu8086, Memory8086, CpuModel};

struct PcSystem {
    ram: Vec<u8>,
}

impl Memory8086 for PcSystem {
    fn read(&self, addr: u32) -> u8 {
        self.ram[addr as usize]
    }
    
    fn write(&mut self, addr: u32, val: u8) {
        self.ram[addr as usize] = val;
    }
    
    fn port_in(&mut self, port: u16) -> u8 {
        // Handle hardware I/O
        0
    }
    
    fn port_out(&mut self, port: u16, val: u8) {
        // Handle hardware I/O
    }
}

let system = PcSystem { ram: vec![0; 0x100000] };
let mut cpu = Cpu8086::new(system, CpuModel::Intel8086);
cpu.reset();

Instruction Set Overview

The x86 instruction set is extensive. Key categories include:

Data Transfer

• MOV: Move data between registers/memory
• PUSH/POP: Stack operations
• XCHG: Exchange values
• IN/OUT: Port I/O
• LEA: Load effective address
• LDS/LES: Load pointer with segment
• LAHF/SAHF: Load/store AH from/to flags
• PUSHF/POPF: Push/pop flags

Arithmetic

• ADD/SUB: Addition/subtraction
• ADC/SBB: Add/subtract with carry
• INC/DEC: Increment/decrement
• NEG: Two's complement negation
• CMP: Compare (subtract without storing)
• MUL/IMUL: Unsigned/signed multiply
• DIV/IDIV: Unsigned/signed divide
• AAA/AAS/AAM/AAD: ASCII adjust for arithmetic
• DAA/DAS: Decimal adjust for addition/subtraction

Logical

• AND/OR/XOR: Bitwise operations
• NOT: Bitwise NOT
• TEST: Logical compare (AND without storing)

Shift/Rotate

• SHL/SHR: Logical shift left/right
• SAL/SAR: Arithmetic shift left/right
• ROL/ROR: Rotate left/right
• RCL/RCR: Rotate through carry left/right

String Operations

• MOVS: Move string
• CMPS: Compare string
• SCAS: Scan string
• LODS: Load string
• STOS: Store string
• Each has byte/word variants (MOVSB/MOVSW)
• REP/REPE/REPNE: Repeat prefixes

Control Flow

• JMP: Unconditional jump
• Jcc: Conditional jumps (JE, JNE, JA, JB, JG, JL, etc.)
• CALL/RET: Subroutine call/return
• LOOP/LOOPE/LOOPNE: Loop instructions
• INT/INTO: Software interrupt
• IRET: Return from interrupt

Flag Operations

• CLC/STC/CMC: Clear/set/complement carry
• CLD/STD: Clear/set direction flag
• CLI/STI: Clear/set interrupt flag

80186+ Instructions

• PUSHA/POPA: Push/pop all general registers
• BOUND: Check array bounds
• ENTER/LEAVE: High-level procedure entry/exit
• INS/OUTS: String I/O

80286 Protected Mode

• LGDT/SGDT: Load/store GDT register
• LIDT/SIDT: Load/store IDT register
• LLDT/SLDT: Load/store LDT register
• LTR/STR: Load/store task register
• LAR/LSL: Load access rights/segment limit
• VERR/VERW: Verify segment for read/write
• ARPL: Adjust RPL field
• LMSW/SMSW: Load/store machine status word

80386 32-bit Extensions

• 32-bit versions of most instructions
• MOVZX/MOVSX: Move with zero/sign extension
• SHLD/SHRD: Double-precision shifts
• BT/BTS/BTR/BTC: Bit test operations
• BSF/BSR: Bit scan forward/reverse
• SETCC: Set byte on condition

Addressing Modes

The 8086 supports complex addressing modes:

1. Register: MOV AX, BX
2. Immediate: MOV AX, 1234h
3. Direct: MOV AX, [1234h]
4. Register Indirect: MOV AX, [BX], MOV AX, [SI]
5. Based: MOV AX, [BX+1234h], MOV AX, [BP+1234h]
6. Indexed: MOV AX, [SI+1234h], MOV AX, [DI+1234h]
7. Based Indexed: MOV AX, [BX+SI], MOV AX, [BP+DI]
8. Based Indexed with Displacement: MOV AX, [BX+SI+1234h]

80386 32-bit Addressing

The 80386 adds more flexible addressing:

• Any general register can be a base: [EAX], [ECX], etc.
• SIB (Scale-Index-Base) byte: [EAX+EBX*4+1234h]
• Scale factors: 1, 2, 4, 8

Operating Modes

Real Mode

• Default mode after reset
• 20-bit addressing (1MB limit)
• Direct memory access
• No memory protection

Protected Mode (80286+)

• Activated by setting PE bit in CR0
• Segment descriptors in GDT/LDT
• Memory protection and privilege levels
• Up to 16MB (80286) or 4GB (80386)

Virtual 8086 Mode (80386+)

• Run real-mode code in protected mode
• Provides isolation and protection

Interrupts

The 8086 supports 256 interrupt vectors (0-255):

Predefined Interrupts

• INT 0: Divide by zero
• INT 1: Single step (debug)
• INT 3: Breakpoint
• INT 4: Overflow (INTO)

DOS Interrupts (System-Specific)

• INT 10h: Video services
• INT 13h: Disk services
• INT 16h: Keyboard services
• INT 21h: DOS services

See docs/PC_INTERRUPT_ANALYSIS.md for DOS interrupt implementation details.

