Intel386TM DX MICROPROCESSOR 32-BIT CHMOS MICROPROCESSOR
WITH INTEGRATED MEMORY MANAGEMENT
YFlexible 32-Bit Microprocessor
Ð8, 16, 32-Bit Data Types
Ð8 General Purpose 32-Bit Registers
YVery Large Address Space
Ð4 Gigabyte Physical
Ð64 Terabyte Virtual
Ð4 Gigabyte Maximum Segment Size
YIntegrated Memory Management Unit
ÐVirtual Memory Support
ÐOptional On-Chip Paging
Ð4 Levels of Protection
ÐFully Compatible with 80286
YObject Code Compatible with All 8086 Family Microprocessors
YVirtual 8086 Mode Allows Running of 8086 Software in a Protected and Paged System
YHardware Debugging Support
YOptimized for System Performance
ÐPipelined Instruction Execution
ÐOn-Chip Address Translation Caches
Ð20, 25 and 33 MHz Clock
Ð40, 50 and 66 Megabytes/Sec Bus Bandwidth
YNumerics Support via Intel387TM DX Math Coprocessor
YComplete System Development Support
ÐSoftware: C, PL/M, Assembler System Generation Tools
ÐDebuggers: PSCOPE, ICETM-386
YHigh Speed CHMOS IV Technology
Y132 Pin Grid Array Package
Y132 Pin Plastic Quad Flat Package
(See Packaging Specification, Order Ý231369)
The Intel386 DX Microprocessor is an entry-level 32-bit microprocessor designed for single-user applications and operating systems such as MS-DOS and Windows. The 32-bit registers and data paths support 32-bit addresses and data types. The processor addresses up to four gigabytes of physical memory and 64 terabytes (2**46) of virtual memory. The integrated memory management and protection architecture includes address translation registers, multitasking hardware and a protection mechanism to support operating systems. Instruction pipelining, on-chip address translation, ensure short average instruction execution times and maximum system throughput.
The Intel386 DX CPU offers new testability and debugging features. Testability features include a self-test and direct access to the page translation cache. Four new breakpoint registers provide breakpoint traps on code execution or data accesses, for powerful debugging of even ROM-based systems.
Object-code compatibility with all 8086 family members (8086, 8088, 80186, 80188, 80286) means the Intel386 DX offers immediate access to the world's largest microprocessor software base.
231630 ± 49
Intel386TM DX Pipelined 32-Bit Microarchitecture
Intel386TM DX and Intel387TM DX are Trademarks of Intel Corporation.
MS-DOS and Windows are Trademarks of MICROSOFT Corporation.
*Other brands and names are the property of their respective owners.
Information in this document is provided in connection with Intel products. Intel assumes no liability whatsoever, including infringement of any patent or copyright, for sale and use of Intel products except as provided in Intel's Terms and Conditions of Sale for such products. Intel retains the right to make changes to these specifications at any time, without notice. Microcomputer Products may have minor variations to this specification known as errata.
COPYRIGHT © INTEL CORPORATION, 1995 |
December 1995 |
Order Number: 231630-011 |
Intel386TM DX MICROPROCESSOR 32-BIT CHMOS MICROPROCESSOR
WITH INTEGRATED MEMORY MANAGEMENT
CONTENTS |
PAGE |
1.PIN ASSIGNMENT ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААА 5
1.1Pin Description Table ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААА 6
2.BASE ARCHITECTURE ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААА 8
2.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААААААА 8
2.2Register Overview ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААА 8
2.3Register Descriptions ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААА 9
2.4Instruction Set ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААА 15
2.5Addressing Modes ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 18
2.6Data Types ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААААА 20
2.7Memory Organization ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААА 22
2.8I/O Space ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААААААА 23
2.9Interrupts ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААААААА 24
2.10Reset and Initialization ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААА 27
2.11Testability ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААААА 28
2.12Debugging Support ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААА 28
3.REAL MODE ARCHITECTURE ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААА 32
3.1Real Mode Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААА 32
3.2Memory Addressing ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААА 33
3.3Reserved Locations ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААА 34
3.4Interrupts ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААААААА 34
3.5Shutdown and Halt ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 34
4.PROTECTED MODE ARCHITECTURE ААААААААААААААААААААААААААААААААААААААААААААААААААА 34
4.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААААА 34
4.2Addressing Mechanism ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААА 35
4.3Segmentation ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААА 36
4.4Protection ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААААААА 46
4.5Paging ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААААААААААА 52
4.6Virtual 8086 Environment ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААА 56
5.FUNCTIONAL DATA ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААА 61
5.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААААААААА 61
5.2Signal Description ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 61
5.2.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААА 61
5.2.2Clock (CLK2) ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 62
5.2.3Data Bus (D0 through D31) ААААААААААААААААААААААААААААААААААААААААААААААААААА ААА 62
5.2.4Address Bus (BEOÝ through BE3Ý, A2 through A31) АААААААААААААААААААААААААААА 62
5.2.5Bus Cycle Definition Signals (W/RÝ, D/CÝ, M/IO, LOCKÝ) ААААААААААААААААААААА 63
5.2.6Bus Control Signals (ADSÝ, READYÝ, NAÝ, BS16Ý) ААААААААААААААААААААААААААА 64
5.2.7Bus Arbitration Signals (HOLD, HLDA) ААААААААААААААААААААААААААААААААААААААААААА 65
5.2.8Coprocessor Interface Signals (PEREQ, BUSYÝ, ERRORÝ) ААААААААААААААААААААА 65
5.2.9Interrupt Signals (INTR, NMI, RESET) АААААААААААААААААААААААААААААААААААААААААААА 66
5.2.10Signal Summary ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААА 67
3
CONTENTS |
PAGE |
5.FUNCTIONAL DATA (Continued)
5.3.Bus Transfer Mechanism ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААА 67
5.3.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААА 67
5.3.2Memory and I/O Spaces ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААА 68
5.3.3Memory and I/O Organization ААААААААААААААААААААААААААААААААААААААААААААААААААА 69
5.3.4Dynamic Data Bus Sizing ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААА 69
5.3.5Interfacing with 32and 16-bit Memories ААААААААААААААААААААААААААААААААААААААААА 70
5.3.6Operand Alignment ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААА 71
5.4Bus Functional Description ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААА 71
5.4.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААААА 71
5.4.2Address Pipelining ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААА 74
5.4.3Read and Write Cycles ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААА 76
5.4.4Interrupt Acknowledge (INTA) Cycles АААААААААААААААААААААААААААААААААААААААААААА 87
5.4.5Halt Indication Cycle ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААА 88
5.4.6Shutdown Indication Cycle ААААААААААААААААААААААААААААААААААААААААААААААААААА АААА 89
5.5Other Functional Descriptions ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААА 90
5.5.1Entering and Exiting Hold Acknowledge АААААААААААААААААААААААААААААААААААААААААА 90
5.5.2Reset during Hold Acknowledge ААААААААААААААААААААААААААААААААААААААААААААААААА 90
5.5.3Bus Activity During and Following Reset ААААААААААААААААААААААААААААААААААААААААА 90
5.6Self-test Signature ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 92
5.7Component and Revision Identifiers ААААААААААААААААААААААААААААААААААААААААААААААААААА 92
5.8Coprocessor Interface ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААА 94
5.8.1Software Testing for Coprocessor Presence ААААААААААААААААААААААААААААААААААААА 94
6.INSTRUCTION SET ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААА 95
6.1Instruction Encoding and Clock Count Summary ААААААААААААААААААААААААААААААААААААААА 95
6.2Instruction Encoding Details ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААА 110
7.DESIGNING FOR ICETM-386 DX EMULATOR USE АААААААААААААААААААААААААААААААААААААА 117
8.MECHANICAL DATA ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 119
8.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААААА 119
8.2Package Dimensions and Mounting АААААААААААААААААААААААААААААААААААААААААААААААААА 119
8.3Package Thermal Specification ААААААААААААААААААААААААААААААААААААААААААААААААААА ААА 122
9.ELECTRICAL DATA ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 123
9.1Introduction ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААААААААА 123
9.2Power and Grounding ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААА 123
9.3Maximum Ratings ААААААААААААААААААААААААААААААААААААААААААААААААААА ААААААААААААААААА 124
9.4D.C. Specifications ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААА 124
9.5A.C. Specifications ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААА 125
10.REVISION HISTORY ААААААААААААААААААААААААААААААААААААААААААААААААААА АААААААААААААААА 137
NOTE:
This is revision 011; This supercedes all previous revisions.
4
1. PIN ASSIGNMENT
The Intel386 DX pinout as viewed from the top side of the component is shown by Figure 1-1. Its pinout as viewed from the Pin side of the component is Figure 1-2.
Intel386TM DX MICROPROCESSOR
VCC and GND connections must be made to multiple VCC and VSS (GND) pins. Each VCC and VSS must be connected to the appropriate voltage level. The circuit board should include VCC and GND planes for power distribution and all VCC and VSS pins must be connected to the appropriate plane.
NOTE:
Pins identified as ``N.C.'' should remain completely unconnected.
231630 ± 33 |
|
231630 ± 34 |
|
|
|
|
Figure 1-1. Intel386TM DX PGA |
|
|
Figure 1-2. Intel386TM DX PGA |
|
||||||
|
PinoutÐView from Top Side |
|
|
PinoutÐView from Pin Side |
|
||||||
|
|
Table 1-1. Intel386TM DX PGA PinoutÐFunctional Grouping |
|
|
|||||||
Signal/Pin |
Signal/Pin |
Signal/Pin |
Signal/Pin |
Signal/Pin |
Signal/Pin |
||||||
A2 |
C4 |
A24 |
L2 |
D6 |
L14 |
D28 |
M6 |
VCC |
C12 |
VSS |
F2 |
A3 |
A3 |
A25 |
K3 |
D7 |
K12 |
D29 |
P4 |
|
D12 |
|
F3 |
A4 |
B3 |
A26 |
M1 |
D8 |
L13 |
D30 |
P3 |
|
G2 |
|
F14 |
A5 |
B2 |
A27 |
N1 |
D9 |
N14 |
D31 |
M5 |
|
G3 |
|
J2 |
A6 |
C3 |
A28 |
L3 |
D10 |
M12 |
D/CÝ |
A11 |
|
G12 |
|
J3 |
A7 |
C2 |
A29 |
M2 |
D11 |
N13 |
ERRORÝ |
A8 |
|
G14 |
|
J12 |
A8 |
C1 |
A30 |
P1 |
D12 |
N12 |
HLDA |
M14 |
|
L12 |
|
J13 |
A9 |
D3 |
A31 |
N2 |
D13 |
P13 |
HOLD |
D14 |
|
M3 |
|
M4 |
A10 |
D2 |
ADSÝ |
E14 |
D14 |
P12 |
INTR |
B7 |
|
M7 |
|
M8 |
A11 |
D1 |
BE0Ý |
E12 |
D15 |
M11 |
LOCKÝ |
C10 |
|
M13 |
|
M10 |
A12 |
E3 |
BE1Ý |
C13 |
D16 |
N11 |
M/IOÝ |
A12 |
|
N4 |
|
N3 |
A13 |
E2 |
BE2Ý |
B13 |
D17 |
N10 |
NAÝ |
D13 |
|
N7 |
|
P6 |
A14 |
E1 |
BE3Ý |
A13 |
D18 |
P11 |
NMI |
B8 |
|
P2 |
|
P14 |
A15 |
F1 |
BS16Ý |
C14 |
D19 |
P10 |
PEREQ |
C8 |
|
P8 |
W/RÝ |
B10 |
A16 |
G1 |
BUSYÝ |
B9 |
D20 |
M9 |
READYÝ |
G13 |
VSS |
A2 |
N.C. |
A4 |
A17 |
H1 |
CLK2 |
F12 |
D21 |
N9 |
RESET |
C9 |
|
A6 |
|
B4 |
A18 |
H2 |
D0 |
H12 |
D22 |
P9 |
VCC |
A1 |
|
A9 |
|
B6 |
A19 |
H3 |
D1 |
H13 |
D23 |
N8 |
|
A5 |
|
B1 |
|
B12 |
A20 |
J1 |
D2 |
H14 |
D24 |
P7 |
|
A7 |
|
B5 |
|
C6 |
A21 |
K1 |
D3 |
J14 |
D25 |
N6 |
|
A10 |
|
B11 |
|
C7 |
A22 |
K2 |
D4 |
K14 |
D26 |
P5 |
|
A14 |
|
B14 |
|
E13 |
A23 |
L1 |
D5 |
K13 |
D27 |
N5 |
|
C5 |
|
C11 |
|
F13 |
5
Intel386TM DX MICROPROCESSOR
1.1 PIN DESCRIPTION TABLE
The following table lists a brief description of each pin on the Intel386 DX. The following definitions are used in these descriptions:
Ý The named signal is active LOW. I Input signal.
