12 ms·

Inside the 8086 processor's instruction prefetch circuitry

127 points by klelatti 4y ago

kens 4y ago
It's nice to see my post about the Intel 8086 here, even if the title is totally mangled. Any questions?
- klelatti 4y ago
  Hi Ken, Thanks for a great post as usual. I forgot HN can mess up titles - hopefully fixed now!
- moosedev 4y ago
  Hey Ken, Always enjoy your posts! > The much-reviled solution was to create a 4-megabyte (20-bit) address space consisting of 64K segments, Did you mean 1-megabyte here? (and again later in the same “paragraph”, pun intended)
  - kens 4y ago
    Thanks, I've fixed that.
  - zozbot234 4y ago
    That solution actually made quite a bit of sense. What was really messy is protected mode in the 80286 where the segment address actually indexes into an indirection table, in order to address 24 bits (16M) of physical address space. But the 8086 had none of that. And the 80386 finally got 32-bit flat addressing in protected mode, enabling modern OS's to be ported.
  - userbinator 4y ago
    There are 4 segments and which one is being used is presented on the bus interface (S4/S3) so 4MB of total memory is actually possible in an 8086 system, and the 8086 documentation does explicitly mention that as an implementation choice, but I don't think many systems made use of that feature; bank-switching seems to have been more common. The reason being that separating the segments into their own address spaces would create something more like a Harvard architecture, which isn't really wanted in a general-purpose computer.
    - moosedev 4y ago
      That's interesting - I didn't know that the memory subsystem could "know" which of the 4 segment registers was in use for a given request. With that detail, one could certainly call it a 4MB "address space", albeit even more of a pain to use than the usual 1MB one :-)
      - ataylor284_ 4y ago
        I can see mapping CS to 1MB and DS, ES, and SS all to another 1MB for 2MB as moderately viable. This would make the system a Harvard Architecture instead of a von Neumann, with the escape hatch of segment prefixes. It would be even more of a nightmare to program than the already janky segmented memory model we ended up with, so I'm happy IBM wisely decided to avoid it.
    - mrlonglong 4y ago
      Fascinating, never knew that was possible. How would that work in practice? I can easily play with the segment registers to address the full 1 megabyte range but how would I do that to address the other 3 megabytes?
      - userbinator 4y ago
        Each segment register implicitly selects its own address space. Thus you have 1MB of CS, 1MB of DS, 1MB of ES, and 1MB of SS.
- toast0 4y ago
  Footnote 10 ends midsentance... I suspect 'instruction' is the missing word at the end
  - kens 4y ago
    Thanks, I've added the missing line.
ajross 4y ago
I love these. kens, nitpick on your first footnote: In fact the Apple II was designed for 4k DRAMs with a whole-cycle time of 500ns, which was the low end of the range in 1977. The idea is that the machine double pumps a 2MHz memory bus, with cycles alternating between the 1 MHz 6502 and the video scan circuitry (which doubles as the refresh controller). By the advent of 4164 chips, DRAM cycle rates were pushing 4MHz. But Woz was stuck with more limited hardware. Similarly the 8086 bus is multiplexed between address and data, a memory access is 4 cycles. So a 4.77 MHz IBM PC was actually cycling the DRAM at just 1.2MHz (though with no clever tricks, as MDA/CGA had physically separate framebuffers; there the extra bandwidth really was wasted). Which isn't to say that the footnote is wrong, just that "DRAM was faster than CPUs" is only part of the story.
mrlonglong 4y ago
I hate to nitpick but there's an error in the text where it's stated that the 8086 could address 4 megabytes with 20 bit addresses, but that's actually one megabyte. Otherwise, all fascinating reading. My first proper pc was an Amstrad PC1512 with a NEC V30 (clone of the 8086 with some enhanced instructions). Maybe you could take a look at the V30 at some point?
- kens 4y ago
  Thanks, I've fixed that. As for the NEC V30, the 8086 is likely to keep me busy for a long time, but it would be interesting to see how the enhanced instructions in the V30 were implemented.
  - mrlonglong 4y ago
    I've got a NEC V30 coprocessor plugged into my raspberry pi. It works, amazingly well enough
    - andrewf 4y ago
      Is it Elijah Miller's https://www.homebrew8088.com/home/raspberry-pi-second-project https://www.homebrew8088.com/home/raspberry-pi-second-projec... or something else? I ask because I'm interested (for no good reason :P) in automating 808x bus traces like http://www.jagregory.com/abrash-zen-of-asm/images/fig5.1aRT.png http://www.jagregory.com/abrash-zen-of-asm/images/fig5.1aRT.... I have a homebrew8088 board with a V30 in it, which I've just started playing with. I've run into two issues: (1) It runs the processor in "minimum mode", which doesn't expose as much internal/debug state on the pins. (Vs "maximum mode", where the CPU consolidates many control signals into 3 pins, which drive an Intel 8288 companion chip, which drives the control signals) (2) To plug an intel processor in, I think I need to use a 3.3V <-> 5V shifter, and https://czh-labs.com/products/rpi-33v-to-5v-26-i-o-bidirectional-voltage-level-shifter-module-for-raspberry-pi-logic-level-converter https://czh-labs.com/products/rpi-33v-to-5v-26-i-o-bidirecti... doesn't expose GPIO0/1, which the board uses for the AD5 / INTA pins. The board is open source and I've never had a PCB made, so this might be a fun yak to shave. The Raspberry Pi doesn't have enough GPIOs to run the CPU in master mode, but I don't need to be IBM compatible, so I figure I can use an 8088 and simply steal some of the higher address pins.