Protected Mode (80286/80386)

Segment Descriptors

In protected mode, segment registers point to descriptors:

Descriptor (8 bytes):
  - Base Address (24/32 bits)
  - Limit (20 bits)
  - Access Rights (type, DPL, present)
  - Granularity, Size flags (80386)

Privilege Levels

Four privilege levels (rings):

• Ring 0: Kernel (highest privilege)
• Ring 1: Device drivers
• Ring 2: System services
• Ring 3: User applications (lowest privilege)

Task Switching

The 80286/80386 supports hardware task switching:

• Task State Segment (TSS) stores task context
• LTR loads task register
• Far JMP/CALL to TSS descriptor switches tasks

Implementation Notes

CPU Model Selection

Different CPU models affect:

• Available instructions
• Register sizes
• Addressing modes
• Operating modes
• Timing characteristics

Instruction Prefixes

Instructions can have multiple prefixes:

• Segment override: CS:, DS:, ES:, SS:, FS:, GS:
• Repeat: REP, REPE/REPZ, REPNE/REPNZ
• Lock: LOCK (for atomic operations)
• Operand size: Switch between 16/32-bit (80386+)
• Address size: Switch between 16/32-bit addressing (80386+)

String Operations

String instructions can use repeat prefixes:

• REP: Repeat CX times
• REPE/REPZ: Repeat while equal/zero
• REPNE/REPNZ: Repeat while not equal/not zero

Direction controlled by DF flag:

• DF=0: Increment (forward)
• DF=1: Decrement (backward)

BCD and ASCII Operations

The x86 supports decimal arithmetic:

• DAA/DAS: Decimal adjust after addition/subtraction
• AAA/AAS/AAM/AAD: ASCII adjust for arithmetic

Systems Using 8086

This CPU core is used by:

• PC (IBM PC/XT) - crates/systems/pc/

Quick Instruction Reference

Highly unofficial reference for cross-checking implementation gaps in source code.

Legend

• r/m: Register or Memory operand.
• imm: Immediate value (constant).
• src/dst: Source / Destination.
• st(i): FPU Stack Register (0-7). st(0) is the Top of Stack.
• IP: Modifies Instruction Pointer directly (Jump/Call).
• Fl: Modifies CPU Status Flags (ZF, CF, OF, SF, PF).
• m16/32/64/80: Memory operand size in bits.

1. Integer Core: Data Transfer

Fundamental addressing and data movement. Verify Segment Registers (CS, DS, ES, SS, FS, GS) logic.

2. Integer Core: ALU (Arithmetic & Logic)

Source of most bugs. Pay close attention to Flag updates (Overflow vs Carry).

3. Integer Core: Control Flow

Directly modifies IP/EIP.

4. Integer Core: String Operations

Usually prefixed with REP, REPE, REPNE. Checks DF (Direction Flag).

5. System & Protected Mode

Essential for OS booting.

6. FPU (x87 Floating Point)

Operates on 80-bit stack ST(0)...ST(7). Distinct from Integer registers.

Critical: FPU Status Word (SW) contains condition codes (C0-C3).

Data Transfer

Arithmetic

Most instructions have a P variant (e.g., FADDP) which pops the stack after op.

Comparison & Control

Transcendental (Trig)

Hard to emulate perfectly bit-exact due to internal microcode variations.

Constants

7. MMX (Pentium MMX)

SIMD operations. Registers MM0-MM7 are aliased to FPU ST0-ST7 (lower 64 bits).

Warning: Mixing MMX and FPU instructions without EMMS corrupts data.

Emulator Implementation Tip: The ModR/M Byte

For most integer and MMX instructions, immediately following the opcode is the ModR/M byte. You must parse this correctly to identify the operands.

• Format: [Mod (2 bits)] [Reg/Opcode (3 bits)] [R/M (3 bits)]
• Mod 00: [reg] (Memory)
• Mod 01: [reg + disp8] (Memory)
• Mod 10: [reg + disp32] (Memory)
• Mod 11: reg (Direct Register)

Note: The SIB (Scale Index Base) byte follows ModR/M if R/M == 100 in 32-bit mode.

References

• Intel 8086 Manual - Official Intel documentation
• x86 Instruction Set Reference - Complete instruction reference
• 80286 Programmer's Reference - Protected mode details
• 80386 Programmer's Reference - 32-bit extensions
• Additional analysis: docs/CPU_ANALYSIS.md, docs/CPU_8086_REVIEW_2025.md