OOutput signal.
I/O Input and Output signal.
ÐNo electrical connection.
For a more complete description refer to Section 5.2 Signal Description.
Symbol |
Type |
Name and Function |
|
|
|
CLK2 |
I |
CLK2 provides the fundamental timing for the Intel386 DX. |
|
|
|
D31 ± D0 |
I/O |
DATA BUS inputs data during memory, I/O and interrupt acknowledge |
|
|
read cycles and outputs data during memory and I/O write cycles. |
|
|
|
A31 ± A2 |
O |
ADDRESS BUS outputs physical memory or port I/O addresses. |
BE0Ý ± BE3Ý |
O |
BYTE ENABLES indicate which data bytes of the data bus take part in |
|
|
a bus cycle. |
|
|
|
W/RÝ |
O |
WRITE/READ is a bus cycle definition pin that distinguishes write |
|
|
cycles from read cycles. |
|
|
|
D/CÝ |
O |
DATA/CONTROL is a bus cycle definition pin that distinguishes data |
|
|
cycles, either memory or I/O, from control cycles which are: interrupt |
|
|
acknowledge, halt, and instruction fetching. |
|
|
|
M/IOÝ |
O |
MEMORY I/O is a bus cycle definition pin that distinguishes memory |
|
|
cycles from input/output cycles. |
|
|
|
LOCKÝ |
O |
BUS LOCK is a bus cycle definition pin that indicates that other |
|
|
system bus masters are denied access to the system bus while it is |
|
|
active. |
|
|
|
ADSÝ |
O |
ADDRESS STATUS indicates that a valid bus cycle definition and |
|
|
address (W/RÝ, D/CÝ, M/IOÝ, BE0Ý, BE1Ý, BE2Ý, BE3Ý and |
|
|
A31 ± A2) are being driven at the Intel386 DX pins. |
NAÝ |
I |
NEXT ADDRESS is used to request address pipelining. |
|
|
|
READYÝ |
I |
BUS READY terminates the bus cycle. |
|
|
|
BS16Ý |
I |
BUS SIZE 16 input allows direct connection of 32-bit and 16-bit data |
|
|
buses. |
|
|
|
HOLD |
I |
BUS HOLD REQUEST input allows another bus master to request |
|
|
control of the local bus. |
|
|
|
6
|
|
Intel386TM DX MICROPROCESSOR |
1.1 PIN DESCRIPTION TABLE (Continued) |
||
Symbol |
Type |
Name and Function |
|
|
|
HLDA |
O |
BUS HOLD ACKNOWLEDGE output indicates that the Intel386 DX |
|
|
has surrendered control of its local bus to another bus master. |
|
|
|
BUSYÝ |
I |
BUSY signals a busy condition from a processor extension. |
|
|
|
ERRORÝ |
I |
ERROR signals an error condition from a processor extension. |
|
|
|
PEREQ |
I |
PROCESSOR EXTENSION REQUEST indicates that the processor |
|
|
extension has data to be transferred by the Intel386 DX. |
|
|
|
INTR |
I |
INTERRUPT REQUEST is a maskable input that signals the Intel386 |
|
|
DX to suspend execution of the current program and execute an |
|
|
interrupt acknowledge function. |
|
|
|
NMI |
I |
NON-MASKABLE INTERRUPT REQUEST is a non-maskable input |
|
|
that signals the Intel386 DX to suspend execution of the current |
|
|
program and execute an interrupt acknowledge function. |
|
|
|
RESET |
I |
RESET suspends any operation in progress and places the Intel386 |
|
|
DX in a known reset state. See Interrupt Signals for additional |
|
|
information. |
|
|
|
N/C |
Ð |
NO CONNECT should always remain unconnected. Connection of a |
|
|
N/C pin may cause the processor to malfunction or be incompatible |
|
|
with future steppings of the Intel386 DX. |
|
|
|
VCC |
I |
SYSTEM POWER provides the a5V nominal D.C. supply input. |
VSS |
I |
SYSTEM GROUND provides 0V connection from which all inputs and |
|
|
outputs are measured. |
|
|
|
7
Intel386TM DX MICROPROCESSOR
2. BASE ARCHITECTURE
2.1 INTRODUCTION
The Intel386 DX consists of a central processing unit, a memory management unit and a bus interface.
The central processing unit consists of the execution unit and instruction unit. The execution unit contains the eight 32-bit general purpose registers which are used for both address calculation, data operations and a 64-bit barrel shifter used to speed shift, rotate, multiply, and divide operations. The multiply and divide logic uses a 1-bit per cycle algorithm. The multiply algorithm stops the iteration when the most significant bits of the multiplier are all zero. This allows typical 32-bit multiplies to be executed in under one microsecond. The instruction unit decodes the instruction opcodes and stores them in the decoded instruction queue for immediate use by the execution unit.
The memory management unit (MMU) consists of a segmentation unit and a paging unit. Segmentation allows the managing of the logical address space by providing an extra addressing component, one that allows easy code and data relocatability, and efficient sharing. The paging mechanism operates beneath and is transparent to the segmentation process, to allow management of the physical address space. Each segment is divided into one or more 4K byte pages. To implement a virtual memory system, the Intel386 DX supports full restartability for all page and segment faults.
Memory is organized into one or more variable length segments, each up to four gigabytes in size. A given region of the linear address space, a segment, can have attributes associated with it. These attributes include its location, size, type (i.e. stack, code or data), and protection characteristics. Each task on an Intel386 DX can have a maximum of 16,381 segments of up to four gigabytes each, thus providing 64 terabytes (trillion bytes) of virtual memory to each task.
The segmentation unit provides four-levels of protection for isolating and protecting applications and the operating system from each other. The hardware enforced protection allows the design of systems with a high degree of integrity.
The Intel386 DX has two modes of operation: Real Address Mode (Real Mode), and Protected Virtual Address Mode (Protected Mode). In Real Mode the Intel386 DX operates as a very fast 8086, but with
32-bit extensions if desired. Real Mode is required primarily to setup the processor for Protected Mode operation. Protected Mode provides access to the sophisticated memory management, paging and privilege capabilities of the processor.
Within Protected Mode, software can perform a task switch to enter into tasks designated as Virtual 8086 Mode tasks. Each such task behaves with 8086 semantics, thus allowing 8086 software (an application program, or an entire operating system) to execute. The Virtual 8086 tasks can be isolated and protected from one another and the host Intel386 DX operating system, by the use of paging, and the I/O Permission Bitmap.
Finally, to facilitate high performance system hardware designs, the Intel386 DX bus interface offers address pipelining, dynamic data bus sizing, and direct Byte Enable signals for each byte of the data bus. These hardware features are described fully beginning in Section 5.
2.2 REGISTER OVERVIEW
The Intel386 DX has 32 register resources in the following categories:
#General Purpose Registers
#Segment Registers
#Instruction Pointer and Flags
#Control Registers
#System Address Registers
#Debug Registers
#Test Registers.
The registers are a superset of the 8086, 80186 and 80286 registers, so all 16-bit 8086, 80186 and 80286 registers are contained within the 32-bit Intel386 DX.
Figure 2-1 shows all of Intel386 DX base architecture registers, which include the general address and data registers, the instruction pointer, and the flags register. The contents of these registers are task-specific, so these registers are automatically loaded with a new context upon a task switch operation.
The base architecture also includes six directly accessible segments, each up to 4 Gbytes in size. The segments are indicated by the selector values placed in Intel386 DX segment registers of Figure 2-1. Various selector values can be loaded as a program executes, if desired.
8
GENERAL DATA AND ADDRESS REGISTERS
31 |
16 |
15 |
0 |
|
|
|
|
|
|
|
|
|
|
|
|
AX |
|
EAX |
|
|
|
|
|
|
|
|
|
|
|
BX |
|
EBX |
|
|
|
|
|
|
|
|
|
|
|
CX |
|
ECX |
|
|
|
|
|
|
|
|
|
|
|
DX |
|
EDX |
|
|
|
|
|
|
|
|
|
|
|
SI |
|
ESI |
|
|
|
|
|
|
|
|
|
|
|
DI |
|
EDI |
|
|
|
|
|
|
GS |
* |
|
|
|
BP |
|
|
||
|
|
|
EBP |
|
|
|
|
|
|
|
|
|
|
|
|
SP |
|
ESP |
|
|
|
|
|
|
|
||
SEGMENT SELECTOR REGISTERS |
|
|
||||
|
|
15 |
0 |
|
|
|
|
|
|
|
CS |
|
CODE |
|
|
|
|
|
||
|
|
|
|
SS |
|
STACK |
|
|
|
|
|
||
|
|
|
|
DS |
|
|
|
|
|
|
|
|
|
|
|
|
|
ES |
|
DATA |
|
|
|
|
|
||
|
|
|
|
FS |
|
|
|
|
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
INSTRUCTION POINTER |
|
|
|
|
||
AND FLAGS REGISTER |
|
|
|
|
||
31 |
16 |
15 |
0 |
|
|
|
|
|
|
|
|
|
|
|
|
IP |
|
EIP |
|
|
|
|
|
|
|
|
|
|
|
FLAGS |
|
EFLAGS |
|
|
|
|
|
|
|
|
|
Figure 2-1. Intel386TM DX Base
Architecture Registers
The selectors are also task-specific, so the segment registers are automatically loaded with new context upon a task switch operation.
The other types of registers, Control, System Address, Debug, and Test, are primarily used by system software.
2.3 REGISTER DESCRIPTIONS
2.3.1 General Purpose Registers
General Purpose Registers: The eight general purpose registers of 32 bits hold data or address quantities. The general registers, Figure 2-2, support data operands of 1, 8, 16, 32 and 64 bits, and bit fields of 1 to 32 bits. They support address operands of 16 and 32 bits. The 32-bit registers are named EAX, EBX, ECX, EDX, ESI, EDI, EBP, and ESP.
The least significant 16 bits of the registers can be accessed separately. This is done by using the 16bit names of the registers AX, BX, CX, DX, SI, DI,
Intel386TM DX MICROPROCESSOR
BP, and SP. When accessed as a 16-bit operand, the upper 16 bits of the register are neither used nor changed.
Finally 8-bit operations can individually access the lowest byte (bits 0 ± 7) and the higher byte (bits 8 ± 15) of general purpose registers AX, BX, CX and DX. The lowest bytes are named AL, BL, CL and DL, respectively. The higher bytes are named AH, BH, CH and DH, respectively. The individual byte accessibility offers additional flexibility for data operations, but is not used for effective address calculation.
31 |
16 |
15 |
8 |
7 |
|
|
0 |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
AH |
|
A |
X |
AL |
|
EAX |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
BH |
|
B |
X |
BL |
|
EBX |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
CH |
|
C |
X |
CL |
|
ECX |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DH |
|
D |
X |
DL |
|
EDX |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SI |
|
|
|
ESI |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DI |
|
|
|
EDI |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
BP |
|
|
|
EBP |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SP |
|
|
|
ESP |
||
|
|
|
|
|
|
|
|
|
|
|
|
31 |
16 |
15 |
|
|
|
|
|
|
0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
EIP |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
X |
|
|
|
ä |
|
|
Y |
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
IP |
|
|
|
|
Figure 2-2. General Registers
and Instruction Pointer
2.3.2 Instruction Pointer
The instruction pointer, Figure 2-2, is a 32-bit register named EIP. EIP holds the offset of the next instruction to be executed. The offset is always relative to the base of the code segment (CS). The lower 16 bits (bits 0 ± 15) of EIP contain the 16-bit instruction pointer named IP, which is used by 16-bit addressing.
