© Copyright 1993, 1994 By Harald Feldmann Revision 04, Nov 3rd 1994. Hamarsoft's 86BUGS list, © 1993/94 By Hamarsoft ® ────────────────────────────────────────────────────────────────────────────── The 86BUGS list, distributed with Ralf Brown's Interrupt list, is maintained and provided to you by Hamarsoft, the maker of the HAP & PAH datacompression program. Latest version of HAP & PAH is 3.14e. If you like this list you are encouraged to register the HAP 3.00 shareware program. You will receive the latest, registered, version of HAP 3.14e by air-mail on 3½-inch diskette. FTP(File Transfer Protocol) The standard protocol for copying files from one machine to another on a TCP/IP (Internet) network. Also the program of the same name with which a user may transfer files. to garbo.uwasa.fi and get pc/arcers/hap300re.zip for more info. ────────────────────────────────┬─────────────────────────────────────────── To contact Hamarsoft, write to │ or send e-mail over Internet to: │ harald.feldmann@almac.co.uk Hamarsoft, New Address! │─────────────────────────────────────────── Harald Feldmann, │ or send e-mail to HARALD FELDMANN over P.o. Box 451, │ Ilink in the international COMPRESS echo 6400 AL Heerlen, │ The p.o. box will be maintained if e-mail The Netherlands │ should no longer be possible. ────────────────────────────────┴─────────────────────────────────────────── Various people have contributed to this list. They are mentioned in a separate page, click on <acknowledgements> to see their names and e-mail addresses. These people are not employed by or affiliated with Hamarsoft. Hamarsoft and all people who contributed to the 86BUGS list do not accept any liability whatsoever regarding the use, inability to use, correctness or completeness of the information presented in the 86BUGS list. Attention authors: if you mention this list in your article or book, please send a courtesy copy to the P.o. box address by airmail. Thank you. This is 86BUGS list revision level 04, issued November 3rd 1994. © Copyright 1993, 1994 By Harald Feldmann. Acknowledgements ────────────────────────────────────────────────────────────────────────────── This file lists undocumentedInformation about a product which is not publicly available from the manufacturer, and must be determined by reverse-engineering (disassembly, trial-and-error, etc.). Undocumented information tends to change -- often dramatically -- between successive revisions of a product, since the manufacturer has no obligation to maintain compatibility in behavior which is not explicitly stated. and buggy instructions of the Intel 80x86 family of processors as well as features of processors compatible with Intel products. Note that Intel does not support the special features and may decide to drop opcode variants and instructions in future products. Wherever the notation 88,86,87,186,286,287,287xl,386,386sx,387,387sx, 486,486sx,487 and Pentium is used, Intel CPUs are referenced unless noted otherwise. All mentioned trademarks and/or tradenames are owned by the respective owners and are acknowledged. I would like to give credit to those who provided useful information or who in another way contributed to the 86BUGS list. 9308 Chris Lueders (chris_lueders@zaphod.fido.de) iAPX program & mul bugs 9311 Anthony Naggs (amn@ubik.demon.co.uk) NEC differences and CPU(Central Processing Unit) The microprocessor which executes programs on your computer. tests 9407 Christian Ludloff (Ludwig-Kühn-Str. 15, 09123 Chemnitz, Germany) Discovered CPUID instruction on 486. 9410 Robert Mashlan (rmashlan@r2m.com) BOUND difference on NEC V20 9410 Anthony Naggs (amn@ubik.demon.co.uk) POP CS & MOV CS on 86/88 SETALC on NEC & i186 BOUND difference, NEC specific instructions. 9410 Christian Ludloff (see above for address) Pentium extensions (MSRs), INFO and STAT programs. If you contributed, but are not listed, please send a note. AAA Adjust After BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. Addition ────────────────────────────────────────────────────────────────────────────── Mnemonic: AAA Opcode : 37 (88=8, 86=8, 286=3, 386=4, 486=3 clocks) Bug in : Different implementation in 88 and 86 versus 286+ Function: The 88 and 86 processors would not add a carry out of al into ah if an invalid operand would be in al (FF), the newer processors will, yielding different results for the same invalid operand. Execution is effectively the same when valid operands are loaded. Highest 4 bits of AL are always cleared. AAD Adjust After BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. Division ────────────────────────────────────────────────────────────────────────────── Mnemonic: AAD Opcode : D5 imm8 (88=60, 86=60, 286=14, 386=19, 486=14 clocks) Bug in : Is an opcode variant on Intel's 88,86,286,386,486 Variant does not work on NEC's V-series, probably not on AMD CPUs Function: This instruction regularly performs the following action: - unpacked BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. in AX example (AX = 0104h) - AL = AH * 10d + AL (AL = 0eh ) - AH = 00 (AH = 00h ) The normal opcode decodes as follows: d5,0a The instruction itself is an instruction plus operand. By replacing the second byte with any number in the range 00 - ff you can build your own instruction AAD for various number systems in those ranges. For example by coding d5,10 you achieve an instruction that performs: - AL = AH * 16d + AL. - AH = 00 This feature of Intel's chips can be used to determine whether there is a true Intel CPU(Central Processing Unit) The microprocessor which executes programs on your computer. installed in a system. (NEC difference supplied by Anthony Naggs) AAM Adjust After BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. Multiplication ────────────────────────────────────────────────────────────────────────────── Mnemonic: AAM Opcode : D4 imm8 (88=83, 86=83, 286=16, 386=17, 486=15 clocks) Bug in : Is an opcode variant on Intel's 88,86,286,386,486 Function: This instruction regularly performs the following action: - binary number in AL - AH = AL / 10d - AL = AL MOD 10d Thus creating an unpacked BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. in AX. The normal opcode decodes as follows: d4,0a. The instruction itself is an instruction plus operand. By replacing the second byte with any number in the range 00 - ff you can build your own instruction AAM for various number systems in that range. For example by coding d4,07 you achieve an instruction that performs: - binary number in AL - AH = AL / 07d - AL = AL MOD 07d AAS Adjust After BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. Subtraction ────────────────────────────────────────────────────────────────────────────── Mnemonic: AAS Opcode : 3F Bug in : Intel's documentation