[File provided by Alex V. Potemkin ] Last Change 1/15/95 ------------------------------------------------------------ This is DOC 'bout undocument command and document command of any last processors. And 'bout some registers and Chip specified stuffs. ------------------------------------------------------------ (C) (P) Potemkin's Hackers Group 1994 ------------------------------------------------------------ Revision 1.09 17 November 1994 ------------------------------------------------------------ All Your messages send to -> E-mail: avp@iron.misa.ac.ru avk@netserv2.ioc.ac.ru AirMail: 111538 RUSSIA, Moscow P.O. box 430 Potemkin's Hackers Group Note: In Russia is reversed standart of components of post address ------------------------------------------------------------- --------------------------------------------------- AAA - ASCII adjust AX after addition CPU: 8086+ Type of Instruction: User Instruction: AAA ; (no operands) Description: IF ((( AL and 0FH ) > 9 ) or (AF==1) THEN { IF CPU<286 THEN { AL <- AL+6 } ELSE { AX <- AX+6 } AH <- AH+1 CF <- 1 AF <- 1 } ELSE { CF <- 0 AF <- 0 } AL <- AL and 0Fh Note: This istruction incorrectly documented in Intel's materials. See description field. Flags Affected: AF,CF (modified) OF,SF,ZF,PF (undefined) CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: COP (Code of Operation) : 37H Clocks: AAA 8086: 4 8088: 4 80186: 8 80286: 3 80386: 4 i486: 3 Cx486SLC: 4 Pentium: 3 --------------------------------------------------- AAD - ASCII adjust AX before Division CPU: 8086+ Type of Instruction: User Instruction: AAD basen Description: AL <- (AH*basen) + AL AH <- 0 Flags Affected: SF,ZF,PF (modified) OF,AF,CF (undefined) CPU mode: RM,PM,VM,SMM Note: AAD without operands means AAD with operand 0AH. +++++++++++++++++++++++ Physical Form: AAD imm8 COP (Code of Operation) : D5H imm8 Clocks: AAD 0AH 8086: 60 80186: 15 80286: 14 80386: 19 i486: 14 Cx486SLC: 4 Pentium: 10 --------------------------------------------------- AAM - ASCII adjust AX after Multiply CPU: 8086+ Type of Instruction: User Instruction: AAM basen Description: AH <- AL / basen AL <- AL MOD basen Flags Affected: SF,ZF,PF (modified) OF,AF,CF (undefined) CPU mode: RM,PM,VM,SMM Note: AAM without operands means AAM with operand 0AH. +++++++++++++++++++++++ Physical Form: AAM imm8 COP (Code of Operation) : D4H imm8 Clocks: AAM 0AH 8086: 83 80186: 19 80286: 16 80386: 17 i486: 15 Cx486SLC: 16 Pentium: 18 --------------------------------------------------- ADD4S - Addition for packed BCD strings CPU: NEC V20/V30 Type of Instruction: User Instruction: ADD4S Description: BCD STRING (ADDRESS=ES:DI,LENGTH=CL) <- BCD STRING (ADDRESS=DS:SI,LENGTH=CL) + BCD STRING (ADDRESS=ES:DI,LENGTH=CL); Note: si,di, other registers not changed Flags Affected: OF,CF,ZF ;; ZF set if both strings are zeros. ;; CF,OF set as result of operation with most ;; signification BCDs. CPU mode: RM +++++++++++++++++++++++ Physical Form: COP (Code of Operation) : 0FH 20H Clocks: ADD4S NEC V20: ~19*(CL/2)+7 --------------------------------------------------- BSWAP - Bytes Swap CPU: I486 + Type of Instruction: User Instruction: BSWAP dwordr Description: XCHG BYTE dwordr[31:24],dwordr[7:0] XCHG BYTE dwordr[23:16],dwordr[15:8] ; Need Good Picture to Show It Notes: This instruction used for converting big-endian (Intel) format to little-endian (Motorolla etc.) format. Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: BSWAP r32 COP (Code of Operation): 0FH 11001rrr (For 32bit segment) Clocks: Cyrix Cx486SLC : 4 i486 : 1 Pentium : 1 Cyrix Cx486DX : 4 UMC U5S : 2 --------------------------------------------------- CALLN - Call Native Mode Routine CPU: NEC/Sony V20/V30 etc Type of Instruction: System Instruction: CALLN intnum Description: CALLN instruction call (interrupt service in Native Mode) from 8080 emulation mode: PUSH FLAGS PUSH CS PUSH IP IF <- 0 TF <- 0 MD <- 1 MOV CS,0:[intnum*4+2] MOV IP,0:[intnum*4] Flags Affected: IF,TF,MD CPU mode: 8080 Emulation +++++++++++++++++++++++ Physical Form: CALLN imm8 COP (Code of Operation) : EDH EDH imm8 Clocks: NEC V20/V30: 38-58 --------------------------------------------------- CMPXCHG8B - Compare and exchange 8 bytes CPU: Pentium (tm) Type of Instruction: Operation Instruction: CMPXCHG8B dest Note: dest is memory operand: QWORD PTR [memory] Description: IF ( QWORD(EDX:EAX) = dest) THEN { ZF <- 1; dest <- QWORD(ECX:EBX); } ELSE { ZF <- 0; EDX:EAX <- dest } END Flags Affected: ZF CPU mode: RM,PM,VM,SMM Physical Form: CMPXCHG8B mem64 COP (Code of Operation) : 0FH C7H Postbyte Clocks: Pentium : 10 Note: Postbyte MMRRRMMM: MM<>11 if (==) then INT 6 --------------------------------------------------- CMPXCHG - Compare and exchange CPU: i486+ Type of Instruction: User Instruction: CMPXCHG dest,sorc Description: Acc = if OperationSize(8) -> AL OperationSize(16) -> AX OperationSize(32) -> EAX IF ( Acc = dest) THEN { ZF <- 1; dest <- sorc; } ELSE { ZF <- 0; Acc <- dest; } END Note: This instruction used to support semaphores Flags Affected: ZF ( see description) OF,SF,AF,PF,CF ( like CMP instruction ) ( see description) CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: CMPXCHG r/m8,r8 COP (Code of Operation) : 0FH A6H Postbyte ; i486 (A-B0 step) : 0FH B0H Postbyte ; i486 (B1+ step clones ; and upgrades) Clocks: Intel i486 : 6/7 if compare OK : 6/10 if compare FAIL Cyrix Cx486SLC : 5/7 Pentium (tm) : 6 Penalty if cache miss : Intel i486 : 2 Cyrix Cx486SLC : 1 +++++++++++++++++++++ Physical Form: CMPXCHG r/m16,r16 CMPXCHG r/m32,r32 COP (Code of Operation) : 0FH A7H Postbyte ; i486 (A-B0 step) : 0FH B1H Postbyte ; i486 (B1+ step clones ; and upgrades) Clocks: Intel i486 : 6/7 if compare OK : 6/10 if compare FAIL Cyrix Cx486SLC : 5/7 Pentium (tm) : 6 Penalty if cache miss : Intel i486 : 2 Cyrix Cx486SLC : 1 --------------------------------------------------- CPUID - CPU Identification CPU: Intel 486DX/SX/DX2 SL Enhanced and all later Intel processors include ( IntelDX4, IntelSX2, Pentium etc.), UMC microprocessors: U5S,U5SD,U5S-VL. Note: i.e. 1993+ years processors produced by Intel Note: To know if your CPU support CPUID instruction try to set ID flag ( bit 21 of EFLAGS ) to 1, and if it sets this mean that CPUID support.(Soft). Or If Your CPU is Intel Look for '&E' signature on Top side of Chip.(Hard) Type of Instruction: Operation Instruction: CPUID Description: IF (EAX=0) THEN { EAX <- Maximum value of EAX to CALL CPUID instruction 1 for all processors (date 1 September 1994) may be >1 in future microprocessors EBX <- 756E6547H i.e. 'Genu' EDX <- 49656E69H i.e. 'ineI' ECX <- 6C65746EH i.e. 