2.3.3 Flags Register
The Flags Register is a 32-bit register named EFLAGS. The defined bits and bit fields within EFLAGS, shown in Figure 2-3, control certain operations and indicate status of the Intel386 DX. The lower 16 bits (bit 0 ± 15) of EFLAGS contain the 16-bit flag register named FLAGS, which is most useful when executing 8086 and 80286 code.
9
0
Intel386TM DX MICROPROCESSOR
|
|
|
231630 ± 50 |
NOTE: |
|
|
|
0 |
indicates Intel reserved: do not define; see section 2.3.10. |
|
|
|
|
|
|
|
|
||
|
Figure 2-3. Flags Register |
||
VM |
(Virtual 8086 Mode, bit 17) |
|
instruction can pop an EFLAG image having |
|
The VM bit provides Virtual 8086 Mode within |
|
the RF bit set and resume the program's exe- |
|
|
cution at the breakpoint address without gen- |
|
|
Protected Mode. If set while the Intel386 DX |
|
|
|
|
erating another breakpoint fault on the same |
|
|
is in Protected Mode, the Intel386 DX will |
|
|
|
|
location. |
|
|
switch to Virtual 8086 operation, handling |
|
|
|
|
|
|
|
segment loads as the 8086 does, but gener- |
NT |
(Nested Task, bit 14) |
|
ating exception 13 faults on privileged op- |
|
This flag applies to Protected Mode. NT is set |
|
codes. The VM bit can be set only in Protect- |
|
|
|
|
to indicate that the execution of this task is |
|
|
ed Mode, by the IRET instruction (if current |
|
|
|
|
nested within another task. If set, it indicates |
|
|
privilege level e 0) and by task switches at |
|
|
|
|
that the current nested task's Task State |
|
|
any privilege level. The VM bit is unaffected |
|
|
|
|
Segment (TSS) has a valid back link to the |
|
|
by POPF. PUSHF always pushes a 0 in this |
|
|
|
|
previous task's TSS. This bit is set or reset by |
|
|
bit, even if executing in virtual 8086 Mode. |
|
|
|
|
control transfers to other tasks. The value of |
|
|
The EFLAGS image pushed during interrupt |
|
|
|
|
NT in EFLAGS is tested by the IRET instruc- |
|
|
processing or saved during task switches will |
|
|
|
|
tion to determine whether to do an inter-task |
|
|
contain a 1 in this bit if the interrupted code |
|
|
|
|
return or an intra-task return. A POPF or an |
|
|
was executing as a Virtual 8086 Task. |
|
|
|
|
IRET instruction will affect the setting of this |
|
|
|
|
|
RF |
(Resume Flag, bit 16) |
|
bit according to the image popped, at any |
|
The RF flag is used in conjunction with the |
|
privilege level. |
|
|
|
|
|
debug register breakpoints. It is checked at |
IOPL |
(Input/Output Privilege Level, bits 12-13) |
|
instruction boundaries before breakpoint pro- |
|
This two-bit field applies to Protected Mode. |
|
cessing. When RF is set, it causes any debug |
|
|
|
|
IOPL indicates the numerically maximum CPL |
|
|
fault to be ignored on the next instruction. RF |
|
|
|
|
(current privilege level) value permitted to ex- |
|
|
is then automatically reset at the successful |
|
|
|
|
ecute I/O instructions without generating an |
|
|
completion of every instruction (no faults are |
|
|
|
|
exception 13 fault or consulting the I/O Per- |
|
|
signalled) except the IRET instruction, the |
|
|
|
|
mission Bitmap. It also indicates the maxi- |
|
|
POPF instruction, (and JMP, CALL, and INT |
|
|
|
|
mum CPL value allowing alteration of the IF |
|
|
instructions causing a task switch). These in- |
|
|
|
|
(INTR Enable Flag) bit when new values are |
|
|
structions set RF to the value specified by the |
|
|
|
|
popped into the EFLAG register. POPF and |
|
|
memory image. For example, at the end of |
|
|
|
|
IRET instruction can alter the IOPL field when |
|
|
the breakpoint service routine, the IRET |
|
|
|
|
executed at CPL e 0. Task switches can al- |
ways alter the IOPL field, when the new flag image is loaded from the incoming task's TSS.
10
Intel386TM DX MICROPROCESSOR
OF |
(Overflow Flag, bit 11) |
|
OF is set if the operation resulted in a signed |
|
overflow. Signed overflow occurs when the |
|
operation resulted in carry/borrow into the |
|
sign bit (high-order bit) of the result but did |
|
not result in a carry/borrow out of the high- |
|
order bit, or vice-versa. For 8/16/32 bit oper- |
|
ations, OF is set according to overflow at bit |
|
7/15/31, respectively. |
DF |
(Direction Flag, bit 10) |
|
DF defines whether ESI and/or EDI registers |
|
postdecrement or postincrement during the |
|
string instructions. Postincrement occurs if |
|
DF is reset. Postdecrement occurs if DF is |
|
set. |
IF |
(INTR Enable Flag, bit 9) |
|
The IF flag, when set, allows recognition of |
|
external interrupts signalled on the INTR pin. |
|
When IF is reset, external interrupts signalled |
|
on the INTR are not recognized. IOPL indi- |
|
cates the maximum CPL value allowing alter- |
|
ation of the IF bit when new values are |
|
popped into EFLAGS or FLAGS. |
TF |
(Trap Enable Flag, bit 8) |
|
TF controls the generation of exception 1 |
|
trap when single-stepping through code. |
|
When TF is set, the Intel386 DX generates an |
|
exception 1 trap after the next instruction is |
|
executed. When TF is reset, exception 1 |
|
traps occur only as a function of the break- |
|
point addresses loaded into debug registers |
|
DR0 ± DR3. |
SF |
(Sign Flag, bit 7) |
|
SF is set if the high-order bit of the result is |
|
set, it is reset otherwise. For 8-, 16-, 32-bit |
|
operations, SF reflects the state of bit 7, 15, |
|
31 respectively. |
ZF |
(Zero Flag, bit 6) |
|
ZF is set if all bits of the result are 0. Other- |
|
wise it is reset. |
AF |
(Auxiliary Carry Flag, bit 4) |
|
The Auxiliary Flag is used to simplify the addi- |
|
tion and subtraction of packed BCD quanti- |
|
ties. AF is set if the operation resulted in a |
|
carry out of bit 3 (addition) or a borrow into bit |
|
3 (subtraction). Otherwise AF is reset. AF is |
|
affected by carry out of, or borrow into bit 3 |
|
only, regardless of overall operand length: 8, |
|
16 or 32 bits. |
PF |
(Parity Flags, bit 2) |
|
PF is set if the low-order eight bits of the op- |
|
eration contains an even number of ``1's'' |
|
(even parity). PF is reset if the low-order eight |
|
bits have odd parity. PF is a function of only |
|
the low-order eight bits, regardless of oper- |
|
and size. |
CF |
(Carry Flag, bit 0) |
|
CF is set if the operation resulted in a carry |
|
out of (addition), or a borrow into (subtraction) |
|
the high-order bit. Otherwise CF is reset. For |
|
8-, 16or 32-bit operations, CF is set accord- |
|
ing to carry/borrow at bit 7, 15 or 31, respec- |
|
tively. |
Note in these descriptions, ``set'' means ``set to 1,'' and ``reset'' means ``reset to 0.''
2.3.4 Segment Registers
Six 16-bit segment registers hold segment selector values identifying the currently addressable memory segments. Segment registers are shown in Figure 2- 4. In Protected Mode, each segment may range in size from one byte up to the entire linear and physi-
|
|
|
SEGMENT |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
|
REGISTERS |
|
|
|
|
DESCRIPTOR REGISTERS (LOADED AUTOMATICALLY) |
|
|
|
|
||||||||||||
|
V |
|
|
â |
|
|
W |
V |
|
|
â |
|
|
|
|
|
|
|
|
|
|
W |
|
|
|
|
|
|
|
|
|
|
|
|
|
Other |
|
|
|
||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Segment |
|
|
|
|
|||
|
15 |
|
|
|
0 |
|
Physical Base Address Segment Limit |
|
Attributes from Descriptor |
|
|
|
||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
|
Selector |
|
|
CS ± |
|
|
|
|
|
|
|
|
|
|
|
|
Ð |
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
Selector |
|
|
SS ± |
|
|
|
|
|
|
|
|
|
|
|
Ð |
|
Ð |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
Selector |
|
|
DS ± |
|
|
|
|
|
|
|
|
|
|
|
Ð |
Ð |
Ð |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
Selector |
|
|
ES ± |
|
|
|
|
|
|
|
|
|
|
|
Ð |
Ð |
Ð |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
Selector |
|
|
FS ± |
|
|
|
|
|
|
|
|
|
|
|
Ð |
Ð |
Ð |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
Selector |
|
|
GS ± |
|
|
|
|
|
|
|
|
|
|
|
Ð |
Ð |
Ð |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 2-4. Intel386TM DX Segment Registers, and Associated Descriptor Registers
11
Intel386TM DX MICROPROCESSOR
cal space of the machine, 4 Gbytes (232 bytes). If a maximum sized segment is used (limit e FFFFFFFFH) it should be Dword aligned (i.e., the least two significant bits of the segment base should be zero). This will avoid a segment limit violation (exception 13) caused by the wrap around. In Real Address Mode, the maximum segment size is fixed at 64 Kbytes (216 bytes).
The six segments addressable at any given moment are defined by the segment registers CS, SS, DS, ES, FS and GS. The selector in CS indicates the current code segment; the selector in SS indicates the current stack segment; the selectors in DS, ES, FS and GS indicate the current data segments.
2.3.5 Segment Descriptor Registers
The segment descriptor registers are not programmer visible, yet it is very useful to understand their content. Inside the Intel386 DX, a descriptor register (programmer invisible) is associated with each pro- grammer-visible segment register, as shown by Figure 2-4. Each descriptor register holds a 32-bit segment base address, a 32-bit segment limit, and the other necessary segment attributes.
When a selector value is loaded into a segment register, the associated descriptor register is automatically updated with the correct information. In Real Address Mode, only the base address is updated directly (by shifting the selector value four bits to the left), since the segment maximum limit and attributes are fixed in Real Mode. In Protected Mode, the base address, the limit, and the attributes are all updated per the contents of the segment descriptor indexed by the selector.
Whenever a memory reference occurs, the segment descriptor register associated with the segment being used is automatically involved with the memory reference. The 32-bit segment base address becomes a component of the linear address calcula-
tion, the 32-bit limit is used for the limit-check operation, and the attributes are checked against the type of memory reference requested.
2.3.6 Control Registers
The Intel386 DX has three control registers of 32 bits, CR0, CR2 and CR3, to hold machine state of a global nature (not specific to an individual task). These registers, along with System Address Registers described in the next section, hold machine state that affects all tasks in the system. To access the Control Registers, load and store instructions are defined.
CR0: Machine Control Register (includes 80286
Machine Status Word)
CR0, shown in Figure 2-5, contains 6 defined bits for control and status purposes. The low-order 16 bits of CR0 are also known as the Machine Status Word, MSW, for compatibility with 80286 Protected Mode. LMSW and SMSW instructions are taken as special aliases of the load and store CR0 operations, where only the low-order 16 bits of CR0 are involved. For compatibility with 80286 operating systems the Intel386 DX LMSW instructions work in an identical fashion to the LMSW instruction on the 80286. (i.e. It only operates on the low-order 16-bits of CR0 and it ignores the new bits in CR0.) New Intel386 DX operating systems should use the MOV CR0, Reg instruction.
The defined CR0 bits are described below.
