Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor

逆向病毒分析 1年前 (2023) admin
426 0 0

One interesting aspect of a computer’s instruction set is its addressing modes, how the computer determines the address for a memory access. The Intel 8086 (1978) used the ModR/M byte, a special byte following the opcode, to select the addressing mode.1 The ModR/M byte has persisted into the modern x86 architecture, so it’s interesting to look at its roots and original implementation.

In this post, I look at the hardware and microcode in the 8086 that implements ModR/M2 and how the 8086 designers fit multiple addressing modes into the 8086’s limited microcode ROM. One technique was a hybrid approach that combined generic microcode with hardware logic that filled in the details for a particular instruction. A second technique was modular microcode, with subroutines for various parts of the task.

I’ve been reverse-engineering the 8086 starting with the silicon die. The die photo below shows the chip under a microscope. The metal layer on top of the chip is visible, with the silicon and polysilicon mostly hidden underneath. Around the edges of the die, bond wires connect pads to the chip’s 40 external pins. I’ve labeled the key functional blocks; the ones that are important to this discussion are darker and will be discussed in detail below. Architecturally, the chip is partitioned into a Bus Interface Unit (BIU) at the top and an Execution Unit (EU) below. The BIU handles bus and memory activity as well as instruction prefetching, while the Execution Unit (EU) executes instructions and microcode. Both units play important roles in memory addressing.

Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
The 8086 die under a microscope, with main functional blocks labeled. This photo shows the chip’s single metal layer; the polysilicon and silicon are underneath. Click on this image (or any other) for a larger version.


8086 addressing modes

Let’s start with an addition instruction, dst,src, which adds a source value to a destination value and stores the result in the destination.3 What are the source and destination? Memory? Registers? The addressing mode answers this question.ADD

You can use a register as the source and another register as the destination. The instruction below uses the register as the destination and the register as the source. Thus, it adds to and puts the result in .AXBXBXAXAX

ADD AX, BX           Add the contents of the BX register to the AX register

A memory access is indicated with square brackets around the “effective address”4 to access. For instance, means the memory location with address 1234, while means the memory location that the register points to. For a more complicated addressing mode, means the memory location is determined by adding the BP and SI registers to the constant 1234 (known as the displacement). On the 8086, you can use memory for the source or the destination, but not both. Here are some examples of using memory as a source:[1234][BP]BP[BP+SI+1234]

ADD AX, [1234]       Add the contents of memory location 1234 to AX register
ADD CX, [BP]         Add memory pointed to by BP register to CX register
ADD DX, [BX+SI+1234] Source memory address is BX + SI + constant 1234

Here are examples with memory as the destination:

ADD [1234], AX       Add AX to the contents of memory location 1234
ADD [BP], CX         Add CX to memory pointed to by BP register
ADD [BX+SI+1234], DX Destination memory address is BX + SI + constant 1234

You can also operate on bytes instead of words, using a byte register and accessing a memory byte:

ADD AL, [SI+1234]    Add to the low byte of AX register
ADD AH, [BP+DI+1234] Add to the high byte of AX register

As you can see, the 8086 supports many different addressing schemes. To understand how they are implemented, we must first look at how instructions encode the addressing schemes in the ModR/M byte.

The ModR/M byte

The ModR/M byte follows many opcodes to specify the addressing mode. This byte is fairly complicated but I’ll try to explain it in this section. The diagram below shows how the byte is split into three fields:5 selects the overall mode, selects a register, and selects either a register or memory mode.modregr/m

mod reg r/m
7 6 5 4 3 2 1 0

I’ll start with the register-register mode, where the bits are 11 and the and fields each select one of eight registers, as shown below. The instruction would use =011 to select and =000 to select , so the ModR/M byte would be 11011000. (The register assignment depends on whether the instruction operates on words, bytes, or segment registers. For instance, in a word instruction, selects the register, while in a byte instruction, selects the register, the low byte of .)modregr/mADD AX,BXregBXr/mAX001CX001CLCX

Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
The register assignments, from MCS-86 Assembly Language Reference Guide.