'ntel' ;; EBX,EDX and ECX contain a OEM name string ;; for Intel this string is 'GenuineIntel' ;; for UMC this string is 'UMC UMC UMC ' } ELSEIF (EAX=1) THEN { EAX[3:0] <- Stepping ID EAX[7:4] <- Model EAX[11:8] <- Family ; 4 - i486 family ; 5 - Pentium family EAX[15:12] <- Reserved ; set to 0 now ; but I'm sure that for Pentium OverDrive for P54C ;this field will be set to 1 EAX[31:16] <- Reserved and set to 0s now EDX <- Compability flags ;; below all info if bit flag =1 EDX[0] <- FPU on Chip EDX[1] <- Virtual Mode Extention present EDX[2] <- CPU support I/O Breakpoints EDX[3] <- CPU support 4MB size pages EDX[4] <- TSC present (See RDTSC command) EDX[5] <- CPU have Pentium Compatible MSR (Model Specified Registers. EDX[6] <- Reserved (=0 now) EDX[7] <- Machine Check exception EDX[8] <- CMPXCHG8B instruction EDX[9] <- APIC on Chip EDX[31:10] <- Reserved and set to 0s now } ELSEIF ( EAX > 1 ) THEN { EAX,EBX,ECX,EDX <- Undefined } END. Global Note: This file contain open i.e nonconfiderential information about CPUID information. If you want MORE try to contact Intel, may be (but I'm sure that not) Intelers give you "Yellow Pages" (i.e Supplement to Pentium(tm) Processor User's Manual) to read inside office. Refer to: Appendix B for more informations about CPU codes. Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: CPUID COP (Code of Operation): 0FH A2H Clocks: 486s & Pentium (EAX=1) : 14 486s & Pentium (EAX=0 or EAX>1) : 9 --------------------------------------------------- F4X4 - FPU: Multiplicate vector on Matrix 4x4 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: F4X4 Description: ; This Instruction Multiplicate vector on ; Matrix 4X4 _ _ _ _ _ _ | | | | | | | Xn | | A00 A01 A02 A03 | | X0 | | Yn | = | A10 A11 A12 A13 | X | Y0 | | Zn | | A20 A21 A22 A23 | | Z0 | | Wn | | A30 A31 A31 A33 | | W0 | |_ _| |_ _| |_ _| ; Data fetches/stores from/to FPU registers: # of F E T C H E S STORE Register Bank0 Bank1 Bank2 Bank0 ST X0 A33 A31 Xn ST(1) Y0 A23 A21 Yn ST(2) Z0 A13 A11 Zn ST(3) W0 A03 A01 Wn ST(4) A32 A30 ST(5) A22 A20 ST(6) A12 A10 ST(7) A02 A00 Note: See FSBP0,FSBP1,FSBP2 for more information FPU Flags Affected: S FPU mode: Any Physical Form: F4X4 COP (Code of Operation): DBH F1H Clocks: IIT 2c87 : 242 IIT 3c87 : 242 IIT 3c87SX : 242 --------------------------------------------------- FNSTDW - FPU Not wait Store Device Word register FPU: i387SL Mobile Type of Instruction: FPU instruction Instruction: FNSTDW dest Description: dest <- Device Word Format of Device word: bit(s) Description 0-7 Reserved 8 S - Status bit: if S=1 then FP device is a static design and OS or APM Bios may set CLK slow to 0 Mhz without lost any data. 9-15 Reserved Note: Device word register valid only after FNINIT FPU Flags Affected: None CPU mode: Any Physical Form: FNSTDW AX COP (Code of Operation): DFH E1H Clocks: i387SL Mobile: 13 --------------------------------------------------- FNSTSG - FPU Not wait Store Signature Word register FPU: i387SL Mobile Type of Instruction: FPU instruction Instruction: FNSTSG dest Description: dest <- Signature Word Format of Signature word: bit(s) Description 3-0 Revision 7-4 Steppin 11-8 Family 15-12 Version Note: For i387(tm) SL Mobile Signature is: Version = 2 Family = 3 ; 387 Stepping = 1 ; Ax step Revision = 0 ; x0 step i.e i387(tm) SL is A0 step Note: This FPU is out of life Note: Signature word register valid only after FNINIT FPU Flags Affected: None CPU mode: Any Physical Form: FNSTSG AX COP (Code of Operation): DFH E2H Clocks: i387SL Mobile: 13 --------------------------------------------------- FRICHOP - FPU: Round to Integer chop method FPU: Cyrix FPUs and 486s with FPU on chip Type of Instruction: FPU instruction Instruction: FRICHOP Description: ST <- ROUND ( ST,CHOP ) Note: This instruction calculate rounding ST toward zero i.e. ignoring part righter that decimal . Examples: 1.2 -> 1.0 -1.2 -> -1.0 3.0 -> 3.0 0.0 -> 0.0 1.5 -> 1.0 -2.0 -> -2.0 FPU Flags Affected: S,P,D,I,C1 FPU mode: Any Physical Form: FRICHOP COP (Code of Operation): DDH FCH Clocks: Cx83D87 : 15 Cx83S87 : 15 CxEMC87 : 15 Cx487DLC : --------------------------------------------------- FRINEAR - FPU: Round to Integer Nearest method FPU: Cyrix FPUs and 486s with FPU on chip Type of Instruction: FPU instruction Instruction: FRINEAR Description: ST <- ROUND ( ST,NEAREST ) Note: This instruction calculate rounding ST toward nearest Examples: 1.2 -> 1.0 -1.2 -> -1.0 3.0 -> 3.0 0.0 -> 0.0 1.5 -> 1.0 1.8 -> 2.0 -2.0 -> -2.0 FPU Flags Affected: S,P,D,I,C1 FPU mode: Any Physical Form: FRINEAR COP (Code of Operation): DFH FCH Clocks: Cx83D87 : 15 Cx83S87 : 15 CxEMC87 : 15 Cx487DLC : --------------------------------------------------- FRINT2 - FPU: Round to Integer FPU: Cyrix FPUs and 486s with FPU on chip Type of Instruction: FPU instruction Instruction: FRINT2 Description: IF ( exact half ) THEN { ST <- SIGN(ST) * ROUND(ABS(ST)+0.5,NEAREST) } ELSE { ST <- ROUND ( ST,NEAREST ) } END Note: This instruction calculate rounding ST toward nearest, but if number is exact half then this instruction round it toward signed infinity. Sign of this infinity is same with sign of number. Examples: 1.2 -> 1.0 -1.2 -> -1.0 3.0 -> 3.0 0.0 -> 0.0 1.5 -> 2.0 1.8 -> 2.0 -2.0 -> -2.0 -1.5 -> -2.0 FPU Flags Affected: S,P,D,I,C1 FPU mode: Any Physical Form: FRINT2 COP (Code of Operation): DBH FCH Clocks: Cx83D87 : 15 Cx83S87 : 15 CxEMC87 : 15 Cx487DLC : --------------------------------------------------- FRSTPM - FPU Reset Protected Mode FPU: i287XL i287XLT Type of Instruction: FPU instruction Instruction: FRSTPM Description: Reset Cooprocessor from Protected Mode to Real Address mode. FPU Flags Affected: None CPU mode:Any ??? Physical Form: FRSTPM COP (Code of Operation): DBH E5H Clocks: i287XL : 12 i287XLT : 12 --------------------------------------------------- FSBP0 - FPU: Set Bank pointer to Bank # 0 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: FSBP0 Description: ; This Instruction set current bank pointer to ; Bank # 0. ; Each bank contain eight 80bit registers ; There are 3 banks (0,1,2) in Chip ; After initialization FPU select bank # 0. FPU Flags Affected: None FPU mode: Any Physical Form: FSBP0 COP (Code of Operation): DBH E8H Clocks: IIT 2c87 : 6 IIT 3c87 : 6 IIT 3c87SX : 6 --------------------------------------------------- FSBP1 - FPU: Set Bank pointer to Bank # 1 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: FSBP1 Description: ; This Instruction set current bank pointer to ; Bank # 1. ; Each bank contain eight 80bit registers ; There are 3 banks (0,1,2) in Chip ; After initialization FPU select bank # 0. FPU Flags Affected: None FPU mode: Any Physical Form: FSBP1 COP (Code of Operation): DBH EBH Clocks: IIT 2c87 : 6 IIT 3c87 : 6 IIT 3c87SX : 6 --------------------------------------------------- FSBP2 - FPU: Set Bank pointer to Bank # 2 FPU: IIT FPUs. Type of Instruction: FPU instruction Instruction: FSBP2 Description: ; This Instruction set current bank pointer to ; Bank # 2. ; Each bank contain eight 80bit registers ; There are 3 banks (0,1,2) in Chip ; After initialization FPU select bank # 0. FPU Flags Affected: None FPU mode: Any Physical Form: FSBP2 COP (Code of Operation): DBH EAH Clocks: IIT 2c87 : 6 IIT 3c87 : 6 IIT 3c87SX : 6 --------------------------------------------------- IBTS - Insert Bits String CPU: 80386 step A0-B0 only Type of Instruction: User Instruction: IBTS base,bitoffset,len,sorc Description: Write bit string length bits from [bits .. 