PG (Paging Enable, bit 31)
the PG bit is set to enable the on-chip paging unit. It is reset to disable the on-chip paging unit.
R(reserved, bit 4)
This bit is reserved by Intel. When loading CR0 care should be taken to not alter the value of this bit.
31 |
|
24 |
23 |
|
|
|
|
|
|
16 |
15 |
|
|
|
8 |
7 |
|
|
|
|
0 |
|
||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
P |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
R |
T |
E |
M |
P |
CR0 |
G |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
S |
M |
P |
E |
|
X ä Y
MSW
NOTE: 0 indicates Intel reserved: Do not define; SEE SECTION 2.3.10
Figure 2-5. Control Register 0
12
Intel386TM DX MICROPROCESSOR
TS (Task Switched, bit 3)
TS is automatically set whenever a task switch operation is performed. If TS is set, a coprocessor ESCape opcode will cause a Coprocessor Not Available trap (exception 7). The trap handler typically saves the Intel387 DX coprocessor context belonging to a previous task, loads the Intel387 DX coprocessor state belonging to the current task, and clears the TS bit before returning to the faulting coprocessor opcode.
EM (Emulate Coprocessor, bit 2)
The EMulate coprocessor bit is set to cause all coprocessor opcodes to generate a Coprocessor Not Available fault (exception 7). It is reset to allow coprocessor opcodes to be executed on an actual Intel387 DX coprocessor (this is the default case after reset). Note that the WAIT opcode is not affected by the EM bit setting.
MP (Monitor Coprocessor, bit 1)
The MP bit is used in conjunction with the TS bit to determine if the WAIT opcode will generate a Coprocessor Not Available fault (exception 7) when TS e 1. When both MP e 1 and TS e 1, the WAIT opcode generates a trap. Otherwise, the WAIT opcode does not generate a trap. Note that TS is automatically set whenever a task switch operation is performed.
PE (Protection Enable, bit 0)
The PE bit is set to enable the Protected Mode. If PE is reset, the processor operates again in Real Mode. PE may be set by loading MSW or CR0. PE can be reset only by a load into CR0. Resetting the PE bit is typically part of a longer instruction sequence needed for proper transition from Protected Mode to Real Mode. Note that for strict 80286 compatibility, PE cannot be reset by the LMSW instruction.
CR1: reserved
CR1 is reserved for use in future Intel processors.
CR2: Page Fault Linear Address
CR2, shown in Figure 2-6, holds the 32-bit linear address that caused the last page fault detected. The
error code pushed onto the page fault handler's stack when it is invoked provides additional status information on this page fault.
CR3: Page Directory Base Address
CR3, shown in Figure 2-6, contains the physical base address of the page directory table. The Intel386 DX page directory table is always pagealigned (4 Kbyte-aligned). Therefore the lowest twelve bits of CR3 are ignored when written and they store as undefined.
A task switch through a TSS which changes the value in CR3, or an explicit load into CR3 with any value, will invalidate all cached page table entries in the paging unit cache. Note that if the value in CR3 does not change during the task switch, the cached page table entries are not flushed.
2.3.7 System Address Registers
Four special registers are defined to reference the tables or segments supported by the 80286 CPU and Intel386 DX protection model. These tables or segments are:
GDT (Global Descriptor Table),
IDT (Interrupt Descriptor Table),
LDT (Local Descriptor Table),
TSS (Task State Segment).
The addresses of these tables and segments are stored in special registers, the System Address and System Segment Registers illustrated in Figure 2-7. These registers are named GDTR, IDTR, LDTR and TR, respectively. Section 4 Protected Mode Architecture describes the use of these registers.
GDTR and IDTR
These registers hold the 32-bit linear base address and 16-bit limit of the GDT and IDT, respectively.
The GDT and IDT segments, since they are global to all tasks in the system, are defined by 32-bit linear addresses (subject to page translation if paging is enabled) and 16-bit limit values.
|
31 |
|
24 |
|
23 |
16 |
|
15 |
|
|
|
8 |
|
7 |
|
|
|
0 |
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
PAGE FAULT LINEAR ADDRESS REGISTER |
|
|
|
|
|
|
|
|
|
|
CR2 |
||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
PAGE DIRECTORY BASE REGISTER |
|
|
0 |
0 |
0 |
0 |
|
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
CR3 |
|||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
NOTE: |
0 |
indicates Intel reserved: Do not define; SEE SECTION 2.3.10 |
|
|
|
|
|
||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||
|
|
|
|
|
|
Figure 2-6. Control Registers 2 and 3 |
|
|
|
|
|
|
|
|
|
|
|
13
Intel386TM DX MICROPROCESSOR
|
|
|
|
|
SYSTEM ADDRESS REGISTERS |
|
|
|
|
|
|
|
|
|
||||||
|
47 32-BIT LINEAR BASE ADDRESS 16 15 LIMIT |
0 |
|
|
|
|
|
|
|
|
||||||||||
GDTR |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
IDTR |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SYSTEM SEGMENT |
|
|
|
|
|
|
|
|
|
|
|
|
|||||||
|
|
|
REGISTERS |
|
|
|
|
DESCRIPTOR REGISTERS (AUTOMATICALLY LOADED) |
|
|
|
|
|
|||||||
|
V |
|
|
â |
|
|
W |
V |
|
|
|
|
â |
|
|
|
|
|
W |
|
15 |
|
|
|
0 |
|
|
32-BIT LINEAR BASE ADDRESS |
32-BIT SEGMENT LIMIT |
ATTRIBUTES |
|||||||||||
TR |
|
SELECTOR |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
LDTR |
|
SELECTOR |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 2-7. System Address and System Segment Registers
LDTR and TR
These registers hold the 16-bit selector for the LDT descriptor and the TSS descriptor, respectively.
The LDT and TSS segments, since they are taskspecific segments, are defined by selector values stored in the system segment registers. Note that a segment descriptor register (programmer-invisible) is associated with each system segment register.
Test Registers: Two registers are used to control the testing of the RAM/CAM (Content Addressable Memories) in the Translation Lookaside Buffer portion of the Intel386 DX. TR6 is the command test register, and TR7 is the data register which contains the data of the Translation Lookaside buffer test. Their use is discussed in section 2.11 Testability.
Figure 2-8 shows the Debug and Test registers.
2.3.8 Debug and Test Registers
Debug Registers: The six programmer accessible debug registers provide on-chip support for debugging. Debug Registers DR0 ± 3 specify the four linear breakpoints. The Debug Control Register DR7 is used to set the breakpoints and the Debug Status Register DR6, displays the current state of the breakpoints. The use of the debug registers is described in section 2.12 Debugging support.
|
DEBUG REGISTERS |
|
|
|
|
31 |
0 |
|
|
|
LINEAR BREAKPOINT ADDRESS 0 |
|
DR0 |
|
|
LINEAR BREAKPOINT ADDRESS 1 |
|
DR1 |
|
|
LINEAR BREAKPOINT ADDRESS 2 |
|
DR2 |
|
|
LINEAR BREAKPOINT ADDRESS 3 |
|
DR3 |
|
|
Intel reserved. Do not define. |
|
|
DR4 |
|
Intel reserved. Do not define. |
|
|
DR5 |
|
BREAKPOINT STATUS |
|
|
DR6 |
|
BREAKPOINT CONTROL |
|
|
DR7 |
|
TEST REGISTERS (FOR PAGE CACHE) |
|
||
|
31 |
0 |
|
|
|
TEST CONTROL |
|
|
TR6 |
|
TEST STATUS |
|
|
TR7 |
|
|
|
|
|
Figure 2-8. Debug and Test Registers
2.3.9 Register Accessibility
There are a few differences regarding the accessibility of the registers in Real and Protected Mode. Table 2-1 summarizes these differences. See Section 4 Protected Mode Architecture for further details.
2.3.10 Compatibility
VERY IMPORTANT NOTE:
COMPATIBILITY WITH FUTURE PROCESSORS
In the preceding register descriptions, note certain Intel386 DX register bits are Intel reserved. When reserved bits are called out, treat them as fully undefined. This is essential for your software compatibility with future processors! Follow the guidelines below:
1)Do not depend on the states of any undefined bits when testing the values of defined register bits. Mask them out when testing.
2)Do not depend on the states of any undefined bits when storing them to memory or another register.
3)Do not depend on the ability to retain information written into any undefined bits.
4)When loading registers always load the undefined bits as zeros.
14
Intel386TM DX MICROPROCESSOR
Table 2-1. Register Usage
|
|
Use in |
|
Use in |
|
Use in |
|||
Register |
Real Mode |
Protected Mode |
Virtual 8086 Mode |
||||||
|
|
|
|
|
|
|
|
|
|
|
Load |
|
Store |
Load |
|
Store |
Load |
|
Store |
|
|
|
|
|
|
|
|
|
|
General Registers |
Yes |
|
Yes |
Yes |
|
Yes |
Yes |
|
Yes |
|
|
|
|
|
|
|
|
|
|
Segment Registers |
Yes |
|
Yes |
Yes |
|
Yes |
Yes |
|
Yes |
|
|
|
|
|
|
|
|
|
|
Flag Register |
Yes |
|
Yes |
Yes |
|
Yes |
IOPL* |
|
IOPL* |
|
|
|
|
|
|
|
|
|
|
Control Registers |
Yes |
|
Yes |
PL e 0 |
|
PL e 0 |
No |
|
Yes |
GDTR |
Yes |
|
Yes |
PL e 0 |
|
Yes |
No |
|
Yes |
IDTR |
Yes |
|
Yes |
PL e 0 |
|
Yes |
No |
|
Yes |
LDTR |
No |
|
No |
PL e 0 |
|
Yes |
No |
|
No |
TR |
No |
|
No |
PL e 0 |
|
Yes |
No |
|
No |
Debug Control |
Yes |
|
Yes |
PL e 0 |
|
PL e 0 |
No |
|
No |
Test Registers |
Yes |
|
Yes |
PL e 0 |
|
PL e 0 |
No |
|
No |
NOTES:
PL e 0: The registers can be accessed only when the current privilege level is zero.
*IOPL: The PUSHF and POPF instructions are made I/O Privilege Level sensitive in Virtual 8086 Mode.
5)However, registers which have been previously stored may be reloaded without masking.
Depending upon the values of undefined register bits will make your software dependent upon the unspecified Intel386 DX handling of these bits. Depending on undefined values risks making your software incompatible with future processors that define usages for the Intel386 DXundefined bits. AVOID ANY SOFTWARE DEPENDENCE UPON THE STATE OF UNDEFINED Intel386 DX REGISTER BITS.
2.4 INSTRUCTION SET
2.4.1 Instruction Set Overview
The instruction set is divided into nine categories of operations:
Data Transfer
Arithmetic
Shift/Rotate
String Manipulation
Bit Manipulation
Control Transfer
High Level Language Support
Operating System Support
Processor Control
These Intel386 DX instructions are listed in Table 2-2.
All Intel386 DX instructions operate on either 0, 1, 2, or 3 operands; where an operand resides in a register, in the instruction itself, or in memory. Most zero operand instructions (e.g. CLI, STI) take only one byte. One operand instructions generally are two bytes long. The average instruction is 3.2 bytes long. Since the Intel386 DX has a 16-byte instruction queue, an average of 5 instructions will be prefetched. The use of two operands permits the following types of common instructions:
Register to Register
Memory to Register
Immediate to Register
Register to Memory
Immediate to Memory.
The operands can be either 8, 16, or 32 bits long. As a general rule, when executing code written for the Intel386 DX (32-bit code), operands are 8 or 32 bits; when executing existing 80286 or 8086 code (16-bit code), operands are 8 or 16 bits. Prefixes can be added to all instructions which override the default length of the operands, (i.e. use 32-bit operands for 16-bit code, or 16-bit operands for 32-bit code).
For a more elaborate description of the instruction set, refer to the Intel386 DX Programmer's Reference Manual.