The next addressing mode specifies a memory argument and a register argument. In this case, the bits are 00, the field specifies a register as described above, and the field specifies a memory address according to the table below. For example, the instruction would use =001 to select and =100 to select , so the ModR/M byte would be 00001100.modregr/mADD [SI],CXregCXr/m[SI]

r/m Operand Address
000 [BX+SI]
001 [BX+DI]
010 [BP+SI]
011 [BP+DI]
100 [SI]
101 [DI]
110 [BP]
111 [BX]

The next mode, 01, adds an 8-bit signed displacement to the address. This displacement consists of one byte following the ModR/M byte. This supports addressing modes such as . The mode 10 is similar except the displacement is two bytes long, for addressing modes such as .[BP+5][BP+DI+0x1234]

The table below shows the meaning of all 256 values for the ModR/M byte. The bits are colored red, the bits green, and the bits blue. Note the special case “disp16” to support a 16-bit fixed address.modregr/m

Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
The ModR/M values. Note that this table would be trivial if it used octal rather than hexadecimal. Based on Table 6-13 in the ASM386 Assembly Language Reference.


The register combinations for memory accesses may seem random but they were designed to support the needs of high-level languages, such as arrays and data structures. The idea is to add a base register, an index register, and/or a fixed displacement to determine the address.6 The base register can indicate the start of an array, the index register holds the offset in the array, and the displacement provides the offset of a field in the array entry. The base register is for data or for information on the stack. The index registers are (Source Index) and (Destination Index).7BXBPSIDI

Some addressing features are handled by the opcode, not the ModR/M byte. For instance, the ModR/M byte doesn’t distinguish between and . Instead, the two variants are distinguished by bit 1 of the instruction, the or “direction” bit.8 Moreover, many instructions have one opcode that operates on words and another that operates on bytes, distinguished by bit 0 of the opcode, the or word bit.ADD AX,[SI]ADD [SI],AXDW

The and bits are an example of orthogonality in the 8086 instruction set, allowing features to be combined in various combinations. For instance, the addressing modes combine 8 types of offset computation with three sizes of displacements and 8 target registers. Arithmetic instructions combine these addressing modes with eight ALU operations, each of which can act on a byte or a word, with two possible memory directions. All of these combinations are implemented with one block of microcode, implementing a large instruction set with a small amount of microcode. (The orthogonality of the 8086 shouldn’t be overstated, though; it has many special cases and things that don’t quite fit.)DW

An overview of 8086 microcode

Most people think of machine instructions as the basic steps that a computer performs. However, many processors (including the 8086) have another layer of software underneath: microcode. With microcode, instead of building the control circuitry from complex logic gates, the control logic is largely replaced with code. To execute a machine instruction, the computer internally executes several simpler micro-instructions, specified by the microcode.

The 8086 uses a hybrid approach: although it uses microcode, much of the instruction functionality is implemented with gate logic. This approach removed duplication from the microcode and kept the microcode small enough for 1978 technology. In a sense, the microcode is parameterized. For instance, the microcode can specify a generic Arithmetic/Logic Unit (ALU) operation and a generic register. The gate logic examines the instruction to determine which specific operation to perform and the appropriate register.

A micro-instruction in the 8086 is encoded into 21 bits as shown below. Every micro-instruction has a move from a source register to a destination register, each specified with 5 bits. The meaning of the remaining bits depends on the type field. A “short jump” is a conditional jump within the current block of 16 micro-instructions. An ALU operation sets up the arithmetic-logic unit to perform an operation. Bookkeeping operations are anything from flushing the prefetch queue to ending the current instruction. A memory operation triggers a bus cycle to read or write memory. A “long jump” is a conditional jump to any of 16 fixed microcode locations (specified in an external table called the Translation ROM). Finally, a “long call” is a conditional subroutine call to one of 16 locations. For more about 8086 microcode, see my microcode blog post.

Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
The encoding of a micro-instruction into 21 bits. Based on NEC v. Intel: Will Hardware Be Drawn into the Black Hole of Copyright?


Some examples of microcode for addressing

In this section, I’ll take a close look at a few addressing modes and how they are implemented in microcode. In the next section, I’ll summarize all the microcode for addressing modes.

A register-register operation

Let’s start by looking at a register-to-register instruction, before we get into the complications of memory accesses: which adds to , storing the result in . This instruction has the opcode value 01 and ModR/M value C3 (hex). ADD BX,AXAXBXBX

Before the microcode starts, the hardware performs some decoding of the opcode. The Group Decode ROM (below) classifies an instruction into multiple categories: this instruction contains a D bit, a W bit, and an ALU operation, and has a ModR/M byte. Fields from the opcode and ModR/M bytes are extracted and stored in various internal registers. The ALU operation type () is stored in the register. From the ModR/M byte, the register code () is stored in the register, and the register code () is stored in the register. (The and registers are internal registers that are invisible to the programmer; each holds a 5-bit register code that specifies a register.9ADDALU oprregAXNr/mBXMMN)

Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
This diagram shows the Group Decode ROM. The Group Decode ROM is more of a PLA (programmable logic array) with two layers of NOR gates. Its input lines are at the lower left and its outputs are at the upper right.


Once the preliminary decoding is done, the microcode below for this ALU instruction is executed.10 (There are three micro-instructions, so the instruction takes three clock cycles.) Each micro-instruction contains a move and an action. First, the register specified by (i.e. ) is moved to the ALU’s temporary A register (). Meanwhile, the ALU is configured to perform the appropriate operation on ; indicates that the ALU operation is specified by the instruction bits, i.e. ).MBXtmpAtmpAXIADD

The second instruction moves the register specified by (i.e. ) to the ALU’s register. The action indicates that this is the next-to-last micro-instruction so the microcode engine can start processing the next machine instruction. The last micro-instruction stores the ALU’s result () in the register indicated by (i.e. ). The status flags are updated because of the . (Run Next Instruction) indicates that this is the end and the microcode engine can process the next machine instruction. The prefix would skip the actions if a memory writeback were pending (which is not the case).NAXtmpBNXΣMBXFWB,RNIWB

  move       action
M → tmpA     XI tmpA   ALU rm↔r: BX to tmpA
N → tmpB     WB,NX      AX to tmpB
Σ → M        WB,RNI F   result to BX, run next instruction.

This microcode packs a lot into three micro-instructions. Note that it is very generic: the microcode doesn’t know what ALU operation is being performed or which registers are being used. Instead, the microcode deals with abstract registers and operations, while the hardware fills in the details using bits from the instructions. The same microcode is used for eight different ALU operations. And as we’ll see, it supports multiple addressing modes.

Using memory as the destination

Memory operations on the 8086 involve both microcode and hardware. A memory operation uses two internal registers: (Indirect) holds the memory address, while (Operand) holds the word that is read or written. A typical memory micro-instruction is , which starts a read from the Data Segment with a “Plus 0” on the register afterward. The Bus Interface Unit carries out this operation by adding the segment register to compute the physical address, and then running the memory bus cycles.INDOPRR DS,P0IND

With that background, let’s look at the instruction , which adds to the memory location indexed by . As before, the hardware performs some analysis of the instruction (hex 01 04). In the ModR/M byte, mod=00 (memory, no displacement), reg=000 (AX), and R/M=100 ([SI]). The register is loaded with the code for as before. The register, however, is loaded with (the memory data register) since the Group Decode ROM determines that the instruction has a memory addressing mode.ADD [SI],AXAXSINAXMOPR

The microcode below starts in an effective address microcode subroutine for the mode. The first line of the microcode subroutine computes the effective address simply by loading the register with . It jumps to the micro-routine which ends up at (for reasons that will be described below), which loads the value from memory. Specifically, puts the address in , reads the value from memory, puts the value into , and returns from the subroutine.[SI]tmpASIEAOFFSETEALOADEALOADINDtmpB