ajross 4y ago
This shocked me a little: > the 8088 has a 4-byte prefetch queue instead of a 6-byte prefetch queue My whole professional life, I've been led to believe that an 8088 is just an 8086 with a tiny state machine bolted in front of the bus to split multiword accesses. That it has design differences is really surprising. If the prefetch queue is smaller, then... what are they putting in that die area? Or did they redo the layout in other ways?
- kens 4y ago
  The 8088 die is almost the same as the 8086, but there are a few differences. There are two prefetch queue registers instead of three. But the 8088 queue registers are slightly more complicated because the chip needs to write one byte at a time instead of one word. So there's just a small gap in the layout. There are various changes in the memory cycle circuitry. And there are a few changes to the microcode. Once I finish with the 8086, I plan to look at the changes in the 8088 more closely.
- adrian_b 4y ago
  This difference between 8088 and 8086 was used by several MS-DOS programs to detect the type of the CPU on which they were run. It was easy to measure the length of the prefetch queue by a self-modifying program, which replaced the instruction placed 4 bytes after the current instruction pointer. On an 8088, the new instruction was executed, while on an 8086 the old instruction was executed. Various other such obscure differences (e.g. the value of a pushed stack pointer or the result of a shift operation with a shift count greater than the register size) were used to identify NEC V20 and V30, Intel 80186, 80188, 80286 and 80386, because architectural identification means, like the CPUID instruction, have been introduced only in Intel Pentium and in the late 486 models that were launched after Pentium.
  - robocat 4y ago
    > It was easy to measure the length of the prefetch queue by a self-modifying program It became hard on the 386, as linked in the article: http://www.rcollins.org/secrets/PrefetchQueue.html http://www.rcollins.org/secrets/PrefetchQueue.html
userbinator 4y ago
If you search for information on 8086/88-specific features and terminology such as BIU/EU, prefetch queue, etc., a surprisingly large number of results are Indian. They are apparently still quite popular in CS courses there. I wonder if new discrete clones are still being made, as Intel stopped making them long ago.
- andrewf 4y ago
  I suspect this might be path dependency / "we're just teaching these courses the way we always have." In the US there has been a push towards teaching using modern, practical languages. It was previously more common for universities to "teach the principles." Figuring out how to apply that to the industrial zeitgeist was on the student. In 2002, the uni I went to prided itself on being allied with industry: they introduced programming with Java. The uni down the road introduced students to Gofer (Haskell circa 1992), then Pascal.
- zozbot234 4y ago
  You can buy industrial computers that are basically a Pentium-based PC in SoC form, they're quite popular for retro gaming. Still compatible with the original 8086 ISA. Modern x86-64 though is quite different, and knowing the 8086 ISA won't help you with following a modern assembly listing. The course material you've found is probably just really old.
  - userbinator 4y ago
    The course material you've found is probably just really old. No, from within the past few years; here's a random example: https://sanjayvidhyadharan.in/Downloads/Microprocessors/Lecture%20Notes/MPI_Lec_4.pdf https://sanjayvidhyadharan.in/Downloads/Microprocessors/Lect...
  - rep_lodsb 4y ago
    >Modern x86-64 though is quite different Optimized code tends to heavily use vector instructions which didn't exist in older generations, but everything else stayed the same, more or less. It was ARM that became radically different when it moved to 64 bit.
rep_lodsb 4y ago
>At some point, Intel implemented consistency between cached instructions and memory. This ensures that self-modifying code will run the latest version of an instruction rather than a stale instruction in the cache. I couldn't determine exactly when this was implemented; various sources say the 486, the Pentium, or the Pentium Pro. (If you have a definitive answer, please let me know.) It's definitely not the case on the 486, the linked HN post written by me was incorrect about that. Tried running self-modifying code on a 486 and it required a jump to make it work.