15
Intel386TM DX MICROPROCESSOR
2.4.2 Intel386TM DX Instructions
|
Table 2-2a. Data Transfer |
|
GENERAL PURPOSE |
MOV |
Move operand |
PUSH |
Push operand onto stack |
POP |
Pop operand off stack |
PUSHA |
Push all registers on stack |
POPA |
Pop all registers off stack |
XCHG |
Exchange Operand, Register |
XLAT |
Translate |
|
CONVERSION |
MOVZX |
Move byte or Word, Dword, with zero |
|
extension |
MOVSX |
Move byte or Word, Dword, sign |
|
extended |
CBW |
Convert byte to Word, or Word to Dword |
CWD |
Convert Word to DWORD |
CWDE |
Convert Word to DWORD extended |
CDQ |
Convert DWORD to QWORD |
|
INPUT/OUTPUT |
IN |
Input operand from I/O space |
OUT |
Output operand to I/O space |
|
ADDRESS OBJECT |
LEA |
Load effective address |
LDS |
Load pointer into D segment register |
LES |
Load pointer into E segment register |
LFS |
Load pointer into F segment register |
LGS |
Load pointer into G segment register |
LSS |
Load pointer into S (Stack) segment |
|
register |
|
FLAG MANIPULATION |
LAHF |
Load A register from Flags |
SAHF |
Store A register in Flags |
PUSHF |
Push flags onto stack |
POPF |
Pop flags off stack |
PUSHFD |
Push EFlags onto stack |
POPFD |
Pop EFlags off stack |
CLC |
Clear Carry Flag |
CLD |
Clear Direction Flag |
CMC |
Complement Carry Flag |
STC |
Set Carry Flag |
STD |
Set Direction Flag |
Table 2-2b. Arithmetic Instructions |
||
|
|
ADDITION |
ADD |
|
Add operands |
ADC |
|
Add with carry |
INC |
|
Increment operand by 1 |
AAA |
|
ASCII adjust for addition |
DAA |
|
Decimal adjust for addition |
|
|
SUBTRACTION |
SUB |
|
Subtract operands |
SBB |
|
Subtract with borrow |
DEC |
|
Decrement operand by 1 |
NEG |
|
Negate operand |
CMP |
|
Compare operands |
DAS |
|
Decimal adjust for subtraction |
AAS |
|
ASCII Adjust for subtraction |
|
|
MULTIPLICATION |
MUL |
|
Multiply Double/Single Precision |
IMUL |
|
Integer multiply |
AAM |
|
ASCII adjust after multiply |
|
|
DIVISION |
DIV |
|
Divide unsigned |
IDIV |
|
Integer Divide |
AAD |
|
ASCII adjust before division |
|
|
|
|
Table 2-2c. String Instructions |
|
MOVS |
|
Move byte or Word, Dword string |
INS |
|
Input string from I/O space |
OUTS |
|
Output string to I/O space |
CMPS |
|
Compare byte or Word, Dword string |
SCAS |
|
Scan Byte or Word, Dword string |
LODS |
|
Load byte or Word, Dword string |
STOS |
|
Store byte or Word, Dword string |
REP |
|
Repeat |
REPE/ |
|
|
REPZ |
|
Repeat while equal/zero |
RENE/ |
|
|
REPNZ |
|
Repeat while not equal/not zero |
|
Table 2-2d. Logical Instructions |
|
|
|
LOGICALS |
NOT |
|
``NOT'' operands |
AND |
|
``AND'' operands |
OR |
|
``Inclusive OR'' operands |
XOR |
|
``Exclusive OR'' operands |
TEST |
|
``Test'' operands |
16
Table 2-2d. Logical Instructions (Continued)
SHIFTS
SHL/SHR |
|
Shift logical left or right |
SAL/SAR |
|
Shift arithmetic left or right |
SHLD/ |
|
|
SHRD |
|
Double shift left or right |
|
|
ROTATES |
ROL/ROR |
Rotate left/right |
|
RCL/RCR |
|
Rotate through carry left/right |
Table 2-2e. Bit Manipulation Instructions |
||
|
SINGLE BIT INSTRUCTIONS |
|
BT |
|
Bit Test |
BTS |
|
Bit Test and Set |
BTR |
|
Bit Test and Reset |
BTC |
|
Bit Test and Complement |
BSF |
|
Bit Scan Forward |
BSR |
|
Bit Scan Reverse |
Table 2-2f. Program Control Instructions |
||
|
CONDITIONAL TRANSFERS |
|
SETCC |
|
Set byte equal to condition code |
JA/JNBE |
|
Jump if above/not below nor equal |
JAE/JNB |
|
Jump if above or equal/not below |
JB/JNAE |
|
Jump if below/not above nor equal |
JBE/JNA |
|
Jump if below or equal/not above |
JC |
|
Jump if carry |
JE/JZ |
|
Jump if equal/zero |
JG/JNLE |
|
Jump if greater/not less nor equal |
JGE/JNL |
|
Jump if greater or equal/not less |
JL/JNGE |
|
Jump if less/not greater nor equal |
JLE/JNG |
|
Jump if less or equal/not greater |
JNC |
|
Jump if not carry |
JNE/JNZ |
|
Jump if not equal/not zero |
JNO |
|
Jump if not overflow |
JNP/JPO |
|
Jump if not parity/parity odd |
JNS |
|
Jump if not sign |
JO |
|
Jump if overflow |
JP/JPE |
|
Jump if parity/parity even |
JS |
|
Jump if Sign |
Intel386TM DX MICROPROCESSOR
Table 2-2f. Program Control Instructions
(Continued)
UNCONDITIONAL TRANSFERS
CALL |
|
Call procedure/task |
RET |
|
Return from procedure |
JMP |
|
Jump |
|
|
ITERATION CONTROLS |
LOOP |
|
Loop |
LOOPE/ |
|
|
LOOPZ |
|
Loop if equal/zero |
LOOPNE/ |
|
|
LOOPNZ |
|
Loop if not equal/not zero |
JCXZ |
|
JUMP if register CXe0 |
|
|
INTERRUPTS |
INT |
|
Interrupt |
INTO |
|
Interrupt if overflow |
IRET |
|
Return from Interrupt/Task |
CLI |
|
Clear interrupt Enable |
STI |
|
Set Interrupt Enable |
Table 2-2g. High Level Language Instructions |
||
BOUND |
|
Check Array Bounds |
ENTER |
|
Setup Parameter Block for Entering |
|
|
Procedure |
LEAVE |
|
Leave Procedure |
|
Table 2-2h. Protection Model |
|
SGDT |
|
Store Global Descriptor Table |
SIDT |
|
Store Interrupt Descriptor Table |
STR |
|
Store Task Register |
SLDT |
|
Store Local Descriptor Table |
LGDT |
|
Load Global Descriptor Table |
LIDT |
|
Load Interrupt Descriptor Table |
LTR |
|
Load Task Register |
LLDT |
|
Load Local Descriptor Table |
ARPL |
|
Adjust Requested Privilege Level |
LAR |
|
Load Access Rights |
LSL |
|
Load Segment Limit |
VERR/ |
|
|
VERW |
|
Verify Segment for Reading or Writing |
LMSW |
|
Load Machine Status Word (lower |
|
|
16 bits of CR0) |
SMSW |
|
Store Machine Status Word |
Table 2-2i. Processor Control Instructions |
||
HLT |
|
Halt |
WAIT |
|
Wait until BUSYÝ negated |
ESC |
|
Escape |
LOCK |
|
Lock Bus |
17
Intel386TM DX MICROPROCESSOR
2.5 ADDRESSING MODES
2.5.1 Addressing Modes Overview
The Intel386 DX provides a total of 11 addressing modes for instructions to specify operands. The addressing modes are optimized to allow the efficient execution of high level languages such as C and FORTRAN, and they cover the vast majority of data references needed by high-level languages.
2.5.2 Register and Immediate Modes
Two of the addressing modes provide for instructions that operate on register or immediate operands:
Register Operand Mode: The operand is located in one of the 8-, 16or 32-bit general registers.
Immediate Operand Mode: The operand is included in the instruction as part of the opcode.
2.5.332-Bit Memory Addressing Modes
The remaining 9 modes provide a mechanism for specifying the effective address of an operand. The linear address consists of two components: the segment base address and an effective address. The effective address is calculated by using combinations of the following four address elements:
DISPLACEMENT: An 8-, or 32-bit immediate value, following the instruction.
BASE: The contents of any general purpose register. The base registers are generally used by compilers to point to the start of the local variable area.
INDEX: The contents of any general purpose register except for ESP. The index registers are used to access the elements of an array, or a string of characters.
SCALE: The index register's value can be multiplied by a scale factor, either 1, 2, 4 or 8. Scaled index mode is especially useful for accessing arrays or structures.
Combinations of these 4 components make up the 9 additional addressing modes. There is no performance penalty for using any of these addressing combinations, since the effective address calculation is pipelined with the execution of other instructions.
The one exception is the simultaneous use of Base and Index components which requires one additional clock.
As shown in Figure 2-9, the effective address (EA) of an operand is calculated according to the following formula.
EAeBase Rega(Index Reg * Scaling)aDisplacement
Direct Mode: The operand's offset is contained as part of the instruction as an 8-, 16or 32-bit displacement.
EXAMPLE: INC Word PTR [500]
Register Indirect Mode: A BASE register contains the address of the operand.
EXAMPLE: MOV [ECX], EDX
Based Mode: A BASE register's contents is added to a DISPLACEMENT to form the operands offset.
EXAMPLE: MOV ECX, [EAXa24]
Index Mode: An INDEX register's contents is added to a DISPLACEMENT to form the operands offset.
EXAMPLE: ADD EAX, TABLE[ESI]
Scaled Index Mode: An INDEX register's contents is multiplied by a scaling factor which is added to a DISPLACEMENT to form the operands offset.
EXAMPLE: IMUL EBX, TABLE[ESI*4],7
Based Index Mode: The contents of a BASE register is added to the contents of an INDEX register to form the effective address of an operand.
EXAMPLE: MOV EAX, [ESI] [EBX]
Based Scaled Index Mode: The contents of an INDEX register is multiplied by a SCALING factor and the result is added to the contents of a BASE register to obtain the operands offset.
EXAMPLE: MOV ECX, [EDX*8] [EAX]
Based Index Mode with Displacement: The contents of an INDEX Register and a BASE register's contents and a DISPLACEMENT are all summed together to form the operand offset.
EXAMPLE: ADD EDX, [ESI] [EBPa00FFFFF0H]
Based Scaled Index Mode with Displacement: The contents of an INDEX register are multiplied by a SCALING factor, the result is added to the contents of a BASE register and a DISPLACEMENT to form the operand's offset.
EXAMPLE: MOV EAX, [EBPa80]
18
Intel386TM DX MICROPROCESSOR
231630 ± 51
Figure 2-9. Addressing Mode Calculations
2.5.4Differences Between 16 and 32 Bit Addresses
In order to provide software compatibility with the 80286 and the 8086, the Intel386 DX can execute 16-bit instructions in Real and Protected Modes. The processor determines the size of the instructions it is executing by examining the D bit in the CS segment Descriptor. If the D bit is 0 then all operand lengths and effective addresses are assumed to be 16 bits long. If the D bit is 1 then the default length for operands and addresses is 32 bits. In Real Mode the default size for operands and addresses is 16-bits.
Regardless of the default precision of the operands or addresses, the Intel386 DX is able to execute either 16 or 32-bit instructions. This is specified via the use of override prefixes. Two prefixes, the Operand Size Prefix and the Address Length Prefix, override the value of the D bit on an individual instruction basis. These prefixes are automatically added by Intel assemblers.
Example: The processor is executing in Real Mode and the programmer needs to access the EAX registers. The assembler code for this might be MOV EAX, 32-bit MEMORYOP, ASM386 Macro Assembler automatically determines that an Operand Size Prefix is needed and generates it.
Example: The D bit is 0, and the programmer wishes to use Scaled Index addressing mode to access an array. The Address Length Prefix allows the use of MOV DX, TABLE[ESI*2]. The assembler uses an Address Length Prefix since, with De0, the default addressing mode is 16-bits.
Example: The D bit is 1, and the program wants to store a 16-bit quantity. The Operand Length Prefix is used to specify only a 16-bit value; MOV MEM16, DX.