0 ] (lowest bits) to bitfield, defined by and bitsoffset from this base to start of the field to write. String write from this start field bit to higher memory addresses or register bits. Flags Affected: None CPU mode: RM,PM,VM +++++++++++++++++++++++ Physical Form: IBTS r/m16,AX,CL,r16 IBTS r/m32,EAX,CL,r32 COP (Code of Operation) : 0FH A7H Postbyte Clocks: IBTS 80386: 12/19 --------------------------------------------------- ICEBP - PWI Mode BreakPoint, ICE address space CPU: IBM 486SLC2 Type of Instruction: System Instruction: ICEBP Description: IF (condition) THEN ; see condition below { SAVE STATUS OF EXECUTION TO ICE space; ENTER SMM; } ELSE { INT 1; } END Note: This condition can be set before execution this instruction: CPL=0 MSR1000H.EPCEA=1 MSR1000H.EPWI=1 Flags Affected: None CPU mode: RM,PM0 Physical Form: ICEBP COP (Code of Operation): F1H Clocks: IBM 486SLC2 : 460 --------------------------------------------------- ICEBP - In-Circuit Emulator Breakpoint CPU: some models of i486, i386 Type of Instruction: System Instruction: ICEBP Description: IF (condition) THEN ; see condition below { CHANGED TO THE ICE instruction mode; } ELSE { INT 1; } END Note: Condition is DR7.bit12=1 Note: This instruction very usefull to debbuging as Single-Byte Interrupt but it generate never int 3, but int 1. Note: Andrew Schulman in his book "The PC Undocument", 1994 year say that this instruction is VERY UNDOCUMENT. Flags Affected: None CPU mode: RM,PM0 Physical Form: ICEBP COP (Code of Operation): F1H Clocks: : N/A --------------------------------------------------- ICERET - Return from PWI mode, ICE space CPU: IBM 486SLC2 Type of Instruction: System Operation (Work only then CPL=0) Instruction: ICERET Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI, and return from PWI mode. Format of ICERET Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 Reserved 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 REP OUTS overrun flag 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit Unknown Unusable area ;; Temporary registers: 100H 4 TST 104H 4 IDX 108H 4 TMPH 10CH 4 TMPG 110H 4 TMPF 114H 4 TMPE 118H 4 TMPD 11CH 4 TMPC 120H 4 TMPB 124H 4 TMPA 128H 4 CR2 12CH 4 CR3 130H 4 MSR1001H (31-0) 134H 4 MSR1001H (63-32) 138H 4 MSR1000H (15-0) 13CH 4 DR0 140H 4 DR1 144H 4 DR2 148H 4 DR3 14CH 4 PEIP Length of table is 150H bytes. Note: For descriptor format refer to LOADALL and RES3 instructions. Flags Affected: All (FLAGS Register Reload) CPU mode: SMM Physical Form: ICERET COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL Clocks: IBM 486SLC2 : 440 --------------------------------------------------- INVD - Invalidate Cache Buffer CPU: I486 + Type of Instruction: System Instruction: INVD Description: FLUSH INTERNAL CACHE ( It means that all lines of internal caches sets as invalid ) SIGNAL EXTERNAL CACHE TO FLUSH Notes: This instruction not work in Real Mode and in Protected mode work only in ring 0 ; Flags Affected: None CPU mode: PM0,SMM? Physical Form: INVD COP (Code of Operation): 0FH 08H Clocks: Cyrix Cx486SLC : 4 i486 : 4 Pentium : 15 --------------------------------------------------- INVLPG - Invalidate Page Entry In TLB CPU: I486 + Type of Instruction: System Instruction: INVLPG mem Description: IF found in data or code (if both) (or common if single) TLB entry with linear address (page part) same as memory operand then mark this entry as Invalid; Notes: This instruction not work in Real Mode and in Protected mode work only in ring 0 ; Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: INVLPG mem COP (Code of Operation): 0FH 01H mm111mmm Clocks: Cyrix Cx486SLC : 4 i486 : 12 if hit : 11 if not hit Pentium : 25 --------------------------------------------------- LOADALL - Load All Registers CPU: Intel 386+ +all clones Type of Instruction: System (Work only then CPL=0) Instruction: LOADALL Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI Format of LOADALL Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 0s 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 0s 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit CCH 4 Length of table D0H 30h Unused,not loaded 100H 4 Temporary Register IST 104H 4 Temporary Register I 108H 4 Temporary Register H 10CH 4 Temporary Register G 110H 4 Temporary Register F 114H 4 Temporary Register E 118H 4 Temporary Register D 11CH 4 Temporary Register C 120H 4 Temporary Register B 124H 4 Temporary Register A Format of Attrib field: Byte Description 0 0s 1 AR (Access Right) byte in the Descriptor format Note: P bit is a valid bit if valid bit=0 then Shadow Register is invalid and INT 0DH - General Protection Fault call DPL of SS,CS det. CPL 2-3 0s Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0 Physical Form: LOADALL COP (Code of Operation): 0FH 07H Clocks: i386XX : n/a i486XX : n/a Note: This operation used 102 data transfer cycles on 32bit bus Typical clocks: i386SX: ~350 i386DX: ~290 i486XX: ~220 --------------------------------------------------- LOADALL - Load All Registers From Table CPU: Intel 80286 and all its clones Type of Instruction: System (Work only then CPL=0) Instruction: LOADALL Description: Load All Registers (Include Shadow Registers) from Table Which Begin on 000800H Address, Len of this table is 66H Format of LOADALL Table: Address Len Description 800H 6 None 806H 2 MSW 808H 14 None 816H 2 TR 818H 2 FLAGS 81AH 2 IP 81CH 2 LDTR 81EH 2 DS 820H 2 SS 822H 2 CS 824H 2 ES 826H 2 DI 828H 2 SI 82AH 2 BP 82CH 2 SP 82EH 2 BX 830H 2 DX 832H 2 CX 834H 2 AX 836H 6 ES Shadow Descriptor 83CH 6 CS Shadow Descriptor 842H 6 SS Shadow Descriptor 848H 6 DS Shadow Descriptor 84EH 6 GDTR 854H 6 LDT Shadow Descriptor 85AH 6 IDTR 860H 6 TSS Shadow Descriptor Format of Shadow Descriptor: Byte Description 0-2 24bit Phisical Address 3 AR (Access Right) byte 4-5 16bit Segment Limit Format of GDTR and IDTR: Byte Description 0-2 24bit Phisical Address 3 0s 4-5 16bit Segment Limit Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0 Physical Form: LOADALL COP (Code of Operation): 0FH 05H Clocks: 80286 : 195 --------------------------------------------------- RDMSR - Read From Model Specified Register