Function: Adjusts result of two subtracted BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. numbers to form a valid new BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. number. Highest 4 bits of AL are always cleared. ADD4S Addition of packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. strings (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: ADD4S Opcode : 0F 20 (7+19n clocks, n is the number of bytes per operand) Bug in : Rarely documented, except in NEC manuals Function: Adds the packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. string at DS:SI to the packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. string at ES:DI. The length of the string, in BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. digits, is specified in CL. Unlike Intel string operations CL, DI & SI are unchanged by the operation. The Zero Flag (ZF) is set if both operands are zero. The Carry Flag (CF) and Overflow Flag (OF) appear to be set by the addition of the most significant digits. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See also SUB4S, CMP4S, ROL4, ROR4 BOUND Checks register against limits ────────────────────────────────────────────────────────────────────────────── Mnemonic: BOUND reg,mem Opcode : 62 [mod:reg:r/m] Bug in : NEC V20 handles it differently from Intel 286+. But apparently, according to Intel documentation, equal to 186. Function: Bound checks a register against limits and generates exception 5 if the value falls outside the limit. On NEC CPUs the mnemonic is apparently also referred to as 'CHKIND'. Note that the mem component refers to two consecutive memory locations, of size 'reg' which contain the lower and upper limit for the value in 'reg' as [low limit][high limit]. 'reg' size: 'mem' specifies address of: word dword dword qword Normally, on Intel 286+ CPUs, the exception saves the CS:IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. pointing TO the BOUND instruction. On the NEC V20, the saved CS:IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. point to the instruction following the BOUND instruction. According to Intel's documentation the 186 handles this exception the same way the NEC does. It has been verified on a 486 that the CS:IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. of BOUND on that CPU(Central Processing Unit) The microprocessor which executes programs on your computer. indeed points TO the instruction itself and not the following one. Also, contrary to what one might expect, BOUND only allows word or dword registers to be tested. Byte registers are invalid. (V20 supplied by Robert Mashlan) (186 difference & 'CHKIND' supplied by Anthony Naggs) BreakpointWhen debugging, a memory location which when accessed causes a break in the normal flow of execution and the invocation of the debugger. Used to let a program run at full speed until a certain instruction is reached or (less frequently) a particular data item is accessed or changed. errors while debugging ────────────────────────────────────────────────────────────────────────────── Mnemonic: N/A Opcode : N/A Bug in : some 386, some 486 Function: Breakpoints are used in the process of debugging programs. On the 386+, debug registers may be used instead of a one byte opcode. 386 specific debugging bugs occurring on some 386s: Breakpoints are missed under the following conditions: - A data breakpoint set to a mem16 operand of a VERR, VERW, LSL or LAR while the segment with selector at mem16 is not accessible. - A data breakpoint is set to the write operand of a REP MOVS instruction and the read cycle of the next iteration generates a fault. - A code or data breakpoint is set on the instruction following a MOV or POP to SS while the instruction needs more than two clocks. (see <MOV> and <POP>) Random breakpoints may occur under the following condition: - Breakpoints set using debug registers DR0 to DR4 may produce spurious breaks if breakpoints were enabled before a MOV from CR3, TR6 or TR7 took place. These unreliable breaks may continue to occur until the next JMP instruction is executed. A workaround would be to: = disable breakpoints before any MOV from CR3, TR6 or TR7 = MOV the values = perform a JMP = enable breakpoints. Single stepping is not disabled in the handler for a TSS fault if the code that caused the fault was being single-stepped and a task gate was used to handle the fault. 486 specific debugging bugs occurring on some 486s: A code breakpoint set on control transfer instructions (like CALL, RET, JMP etc.) will clear the lowest four bits of DR6 when the breakpoint is taken. A code breakpoint set on an instruction immediately following a RETN, JCXZ, intrasegment indirect CALL (CALL word ptr [bx] for example) or intrasegment indirect JMP (JMP word ptr [bx] for example) will always be satisfied, even when the control instruction is taken. A breakpoint set at the target of these control transfer instructions will not be taken, even if control is transferred to them, because the buggy breakpoint sets the RF (Resume Flag). There is said to be no workaround other than to avoid the situation, however, coding a nop after the control transfer instruction and setting the breakpoint to the instruction following the nop may, according to my view, very well solve the problem. (untested) BRKEM Break for emulation (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: BRKEM imm Opcode : 0F FF imm (38 clocks) Bug in : Rarely documented, except in NEC manuals Function: (8080 is written here as 8O8O to avoid visual confusion with the 8088). This is the basic instruction used to switch to 8O8O emulation mode. The BRKEM instruction is used in a similar way to an INT instruction, (referred to as BRK by NEC). The mode flag (MD) is set to zero, the Flags, CS & IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. are pushed onto the stack then CS & IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. are loaded from the specified interrupt vector. In 8O8O emulation mode the V30 registers and flags are mapped to 8O8O registers and flags. General purpose register names: ┌───┬───┬───┬───┬───┬───┬───┬───┬───┐ 8O8O name───────│ A │ B │ C │ D │ E │ H │ L │ SP│ PCIBM PC│ Intel x86 name──│ AL│ CH│ CL│ DH│ DL│ BH│ BL│ BP│ IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP.│ V30 name────────│ AL│ CH│ CL│ DH│ DL│ BH│ BL│ BP│ PCIBM PC│ └───┴───┴───┴───┴───┴───┴───┴───┴───┘ Individual flag names: ┌───┬───┬───┬───┬───┐ 8O8O name───────│ C │ Z │ S │ P │ AC│ Intel x86 name──│ CF│ ZF│ SF│ PF│ AF│ V30 name────────│ C │ Z │ S │ P │ AC│ └───┴───┴───┴───┴───┘ In 8O8O emulation mode the segment used for instructions is determined by the CS (PSIBM PS/2, any model) register. The DS (DS0) register determines the segment used for data. When an interrupt occurs during 8O8O emulation the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. switches to native V30 mode to process the interrupt. When the interrupt handler is complete the IRET, (RETI in NEC nomenclature), will return to 8O8O emulation mode. From 8O8O emulation mode RETEM (Return from Emulation, opcode ED FD) returns to native mode, setting MD flag and restoring flags, CS & IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. from the native stack. Alternatively CALLN imm8 (Call Native, opcode ED ED imm) can be used to call native V30 interrupts, (just like a regular INT). Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) BSF, Bit Scan Forward ────────────────────────────────────────────────────────────────────────────── Mnemonic: BSF op1,op2 Opcode : 0F BC Bug in : Intel's documentation Function: Finds the first (lowest) bit set to 1 in op2, sets ZF=1 and returns the bit position in op1. If op2 is 0, ZF=0 and the value of op1 is undetermined, some 386's leave the old value in op1, some early 486's load garbage into op1 and later 486's leave op1 unchanged. BSWAP reg32 Byte Swap ────────────────────────────────────────────────────────────────────────────── Mnemonic: BSWAP reg32 Opcode : 0F C8+reg# (00001111 11001rrr) Bug in : 486 Function: Swaps all bytes in 32 bit registers, changing the sequence from ABCD to DCBA, handy for converting numbers to a CPU(Central Processing Unit) The microprocessor which executes programs on your computer. format where the byte order is reversed. Bug appears when BSWAP is not preceded by prefix 66h to indicate 32 bit registers in 16 bit mode or when it IS preceded by 66h in 32 bit mode. Do not use this instruction with 16 bit registers as operand. Results are undefined in that case. Use XCHG reg8,reg8 instead if you need to swap 2 bytes in a 16 bit register like AX. BT op1,op2 Bit Test ────────────────────────────────────────────────────────────────────────────── Mnemonic: BT Opcode : 0F A3 op1,op2 Bug in : No bug, avoid use on ports in 386, 486 Function: Basically copies bit(op2) from op1 into CY. Memory variant is more complex. Do not use on memory mapped I/O ports or memory operands that span into or lie completely within nonexistent memory. In the case of memory mapped I/O ports, use MOV and TEST instead. BTC op1,op2 Bit Test and Complement ────────────────────────────────────────────────────────────────────────────── Mnemonic: BTC op1,op2 Opcode : 0F BB reg1,reg2 0F BA reg,mem Bug in : No bug, avoid use on ports in 386, 486 Function: Basically copies bit(op2) from op1 into CY and complements bit(op2) of op1. Memory variant is more complex. Do not use on memory mapped I/O ports or memory operands that span into or lie completely within nonexistent memory. In the case of memory mapped I/O ports, use MOV and TEST instead. BTR op1,op2 Bit Test and Reset ────────────────────────────────────────────────────────────────────────────── Mnemonic: BTR op1,op2 Opcode : 0F B3 [mod:reg:r/m] 0F BA [mod:110:r/m] imm8 Bug in : No bug, avoid use on ports in 386, 486 Function: Basically copies bit(op2) from op1 into CY and sets bit(op2) of op1 to 0. Memory variant is more complex. Do not use on memory mapped I/O ports or memory operands that span into or lie completely within nonexistent memory. In the case of memory mapped I/O ports, use MOV and TEST instead. BTS op1,op2 Bit Test and Set ────────────────────────────────────────────────────────────────────────────── Mnemonic: BTS Opcode : 0F BA [mod:101:r/m] imm8 / 0F AB [mod:reg:r/m] Bug in : No bug, avoid use on ports in 386, 486 Function: Basically copies bit(op2) from op1 into CY and sets bit(op2) of op1 to 1. Memory variant is more complex. Do not use on memory mapped I/O ports or memory operands that span into or lie completely within nonexistent memory. In the case of memory mapped I/O ports, use MOV and TEST instead. Chip Step information for Intel CPUs ────────────────────────────────────────────────────────────────────────────── CPUs are manufactured in models (like the 80386). While these models are manufactured, errors in the mask layout and mask design may become apparent. These errors may be corrected before a new batch of chips is made. To distinguish between these revisions an identification code is placed within the mask design on 386+ CPUs. By testing the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. with CPUID or by performing a RESET, this information is copied to specific registers. The register used to hold mask info after a RESET is DX (apparently also sometimes the high word of EDX on some 486s). This page lists some component and revision ID's found in the DX register for the 386SX, 386DX, 486SX and 486DX models from Intel. CPU(Central Processing Unit) The microprocessor which executes programs on your computer.: DX: Step: 386SX 2304h A0 2305h B 2306h C 2308h D1 386DX 0303h B0 - B10 0305h D0 0308h D1 & D2 486SX 0420h A0 486DX 0000h A1 0401h Bn 0302h C0 0404h D0 0410h cAn 0411h cBn CLEAR1 Clears a specific bit to 0 (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: CLEAR1 reg/mem,CL/immediate Opcode : CLEAR1 r/m8,CL : 0F 12 [mod:000:r/m] (5/14 clocks) CLEAR1 r/m8,imm3 : 0F 1A [mod:000:r/m] imm (6/15 clocks) CLEAR1 r/m16,CL : 0F 13 [mod:000:r/m] (5/14 clocks) CLEAR1 r/m16,imm4: 0F 1B [mod:000:r/m] imm (6/15 clocks) CLEAR1 CY : F8 (NEC nomenclature for Intel's CLC) CLEAR1 DIR : FC (NEC nomenclature for Intel's CLD) Bug in : Rarely documented, except in NEC manuals Function: Clears the specified bit in the register/memory operand. The bit number (CL or immediate) is ANDed with 07 (for 8-bit operands) or 0F (for 16-bit operands) to get a valid bit number. No flags are affected by this operation, except by CLEAR1 CY and CLEAR1 DIR. The first (smaller) clock count of each pair is for register operands. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: NECINS, EXT, TEST1, NOT1, SET1 CMP4S Subtraction of packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. strings (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: CMP4S Opcode : 0F 26 (7+19n clocks, n is the number of bytes per operand) Bug in : Rarely documented, except in NEC manuals Function: Subtracts the packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. string at DS:SI from the packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. string at ES:DI, but does not store the result. The length of the string, in BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. digits, is specified in CL. Unlike Intel string operations CL, DI & SI are unchanged by the operation. The Zero Flag (ZF) is set if the result is zero. The Carry Flag (CF) and Overflow Flag (OF) appear to be set by the subtraction of the most significant digits. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: ADD4S, SUB4S, ROL4, ROR4 CMPS Compare String Bytes, Word or Dword ────────────────────────────────────────────────────────────────────────────── Mnemonic: CMPS Opcode : A6 (Bytes) A7 (Words) 66 A6 (Bytes) 66 A7 (DWords) Bug in : Early 286 in protected mode Function: Compares two strings in memory. Repeated version (REP CMPS) in early 286 protected mode has a bug that shows when, during execution, a segment limit exception or IO Privilege Level ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. occurs. In that case the exception handler sees the value of CX as it was at the start of the REP instruction. SI and DI however reflect the correct index of the elements currently scanned at the time of the exception. Workaround: Do not scan beyond segment limits or into memory mapped I/O areas. CMPXCHG op1,op2 Compare and Exchange ────────────────────────────────────────────────────────────────────────────── Mnemonic: CMPXCHG Opcode : 0F B0 reg,mem/reg (Byte) 0F B1 reg,mem/reg (Word) 66 0F b0/b1 (Byte / DWord) Bug in : pre-B step 486 Function: Compares the accumulator (8,16 or 32 bit form) with op1 by internally subtracting op1 from the accumulator and setting ZF according to the result. If ZR, op2 is copied to op1, otherwise op1 is loaded into the accumulator. On the A-step of the 486, this Mnemonic was coded using the opcodes for the, discarded, A- to B0-step 386 instructions XBTS (a6) and IBTS (a7). Because of software conflicts with software written for the early 386 DX the opcodes for the 486 were changed to the ones above starting with the B step. Note that some 386 software won't run on older 386es and some 486 software will not run on early 486es when using this instruction. CPUID Identify CPU(Central Processing Unit) The microprocessor which executes programs on your computer. on 486 and higher CPUs ────────────────────────────────────────────────────────────────────────────── Mnemonic: CPUID Opcode : 0F A2 Bug in : Is undocumentedInformation about a product which is not publicly available from the manufacturer, and must be determined by reverse-engineering (disassembly, trial-and-error, etc.). Undocumented information tends to change -- often dramatically -- between successive revisions of a product, since the manufacturer has no obligation to maintain compatibility in behavior which is not explicitly stated. for 486, seems not to work on tested AMD 486s Officially introduced as a new instruction with the Pentium. Function: Identifies CPU(Central Processing Unit) The microprocessor which executes programs on your computer. and revision information for the installed CPU(Central Processing Unit) The microprocessor which executes programs on your computer.. Note that Intel officially introduced CPUID only with the Pentium processor. It seems the instruction was unofficially introduced in the later 486 CPUs as well. Discovered by Christian Ludloff (see acknowledgements). Supported by the UMC U5S 486 clones as well. Executing it on an early 486 yields an Invalid Opcode ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning.. To safely use this instruction, an exception handler must be installed. A safer workaround though is to test whether the ID bit in EFLAGS is set. If so, the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. supports CPUID. See <EFLAGS> image. The instruction expects input in the EAX register and outputs information in the EAX, EBX, ECX and EDX registers. Input: EAX = 0000 0000 : Check CPU(Central Processing Unit) The microprocessor which executes programs on your computer. 486+ installed Output: after CPUID: EAX = 0000 0001 : OK, instruction supported EBX = 756e 6547 : 'uneG' EDX = 4965 6e69 : 'Ieni' ECX = 6c65 746e : 'letn' effectively the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. says 'GenuineIntel' Officially this returns a 'vendor string', which may indicate other than Intel strings for OEMs. The UMC U5S-33 returns 'UMC UMC UMC ' or ' UMC UMC UMC' (untested). Input: EAX = 0000 0001 : Obtain model specific information Output: after CPUID: EAX = RRRR RFMS : revision information R = Reserved Zero, but reserved F = Family (4=486, 5=Pentium) M = Model (3 on tested 486DX-2/66, 1 on tested Pentium/60) S = Stepping (5 on tested 486DX-2/66, 3 on tested Pentium/60) EBX = RRRR RRRR R = Reserved Zero, but reserved ECX = RRRR RRRR R = Reserved Zero, but reserved EDX = xxxx xxxx : Bitmapped features, 1 means option available Bit 0 = FPU built-in (supported on 486 and Pentium) Bit 1 = V-86 mode extensions present Bit 2 = I/O breakpoints possible Bit 3 = 4 MB paging supported Bit 4 = Time Stamp Counter present Bit 5 = Has Pentium compatible Model Specific Registers Bit 6 = Reserved (0) Bit 7 = Machine Check ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. supported (P5 only) Bit 8 = CMPXCHG8B supported (apparently Pentium only) Bits 9-31 Reserved Assume zero if bit is not mentioned. Note that this instruction is not supported on all 486 CPUs. However, Christian Ludloff has tested it on some 486 DX and 486 SX models, in addition to the Pentium/60 and found them to be present on those machines. Any step and model information you find this instruction to run on is welcomed. Please forward it to Christian. Apparently all new(er) Intel CPUs are equipped with (some) of these extensions, not just the Pentium. CR0-4 register layout (386+) ────────────────────────────────────────────────────────────────────────────── = CR0: Some bits remain from the Machine Status Word of the 286. Bit 31 16 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┐ │P│C│N│r│r│r│r│r│r│r│r│r│r│A│r│W│r│r│r│r│r│r│r│r│r│r│n│e│t│E│m│p│ └┼┴┼┴┼┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴┼┴─┴┼┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴┼┴┼┴┼┴┼┴┼┴┼┘ │┌┘ │ │ └───────────────────┐ │ │ │ │ │ │ ││┌─┘ └─────────────────────┐ │ │ │ │ │ │ │ ││└NW Not Write through (1 if write through) │ │ │ │ │ │ │ │ │└─CD CacheCaching is a method of increasing performance by keeping frequently-used data in a location which is more quickly accessed. The most common caches are disk caches (store disk sectors in RAM) and RAM caches (store portions of main memory in special high-speed RAM which may be accessed as fast as the CPU is capable of accessing memory). See also Delayed Write, Write-Through. Disable (1 if disabled) │ │ │ │ │ │ │ │ └──PE Paging Enabled │ │ │ │ │ │ │ │ AC Alignment mask (1=masked)─────────────────┘ │ │ │ │ │ │ │ WP Write Protect (1 if read-only pages protected)│ │ │ │ │ │ NE Numeric Error (1 if errors should be ignored)─┘ │ │ │ │ │ ET Extension Type (1=387 type FPU,0=287 type FPU)──┘ │ │ │ │ TS Task Switch (1=task switch has occurred)──────────┘ │ │ │ EP Emulate Processor Extension ────────────────────────┘ │ │ (1=execute exception 7 on