19
Intel386TM DX MICROPROCESSOR
Table 2-3. BASE and INDEX Registers for 16and 32-Bit Addresses
|
16-Bit Addressing |
32-Bit Addressing |
|
|
|
BASE REGISTER |
BX,BP |
Any 32-bit GP Register |
INDEX REGISTER |
SI,DI |
Any 32-bit GP Register |
|
|
Except ESP |
SCALE FACTOR |
none |
1, 2, 4, 8 |
DISPLACEMENT |
0, 8, 16 bits |
0, 8, 32 bits |
|
|
|
The OPERAND LENGTH and Address Length Prefixes can be applied separately or in combination to any instruction. The Address Length Prefix does not allow addresses over 64K bytes to be accessed in Real Mode. A memory address which exceeds FFFFH will result in a General Protection Fault. An Address Length Prefix only allows the use of the additional Intel386 DX addressing modes.
When executing 32-bit code, the Intel386 DX uses either 8-, or 32-bit displacements, and any register can be used as base or index registers. When executing 16-bit code, the displacements are either 8, or 16 bits, and the base and index register conform to the 80286 model. Table 2-3 illustrates the differences.
2.6 DATA TYPES
The Intel386 DX supports all of the data types commonly used in high level languages:
Bit: A single bit quantity.
Bit Field: A group of up to 32 contiguous bits, which spans a maximum of four bytes.
Bit String: A set of contiguous bits, on the Intel386 DX bit strings can be up to 4 gigabits long.
Byte: A signed 8-bit quantity.
Unsigned Byte: An unsigned 8-bit quantity.
Integer (Word): A signed 16-bit quantity.
Long Integer (Double Word): A signed 32-bit quantity. All operations assume a 2's complement representation.
Unsigned Integer (Word): An unsigned 16-bit quantity.
Unsigned Long Integer (Double Word): An unsigned 32-bit quantity.
Signed Quad Word: A signed 64-bit quantity.
Unsigned Quad Word: An unsigned 64-bit quantity.
Offset: A 16or 32-bit offset only quantity which indirectly references another memory location.
Pointer: A full pointer which consists of a 16-bit segment selector and either a 16or 32-bit offset.
Char: A byte representation of an ASCII Alphanumeric or control character.
String: A contiguous sequence of bytes, words or dwords. A string may contain between 1 byte and 4 Gbytes.
BCD: A byte (unpacked) representation of decimal digits 0 ± 9.
Packed BCD: A byte (packed) representation of two decimal digits 0 ± 9 storing one digit in each nibble.
When the Intel386 DX is coupled with an Intel387 DX Numerics Coprocessor then the following common Floating Point types are supported.
Floating Point: A signed 32-, 64-, or 80-bit real number representation. Floating point numbers are supported by the Intel387 DX numerics coprocessor.
Figure 2-10 illustrates the data types supported by the Intel386 DX and the Intel387 DX numerics coprocessor.
20
Intel386TM DX MICROPROCESSOR
231630 ± 52
Figure 2-10. Intel386TM DX Supported Data Types
21
Intel386TM DX MICROPROCESSOR
2.7 MEMORY ORGANIZATION
2.7.1 Introduction
Memory on the Intel386 DX is divided up into 8-bit quantities (bytes), 16-bit quantities (words), and 32-bit quantities (dwords). Words are stored in two consecutive bytes in memory with the low-order byte at the lowest address, the high order byte at the high address. Dwords are stored in four consecutive bytes in memory with the low-order byte at the lowest address, the high-order byte at the highest address. The address of a word or dword is the byte address of the low-order byte.
In addition to these basic data types, the Intel386 DX supports two larger units of memory: pages and segments. Memory can be divided up into one or more variable length segments, which can be swapped to disk or shared between programs. Memory can also be organized into one or more 4K byte pages. Finally, both segmentation and paging can be combined, gaining the advantages of both systems. The Intel386 DX supports both pages and segments in order to provide maximum flexibility to the system designer. Segmentation and paging are complementary. Segmentation is useful for organizing memory in logical modules, and as such is a tool for the application programmer, while pages are useful for the system programmer for managing the physical memory of a system.
2.7.2 Address Spaces
The Intel386 DX has three distinct address spaces: logical, linear, and physical. A logical address
(also known as a virtual address) consists of a selector and an offset. A selector is the contents of a segment register. An offset is formed by summing all of the addressing components (BASE, INDEX, DISPLACEMENT) discussed in section 2.5.3 Memory Addressing Modes into an effective address. Since each task on Intel386 DX has a maximum of 16K (214 b1) selectors, and offsets can be 4 gigabytes, (232 bits) this gives a total of 246 bits or 64 terabytes of logical address space per task. The programmer sees this virtual address space.
The segmentation unit translates the logical address space into a 32-bit linear address space. If the paging unit is not enabled then the 32-bit linear address corresponds to the physical address. The paging unit translates the linear address space into the physical address space. The physical address is what appears on the address pins.
The primary difference between Real Mode and Protected Mode is how the segmentation unit performs the translation of the logical address into the linear address. In Real Mode, the segmentation unit shifts the selector left four bits and adds the result to the offset to form the linear address. While in Protected Mode every selector has a linear base address associated with it. The linear base address is stored in one of two operating system tables (i.e. the Local Descriptor Table or Global Descriptor Table). The selector's linear base address is added to the offset to form the final linear address.
Figure 2-11 shows the relationship between the various address spaces.
231630 ± 53
Figure 2-11. Address Translation
22
2.7.3 Segment Register Usage
The main data structure used to organize memory is the segment. On the Intel386 DX, segments are variable sized blocks of linear addresses which have certain attributes associated with them. There are two main types of segments: code and data, the segments are of variable size and can be as small as 1 byte or as large as 4 gigabytes (232 bytes).
In order to provide compact instruction encoding, and increase processor performance, instructions do not need to explicitly specify which segment register is used. A default segment register is automatically chosen according to the rules of Table 2-4 (Segment Register Selection Rules). In general, data references use the selector contained in the DS register; Stack references use the SS register and Instruction fetches use the CS register. The contents of the Instruction Pointer provides the offset. Special segment override prefixes allow the explicit use of a given segment register, and override the implicit rules listed in Table 2-4. The override prefixes also allow the use of the ES, FS and GS segment registers.
Intel386TM DX MICROPROCESSOR
There are no restrictions regarding the overlapping of the base addresses of any segments. Thus, all 6 segments could have the base address set to zero and create a system with a four gigabyte linear address space. This creates a system where the virtual address space is the same as the linear address space. Further details of segmentation are discussed in section 4.1.
2.8 I/O SPACE
The Intel386 DX has two distinct physical address spaces: Memory and I/O. Generally, peripherals are placed in I/O space although the Intel386 DX also supports memory-mapped peripherals. The I/O space consists of 64K bytes, it can be divided into 64K 8-bit ports, 32K 16-bit ports, or 16K 32-bit ports, or any combination of ports which add up to less than 64K bytes. The 64K I/O address space refers to physical memory rather than linear address since I/O instructions do not go through the segmentation or paging hardware. The M/IOÝ pin acts as an additional address line thus allowing the system designer to easily determine which address space the processor is accessing.
Table 2-4. Segment Register Selection Rules
Type of |
Implied (Default) |
Segment Override |
Memory Reference |
Segment Use |
Prefixes Possible |
|
|
|
Code Fetch |
CS |
None |
|
|
|
Destination of PUSH, PUSHF, INT, |
SS |
None |
CALL, PUSHA Instructions |
|
|
|
|
|
Source of POP, POPA, POPF, |
SS |
None |
IRET, RET instructions |
|
|
|
|
|
Destination of STOS, MOVS, REP |
ES |
None |
STOS, REP MOVS Instructions |
|
|
(DI is Base Register) |
|
|
|
|
|
Other Data References, with |
|
|
Effective Address Using Base |
|
|
Register of: |
|
|
[EAX] |
DS |
DS,CS,SS,ES,FS,GS |
[EBX] |
DS |
DS,CS,SS,ES,FS,GS |
[ECX] |
DS |
DS,CS,SS,ES,FS,GS |
[EDX] |
DS |
DS,CS,SS,ES,FS,GS |
[ESI] |
DS |
DS,CS,SS,ES,FS,GS |
[EDI] |
DS |
DS,CS,SS,ES,FS,GS |
[EBP] |
SS |
DS,CS,SS,ES,FS,GS |
[ESP] |
SS |
DS,CS,SS,ES,FS,GS |
|
|
|
23
Intel386TM DX MICROPROCESSOR
The I/O ports are accessed via the IN and OUT I/O instructions, with the port address supplied as an immediate 8-bit constant in the instruction or in the DX register. All 8- and 16-bit port addresses are zero extended on the upper address lines. The I/O instructions cause the M/IOÝ pin to be driven low.
I/O port addresses 00F8H through 00FFH are reserved for use by Intel.
2.9 INTERRUPTS
2.9.1 Interrupts and Exceptions
Interrupts and exceptions alter the normal program flow, in order to handle external events, to report errors or exceptional conditions. The difference between interrupts and exceptions is that interrupts are used to handle asynchronous external events while exceptions handle instruction faults. Although a program can generate a software interrupt via an INT N instruction, the processor treats software interrupts as exceptions.
Hardware interrupts occur as the result of an external event and are classified into two types: maskable or non-maskable. Interrupts are serviced after the execution of the current instruction. After the interrupt handler is finished servicing the interrupt, execution proceeds with the instruction immediately after the interrupted instruction. Sections 2.9.3 and 2.9.4 discuss the differences between Maskable and Non-Maskable interrupts.
Exceptions are classified as faults, traps, or aborts depending on the way they are reported, and whether or not restart of the instruction causing the exception is supported. Faults are exceptions that are detected and serviced before the execution of the faulting instruction. A fault would occur in a virtual memory system, when the processor referenced a page or a segment which was not present. The operating system would fetch the page or segment from disk, and then the Intel386 DX would restart the instruction. Traps are exceptions that are reported immediately after the execution of the instruction which caused the problem. User defined interrupts are examples of traps. Aborts are exceptions which do not permit the precise location of the instruction causing the exception to be determined. Aborts are used to report severe errors, such as a hardware error, or illegal values in system tables.
Thus, when an interrupt service routine has been completed, execution proceeds from the instruction
immediately following the interrupted instruction. On the other hand, the return address from an exception fault routine will always point at the instruction causing the exception and include any leading instruction prefixes. Table 2-5 summarizes the possible interrupts for the Intel386 DX and shows where the return address points.
The Intel386 DX has the ability to handle up to 256 different interrupts/exceptions. In order to service the interrupts, a table with up to 256 interrupt vectors must be defined. The interrupt vectors are simply pointers to the appropriate interrupt service routine. In Real Mode (see section 3.1), the vectors are 4 byte quantities, a Code Segment plus a 16-bit offset; in Protected Mode, the interrupt vectors are 8 byte quantities, which are put in an Interrupt Descriptor Table (see section 4.1). Of the 256 possible interrupts, 32 are reserved for use by Intel, the remaining 224 are free to be used by the system designer.
2.9.2 Interrupt Processing
When an interrupt occurs the following actions happen. First, the current program address and the Flags are saved on the stack to allow resumption of the interrupted program. Next, an 8-bit vector is supplied to the Intel386 DX which identifies the appropriate entry in the interrupt table. The table contains the starting address of the interrupt service routine. Then, the user supplied interrupt service routine is executed. Finally, when an IRET instruction is executed the old processor state is restored and program execution resumes at the appropriate instruction.
The 8-bit interrupt vector is supplied to the Intel386 DX in several different ways: exceptions supply the interrupt vector internally; software INT instructions contain or imply the vector; maskable hardware interrupts supply the 8-bit vector via the interrupt acknowledge bus sequence. Non-Maskable hardware interrupts are assigned to interrupt vector 2.