SI → tmpA   JMP EAOFFSET [SI]: put SI in tmpA
tmpA → IND  R DS,P0      EALOAD: read memory
OPR → tmpB  RTN  
M → tmpA    XI tmpA      ALU rm↔r: OPR to tmpA
N → tmpB    WB,NX         AX to tmpB
Σ → M       WB,RNI F      result to BX, run next instruction.
            W DS,P0 RNI   writes result to memory

Microcode execution continues with the routine described above, but with a few differences. The register indicates , so the value read from memory is put into . As before, the register specifies , so that register is put into . In this case, the determines that the result will be written back to memory so it skips the operation. The ALU’s result () is stored in as directed by . The is skipped so microcode execution continues. The micro-instruction writes the result (in ) to the memory address in . At this point, terminates the microcode sequence.ALU rm↔rMOPRtmpANAXtmpBWB,NXNXTΣOPRMWB,RNIW DS,P0OPRINDRNI

A lot is going on here to add two numbers! The main point is that the same microcode runs as in the register case, but the results are different due to the register and the conditional code. By running different subroutines, different effective address computations can be performed.MWB

Using memory as the source

Now let’s look at how the microcode uses memory as a source, as in the instruction . This instruction (hex 03 04) has the same ModR/M byte as before, so the register holds and the register holds . However, because the opcode has the D bit set, the and registers are swapped when accessed. Thus, when the microcode uses , it gets the value from , and vice versa. (Yes, this is confusing.)ADD AX,[SI]NAXMOPRMNMAXN

The microcode starts the same as the previous example, reading into and returning to the ALU code. However, since the meaning of and are reversed, the AX value goes into while the memory value goes into . (This switch doesn’t matter for addition, but would matter for subtraction.) An important difference is that there is no writeback to memory, so starts processing the next machine instruction. In the last micro-instruction, the result is written to , indicating the register. Finally, runs the next machine instruction.[SI]tmpBMNtmpAtmpBWB,NXMAXWB,RNI

SI → tmpA   JMP EAOFFSET [SI]: put SI in tmpA
tmpA → IND  R DS,P0      EALOAD: read memory
OPR → tmpB  RTN  
M → tmpA    XI tmpA      ALU rm↔r: AX to tmpA
N → tmpB    WB,NX         OPR to tmpB
Σ → M       WB,RNI F      result to AX, run next instruction.

The main point is that the same microcode handles memory as a source and a destination, simply by setting the bit. First, the bit reverses the operands by swapping and . Second, the conditionals prevent the writeback to memory that happened in the previous case.DDMNWB

Using a displacement

The memory addressing modes optionally support a signed displacement of one or two bytes. Let’s look at the instruction . In hex, this instruction is 03 84 34 12, where the last two bytes are the displacement, reversed because the 8086 uses little-endian numbers. The mod bits are 10, indicating a 16-bit displacement, but the other bits are the same as in the previous example.ADD AX,[SI+0x1234]

Microcode execution again starts with the subroutine. However, the jump to goes to this time, to handle the displacement offset. (I’ll explain how, shortly.) This code loads the offset as two bytes from the instruction prefetch queue () into the register. It adds the offset to the previous address in and puts the sum Σ in , computing the effective address. Then it jumps to (). From there, the code continues as earlier, reading an argument from memory and computing the sum.[SI]EAOFFSET[i]QtmpBtmpAtmpAEAFINISHEALOAD

SI → tmpA   JMP EAOFFSET [SI]: put SI in tmpA
Q → tmpBL   JMPS MOD1 12 [i]: load from queue, conditional jump
Q → tmpBH     
Σ → tmpA    JMP EAFINISH 12:
tmpA → IND  R DS,P0      EALOAD: read memory
OPR → tmpB  RTN  
M → tmpA    XI tmpA      ALU rm↔r: AX to tmpA
N → tmpB    WB,NX         OPR to tmpB
Σ → M       WB,RNI F      result to AX, run next instruction.