127 points by klelatti 4y ago

kens 4y ago

It's nice to see my post about the Intel 8086 here, even if the title is totally mangled. Any questions?

klelatti 4y ago
Hi Ken, Thanks for a great post as usual. I forgot HN can mess up titles - hopefully fixed now!
moosedev 4y ago
Hey Ken, Always enjoy your posts! > The much-reviled solution was to create a 4-megabyte (20-bit) address space consisting of 64K segments, Did you mean 1-megabyte here? (and again later in the same “paragraph”, pun intended)
- kens 4y ago
  Thanks, I've fixed that.
- zozbot234 4y ago
  That solution actually made quite a bit of sense. What was really messy is protected mode in the 80286 where the segment address actually indexes into an indirection table, in order to address 24 bits (16M) of physical address space. But the 8086 had none of that. And the 80386 finally got 32-bit flat addressing in protected mode, enabling modern OS's to be ported.
- userbinator 4y ago
  There are 4 segments and which one is being used is presented on the bus interface (S4/S3) so 4MB of total memory is actually possible in an 8086 system, and the 8086 documentation does explicitly mention that as an implementation choice, but I don't think many systems made use of that feature; bank-switching seems to have been more common. The reason being that separating the segments into their own address spaces would create something more like a Harvard architecture, which isn't really wanted in a general-purpose computer.
  - moosedev 4y ago
    That's interesting - I didn't know that the memory subsystem could "know" which of the 4 segment registers was in use for a given request. With that detail, one could certainly call it a 4MB "address space", albeit even more of a pain to use than the usual 1MB one :-)
    - ataylor284_ 4y ago
      I can see mapping CS to 1MB and DS, ES, and SS all to another 1MB for 2MB as moderately viable. This would make the system a Harvard Architecture instead of a von Neumann, with the escape hatch of segment prefixes. It would be even more of a nightmare to program than the already janky segmented memory model we ended up with, so I'm happy IBM wisely decided to avoid it.
  - mrlonglong 4y ago
    Fascinating, never knew that was possible. How would that work in practice? I can easily play with the segment registers to address the full 1 megabyte range but how would I do that to address the other 3 megabytes?
    - userbinator 4y ago
      Each segment register implicitly selects its own address space. Thus you have 1MB of CS, 1MB of DS, 1MB of ES, and 1MB of SS.
toast0 4y ago
Footnote 10 ends midsentance... I suspect 'instruction' is the missing word at the end
- kens 4y ago
  Thanks, I've added the missing line.

ajross 4y ago

I love these. kens, nitpick on your first footnote: In fact the Apple II was designed for 4k DRAMs with a whole-cycle time of 500ns, which was the low end of the range in 1977. The idea is that the machine double pumps a 2MHz memory bus, with cycles alternating between the 1 MHz 6502 and the video scan circuitry (which doubles as the refresh controller). By the advent of 4164 chips, DRAM cycle rates were pushing 4MHz. But Woz was stuck with more limited hardware. Similarly the 8086 bus is multiplexed between address and data, a memory access is 4 cycles. So a 4.77 MHz IBM PC was actually cycling the DRAM at just 1.2MHz (though with no clever tricks, as MDA/CGA had physically separate framebuffers; there the extra bandwidth really was wasted). Which isn't to say that the footnote is wrong, just that "DRAM was faster than CPUs" is only part of the story.

mrlonglong 4y ago

I hate to nitpick but there's an error in the text where it's stated that the 8086 could address 4 megabytes with 20 bit addresses, but that's actually one megabyte. Otherwise, all fascinating reading. My first proper pc was an Amstrad PC1512 with a NEC V30 (clone of the 8086 with some enhanced instructions). Maybe you could take a look at the V30 at some point?