2.9.3 Maskable Interrupt
Maskable interrupts are the most common way used by the Intel386 DX to respond to asynchronous external hardware events. A hardware interrupt occurs when the INTR is pulled high and the Interrupt Flag bit (IF) is enabled. The processor only responds to interrupts between instructions, (REPeat String instructions, have an ``interrupt window'', between memory moves, which allows interrupts during long
24
Intel386TM DX MICROPROCESSOR
Table 2-5. Interrupt Vector Assignments
|
|
Instruction Which |
Return Address |
|
|
|
Interrupt |
Points to |
|
||
Function |
Can Cause |
Type |
|||
Number |
Faulting |
||||
|
Exception |
|
|||
|
|
Instruction |
|
||
|
|
|
|
||
|
|
|
|
|
|
Divide Error |
0 |
DIV, IDIV |
YES |
FAULT |
|
|
|
|
|
|
|
Debug Exception |
1 |
any instruction |
YES |
TRAP* |
|
|
|
|
|
|
|
NMI Interrupt |
2 |
INT 2 or NMI |
NO |
NMI |
|
|
|
|
|
|
|
One Byte Interrupt |
3 |
INT |
NO |
TRAP |
|
|
|
|
|
|
|
Interrupt on Overflow |
4 |
INTO |
NO |
TRAP |
|
|
|
|
|
|
|
Array Bounds Check |
5 |
BOUND |
YES |
FAULT |
|
|
|
|
|
|
|
Invalid OP-Code |
6 |
Any Illegal Instruction |
YES |
FAULT |
|
|
|
|
|
|
|
Device Not Available |
7 |
ESC, WAIT |
YES |
FAULT |
|
|
|
|
|
|
|
Double Fault |
8 |
Any Instruction That Can |
|
ABORT |
|
|
|
Generate an Exception |
|
|
|
|
|
|
|
|
|
Coprocessor Segment Overrun |
9 |
ESC |
NO |
ABORT |
|
|
|
|
|
|
|
Invalid TSS |
10 |
JMP, CALL, IRET, INT |
YES |
FAULT |
|
|
|
|
|
|
|
Segment Not Present |
11 |
Segment Register Instructions |
YES |
FAULT |
|
|
|
|
|
|
|
Stack Fault |
12 |
Stack References |
YES |
FAULT |
|
|
|
|
|
|
|
General Protection Fault |
13 |
Any Memory Reference |
YES |
FAULT |
|
|
|
|
|
|
|
Intel Reserved |
15 |
|
|
|
|
|
|
|
|
|
|
Page Fault |
14 |
Any Memory Access or Code Fetch |
YES |
FAULT |
|
|
|
|
|
|
|
Coprocessor Error |
16 |
ESC, WAIT |
YES |
FAULT |
|
|
|
|
|
|
|
Intel Reserved |
17 ± 31 |
|
|
|
|
|
|
|
|
|
|
Two Byte Interrupt |
0 ± 255 |
INT n |
NO |
TRAP |
|
|
|
|
|
|
* Some debug exceptions may report both traps on the previous instruction, and faults on the next instruction.
string moves). When an interrupt occurs the processor reads an 8-bit vector supplied by the hardware which identifies the source of the interrupt, (one of 224 user defined interrupts). The exact nature of the interrupt sequence is discussed in section 5.
The IF bit in the EFLAG registers is reset when an interrupt is being serviced. This effectively disables servicing additional interrupts during an interrupt service routine. However, the IF may be set explicitly by the interrupt handler, to allow the nesting of interrupts. When an IRET instruction is executed the original state of the IF is restored.
input is pulled high it causes an interrupt with an internally supplied vector value of 2. Unlike a normal hardware interrupt, no interrupt acknowledgment sequence is performed for an NMI.
While executing the NMI servicing procedure, the Intel386 DX will not service further NMI requests, until an interrupt return (IRET) instruction is executed or the processor is reset. If NMI occurs while currently servicing an NMI, its presence will be saved for servicing after executing the first IRET instruction. The IF bit is cleared at the beginning of an NMI interrupt to inhibit further INTR interrupts.
2.9.4 Non-Maskable Interrupt
Non-maskable interrupts provide a method of servicing very high priority interrupts. A common example of the use of a non-maskable interrupt (NMI) would be to activate a power failure routine. When the NMI
2.9.5 Software Interrupts
A third type of interrupt/exception for the Intel386 DX is the software interrupt. An INT n instruction causes the processor to execute the interrupt service routine pointed to by the nth vector in the interrupt table.
25
Intel386TM DX MICROPROCESSOR
A special case of the two byte software interrupt INT n is the one byte INT 3, or breakpoint interrupt. By inserting this one byte instruction in a program, the user can set breakpoints in his program as a debugging tool.
A final type of software interrupt, is the single step interrupt. It is discussed in section 2.12.
2.9.6Interrupt and Exception Priorities
Interrupts are externally-generated events. Maskable Interrupts (on the INTR input) and Non-Maskable Interrupts (on the NMI input) are recognized at instruction boundaries. When NMI and maskable INTR are both recognized at the same instruction boundary, the Intel386 DX invokes the NMI service routine first. If, after the NMI service routine has been invoked, maskable interrupts are still enabled, then the Intel386 DX will invoke the appropriate interrupt service routine.
Table 2-6a. Intel386TM DX Priority for Invoking Service Routines in Case of Simultaneous External Interrupts
1.NMI
2.INTR
Exceptions are internally-generated events. Exceptions are detected by the Intel386 DX if, in the course of executing an instruction, the Intel386 DX detects a problematic condition. The Intel386 DX then immediately invokes the appropriate exception service routine. The state of the Intel386 DX is such that the instruction causing the exception can be restarted. If the exception service routine has taken care of the problematic condition, the instruction will execute without causing the same exception.
It is possible for a single instruction to generate several exceptions (for example, transferring a single operand could generate two page faults if the operand location spans two ``not present'' pages). However, only one exception is generated upon each attempt to execute the instruction. Each exception service routine should correct its corresponding exception, and restart the instruction. In this manner, exceptions are serviced until the instruction executes successfully.
As the Intel386 DX executes instructions, it follows a consistent cycle in checking for exceptions, as shown in Table 2-6b. This cycle is repeated
as each instruction is executed, and occurs in parallel with instruction decoding and execution.
Table 2-6b. Sequence of Exception Checking
Consider the case of the Intel386 DX having just completed an instruction. It then performs the following checks before reaching the point where the next instruction is completed:
1.Check for Exception 1 Traps from the instruction just completed (single-step via Trap Flag, or Data Breakpoints set in the Debug Registers).
2.Check for Exception 1 Faults in the next instruction (Instruction Execution Breakpoint set in the Debug Registers for the next instruction).
3.Check for external NMI and INTR.
4.Check for Segmentation Faults that prevented fetching the entire next instruction (exceptions 11 or 13).
5.Check for Page Faults that prevented fetching the entire next instruction (exception 14).
6.Check for Faults decoding the next instruction (exception 6 if illegal opcode; exception 6 if in Real Mode or in Virtual 8086 Mode and attempting to execute an instruction for Protected Mode only (see 4.6.4); or exception 13 if instruction is longer than 15 bytes, or privilege violation in Protected Mode (i.e. not at IOPL or at CPLe0).
7.If WAIT opcode, check if TSe1 and MPe1 (exception 7 if both are 1).
8.If ESCAPE opcode for numeric coprocessor, check if EMe1 or TSe1 (exception 7 if either are 1).
9.If WAIT opcode or ESCAPE opcode for numeric coprocessor, check ERRORÝ input signal (exception 16 if ERRORÝ input is asserted).
10.Check in the following order for each memory reference required by the instruction:
a.Check for Segmentation Faults that prevent transferring the entire memory quantity (exceptions 11, 12, 13).
b.Check for Page Faults that prevent transferring the entire memory quantity (exception 14).
Note that the order stated supports the concept of the paging mechanism being ``underneath'' the segmentation mechanism. Therefore, for any given code or data reference in memory, segmentation exceptions are generated before paging exceptions are generated.
26
2.9.7 Instruction Restart
The Intel386 DX fully supports restarting all instructions after faults. If an exception is detected in the instruction to be executed (exception categories 4 through 10 in Table 2-6b), the Intel386 DX invokes the appropriate exception service routine. The Intel386 DX is in a state that permits restart of the instruction, for all cases but those in Table 2-6c. Note that all such cases are easily avoided by proper design of the operating system.
Table 2-6c. Conditions Preventing
Instruction Restart
A.An instruction causes a task switch to a task whose Task State Segment is partially ``not present''. (An entirely ``not present'' TSS is restartable.) Partially present TSS's can be avoided either by keeping the TSS's of such tasks present in memory, or by aligning TSS segments to reside entirely within a single 4K page (for TSS segments of 4K bytes or less).
B.A coprocessor operand wraps around the top of a 64K-byte segment or a 4G-byte segment, and spans three pages, and the page holding the middle portion of the operand is ``not present.'' This condition can be avoided by starting at a page boundary any segments containing coprocessor operands if the segments are approximately 64K-200 bytes or larger (i.e. large enough for wraparound of the coprocessor operand to possibly occur).
Note that these conditions are avoided by using the operating system designs mentioned in this table.
2.9.8 Double Fault
A Double Fault (exception 8) results when the processor attempts to invoke an exception service routine for the segment exceptions (10, 11, 12 or 13), but in the process of doing so, detects an exception other than a Page Fault (exception 14).
A Double Fault (exception 8) will also be generated when the processor attempts to invoke the Page Fault (exception 14) service routine, and detects an exception other than a second Page Fault. In any functional system, the entire Page Fault service routine must remain ``present'' in memory.
Double page faults however do not raise the double fault exception. If a second page fault occurs while the processor is attempting to enter the service routine for the first time, then the processor will invoke
Intel386TM DX MICROPROCESSOR
the page fault (exception 14) handler a second time, rather than the double fault (exception 8) handler. A subsequent fault, though, will lead to shutdown.
When a Double Fault occurs, the Intel386 DX invokes the exception service routine for exception 8.
2.10 RESET AND INITIALIZATION
When the processor is initialized or Reset the registers have the values shown in Table 2-7. The Intel386 DX will then start executing instructions near the top of physical memory, at location FFFFFFF0H. When the first InterSegment Jump or Call is executed, address lines A20-31 will drop low for CS-rela- tive memory cycles, and the Intel386 DX will only execute instructions in the lower one megabyte of physical memory. This allows the system designer to use a ROM at the top of physical memory to initialize the system and take care of Resets.
RESET forces the Intel386 DX to terminate all execution and local bus activity. No instruction execution or bus activity will occur as long as Reset is active. Between 350 and 450 CLK2 periods after Reset becomes inactive the Intel386 DX will start executing instructions at the top of physical memory.
Table 2-7. Register Values after Reset
Flag Word |
UUUU0002H Note 1 |
|
Machine Status Word (CR0) |
UUUUUUU0H Note 2 |
|
Instruction Pointer |
0000FFF0H |
|
Code Segment |
F000H Note 3 |
|
Data Segment |
0000H |
|
Stack Segment |
0000H |
|
Extra Segment (ES) |
0000H |
|
Extra Segment (FS) |
0000H |
|
Extra Segment (GS) |
0000H |
|
DX register |
component and |
|
|
stepping ID |
Note 5 |
All other registers |
undefined |
Note 4 |
|
|
|
NOTES:
1.EFLAG Register. The upper 14 bits of the EFLAGS register are undefined, VM (Bit 17) and RF (BIT) 16 are 0 as are all other defined flag bits.
2.CR0: (Machine Status Word). All of the defined fields in the CR0 are 0 (PG Bit 31, TS Bit 3, EM Bit 2, MP Bit 1, and PE Bit 0).
3.The Code Segment Register (CS) will have its Base Address set to FFFF0000H and Limit set to 0FFFFH.
4.All undefined bits are Intel Reserved and should not be used.
5.DX register always holds component and stepping identifier (see 5.7). EAX register holds self-test signature if selftest was requested (see 5.6).
27
Intel386TM DX MICROPROCESSOR
2.11 TESTABILITY
2.11.1 Self-Test
The Intel386 DX has the capability to perform a selftest. The self-test checks the function of all of the Control ROM and most of the non-random logic of the part. Approximately one-half of the Intel386 DX can be tested during self-test.