For the one-byte displacement case, the conditional will jump over the fetch of the second displacement byte. When the first byte is loaded into the low byte of , it was sign-extended into the high byte.14 Thus, the one-byte displacement case uses the same microcode but ends up with a sign-extended 1-byte displacement in .MOD1tmpBtmpB

The Translation ROM

Now let’s take a closer look at the jumps to , , and the effective address subroutines, which use something called the Translation ROM. The Translation ROM converts the 5-bit jump tag in a micro-instruction into a 13-bit microcode address. It also provides the addresses of the effective address subroutines. As will be seen below, there are some complications.11EAOFFSETEAFINISH

Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
The Translation ROM as it appears on the die. The metal layer has been removed to expose the silicon and polysilicon underneath. The left half decodes the inputs to select a row. The right half outputs the corresponding microcode address.


The effective address micro-routines

Register calculations

The Translation ROM has an entry for the addressing mode calculations such as and , generally indicated by the bits, the three low bits of the ModR/M byte. Each routine computes the effective address and puts it into the ALU’s temporary A register and jumps to , which adds any displacement offset. The microcode below shows the four simplest effective address calculations, which just load the appropriate register into .[SI][BP+DI]r/mEAOFFSETtmpA

SI → tmpA   JMP EAOFFSET   [SI]: load SI into tmpA
DI → tmpA   JMP EAOFFSET   [DI]: load SI into tmpA
BP → tmpA   JMP EAOFFSET   [BP]: load BP into tmpA
BX → tmpA   JMP EAOFFSET   [BX]: load BX into tmpA

For the cases below, an addition is required, so the registers are loaded into the ALU’s temporary A and temporary B registers. The effective address is the sum (indicated by Σ), which is moved to temporary A.12 These routines are carefully arranged in memory so and each execute one micro-instruction and then jump into the middle of the other routines, saving code.13[BX+DI][BP+SI]

BX → tmpA         [BX+SI]: get regs
SI → tmpB         1:

BP → tmpA         [BP+DI]: get regs
DI → tmpB         4:

BX → tmpA  JMPS 4 [BX+DI]: short jump to 4
BP → tmpA  JMPS 1 [BP+SI]: short jump to 1


After computing the register portion of the effective address, the routines above jump to , but this is not a fixed target. Instead, the Translation ROM selects one of three target microcode addresses based on the instruction and the ModR/M byte:
If there’s a displacement, the microcode jumps to to add the displacement value.
If there is no displacement but a memory rea but a memory read, the microcode otherwise jumps to to load the memory contents.
If there is no displacement and no memory read should take place, the microcode jumps to .
In other words, the microcode jump is a three-way branch that is implemented by the Translation ROM and is transparent to the microcode.

For a displacement, the immediate code below loads a 1-byte or 2-byte displacement into the register and adds it to the register, as described earlier. At the end of a displacement calculation, the microcode jumps to the tag, which is another branching target. Based on the instruction, the Translation ROM selects one of two microcode targets: to load from memory, or to skip the load.[i]tmpBtmpAEAFINISHEALOADEADONE

Q → tmpBL   JMPS MOD1 12 [i]: get byte(s)
Q → tmpBH         
Σ → tmpA    JMP EAFINISH 12: add displacement

The microcode below reads the value from memory, using the effective address in . It puts the result in . The micro-instruction returns to the microcode that implements the original machine instruction.EALOADtmpAtmpBRTN

tmpA → IND  R DS,P0   EALOAD: read from tmpA address
OPR → tmpB  RTN        store result in tmpB, return

The routine puts the effective address in , but it doesn’t read from the memory location. This supports machine instructions such as (some moves) and (Load Effective Address) that don’t read from memoryEADONEINDMOVLEA

tmpA → IND  RTN   EADONE: store effective address in IND

To summarize, the microcode runs different subroutines and different paths, depending on the addressing mode, executing the appropriate code. The Translation ROM selects the appropriate control flow path.

Special cases

There are a couple of special cases in addressing that I will discuss in this section.