CPU: Pentium (tm), IBM 386SLC,486SLC,486SLC2 Type of Instruction: System Instruction: RDMSR Description: IF (ECX is valid number of MSR) and (CPL=0) THEN { EDX:EAX <- MSR [ECX]; } ELSE { General Protection Fault INT 0DH (0) } END Valid number Of MSR is: Pentium: 0-2,4-0Eh,10h-13h IBM 486SLC2: 1000H-1002H IBM 386SLC: 1000H-1001H IBM 486SLC: 1000H-1001H Flags Affected: None CPU mode: RM,PM0,SMM Physical Form: RDMSR COP (Code of Operation): 0FH 32H Clocks: Pentium : 20-24 Note: The MSR # 3,0fh and >13h are reserved. Do not execute RDMSR/WRMSR with this values. Register Description MSR 0 is Machine check Exception Address register (Read only) bits Description 63..32 Reserved 31..0 Machine Check Phisical Address MSR 1 is Machine Check Type register (Read Only) bits Description 63..5 Reserved 4 LOCK =1 if bus cycle called Machine Check was Locked =0 if --//-- not locked (normal) 3 M/IO# \ 2 D/C# State of output pins in bus cycle called 1 W/R# / Machine check 0 CHK (Check) =1 after last read MSR 1 was Machine Check Note: This bit Clearing on reading MSR 2,4,5,6,7,8,9,Ah,Bh,Ch,Dh,Eh used to perform Cache,TLB,BTB testing and perfomance monitoring. This registers named Test Registers 0,2-C. MSR Eh is Test Register 12 (TR 12) (Read/Write) bits Description 63..4 Reserved 3 CI 2 SE 1 TR (Tracing Control) After reset clear to zero. This bit enable/disable special branch trace message cycle which generating when BTB hit. =0 disable =1 enable 0 NBP MSR 10h is Time Stamp Counter (TSC) (Read/Write) Time Stamp Counter (as all other MSRs) is clearing to 0 when RESET pin shutdown and unchanged when INIT pin shutdown. TSC is incremented every CPU core clock cycle. MSR 11h is Control/Event Select Register (CESR) (Read/Write) Init value after reset = 00000000000000000h bits Description 63..25 Reserved 24 Counting Method (Counter #1) =1 count CPU cycles =0 count events 23 Allow count in CPL=3 (Counter #1) =1 Yes =0 No 22 Allow count in CPL<3 (Counter #1) =1 Yes =0 No 21..16 Event Type for Counter #1 (see below) 15..9 Reserved 8 Counting Method (Counter #0) =1 count CPU cycles =0 count events 7 Allow count in CPL=3 (Counter #0) =1 Yes =0 No 6 Allow count in CPL<3 (Counter #0) =1 Yes =0 No 5..0 Event Type for counter #0 Value Event Type 00h Data Read 01h Data Write 02h Data TLB miss 03h Data Read Miss 04h Data Write miss 05h Write hit to Modified or Exclusive Cacheline 06h Data cache lines written back 07h Data cache snoops 08h Data cache snoops hit 09h Memory access in both pipes 0Ah Data bank access conflict 0Bh Misaligned data memory references 0Ch Code read 0Dh Code TLB miss 0Eh Code cache miss 0Fh Any segment register load 10h Segment descriptor cache accessed 11h Segment descriptor cache hit 12h Branches 13h BTB hit 14h Taken branch or BTB hit 15h Pipeline flushes 16h Instructions executed 17h Instruction executed in V pipes 18h Bus utilization 19h Pipeline stalled by write backups 1Ah Pipeline stalled by data memory read 1Bh Pipeline stalled by write to M or E line 1Ch Locked bus cycle 1Dh I/O cycle 1Eh Noncachable memory references 1Fh Pipeline stalled by AGI 20h-21h Reserved 22h FP operations 23h Breakpoint 0 match 24h Breakpoint 1 match 25h Breakpoint 2 match 26h Breakpoint 3 match 27h Hardware interrupt 28h Data read or data write 29h Data read/write miss 2Ah-3Fh Reserved MSR 12h is Counter #0 (Read/Write) bits Description 63..?? Reserved ??..0 Current counter value MSR 13h is Counter #1 (Read/Write) bits Description 63..?? Reserved ??..0 Current counter value MSR 1000H is Processor Operation Register (IBM only) (486SLC/486SLC2/386SLC) bits Description 63..19 Reserved 18 LWPLA (Low Power PLA) (reserved on IBM 386SLC) 17 BUSRD (Bus Read) (reserved on IBM 386SLC) 16 CPGE (Cache Parity Generate Error) (reserved on IBM 386SLC) 15 ECNPX (Enable cachebility of NPX operands) 14 EPWIA (Enable PWI ADS) 13 ELPWH (Enable Low Power Halt Mode) 12 XTOUT (Extend Out Instruction) 11 CRLD (Cache reload bit) 10 EIKEN (Enable internal KEN#) 9 DSCL (Disable cache Lock Mode) 8 Reserved 7 CE (Cache enable) 6 EDBS (Enable DBCS) 5 EPWI (Enable Power Interrupt) 4 EFSP (Enable Flush Snooping) 3 ENSP (Enable Snoop Input) 2 A20M (Address line 20 Mask) 1 CPCE (Cache Parity Checking Enable) 0 CPE (Cache Parity Error) MSR 1001H is Cache Region Control Register (IBM only) ( IBM 386SLC/486SLC/486SLC2) bits description 63..40 Reserved 39..32 Cache Memory Limit (CMLR) 31..16 1st MB Read Only (LMROR) 15..0 1st MB Cachable (LMCR) MSR 1002H is processor operation register (IBM only) (IBM 486SLC2 only) bits description 63..30 Reserved 29 EEDFS (Enable External Dynamic Frequency Shift) 28 DFSRY (Dynamic Frequency Shift Ready) 27 DFSMD (Dynamic Frequency Shift Mode) 26..24 CLKMD (Clock Mode) =000 x2 =011 x1 23..0 Reserved Note: MSRs usefull documented in "Supplement to Pentium Processors User's Manual" (Intel Corp. 1993,1994). IBM MSRs documented in "486SLC2 (tm) Microprocessor Data Sheet" (IBM Corp. 1993,Order number: VT05452) --------------------------------------------------- RDTSC - Read From Time Stamp Counter CPU: Pentium (tm) Type of Instruction: System/User Instruction: RDTSC Description: IF (CR4.TSD=0) or ((CR4.TSD=1) and (CPL=0)) THEN { EDX:EAX <- TSC; } ELSE { General Protection Fault INT 0DH (0) } END Note: TSC is one of MSR and after global hardware reset (not SRESET , but RESET ) it clear to 0000000000000000H. TSC is MSR index 10h. TSC may set using WRMSR instruction. TSC incremented every CPU core clock cycle. Flags Affected: None CPU mode: RM,PM0,SMM ; PM,VM if enable Physical Form: RDTSC COP (Code of Operation): 0FH 31H Clocks: Pentium : n/a [20-24] --------------------------------------------------- REPC - Repeat While Carry Flag CPU: NEC V20, NEC V30, etc [ Vxx seria ] Sony V20, Sony V30 Type of Instruction: Prefix Instruction: REPC Description: DO CX=CX-1; SERVICE_PENDING_INTERRUPT; STRING_INSTRUCTION; LOOPWHILE ((CX<>0) AND (CF==1)); Flags Affected: None CPU Mode: RM 8086 Physical Form: REPC COP (Code of Operation): 65H Clocks: NEC V20 : 2 NEC V30 : 2 --------------------------------------------------- REPNC - Repeat While Not Carry Flag CPU: NEC V20, NEC V30, etc [ Vxx seria ] Sony V20, Sony V30 Type of Instruction: Prefix Instruction: REPNC Description: DO CX=CX-1; SERVICE_PENDING_INTERRUPT; STRING_INSTRUCTION; LOOPWHILE ((CX<>0) AND (CF<>1)); Flags Affected: None CPU mode: RM 8086 Physical Form: REPNC COP (Code of Operation): 64H Clocks: NEC V20 : 2 NEC V30 : 2 --------------------------------------------------- RES3 - Restore All CPU Registers CPU: AMD Am386SXLV, Am386DXLV Type of Instruction: System Operation (Work only then CPL=0) Instruction: RES3 Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI Note: This instruction is AMD analog Intel's LOADALL