FPU codes) │ │ MP Math Present (1=_FPU_ will handle FPU codes)──────────┘ │ PE Protection Enabled (1=Protected mode activated)─────────┘ If EP=1 and MP=0, the FPU codes will be handled by software routines via exception 7. Coprocessor emulators use this property. = CR1: Is reserved = CR2: Linear 32-bit address of Page FaultA CPU-generated signal, and the operating system's reaction to it, generated when a program accesses a page of virtual memory which is not located in RAM at the time. The operating system's response is to load in the required page, possibly writing some other page out to disk in order to make room. See also INT 0E in INTERRUP.LST. = CR3: Page Directory Base Register (386+) Bit 31 16 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┐ │x│x│x│x│x│x│x│x│x│x│x│x│x│x│x│x│x│x│x│x│r│r│r│r│r│r│r│p│P│r│r│r│ └┼┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴┼┴─┴─┴─┴─┴─┴─┴─┴┼┴┼┴─┴─┴─┘ └─────Page Directory Base Register────┘ │ │ PDBR (used in the Paging process implemented on the 386+) │ │ │ │ Page-level CacheCaching is a method of increasing performance by keeping frequently-used data in a location which is more quickly accessed. The most common caches are disk caches (store disk sectors in RAM) and RAM caches (store portions of main memory in special high-speed RAM which may be accessed as fast as the CPU is capable of accessing memory). See also Delayed Write, Write-Through. Disable (486+)───────────────────────┘ │ PCD Page-level Writes Transparent (486+)────────────────────┘ PWT = CR4: Extended Machine Control (Pentium+) Bit 31 16 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┐ │r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│r│M│r│p│D│T│P│V│ └─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴┼┴─┴┼┴┼┴┼┴┼┴┼┘ Machine Check Enable (1=enabled)──────────────────┘ │ │ │ │ │ MCE Page Size Extension (1=4 Mb paging instead of 4 Kb)───┘ │ │ │ │ PSE Debugging Extension (1=breakpoints also valid for I/O)──┘ │ │ │ DE Time Stamp instruction Disable (1=RDTSC only with CPL=0)──┘ │ │ TSD Protected mode Virtual Interrupts (1=use VI flag in PM)─────┘ │ PVI Virtual86 mode Virtual Interrupts (1=use VI flag in VMsee Virtual Machine)───────┘ VME The VME bit allows a V86see Virtual-86 Mode (or VMsee Virtual Machine) task to use the 'virtual' interrupt flag. Setting and clearing the interrupt flag (IF) in EFLAGS is no longer intercepted by the V86see Virtual-86 Mode Monitor program (a very time consuming procedure), instead, the Pentium+ sets and clears the VI flag in EFLAGS, instead of the IF flag. This saves task switches to the monitor to handle the CLI and STI instructions and thus a lot of time in general purpose 8086 programs running in V86see Virtual-86 Mode mode. The PVI bit allows the same for Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode. procedures who would otherwise need supervision by a different task. That is: Tasks with CPL<0 may now call tasks with CPL=0 without crashing the system, but only under specific circumstances. The TSD bit changes the CPL-sensitivity of the RDTSC (Read Time Stamp Counter) instruction, a built-in CPU(Central Processing Unit) The microprocessor which executes programs on your computer. counter which is incremented every internal clockpulse. When TSD is 0, <RDTSC> is accessible for all CPL levels. With TSD set to 1 however, RDTSC is available only to tasks with CPL=0. The DE bit allows the Pentium+ to set breakpoints in I/O space using the breakpoint registers. The R/W coding 10b is used to indicate that the breakpoint is in I/O space on the Pentium+. The 10b encoding was marked as 'invalid' for pre-Pentium CPUs. The PSE bit determines the size of the pages controlled by the Paging Unit. With PSE = 0, the Paging mechanism uses 4 Kb pages. With PSE set to 1 however, the Paging mechanism uses 4 Mb pages. The MCE bit is used to allow generation of a Machine Check ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning.. This exception is the result of a Parity error within the Pentium or an active BUSCHK signal (low) on pin T3 (upper right hand corner, fourth pin from right, third from top when pin A1 is upper left corner, TOP view). The exception is vectored through interrupt 18d (or 12h). Execution after this exception may void system integrity. The Machine Check Address register holds the value of the address bus at the moment the event took place. The Machine Check Type register holds the type of bus access at the time the event took place. Both these registers are internal 64 bit registers which can only be read through the instruction <RDMSR> (Read Model Specific Register). See also <WRMSR> (Write Model Specific Register). EFLAGS register layout (8088 to Pentium & NEC) ────────────────────────────────────────────────────────────────────────────── Bit 31 16 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┐ │r│r│r│r│r│r│r│r│r│r│c│p│v│a│V│R│M│N│IOP│O│D│I│T│S│Z│r│A│r│P│r│C│ └─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴┼┴┼┴┼┴┼┴┼┴┼┴┼┴┼┴┼┴─┴┼┴┼┴┼┴┼┴┼┴┼┴─┴┼┴─┴┼┴─┴┼┘ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │Carry CPUID available ─────┘ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ Parity Virtual Interrupt Pending│ │ │ │ │ │ │ │ │ │ │ │ │ └Aux carry Virtual Interrupt flag ──┘ │ │ │ │ │ │ │ │ │ │ │ └──────── Zero Alignment check ───────────┘ │ │ │ │ │ │ │ │ │ └────────── Sign Virtual-86 mode enabled ─────┘ │ │ │ │ │ │ │ └ Trap (step mode) Resume flag ───────────────────┘ │ │ │ │ │ └── Interrupt enable Mode Flag ───────────────────────┘ │ │ │ └──── Direction (1=up) Nested Task ───────────────────────┘ │ └────────────── Overflow └── I/O privilege level 0..3 Note: the Mode Flag is supported only on the NEC V20/30, it is reserved on Intel CPUs. The diagram below shows the names for each bit as referenced to in most books, along with the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. in which the bit was =officially= introduced. Description: Name: CPU(Central Processing Unit) The microprocessor which executes programs on your computer. introduced: CPUID available───────────────ID Pentium Virtual Interrupt Pending─────VIP Pentium Virtual Interrupt flag────────VI Pentium Alignment Check Flag──────────AC 486 Virtual-86 ModeOne of the operating modes of the 80386 and 80486 processors in which user programs run as if the CPU were in Real Mode, while providing the protection and address-mapping capabilities of Protected Mode to a supervisor program which oversees the virtual machine on which the user programs are running. This mode is called Virtual-86 because one or more virtual 8086 environments are run on a single CPU. See also Protected Mode, Real Mode, Virtual Machine. Flag──────────VMsee Virtual Machine 386 Resume Flag───────────────────RF 386 Mode Flag (8O8O emulation