Supporting a fixed address

It is common to access a fixed memory address, but the standard addressing modes use a base or index register. The 8086 replaces the mode of with no displacement with 16-bit fixed addressing. In other words, a ModR/M byte with the pattern is treated specially. (This special case is the orange line in the ModR/M table earlier.) This is implemented in the Translation ROM which has additional rows to detect this pattern and execute the immediate word microcode below instead. This microcode fetches a word from the instruction prefetch queue () into the register, a byte at a time. It jumps to instead of because it doesn’t make sense to add another displacement.[BP]00xxx110disp16[iw]QtmpAEAFINISHEAOFFSET

Q → tmpAL          [iw]: get bytes

Selecting the segment

Memory accesses in the 8086 are relative to one of the 64-kilobyte segments: Data Segment, Code Segment, Stack Segment, or Extra Segment. Most addressing modes use the Data Segment by default. However, addressing modes that use the register use the Stack Segment by default. This is a sensible choice since the (Base Pointer) register is intended for accessing values on the stack. BPBP

This special case is implemented in the Translation ROM. It has an extra output bit that indicates that the addressing mode should use the Stack Segment. Since the Translation ROM is already decoding the addressing mode to select the right microcode routine, adding one more output bit is straightforward. This bit goes to the segment register selection circuitry, changing the default segment. This circuitry also handles prefixes that change the segment. Thus, segment register selection is handled in hardware without any action by the microcode.


I hope you have enjoyed this tour through the depths of 8086 microcode. The effective address calculation in the 8086 uses a combination of microcode and logic circuitry to implement a variety of addressing methods. Special cases make the addressing modes more useful, but make the circuitry more complicated. This shows the CISC (Complex Instruction Set Computer) philosophy of x86, making the instructions complicated but highly functional. In contrast, the RISC (Reduced Instruction Set Computer) philosophy takes the opposite approach, making the instructions simpler but allowing the processor to run faster. RISC vs. CISC was a big debate of the 1980s, but isn’t as relevant nowadays.

People often ask if microcode could be updated on the 8086. Microcode was hardcoded into the ROM, so it could not be changed. This became a big problem for Intel with the famous Pentium floating-point division bug. The Pentium chip turned out to have a bug that resulted in rare but serious errors when dividing. Intel recalled the defective processors in 1994 and replaced them at a cost of $475 million. Starting with the Pentium Pro (1995), microcode could be patched at boot time, a useful feature that persists in modern CPUs.

I’ve written multiple posts on the 8086 so far and plan to continue reverse-engineering the 8086 die so follow me on Twitter @kenshirriff or RSS for updates. I’ve also started experimenting with Mastodon recently as