Self-Test is initiated on the Intel386 DX when the RESET pin transitions from HIGH to LOW, and the BUSYÝ pin is low. The self-test takes about 2**19 clocks, or approximately 26 milliseconds with a 20 MHz Intel386 DX. At the completion of self-test the processor performs reset and begins normal operation. The part has successfully passed self-test if the contents of the EAX register are zero (0). If the results of EAX are not zero then the self-test has detected a flaw in the part.
2.11.2 TLB Testing
The Intel386 DX provides a mechanism for testing the Translation Lookaside Buffer (TLB) if desired. This particular mechanism is unique to the Intel386 DX and may not be continued in the same way in future processors. When testing the TLB paging must be turned off (PG e 0 in CR0) to enable the TLB testing hardware and avoid interference with the test data being written to the TLB.
There are two TLB testing operations: 1) write entries into the TLB, and, 2) perform TLB lookups. Two Test Registers, shown in Figure 2-12, are provided for the purpose of testing. TR6 is the ``test command register'', and TR7 is the ``test data register''. The fields within these registers are defined below.
C: This is the command bit. For a write into TR6 to cause an immediate write into the TLB entry, write a 0 to this bit. For a write into TR6 to cause an immediate TLB lookup, write a 1 to this bit.
Linear Address: This is the tag field of the TLB. On a TLB write, a TLB entry is allocated to this linear address and the rest of that TLB entry is set per the value of TR7 and the value just written into TR6. On a TLB lookup, the TLB is interrogated per this value and if one and only one TLB entry matches, the rest of the fields of TR6 and TR7 are set from the matching TLB entry.
Physical Address: This is the data field of the TLB. On a write to the TLB, the TLB entry allocated to the linear address in TR6 is set to this value. On a TLB lookup, the data field (physical address) from the TLB is read out to here.
PL: On a TLB write, PLe1 causes the REP field of TR7 to select which of four associative blocks of the TLB is to be written, but PLe0 allows the internal pointer in the paging unit to select which TLB block is written. On a TLB lookup, the PL bit indicates whether the lookup was a hit (PL gets set to 1) or a miss (PL gets reset to 0).
V: The valid bit for this TLB entry. All valid bits can also be cleared by writing to CR3.
D, DÝ: The dirty bit for/from the TLB entry.
U, UÝ: The user bit for/from the TLB entry.
W, WÝ: The writable bit for/from the TLB entry.
For D, U and W, both the attribute and its complement are provided as tag bits, to permit the option of a ``don't care'' on TLB lookups. The meaning of these pairs of bits is given in the following table:
X |
XÝ |
Effect During |
Value of Bit |
|
TLB Lookup |
X after TLB Write |
|||
|
|
|||
|
|
|
|
|
0 |
0 |
Miss All |
Bit X Becomes Undefined |
|
0 |
1 |
Match if X e 0 |
Bit X Becomes 0 |
|
1 |
0 |
Match if X e 1 |
Bit X Becomes 1 |
|
1 |
1 |
Match all |
Bit X Becomes Undefined |
|
|
|
|
|
For writing a TLB entry:
1.Write TR7 for the desired physical address, PL and REP values.
2.Write TR6 with the appropriate linear address, etc. (be sure to write C e 0 for ``write'' command).
For looking up (reading) a TLB entry:
1.Write TR6 with the appropriate linear address (be sure to write Ce1 for ``lookup'' command).
2.Read TR7 and TR6. If the PL bit in TR7 indicates a hit, then the other values reveal the TLB contents. If PL indicates a miss, then the other values in TR7 and TR6 are indeterminate.
2.12 DEBUGGING SUPPORT
The Intel386 DX provides several features which simplify the debugging process. The three categories of on-chip debugging aids are:
1)the code execution breakpoint opcode (0CCH),
2)the single-step capability provided by the TF bit in the flag register, and
3)the code and data breakpoint capability provided by the Debug Registers DR0-3, DR6, and DR7.
28
Intel386TM DX MICROPROCESSOR
|
31 |
|
|
12 |
|
11 |
|
|
|
|
|
|
|
|
|
|
0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
LINEAR ADDRESS |
|
|
V |
D |
D |
U |
U |
W |
W |
0 |
0 |
0 |
0 |
C |
TR6 |
|
|
|
|
|
|
|
Ý |
|
Ý |
|
Ý |
||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
PHYSICAL ADDRESS |
|
|
0 |
0 |
0 |
0 |
0 |
0 |
0 |
P |
REP |
0 |
0 |
TR7 |
||
|
|
|
|
L |
||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
NOTE: |
0 |
indicates Intel reserved: Do not define; SEE SECTION 2.3.10 |
|
|
|
|
|
|
|||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||
|
|
|
|
Figure 2-12. Test Registers |
|
|
|
|
|
|
|
|
|
2.12.1 Breakpoint Instruction
A single-byte-opcode breakpoint instruction is available for use by software debuggers. The breakpoint opcode is 0CCh, and generates an exception 3 trap when executed. In typical use, a debugger program can ``plant'' the breakpoint instruction at all desired code execution breakpoints. The single-byte breakpoint opcode is an alias for the two-byte general software interrupt instruction, INT n, where ne3. The only difference between INT 3 (0CCh) and INT n is that INT 3 is never IOPL-sensitive but INT n is IOPL-sensitive in Protected Mode and Virtual 8086 Mode.
2.12.2 Single-Step Trap
If the single-step flag (TF, bit 8) in the EFLAG register is found to be set at the end of an instruction, a single-step exception occurs. The single-step exception is auto vectored to exception number 1. Precisely, exception 1 occurs as a trap after the instruction following the instruction which set TF. In typical practice, a debugger sets the TF bit of a flag register image on the debugger's stack. It then typically transfers control to the user program and loads the flag image with a signal instruction, the IRET instruction. The single-step trap occurs after executing one instruction of the user program.
Since the exception 1 occurs as a trap (that is, it occurs after the instruction has already executed), the CS:EIP pushed onto the debugger's stack points to the next unexecuted instruction of the program being debugged. An exception 1 handler, merely by ending with an IRET instruction, can therefore efficiently support single-stepping through a user program.
2.12.3 Debug Registers
The Debug Registers are an advanced debugging feature of the Intel386 DX. They allow data access breakpoints as well as code execution breakpoints. Since the breakpoints are indicated by on-chip registers, an instruction execution breakpoint can be
placed in ROM code or in code shared by several tasks, neither of which can be supported by the INT3 breakpoint opcode.
The Intel386 DX contains six Debug Registers, providing the ability to specify up to four distinct breakpoints addresses, breakpoint control options, and read breakpoint status. Initially after reset, breakpoints are in the disabled state. Therefore, no breakpoints will occur unless the debug registers are programmed. Breakpoints set up in the Debug Registers are autovectored to exception number 1.
2.12.3.1LINEAR ADDRESS BREAKPOINT REGISTERS (DR0 ± DR3)
Up to four breakpoint addresses can be specified by writing into Debug Registers DR0 ± DR3, shown in Figure 2-13. The breakpoint addresses specified are 32-bit linear addresses. Intel386 DX hardware continuously compares the linear breakpoint addresses in DR0 ± DR3 with the linear addresses generated by executing software (a linear address is the result of computing the effective address and adding the 32-bit segment base address). Note that if paging is not enabled the linear address equals the physical address. If paging is enabled, the linear address is translated to a physical 32-bit address by the onchip paging unit. Regardless of whether paging is enabled or not, however, the breakpoint registers hold linear addresses.
2.12.3.2 DEBUG CONTROL REGISTER (DR7)
A Debug Control Register, DR7 shown in Figure 2-13, allows several debug control functions such as enabling the breakpoints and setting up other control options for the breakpoints. The fields within the Debug Control Register, DR7, are as follows:
LENi (breakpoint length specification bits)
A 2-bit LEN field exists for each of the four breakpoints. LEN specifies the length of the associated breakpoint field. The choices for data breakpoints are: 1 byte, 2 bytes, and 4 bytes. Instruction execu-
29
Intel386TM DX MICROPROCESSOR
|
31 |
|
|
|
|
|
|
|
|
|
|
|
16 15 |
|
|
|
|
|
|
|
|
|
|
|
0 |
|
||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
BREAKPOINT 0 LINEAR ADDRESS |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR0 |
|||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
BREAKPOINT 1 LINEAR ADDRESS |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR1 |
|||||||||||||
|
|
BREAKPOINT 2 LINEAR ADDRESS |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR2 |
|||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
BREAKPOINT 3 LINEAR ADDRESS |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR3 |
|||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
Intel reserved. Do not define. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR4 |
||||||||||
|
|
Intel reserved. Do not define. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR5 |
||||||||||
|
|
|
|
|
|
|
|
|
0 |
|
|
|
|
|
B |
B |
B |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
B |
B |
B |
B |
DR6 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
T |
S |
D |
|
|
|
|
|
|
|
|
|
3 |
2 |
1 |
0 |
|
|
LEN |
R |
W |
LEN |
|
R |
W |
|
LEN |
R |
W |
LEN |
R |
W |
0 |
0 |
G |
0 |
0 |
0 |
G |
L |
G |
L |
G |
L |
G |
L |
G |
L |
DR7 |
|
|
3 |
3 |
3 |
2 |
2 |
2 |
|
1 |
1 |
1 |
0 |
0 |
0 |
|
|
D |
|
|
|
E |
E |
3 |
3 |
2 |
2 |
1 |
1 |
0 |
0 |
|
||
|
31 |
|
|
|
|
|
|
|
|
|
|
|
16 15 |
|
|
|
|
|
|
|
|
|
|
|
0 |
|
||||||
|
|
NOTE: |
|
0 |
indicates Intel reserved: Do not define; SEE SECTION 2.3.10 |
|
|
|
|
|
||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 2-13. Debug Registers
tion breakpoints must have a length of 1 (LENi e 00). Encoding of the LENi field is as follows:
|
|
Usage of Least |
LENi |
Breakpoint |
Significant Bits in |
Encoding |
Field Width |
Breakpoint Address |
|
|
Register i, (ie0b3) |
00 |
1 byte |
All 32-bits used to |
|
|
specify a single-byte |
|
|
breakpoint field. |
01 |
2 bytes |
A1 ± A31 used to |
|
|
specify a two-byte, |
|
|
word-aligned |
|
|
breakpoint field. A0 in |
|
|
Breakpoint Address |
|
|
Register is not used. |
10 |
UndefinedÐ |
|
|
do not use |
|
|
this encoding |
|
11 |
4 bytes |
A2 ± A31 used to |
|
|
specify a four-byte, |
|
|
dword-aligned |
|
|
breakpoint field. A0 |
|
|
and A1 in Breakpoint |
|
|
Address Register are |
|
|
not used. |
The LENi field controls the size of breakpoint field i by controlling whether all low-order linear address bits in the breakpoint address register are used to detect the breakpoint event. Therefore, all breakpoint fields are aligned; 2-byte breakpoint fields begin on Word boundaries, and 4-byte breakpoint fields begin on Dword boundaries.
The following is an example of various size breakpoint fields. Assume the breakpoint linear address in DR2 is 00000005H. In that situation, the following illustration indicates the region of the breakpoint field for lengths of 1, 2, or 4 bytes.
|
DR2e00000005H; |
LEN2 e 00B |
|
|||
|
31 |
|
|
|
0 |
00000008H |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
bkpt fld2 |
|
00000004H |
|
|
|
|
|
|
00000000H |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
DR2e00000005H; |
LEN2 e 01B |
|
|||
|
31 |
|
|
|
0 |
00000008H |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
00000004H |
|
|
|
|
w bkpt |
fld2 x |
|
|
|
|
|
|
|
00000000H |
|
|
|
|
|
|
|
|
|
|
|
|||
|
DR2e00000005H; |
LEN2 e 11B |
|
|||
|
31 |
|
|
|
0 |
00000008H |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
w bkpt fld2 x |
00000004H |
||||
|
|
|
|
|
|
00000000H |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
30