on)─MD V20/V30 only Nested Task───────────────────NT 286 I/O privilege level 0..3──────IOPL 286 Overflow Flag─────────────────OF 86 Direction Flag (1=up)─────────DF 86 Interrupt Flag (1=enabled)────IF 86 Trap Flag (single step mode)──TF 86 Sign Flag─────────────────────SF 86 Zero Flag─────────────────────ZF 86 Auxiliary carry Flag──────────AF 86 Parity Flag───────────────────PF 86 Carry Flag────────────────────CF 86 (8080 is written here as 8O8O to avoid visual confusion with the 8088). (Mode Flag supplied by Anthony Naggs) EXT Extract bit field (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: EXT reg8,reg8 / EXT reg8,imm4 Opcode : 0F 33 [mod:reg:r/m] (26-55 clocks) Bug in : Rarely documented, except in NEC manuals Function: Loads AX with bit field data. Bit field length is specified by the lowest four bits of the second operand, more significant bits in AX are set to zero. DS:SI specify the first memory location to read, and the low 4-bits of the first operand specify the bit start position. The bit field can cross a byte boundary. After each complete data transfer, SI and the first operand are automatically updated to point to the next bit field. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: NECINS, TEST1, NOT1, CLEAR1, SET1 FPO2 Floating Point Operation 2 (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: FPO2 fp-op / FPO2 fp-op,mem Opcode : 0110011X [mod:XXX:r/m] (2/11 clocks) Bug in : Rarely documented, except in NEC manuals Function: Intended to communicate with NEC maths co-processors. The NEC "FPO1" opcode corresponds to Intel's "ESC" prefix for co-processor instructions. Although data sheets exist for NEC maths co-processors, they have never been manufactured. Note that the 386+ CPUs implement the opcodes 66 and 67 as Operand Size and Address Size prefixes respectively. (Supplied by Anthony Naggs) HLT Halt the processor ────────────────────────────────────────────────────────────────────────────── Mnemonic: HLT Opcode : F4 Bug in : No bug, handy use of instruction described below Function: Halts the processor, CPU(Central Processing Unit) The microprocessor which executes programs on your computer. restarts only when external event takes place such as RESET activation, NMIsee Non-Maskable Interrupt request on NMIsee Non-Maskable Interrupt lines or maskable interrupt request on INTR when interrupts are enabled. Handy to use with following piece of code: STI ; enable interrupts lazy: HLT ; suspend CPU(Central Processing Unit) The microprocessor which executes programs on your computer. internal bus clock IN AL,60h ; Key pressed ! CMP AL,whatever_key JNE lazy ; was not our key, just go back to sleep. If the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. is not going to be used for any processing tasks (hence is idle) one may execute the code above to cool down the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. because it stops the internal CPU(Central Processing Unit) The microprocessor which executes programs on your computer. bus clock. It also saves (some) energy. IBTS op1,op2 Insert Bit String ────────────────────────────────────────────────────────────────────────────── Mnemonic: IBTS op1,op2 Opcode : 0F A7 Bug in : 386, 486 conflicting instruction opcode. Function: Obsolete instruction which was introduced on the A step of the 386 and removed on the B1 step of the 386. The opcode a7 is used by the A step 486 to function as part of the CMPXCHG instruction. Because of software conflicts (some compilers generated code for IBTS and its counterpart XBTS) Intel decided to change the opcode for CMPXCHG on the B step of the 486. Do NOT use IBTS in general purpose 386 or 486 applications. IMUL Integer, signed, Multiply ────────────────────────────────────────────────────────────────────────────── Mnemonic: IMUL op IMUL op1,op2 IMUL op1,op2,op3 IMUL op1,op3 Opcode : F6w [mod:101:r/m] disp Bug in : Apparently no bug, timing formula may be handy Function: It is mentioned here because of the timing formula. The clocks used on 386 and 486 equal 9 or ceiling(log2(multiplier))+6. Depending on which one is bigger. Add an additional 3 clocks if multiplier is a memory operand. See <MUL> for 32-bit MUL bugs. INS Input String from IO port ────────────────────────────────────────────────────────────────────────────── Mnemonic: INS, INSB, INSW, INSD Opcode : AA, AB Bug in : early 286, some 386, early 486, NEC conflicting mnemonic: INS Function: Reads values from a port address in DX into a string at ES:DI or ES:EDI in memory. When used with the REPcondition prefix, CX or ECX contains the number of values to read. There is also a NEC specific instruction with the conflicting mnemonic INS, see <NECINS> or select <NEC specific instructions> from the mnemonic list page for more information regarding that instruction. Bugs in the 286; If, in protected mode, ES would contain a null selector or ES:DI would point beyond the segment limit when executing the single INS, causing exception 0dh, the 0d exception handler would point to the instruction following INS and not to it. If, in protected mode, during the repeated version of the instruction, a segment limit or IOPL exception occurred, the exception handler would see the CX value as it was before the start of the instruction, DI would reflect the proper index at the time of the exception though. This type of bug also occurs with the CMPS instruction. Bugs in the 386: The value of CX or ECX after the REPcondition version is not correct when the instruction is followed by a PUSH, POP or memory reference. After REP INS the value of CX, ECX is -1, not 0. Do not assume (E)CX to be 0. When REP INS or INS is followed by an instruction that uses a different address size or when they are followed by an instruction that references the stack implicitly while the B bit of the SS descriptor is different than the address size used by the instruction, INS will not properly update the (E)DI and REP INS will not properly update the (E)CX register. The actual address size used will be the one of the instruction following the (REP) INS. A workaround for this bug is to code a NOP with the same address size as the INS right behind it by using the address size prefix byte 67h (when needed). Bugs in the 486: Early 486 may hang if the INS destination address spans across a doubleword boundary, while not asserting BS16# or BS8#. To avoid this, always align the string at a doubleword. INS (NECINS) Insert bit field (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: INS reg8,reg8 / INS reg8,imm4 Opcode : 0F 31 [mod:reg:r/m] (31-117 clocks) Bug in : Rarely documented, except in NEC manuals Function: Stores bit field data from AX into memory. Bit field length is specified by the lowest four bits of the second operand. ES:DI specify the first memory location to write, and the low 4-bits of the first operand specify the bit offset position. The bit field can cross a byte boundary. After each complete data transfer, DI and the first operand are automatically updated to point to the next bit field. This mnemonic (INS) conflicts with the Intel mnemonic INS, which reads a string from an I/O port. This Intel instruction has bugs which are listed with the entry for <INS>. For clarity, this NEC version is referred to as "NECINS" where possible in this list. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: EXT, TEST1, NOT1, CLEAR1, SET1 INVD Invalidate internal and external caches ────────────────────────────────────────────────────────────────────────────── Mnemonic: INVD Opcode : 0F 08 Bug in : some 486 Function: INVD tells the processor that all data in both the internal as well as the external caches is invalid. Data held in external write-back caches is discarded. If on some 486's a cache line fill is in progress while the INVD instruction is being executed, that line is NOT invalidated and the buffer contents is moved into the cache. Valid cache lines are ALWAYS used to satisfy read requests on all 486's, regardless whether the cache is enabled or not. Workaround is to disable the cache prior to flushing it like this: MOV EAX,CR0 OR EAX,60000000h ; cache disable bits PUSHFD CLI MOV BL,CS:here OUT dummyport,dummydata MOV CR0,EAX here: INVD AND EAX,9fffffff ; cache enable, write-through MOV CR0,EAX POPFD JMP Jump unconditionally. ────────────────────────────────────────────────────────────────────────────── Mnemonic: JMP dest Opcode : EB disp8 Bug in : A to C0 step of 486 Function: JMP transfers execution to a location within -127 to +128 bytes from the jump instruction. The bug occurs when the jump causes a General Protection Violation while an NMIsee Non-Maskable Interrupt or INTR occur at exactly the same clockpulse. Although very unlikely to occur, it is listed for completeness. LAR Load Access Rights (Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode.) ────────────────────────────────────────────────────────────────────────────── Mnemonic: LAR reg1,reg/mem Opcode : 0F 02 Bug in : some 386 Function: LAR Loads the Access rights of a descriptor in the Global Descriptor Table, whose selector is reg/mem into reg1. When successful, ZF=1, otherwise ZF=0. Some 386es allow access to selector 0 in the GDT leaving ZF=1. Normally this should not be possible and produce the condition ZF=0. Workaround would be to create an entry 0 in the GDT that consists of only zeroes. This will cause access with a selector of 0 to fail and produce ZF=0. A data breakpoint set to the mem16 operand of LAR can be missed on some 386es if the segment with the selector at mem16 is not accessible. (see also <debugging>) 286-LOADALL / 386-LOADALL ────────────────────────────────────────────────────────────────────────────── Mnemonic: LOADALL Opcode : 286 : 0F 05 (195 clocks) 386+: 0F 07 ( ? clocks) Bug in : Is an undocumentedInformation about a product which is not publicly available from the manufacturer, and must be determined by reverse-engineering (disassembly, trial-and-error, etc.). Undocumented information tends to change -- often dramatically -- between successive revisions of a product, since the manufacturer has no obligation to maintain compatibility in behavior which is not explicitly stated. opcode on 286,some 386,some early 486 ? Support for this instruction has been dropped with the 486. Function: Loads virtually all processor registers with defined values from memory. Initialises processor to specified state. Apparently aliased on the 286 by opcode 0f 04. The 286 LOADALL instruction reads a block of 102 bytes into the chip, starting at address 000800 hex. Memory description for LOADALL read area on 286: (addresses are in hexadecimal, lengths in decimal) 0800: 6 N/A 0806: 2 MSW (Machine Status Word) 0808: 14 N/A 0816: 2 TR (Task Register) 0818: 2 FLAGS (286 Flags) 081a: 2 IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. (Instruction Pointer) 081c: 2 LDT (Local Descriptortable) 081e: 2 DS (Data Segment) 0820: 2 SS (Stack Segment) 0822: 2 CS (Code Segment) 0824: 2 ES (Extra Segment) 0826: 2 DI (Destination Index) 0828: 2 SI (Source Index) 082a: 2 BP (Base Pointer) 082c: 2 SP (Stack Pointer) 082e: 2 BX (BX register) 0830: 2 DX (DX register) 0832: 2 CX (CX register) 0834: 2 AX (AX register) 0836: 6 ES cache (ES descriptor cache ) 083c: 6 CS cache (CS descriptor cache ) 0842: 6 SS cache (SS descriptor cache ) 0848: 6 DS cache (DS descriptor cache ) 084e: 6 GDTR (Global Descriptor Table) 0854: 6 LDT cache (Local Descriptor_cache_) 085a: 6 IDTR (Interrupt Descriptor table) 0860: 6 TSS cache (Task State Segment cache ) Descriptor caches layout: 3 bytes 24 bit physical address of segment 1 byte access rights byte, same format as access right byte in a regular descriptor. The 'present' bit now represents a 'valid' bit. If this bit is cleared (zero) the segment is invalid and accessing it will trigger exception 0dh. The DPLsee DOS Parameter List (Descriptor Privilege Level) fields of the CS and SS descriptor caches determine the CPL (Current Privilege Level). 2 bytes 16 bit segment length limit. This layout is the same for the GDTR and IDTR registers, except that the access rights byte must be zero. The register caches are internal CPU(Central Processing Unit) The microprocessor which executes programs on your computer. registers containing a copy of the last 'composed' address and access information loaded for a particular register in protected mode (e.g. ES). An outline of the basics of 286 protected mode register caching and register layout is beyond the scope of this file The 386 LOADALL loads 204 (dec) bytes from the address at ES:EDI and resumes execution in the specified state. Memory description for LOADALL read area on 386+: (addresses are in hexadecimal, lengths in decimal) relative offset: Bytes: Registers: 0000: 4 CR0 0004: 4 EFLAGS 0008: 4 EIP 000c: 4 EDI 0010: 4 ESI 0014: 4 EBP 0018: 4 ESP 001c: 4 EBX 0020: 4 EDX 0024: 4 ECX 0028: 4 EAX 002c: 4 DR6 0030: 4 DR7 0034: 4 TR 0038: 4 LDT 003c: 4 GS (zero extended) 0040: 4 FS (zero extended) 0044: 4 DS (zero extended) 0048: 4 SS (zero extended) 004c: 4 CS (zero extended) 0050: 4 ES (zero extended) 0054: 12 TSS descriptor cache 0060: 12 IDTsee Interrupt Descriptor Table descriptor cache 006c: 12 GDT descriptor cache 0078: 12 LDT descriptor cache 0084: 12 GS descriptor cache 0090: 12 FS descriptor cache 009c: 12 DS descriptor cache 00a8: 12 SS descriptor cache 00b4: 12 CS descriptor cache 00c0: 12 ES descriptor cache Descriptor caches layout: 1 byte zero 1 byte access rights byte, same as 286 2 bytes zero 4 bytes 32 bit physical base