Notes and references

  1. There are additional addressing modes that don’t use a ModR/M byte. For instance, immediate instructions use a constant in the instruction. For instance adds 42 to the AX register. Other instructions implicitly define the addressing mode. I’m ignoring these instructions for now. ADD AX,42
  2. The 8086 supports more addressing modes than the ModR/M byte provides, by using separate opcodes. For instance, arithmetic instructions can take an “immediate” value, an 8- or 16-bit value specified as part of the instruction. Other instructions operate on specific registers rather than memory or access memory through the stack. For this blog post, I’m focusing on the ModR/M modes and ignoring the other instructions. Also, although I’m discussing the 8086, this blog post applies to the Intel 8088 processor as well. The 8088 has an 8-bit bus, a smaller prefetch queue, and some minor internal changes, but for this post you can consider them to be the same. 
  3. My assembly code examples are based on Intel ASM86 assembly syntax. There’s a completely different format of x86 assembly language known as AT&T syntax. Confusingly, it reverses the source and destination. For example, in AT&T syntax, stores the result in CX. AT&T syntax is widely used, for instance in Linux code. The AT&T syntax is based on earlier PDP-11 assembly codeaddw %bx, %cx%
  4. The term “effective address” dates back to the 1950s, when computers moved beyond fixed memory addresses and started using index registers. The earliest uses that I could find are from 1955 for the IBM 650 data processing machine and the IBM 704 mainframe. The “Load Effective Address” instruction, which provides the effective address as a value instead of performing the memory access, was perhaps introduced in the IBM System/360 (1964) under the name “Load Address”. It has been a part of many subsequent processors including the 8086. 
  5. Note that the ModR/M byte has the bits grouped in threes (as do many instructions). This is due to the octal heritage of the 8086, dating back through the 8080 and the 8008 to the Datapoint 2200 (which used TTL chips to decode groups of three bits). Although the 8086 instruction set is invariably described in hexadecimal, it makes much more sense when viewed in octal. See x86 is an octal machine for details. 
  6. The 8086’s addressing schemes are reminiscent of the IBM System/360 (1964). In particular, System/360 had a “RX” instruction format that accessed memory through a base register plus an index register plus a displacement, using another register for the other argument. This is very similar to the 8086’s base + index + displacement method. The System/360’s “RR” (register-register) instruction format accessed two registers, much like the register mode of the ModR/M byte. The details are very different, though, between the two systems. See the IBM System/360 Principles of Operation for more details. 
  7. The motivation behind the ModR/M options is discussed in The 8086/8088 Primer by 8086 designer Steve Morse, pages 23-33. 
  8. The D bit is usually called the register direction bit, but the designer of the 8086 instruction set calls it the destination field; see The 8086/8088 Primer, Steve Morse, page 28. To summarize:
    If the bit is 0, the result is stored into the location indicated by the and fields while the register specified by is the source.
    If the bit is 1, the result is stored into the register indicated by the field.

    For the word bit, 0 indicates a byte operation and 1 indicates a word operation.W

    One curious side-effect of the D bit is that an instruction like can be implemented in two ways since both arguments are registers. The field can specify while the field specifies or vice versa, depending on the D bit. Different 8086 assemblers can be “fingerprinted” based on their decisions in these ambiguous cases. ADD AX,BXregAXr/mBX

  9. The M and N registers hold a 5-bit code. This code indicates a 16-bit register (e.g. or ), an 8-bit register (e.g. ), or a special value (e.g. , the ALU result; , all zero bits; or , the flags). The 3-bit register specification is mapped onto the 5-bit code depending on whether the W bit is set (byte or word register), or if the operation is specifying a segment register. AXINDALΣZEROSF
  10. The microcode listings are based on Andrew Jenner’s disassembly. I have made some modifications to (hopefully) make it easier to understand. 
  11. You can also view the Translation ROM as a PLA (Programmable Logic Array) constructed from two layers of NOR gates. The conditional entries make it seem more like a PLA than a ROM. Technically, it can be considered a ROM since a single row is active at a time. I’m using the name “Translation ROM” because that’s what Intel calls it in the patents. 
  12. Normally, an ALU operation requires a micro-instruction to specify the desired ALU operation and temporary register. For the address addition, the ALU operation is not explicitly specified because it uses the ALU’s default, of adding and . The ALU is reset to this default at the beginning of each machine instruction. tmpAtmpB
  13. A microcode jump takes an extra clock cycle for the microcode address register to get updated. This is why, for instance, takes 7 clock cycles but takes 8 clock cycles. Thus, the 8086 implementers took the tradeoff of slowing down some addressing modes by a clock cycle in order to save a few micro-instructions in the small microcode ROM.[BP+DI][BX+DI] Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor
    This table shows the clock cycles required for effective address calculations. From MCS-86 Assembly Language Reference Guide.


  14. A one-byte signed number can be sign-extended into a two-byte signed number. This is done by copying the top bit (the sign) from the low byte and filling the top byte with that bit. For example, 0x64 is sign-extended to 0x0064 (+100), while 0x9c is sign-extended to 0xff9c (-100). 


版权声明:admin 发表于 2023年3月1日 上午10:46。
转载请注明:Reverse-engineering the ModR/M addressing microcode in the Intel 8086 processor | CTF导航