instruction but it's more i.c. return from SMM used this instruction. Then in SMM table is in SMRAM, then non SMM then table is in main memory. Format of RES3 Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 Reserved 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 REP OUTS overrun flag 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit Unknown Unusable area 100H 4 Temporary register 104H 4 ------------- 108H 4 ------------- 10CH 4 ------------- 110H 4 ------------- 114H 4 ------------- 118H 4 ------------- 11CH 4 ------------- 120H 4 ------------- 124H 4 Last EIP (Last instruction EIP for Restart) Format of Attrib field: Byte Description 0 0s 1 AR (Access Right) byte in the Descriptor format Note: P bit is a valid bit if valid bit=0 then Shadow Register is invalid and INT 0DH - General Protection Fault call DPL of SS,CS det. CPL 2-3 0s Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0,SMM Physical Form: RES3 COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL Clocks: Am386SXLV : 366 Am386DXLV : 291 --------------------------------------------------- RES4 - Restore All CPU Registers CPU: AMD Am486SXLV, Am486DXLV Type of Instruction: System Operation (Work only then CPL=0) Instruction: RES3 Description: Load All Registers (Include Shadow Registers) from Table Which Begin on place pointed ES:EDI Note: This instruction is AMD analog Intel's LOADALL instruction but it's more i.c. return from SMM used this instruction. Then in SMM table is in SMRAM, then non SMM then table is in main memory. Format of RES3 Table: Offset Len Description 0H 4 CR0 4H 4 EFLAGS 8H 4 EIP CH 4 EDI 10H 4 ESI 14H 4 EBP 18H 4 ESP 1CH 4 EBX 20H 4 EDX 24H 4 ESX 28H 4 EAX 2CH 4 DR6 30H 4 DR7 34H 4 TR (16 bit, zero filled up) 38H 4 LDT --------- 3CH 4 GS --------- 40H 4 FS --------- 44H 4 DS --------- 48H 4 SS --------- 4CH 4 CS --------- 50H 4 ES --------- 54H 4 TSS.attrib 58H 4 TSS.base 5CH 4 TSS.limit 60H 4 Reserved 64H 4 IDT.base 68H 4 IDT.limit 6CH 4 REP OUTS overrun flag 70H 4 GDT.base 74H 4 GDT.limit 78H 4 LDT.attrib 7CH 4 LDT.base 80H 4 LDT.limit 84H 4 GS.attrib 88H 4 GS.base 8CH 4 GS.limit 90H 4 FS.attrib 94H 4 FS.base 98H 4 FS.limit 9CH 4 DS.attrib A0H 4 DS.base A4H 4 DS.limit A8H 4 SS.attrib ACH 4 SS.base B0H 4 SS.limit B4H 4 CS.attrib B8H 4 CS.base BCH 4 CS.limit C0H 4 ES.attrib C4H 4 ES.base C8H 4 ES.limit Unknown Unusable area 100H 4 Temporary register 104H 4 ------------- 108H 4 ------------- 10CH 4 ------------- 110H 4 ------------- 114H 4 ------------- 118H 4 ------------- 11CH 4 ------------- 120H 4 ------------- 124H 4 Last EIP (Last instruction EIP for Restart) 128H 4 PEIP - Previous SRAM space instruction pointer 12EH 36 Unused 150H 22 Floating Pointer Internal Registers (Am486DXLV) Format of Attrib field: Byte Description 0 0s 1 AR (Access Right) byte in the Descriptor format Note: P bit is a valid bit if valid bit=0 then Shadow Register is invalid and INT 0DH - General Protection Fault call DPL of SS,CS det. CPL 2-3 0s Flags Affected: All (FLAGS Register Reload) CPU mode: RM,PM0,SMM Physical Form: RES4 COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL Clocks: Am486SXLV : N/A --------------------------------------------------- RSDC - Restore Register and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 TI Potomac Type of Instruction: System Instruction: RSDC sreg,sorc Description: sreg [selector,shadow_descriptor] <- sorc ; sorc is register and descriptor structure (see below) ; Note: This instruction load segment register ; include shadow descriptor Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 10h Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: RSDC sgeg,mem80 COP (Code of Operation) : 0FH 79H [mm sreg3 mmm] Clocks IBM BL486DX: 10 Note: sreg3 is: 000 ES 001 CS 010 SS 011 DS 100 FS 101 GS --------------------------------------------------- RSLDT - Restore LDTR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 TI Potomac Type of Instruction: System Instruction: RSLDT sorc Description: LDTR [selector,shadow_descriptor] <- sorc ; sorc is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 10h Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: RSLDT mem80 COP (Code of Operation) : 0FH 7BH [mm 000 mmm] Clocks IBM BL486DX: 10 --------------------------------------------------- RSM - Resume from System Managment Mode CPU: I486 SL Enhanced+,i486SL,i386CX,i386EX Type of Instruction: System Instruction: RSM Description: Restore execution state from SMRAM and return to previous CPU mode CPU mode: SMM only ( INT 6 - Undefined Opcode in all other mode ) Flags Affected: All Note: CPU state restored from dump created entrance to SMM. The CPU leave SMM and return to previous mode. If CPU detect any invalid state it enters shutdown. This invalid states is: * The value stored in State Dump Base field is not 32K aligned address * Any Reserved bit of CR4 is set to 1 (Pentium only) * Any illegal Combination of CR0: ** (PG=1 and PE=0) ** (NW=1 and CD=0) Physical Form: RSM COP (Code of Operation) : 0FH AAH Clocks: i386CX : 338 i486 SL Enhanced : ??? IntelDX4 : 452 ; SMBASE relocation : 456 ; AutoHALT restart : 465 ; I/O Trap restart Pentium : 83 --------------------------------------------------- RSM - Resume from SMM CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 TI Potomac Type of Instruction: System Instruction: RSM Description: RESTORE CPU STATE FROM SMM HEADER AT THE TOP OF SMM SPACE (defined by SMAR register); EXIT SMM; Format of SMM Header: Offset Length Description -00h - Nothing (Top of SMM space) (Not accessable) -04h 32 DR7 -08h 32 EFLAGS -0Ch 32 CR0 -10h 32 Current EIP -14h 32 Next instruction EIP -16h 16 Reserved -18h 16 CS selector -1Ch 32 CS descriptor(63-32) -20h 32 CS descriptor(31-0) -24h 32 SMM Flags [ Not available in Cx486S/S2/D/D2] Bit Description 1 I (IN/INSx/OUT/OUTx Indicator) If =0 current instruction performed I/O read =1 I/O write 2 P (REP INSx/OUTx Prefix) If =1 current instruction has REP pfix. =0 not has REP pfix 3 S (Software SMI) If =1 current SMM is result of execution SMINT instruction =0 current SMM is result of hardware SMI -26h 16 I/O Write Data size [ Not available in Cx486S/S2/D/D2] 1h = byte 3h = word fh = dword -28h 16 I/O Write Address [ Not avaliable in Cx486S/S2/D/D2] -2Ch 32 I/O Write Data [ Not avaliable in Cx486S/S2/D/D2] -30h 32 ESI or EDI This field saved value of source/destination for restart INSx/OUTSx instruction [ Not avaliable in Cx486S/S2/D/D2] Flags Affected: All CPU mode: SMM ++++++++++++++++ Physical Form: RSM COP (Code of Operation) : 0FH AAH Clocks IBM BL486DX: 76 --------------------------------------------------- RSTS - Restore TR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 Type of Instruction: System Instruction: RSTS sorc Description: TR [selector,shadow_descriptor] <- sorc ; sorc is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 10h Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: RSTS mem80 COP (Code of Operation) : 0FH 7DH [mm 000 mmm] Clocks IBM BL486DX: 10 --------------------------------------------------- SETALC - Set AL to Carry Flag CPU: Intel 80286 and all its clones and upward compatibility chips Type of Instruction: User Instruction: SETALC Description: IF (CF=0) THEN AL:=0 ELSE AL:=FFH; Flags Affected: None CPU mode: RM,PM,VM,SMM Physical Form: SETALC COP (Code of Operation): D6H Clocks: 80286 : n/a [3] 80386 : n/a [3] Cx486SLC : n/a [2] i486 : n/a [3] Pentium : n/a [3] Note: n/a is Time that Intel etc not say. [3] is real time it executed. --------------------------------------------------- SMI - System Managment Interrupt CPU: AMD Am386SXLV,Am386DXLV AMD 486s Type of Instruction: System Instruction: SMI Description: IF (SMIE=1) THEN { SAVE STATUS OF EXECUTION TO SMRAM; ENTER SMM; SMMS <- 1; } ELSE { INT 1; } END Notes: SMIE is (DR7.bit12) =1 Enable soft SMI =0 Disable soft SMI SMMS is (DR6.bit12) =1 SMM was entered =0 SMM status cleared Flags Affected: None CPU mode: RM?,PM0 Physical Form: SMI COP (Code of Operation): F1H Clocks: Am386SXLV : 357 Am386DXLV : 325 Am486xxxx : Don't know, do you? --------------------------------------------------- SMINT - Software SMM Interrupt CPU: Cyrix Cx486DX/DX2 IBM BL486DX/DX2 Note: Never in Cx486S/S2/D/D2 Type of Instruction: System Instruction: SMINT Description: SAVE CPU STATE TO SMM HEADER AT THE TOP OF SMM SPACE (defined by SMAR register); ENTER SMM MODE; Format of SMM Header: Refer to Cyrix/IBM SMI Instruction Flags Affected: None CPU mode: CPL=0, CCR1.bit1=1, SMAR size >= 30h. ++++++++++++++++ Physical Form: SMINT COP (Code of Operation) : 0FH 7EH Clocks IBM BL486DX: 24 --------------------------------------------------- SVDC - Save Register and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 TI Potomac Type of Instruction: System Instruction: SVDC dest,sreg Description: dest <- sreg [selector,shadow_descriptor] ; dest is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 10h Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: SVDC mem80,sreg COP (Code of Operation) : 0FH 78H [mm sreg3 mmm] Clocks IBM BL486DX: 18 Note: sreg3 is: 000 ES 001 CS 010 SS 011 DS 100 FS 101 GS --------------------------------------------------- SVLDT - Save LDTR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 TI Potomac Type of Instruction: System Instruction: SVLDT dest Description: dest <- LDTR [selector,shadow_descriptor] ; dest is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 10h Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: SVLDT mem80 COP (Code of Operation) : 0FH 7AH [mm 000 mmm] Clocks IBM BL486DX: 18 --------------------------------------------------- SVTS - Save TR and Descriptor CPU: Cyrix Cx486S/S2/D/D2/DX/DX2 IBM BL486DX/DX2 TI Potomac Type of Instruction: System Instruction: SVTS dest Description: dest <- TR [selector,shadow_descriptor] ; dest is register and descriptor structure (see below) Format or Register and Descriptor Structure: +00 Limit (15-0) +02 Base (15-0) +04 Base (23-16) +05 AR byte +06 AR2/Limit (19-16) +07 Base (31-24) +08 Selector Length of structure is 10h Flags Affected: None CPU mode: (1) and (2) and (3) and [(4A) or (4B)] 1) CPL=0 2) CCR1.bit1=1 ; SMI enable 3) SMAR size > 0 4A) in SMM 4B) CCR1.bit2=1 ; SMAC is on ++++++++++++++++ Physical Form: SVTS mem80 COP (Code of Operation) : 0FH 7CH [mm 000 mmm] Clocks IBM BL486DX: 18 --------------------------------------------------- UMOV - Mov Data to Main (User) Memory CPU: AMD Am386SXLV,Am386DXLV AMD 486s IBM 486SLC2 Type of Instruction: Special System Instruction: UMOV dest,sorc Description: dest <- sorc; Note!!!!!: But all memory operands placed in Main memory only ! ( i.e. not in SMRAM then in SMM ) Flags Affected: None CPU mode: RM?,PM?,VM?,SMM +++++++++++++++++++++++ Physical Form: UMOV r/m8,r8 COP (Code of Operation) : 0FH 10H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/2 IBM 486SLC2 : 4 +++++++++++++++++++++ Physical Form: UMOV r/m16,r16 UMOV r/m32,r32 COP (Code of Operation) : 0FH 11H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/2 IBM 486SLC2 : 4 +++++++++++++++++++++++ Physical Form: UMOV r8,r/m8 COP (Code of Operation) : 0FH 12H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/4 IBM 486SLC2 : 4 +++++++++++++++++++++ Physical Form: UMOV r16,r/m16 UMOV r32,r/m32 COP (Code of Operation) : 0FH 13H Postbyte Clocks: Am386SXLV or AM386DXLV: 2/4 IBM 486SLC2 : 4 --------------------------------------------------- WBINVD - Write Back and Invalidate Cache CPU: I486 + Type of Instruction: System Instruction: WBINVD Description: IF (internal cache is WB and in WB mode) THEN { Write Back Internal Cache; } Flush internal cache; Signal external cache to Write Back; Signal external cache to Flush; Notes: This instruction not work in Real Mode and in Protected mode work only in ring 0 ; Flags Affected: None CPU mode: PM0,SMM Physical Form: INVD COP (Code of Operation): 0FH 09H Clocks: Cyrix Cx486SLC : 4 i486 : 5 Pentium : 2000+ --------------------------------------------------- WRMSR - Write to From Model Specified Register CPU: Pentium (tm), IBM 486SLC2 Type of Instruction: System Instruction: WRMSR Description: IF (ECX is valid number of MSR) and (CPL=0) THEN { MSR [ECX] <- EDX:EAX; } ELSE { General Protection Fault INT 0DH (0) } END Flags Affected: None Note: Refer to RDMSR for more Info. CPU mode: RM,PM0,SMM Physical Form: WRMSR COP (Code of Operation): 0FH 30H Clocks: Pentium : 30-45 --------------------------------------------------- XADD - Exchange and addition CPU: i486+ Type of Instruction: User Instruction: XADD dest,sorc Description: Temporary <- dest; dest <- dest + sorc; sorc <- Temporary; Flags Affected: ZF,OF,SF,AF,PF,CF ( like ADD instruction ) ( see description) CPU mode: RM,PM,VM,SMM +++++++++++++++++++++++ Physical Form: XADD r/m8,r8 COP (Code of Operation) : 0FH C0H Postbyte Clocks: Intel i486 : 3/4 Cyrix Cx486SLC : 3/6 Pentium (tm) : 3/4 Penalty if cache miss : Intel i486 : 6/2 ; Unlocked/Locked Cyrix Cx486SLC : 0 ; N/A +++++++++++++++++++++ Physical Form: XADD r/m16,r16 XADD r/m32,r32 COP (Code of Operation) : 0FH C1H Postbyte Clocks: Intel i486 : 3/4 Cyrix Cx486SLC : 3/6 Pentium (tm) : 3/4 Penalty if cache miss : Intel i486 : 6/2 ; Unlocked/Locked Cyrix Cx486SLC : 1 ; N/A --------------------------------------------------- XBTS - Extract Bits String CPU: 80386 step A0-B0 only Type of Instruction: User Instruction: XBTS dest,base,bitoffset,len Description: Write bit string length bits from bitfield, defined by and bitsoffset from this base to start of the field to read. String