kens 4y ago
Thanks, I've fixed that. As for the NEC V30, the 8086 is likely to keep me busy for a long time, but it would be interesting to see how the enhanced instructions in the V30 were implemented.
- mrlonglong 4y ago
  I've got a NEC V30 coprocessor plugged into my raspberry pi. It works, amazingly well enough
  - andrewf 4y ago
    Is it Elijah Miller's https://www.homebrew8088.com/home/raspberry-pi-second-project https://www.homebrew8088.com/home/raspberry-pi-second-projec... or something else? I ask because I'm interested (for no good reason :P) in automating 808x bus traces like http://www.jagregory.com/abrash-zen-of-asm/images/fig5.1aRT.png http://www.jagregory.com/abrash-zen-of-asm/images/fig5.1aRT.... I have a homebrew8088 board with a V30 in it, which I've just started playing with. I've run into two issues: (1) It runs the processor in "minimum mode", which doesn't expose as much internal/debug state on the pins. (Vs "maximum mode", where the CPU consolidates many control signals into 3 pins, which drive an Intel 8288 companion chip, which drives the control signals) (2) To plug an intel processor in, I think I need to use a 3.3V <-> 5V shifter, and https://czh-labs.com/products/rpi-33v-to-5v-26-i-o-bidirectional-voltage-level-shifter-module-for-raspberry-pi-logic-level-converter https://czh-labs.com/products/rpi-33v-to-5v-26-i-o-bidirecti... doesn't expose GPIO0/1, which the board uses for the AD5 / INTA pins. The board is open source and I've never had a PCB made, so this might be a fun yak to shave. The Raspberry Pi doesn't have enough GPIOs to run the CPU in master mode, but I don't need to be IBM compatible, so I figure I can use an 8088 and simply steal some of the higher address pins.

ajross 4y ago

This shocked me a little: > the 8088 has a 4-byte prefetch queue instead of a 6-byte prefetch queue My whole professional life, I've been led to believe that an 8088 is just an 8086 with a tiny state machine bolted in front of the bus to split multiword accesses. That it has design differences is really surprising. If the prefetch queue is smaller, then... what are they putting in that die area? Or did they redo the layout in other ways?

kens 4y ago
The 8088 die is almost the same as the 8086, but there are a few differences. There are two prefetch queue registers instead of three. But the 8088 queue registers are slightly more complicated because the chip needs to write one byte at a time instead of one word. So there's just a small gap in the layout. There are various changes in the memory cycle circuitry. And there are a few changes to the microcode. Once I finish with the 8086, I plan to look at the changes in the 8088 more closely.
adrian_b 4y ago
This difference between 8088 and 8086 was used by several MS-DOS programs to detect the type of the CPU on which they were run. It was easy to measure the length of the prefetch queue by a self-modifying program, which replaced the instruction placed 4 bytes after the current instruction pointer. On an 8088, the new instruction was executed, while on an 8086 the old instruction was executed. Various other such obscure differences (e.g. the value of a pushed stack pointer or the result of a shift operation with a shift count greater than the register size) were used to identify NEC V20 and V30, Intel 80186, 80188, 80286 and 80386, because architectural identification means, like the CPUID instruction, have been introduced only in Intel Pentium and in the late 486 models that were launched after Pentium.
- robocat 4y ago
  > It was easy to measure the length of the prefetch queue by a self-modifying program It became hard on the 386, as linked in the article: http://www.rcollins.org/secrets/PrefetchQueue.html http://www.rcollins.org/secrets/PrefetchQueue.html

userbinator 4y ago

If you search for information on 8086/88-specific features and terminology such as BIU/EU, prefetch queue, etc., a surprisingly large number of results are Indian. They are apparently still quite popular in CS courses there. I wonder if new discrete clones are still being made, as Intel stopped making them long ago.

andrewf 4y ago
I suspect this might be path dependency / "we're just teaching these courses the way we always have." In the US there has been a push towards teaching using modern, practical languages. It was previously more common for universities to "teach the principles." Figuring out how to apply that to the industrial zeitgeist was on the student. In 2002, the uni I went to prided itself on being allied with industry: they introduced programming with Java. The uni down the road introduced students to Gofer (Haskell circa 1992), then Pascal.
zozbot234 4y ago
You can buy industrial computers that are basically a Pentium-based PC in SoC form, they're quite popular for retro gaming. Still compatible with the original 8086 ISA. Modern x86-64 though is quite different, and knowing the 8086 ISA won't help you with following a modern assembly listing. The course material you've found is probably just really old.
- userbinator 4y ago
  The course material you've found is probably just really old. No, from within the past few years; here's a random example: https://sanjayvidhyadharan.in/Downloads/Microprocessors/Lecture%20Notes/MPI_Lec_4.pdf https://sanjayvidhyadharan.in/Downloads/Microprocessors/Lect...
- rep_lodsb 4y ago
  >Modern x86-64 though is quite different Optimized code tends to heavily use vector instructions which didn't exist in older generations, but everything else stayed the same, more or less. It was ARM that became radically different when it moved to 64 bit.

rep_lodsb 4y ago

>At some point, Intel implemented consistency between cached instructions and memory. This ensures that self-modifying code will run the latest version of an instruction rather than a stale instruction in the cache. I couldn't determine exactly when this was implemented; various sources say the 486, the Pentium, or the Pentium Pro. (If you have a definitive answer, please let me know.) It's definitely not the case on the 486, the linked HN post written by me was incorrect about that. Tried running self-modifying code on a 486 and it required a jump to make it work.