read from this start field bit to higher memory addresses or register bits. And after it string placed to operand, lowest bit of register or memory to bit 0 of . Note: Use SHLD/SHRD instructions for extract bits strings. On 80386 steps B1+ this opcode generation INT 6, and on some of 486 other instruction replace this instruction opcode. Flags Affected: None CPU mode: RM,PM,VM +++++++++++++++++++++++ Physical Form: XBTS r16,r/m16,AX,CL XBTS r32,r/m32,EAX,CL COP (Code of Operation) : 0FH A6H Postbyte Clocks: XBTS 80386: 6/13 ----------------------------------------------------- APPENDIX A0 Cyrix Cx486SLC/DLC configuration Registers Register Full Register Name Index size(bits) CCR0 Configuration Control Register #0 C0H 8 CCR1 Configuration Control Register #1 C1H 8 NCR1 Non-cacheble Region #0 C4H-C6H 24 NCR2 Non-cachable Region #1 C7H-C9H 24 NCR3 Non-cacheble Region #2 CAH-CCH NCR4 Non-cacheble Region #4 CDH-CFH 24 For access to this register You need to do: A) write INDEX_OF_REGISTER to I/O port #22H B) wait 5-6 clocks D) read/write DATA from/to register via I/O port #23 Note: If Index of register not in range C0H..CFH then Cyrix CPU generated external bus cycle. If You try to read I/O port #22H CPU will generated external bus cycle too. Then index is out of range all operations with port #23H will generate external bus cycle. State After Reset: CCR0 00H CCR1 xxxx xxx0B NCR1 000Fh (SLC) NCR2 0 NCR3 0 NCR4 0 format of registers: CCR0: Bit Name Description 7 SUSPEND If =1 then enable SUSP# and SUSPA# pins, which used for put CPU in PowerSave mode. If =0 disable 6 CO (Cache Organisation) If =0 2ways set associative If =1 Dirrect Mapped 5 BARB If =1 then enable flushing internal cache when begining HOLD state. IF =0 disable. 4 FLUSH If =1 enable input pin FLUSH# if =0 disable 3 KEN If =1 enable input pin KEN# if =0 disable 2 A20M If =1 enable input pin A20M# if =0 disable 1 NC1 If=1 then 640KB-1MB area never caching If=0 caching (but see NCRi) 0 NC0 If=1 then first 64K of each 1MB bounds not caching, when in Real or Virtual8086 mode If =0 caching CCR1: Bit Name Description 7-1 Reserved 0 RPL If =1 then enable RPLSET,RPLVAL# pins If =0 this pins are disable and float. NCRi: Byte Bits Description 0 7-0 Address bits A31-A24 of non-cacheble region start (Reserved for SLC) 1 7-0 Address bits A23-A16 of non-cachable region start 2 7-4 Address bits A15-A12 of non-cacheble region start 2 3-0 Size of non-cacheble block: 0000 Disable NCRi 0001 4K 0010 8K 0011 16K 0100 32K 0101 64K 0110 128K 0111 256K 1000 512K 1001 1M 1010 2M 1011 4M 1100 8M 1101 16M 1110 32M 1111 4G NCRi bytes: Byte NCRi 0 1 2 NCR1 C4H C5H C6H NCR2 C7H C8H C9H NCR3 CAH CBH CCH NCR4 CDH CDH CEH ------------------------------------------------ APPENDIX B Codes which returned after Reset in EDX DH DL Type of CPU Steppin Model ID Revision i386DX A (00h) ??? B0-B10 03h 03h D0 05h D1-D2 08h Am386DX/DXL A 03h 05h B 08h i386SX A0 23h 04h B 05h C,D,E 08h Am386SX/SXL A1 23h 05h B 08h i386CX A 23h 09h i386EX A 23h 09h i386SX static ??? 23h 09h i376 A0 33h 05h B 08h i386SL A0-A3 43h 0xh (05H) B0-B1 1xh RapidCAD (tm) A 03h 40h IBM 386SLC A A3h xxh Cx486SLC A 04h 10h i486DX A0/A1 04h 00h B2-B6 01h C0 02h C1 03h D0 04h cA2,cA3 10h cB0,cB1 11h Am486DX ?? 04h 12h UMC U5SD any 04h 1xh i486SX A0 04h 20h B0 22h D ?? 23h ; SL Enhanced 1994 cA0 27h cB0 28h i487SX A0 04h 20h B0 21h UMC U5S A 04h 23h i486DX2 & A0-A2 04h 32h OverDrive (tm) B1 33h C ?? 35h ; SL Enhanced 1994 Am486DX2 ?? 04h 32h Am486DXL2 ?? 04h 32h Am486DX2 ?? 04h 32h ; 3 VOLT i486SL A 04h 40h IntelSX2 (tm) A 04h 5xh IntelSX2 (tm) A 04h 5xh OverDrive (tm) WB IntelDX2 A 04h 7xh (P24D) IBM BL486DX2 A 04h 80h ; PRELIMINARY IntelDX4 (tm) A 04h 80h IBM 486SLC A A4h 0xh IBM 486SLC2 A A4h 1xh B 2xh IBM 486BLX3 A 84h xxh Cyrix M5 all 00h 05h (Cx486S/D) Cyrix M6 all 00h 06h (Cx486DX) Cyrix M7 all 00h 07h (Cx486DX2) Pentium (P5) Ax 05h 0xh Bx 05h 1xh Pentium (P54C) A 05h 2xh Pentium Overdrive 15h 3xh (Vcc=5V)(P24T) -------------------------------------------- APPENDIX C0 iCOMP index for Intel's Microprocessors i386SX-20 32 i386SX-25 39 i386SL-25 41 i386DX-25 49 i386DX-33 68 i486SX-20 78 i486SX-25 100 ; Base model for test iCOMP=100 by define i486DX-25 122 i486SX-33 136 i486DX-33 166 IntelSX2-25/50 180 i486DX2-25/50 231 i486DX-50 249 i486DX2-33/66 297 IntelDX4-25/75 319 IntelDX4-33/100 435 Pentium-(510\60) 510 ; P5 Pentium-(567\66) 567 ; P5 Pentium-(610\75) 610 ; P54C Pentium-(735\90) 735 ; P54C Pentium-(815\100) 815 ; P54C ---------------------------------------------- APPENDIX C1 Cyrix Microprocessors Relative Perfomance Cyrix Inc. Used for declaration of perfomance of theys microprocessors tests based on PC Bench 8.0 and normalization. CPU Perfomance Scores Cx486SLC-25 36 Cx486SLC-33 39 Cx486SLC2-50 40 Cx486DLC-33 69 Cx486DLC-40 83 Cx486DX-33 100 ; <--- Base Point Cx486DX-40 118 Cx486DX2-50 139 Cx486DX-50 148 Cx486DX2-66 179 Cx486DX2-V80 209 ------------------------------------------------ APPENDIX D Pentium P54C+ Build-in APIC (Advanced programmable Interrupt Controller) Base Address of Build-in APIC in memory location is 0FEE00000H. Map of APIC REgisters: Offset (hex) Description Read/Write state 0 Reserved 10 Reserved 20 Local APIC ID R/W 30 Local APIC Version R 40-70 Reserved 80 Task Priority Register R/W 90 Arbitration Priority Register R A0 Processor Priority Register R B0 EOI Register W C0 Remote read R D0 Logical Destination R/W E0 Destination Format Register 0..27 R 28..31 R/W F0 Spurious Interrupt Vector Reg. 0..3 R 4..9 R/W 100-170 ISR 0-255 R 180-1F0 TMR 0-255 R 200-270 IRR 0-255 R 280 Error Status Register R 290-2F0 Reserved 300 Interrupt Command Reg. (0-31) R/W 310 Interrupt Command Reg. (32-63) R/W 320 Local Vector Table (Timer) R/W 330-340 Reserved 350 Local Vector Table (LINT0) R/W 360 Local Vector Table (LINT1) R/W 370 Local Vector Table (ERROR) R/W 380 Initial Count Reg. for Timer R/W 390 Current Count of Timer R 3A0-3D0 Reserved 3E0 Timer Divide Configuration Reg. R/W 3F0 Reserved --------------------------------------------- APPENDIX E Pentium (tm) Processor Pairing Instruction (Integer part only, nor FPU) Pentium (tm) is superscalar microprocessor i.e. it may execute >1 instruction per CLK cycle. It may execute maximum 2 instruction per cycle.It have two integer pipes to execute instruction. This pipes not same, and some instruction may pairing (i.e. execute together) (only if not link with this 2 instruction) only in U pipe, some other only in V pipe, other in any pipe,other absolutely not pairing and they executed on U pipe only. Note: PU - is pairable if issued to U pipe PV - is pairable if issued to V pipe UV - pairable in either pipe ADC Reg,Reg PU Reg,Mem PU Reg,Imm PU Mem,Reg PU Mem,Imm PU ADD Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV AND Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV CALL direct PV CMP Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV DEC Reg UV Mem UV INC Reg UV Mem UV Jcc any PV JMP Short PV Direct PV LEA Reg,Mem UV MOV Reg,Reg/Mem/Imm UV Mem,Reg UV NOP UV OR Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV POP Reg UV PUSH Reg UV Imm UV Rotates/Shifts: Reg,1 PU Mem,1 PU Reg,Imm PU Mem,Imm PU SUB Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV TEST Reg,Reg UV Mem,Reg UV Acc,Imm UV XOR Reg,Reg UV Reg,Mem UV Reg,Imm UV Mem,Reg UV Mem,Imm UV For more information refer to: 1) Optimization for Intel's 32-Bit Processors (Application Note AP-500) Gary CArleton) // Intel Corp. 1993 // Order Number 241799 2) Supplement to the Pentium (tm) Processor User's Manual // Intel Corp. 1993. ------------------------------------------ BUGS & CPU IDENTIFICATION INFO 1) How to separate i386SX and i386DX (Cx486SLC and Cx486DLC) Note: With 386DX type CPU possible to used 287 class NPX, and bit 4 in CR0 ET - Extention Type on DX we may to clear to 0, but for SX and REAL 486 this bit always 1. Routine: mov eax,cr0 push eax and al,0efh mov cr0,eax mov eax,cr0 test al,10h pop eax mov cr0,eax jne SX/SLC jmp DX/DLC 2) How to separate i486SX and i487SX/i486DX/DX2 etc Routine: memory_location DW ? mov memory_location,0 fninit fstcw memory_location cmp memory_location,037Fh jz i486SX jmp i486DX/DX2etc/i487SX 3) How to separate Cyrix's CPUs and other Be sure that Your CPU no Pentium before UMOV executed on Intel and other in Non SM modes as MOV. But Cyrix executed this instruction as Double NOP, and never generate INT 6. So. Mem_Loc DW 1 xor ax,ax umov ax,Mem_Loc or ax,ax jz Cyrix jmp No_Cyrix ---------------------------------------------------- More Info? OK EFLAGS register format (C) (P) Potemkins' Hackers Group Revision 1.00 23/09/94 ============================================================================== [Pentium P5] [Pentium P54C] [IntelDX4] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- I V V A V R N IO O D I T S Z A P C 0000000000 D I I C M F 0 T PL F F F F F F 0 F 0 F 1 F P F ----------------------------------------------------- ============================================================================= [i486 SL Enhanced SX,DX,DX2] [IntelSX2] [UMC] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- I A V R N IO O D I T S Z A P C 0000000000 D 0 0 C M F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- ============================================================================= [i486 SX,DX,DX2] [OverDrive] [M5,M6,M7] [AMD Am486DX/DXL/DX2/DXL2 ] etc [IBM BL486DX/DX2] [Cx486SLC/DLC/SLC2/DLC2] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- A V R N IO O D I T S Z A P C 0000000000 0 0 0 C M F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- ============================================================================== [i386 SX,DX,CX,EX] [AMD Am386 ] [C&T 38600 ] etc [IBM 486SLC2] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- V R N IO O D I T S Z A P C 0000000000 0 0 0 0 M F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- ============================================================================== [i376] 3322222222 2 2 1 1 1 1 1 1 11 1 1 1098765432 1 0 9 8 7 6 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ----------------------------------------------------- R N IO O D I T S Z A P C 0000000000 0 0 0 0 0 F 0 T PL F F F F F F 0 F 0 F 1 F ----------------------------------------------------- =============================================================================== [i286 and all clones] 1 1 11 1 1 5 4 32 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------ N IO O D I T S Z A P C 0 T PL F F F F F F 0 F 0 F 1 F ------------------------------ ================================================================================ [NEC/Sony V20/V30] 1 1 1 1 1 1 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------- M O D I T S Z A P C D 1 1 1 F F F F F F 0 F 0 F 1 F ------------------------------- ================================================================================ [80x186 ,EA,EB,EC,XL] [8086/88 and all clones] 1 1 1 1 1 1 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 ------------------------------- O D I T S Z A P C 1 1 1 1 F F F F F F 0 F 0 F 1 F ------------------------------- ============================================================================== ID - Identification Flag VIP - Virtual Interrupt Pending VIF - Virtual Interrupt Flag AC - Align Check VM - Virtual 8086 Mode RF - Resume Flag MD - Mode Flag NT - Nested Task flag IOPL - Input/Output Privelege Level OF - Overflow Flag DF - Direction Flag IF - Interrupt Flag TF - Trap Flag SF - Sign Flag ZF - Zero Flag AF - Auxiliary Carry Flag PF - Parity Flag CF - Carry Flag --------------------------------------------- APPENDIX LAST List of the Literature 1) "Pentium (tm) Famaly User's Manual Volume 3: Architecture and Programming Manual" // Intel Corp. 1994 ;; Order number: 241430 2) "Blue Lightning 486DX2 3 and 5 Volt Microprocessors Databook" // IBM Corp./Cyrix Corp. 1994 ;; Order Number: MPIDX2DSU-01 3) "486SLC2 (tm) Microprocessor" Data Sheet. // IBM Corp. 1993 ;; Order number VT05452 4) "Cyrix Cx486SLC (tm) Microprocessor" // Cyrix Corp. 1991 ;; Order Number 94073 5) "3-Volt System Logic for Personal Computers" // Advanced Micro Devices Inc. 1993 ;; Order number: 17028B 6) "IntelDX4 (tm) Processor Data Book" // Intel Corp. 1994 ;; Order number: 241944 7) "Intel Processor Identification with the CPUID instruction" // Intel Corp. 1993,1994 ;; Order number: 241618 8) "82489DX Advanced Programmable Interrupt Controller" Application Note: AP-485 // Intel Corp. 1993 ;; Order number: 290446 9) "Optimization for Intel's 32-bit Processors" Application Note: AP-500 // Intel Corp. 1993 ;; Order number 241799 A) "MultiProcessor Specification Version 1.1" // Intel Corp. 1993 ;; Order Number: 242016 ---------------------------------------------------------- If Your (Reader) interested for some info about 80x86 CPUs lets send request to avp@iron.misa.ac.ru or avk@netserv2.ioc.ac.ru and we place some information in next versions of our doc, or answer directly if we can. ----------------------------------------------------------- If Your found some errors or incorrections in this text please send info 'bout it. ----------------------------------------------------------- Thanx for Alex V.Korsunov,Gleb A.Chechin, Yury V.Temkin, Evgenia A.Kouchnirenko and all other numbers of Potemkin's Hackers Group. - - - - - - - - - - - - - - Special Thanks for Vsevolod (Intel),Joe (AMD),Alex (DVM). ------------------------------------------------------------ Sorry, But EOF Contact address: avp@iron.misa.ac.ru