address of segment 4 bytes 32 bit segment length limit LSL Load Segment Limit ────────────────────────────────────────────────────────────────────────────── Mnemonic: LSL reg1,reg/mem Opcode : 0F 03 Bug : some 386 Function: Loads the limits of a segment in protected mode by reading GDT entry reg/mem into reg1. Proper completion generates ZF=1, otherwise ZF=0. Some 386es allow access to selector 0 in the GDT leaving ZF=1. Normally this should not be possible and produce the condition ZF=0. Workaround would be to create an entry 0 in the GDT that consists of only zeroes. This will cause access with a selector of 0 to fail and produce ZF=0. Some 386es leave SP/ESP corrupted after successful completion of LSL, when LSL is followed by an explicit stack reference, using instructions like CALL, ENTER, LEAVE, IRET, RET, PUSH, POP, PUSHA, POPA, PUSHF and POPF. System-induced exceptions or interrupts however do not corrupt SP/ESP in that case. A workaround is to code a NOP after LSL. A data breakpoint set to the mem16 operand of LSL can be missed on some 386es if the segment with the selector at mem16 is not accessible. (see also <debugging>) MOV Move data to and from registers and or memory ────────────────────────────────────────────────────────────────────────────── Mnemonic: MOV involving CRx, DRx or TRx, MOV to SS, CS Opcode : 0F 2n [mod:rrr:r/m], 8E [mod:sreg:r/m] Bug in : some 88,some 86,some 386,all 386,A to C0 step of 486 Function: MOV Moves data in and out of (special) registers and memory. Some _very early_ 88 and 86 processors do not disable interrupts following a MOV sreg,reg. This causes them to crash when an interrupt uses the stack between MOV SS,reg and MOV SP,op. These versions carry a copyright message for 1978 on the package. Later, corrected revisions, carry both 1978 and 1981 as the copyright year. Normally interrupts would be disabled between the move to SS and execution of the instruction following it on 88 and 86es. A workaround is to manually disable the interrupts when reloading SS. The 286 and higher processors only disable interrupts after a MOV SS, in contrast to earlier CPUs, including the NECs, who do this with all MOV sreg,op instructions. An unsolvable problem occurs when an unmaskable interrupt or exception takes place while executing the instruction pair on an old 88 or 86. There are conflicting messages though about this type of interrupts having no effect on the bug. On the 86 and 88, but not on the C-MOS versions 80C86 and 80C88, the instruction MOV CS,op is valid and causes an unconditional jump. The C-MOS versions, as well as the NEC V20 and V30 ignore this coding. This may also be the case on the 186 but has not been tested. The 286+ CPUs consider CS an invalid operand for this instruction and generate exception 6 (Invalid opcode). The opcode for the MOV CS,op is: 8e [mod:001:r/m] See also <POP CS>. On some 386es, random breakpoint breaks occur from the debug registers D0-D3 when a MOV from CR3, TR6 or TR7 is executed. This will continue until after a jump instruction is executed. The actual contexts of D0-D3 is not affected. Workaround is to disable breakpoints before the MOV from CR3,TR6 or TR7, execute a jmp right after the move and enabling breakpoints again. See also <debugging> On some 386es a MOV to SS may cause a code or data breakpoint set to the instruction following the MOV to be missed if the instruction takes more than two clocks. (see <debugging>) On all 386es a MOV to or from CRx, TRx or DRx executes correctly regardless of the mod field (the first two bits in the third byte of the opcode). The mod should be 11b. Intel documentation for the 386 stated it was undefined. Some 386 assemblers and compilers may generate values other than 11b for mod and fail on early 486es, causing an Invalid Opcode ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning., since they do require the mod field to be correct. More recent 486es recognize the aliased instructions as valid and execute them accordingly. On all 386es, moves to or from DR4 and DR5 are aliased to DR6 and DR7. On the early 486es these encodings are not recognized and generate an Invalid Opcode ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning.. More recent 486es do recognize these aliases and execute them correctly. On the A to C0 steps of the 486, loading TR5 with a reg32 operand may hang the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. if bits 0 and 1 (control bits) activate cache read, cache write or flush. A workaround is: JMP fetcher ALIGN 16 fetcher: NOP IN AL,port ; Note that this corrupts EAX... MOV TR5,EBX ; EBX contained the new TR5 value. NOP NOP On the A to C0 step of the 486 loading a value into CR0 which disables the cache may corrupt the cache. Forcing a prefetch will avoid this. PUSHFD CLI MOV BL,CS:label MOV CR0,EAX label: POPFD NOP Using EBX: Note that using EBX under the Microsoft Windows 3.0 DOS box in standard mode or after Microsoft Windows 3.0' termination after running standard mode, for 32-bit addressing in real or virtual 86 mode, is likely to crash the system due to the fact that apparently the Windows 3.0 DOS box trashes EBX while servicing interrupts, turning bit 18 of EBX to 1 and thus causing unwanted segment violation errors. Use of EBX in calculations is likely to cause spurious errors and may yield unpredictable behaviour of your code under the aforementioned circumstances. (MOV CS,op for NEC and 88/86, C88/C86, & 1978 copyright message supplied by Anthony Naggs). MOVS Move string of bytes, words or doublewords in memory ────────────────────────────────────────────────────────────────────────────── Mnemonic: MOVSB / MOVSW / MOVSD Opcode : A4 / A5 / 66 A5 Bug in : early 286 in PM, some 386 Function: MOVS moves strings in memory. Possible units to move are byte, word and doubleword. Typically the source is DS:(E)SI, the target ES:(E)DI If the single instruction MOVS (not prefixed by REPx) is executed with a NULL selector in ES or when ES:DI points beyond the segment limit while executing the the single instruction, causing exception 0dh, the CS:IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. saved by the 0dh exception handler will point after the MOVS instruction, instead of to it on some 286s. If a segment limit exception or IOPL violation exception occurs during the REPx prefixed form of MOVS in Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode., some early 286 will reset CX to its initial setting (before the REPx started) instead of showing CX as it was at the time of the exception. SI and DI are not affected and show the values they had at the time of the exception. During debugging with breakpoints set, REP MOVS can cause data breakpoints to be missed on some 386, see <debugging>. If, on some 386es, MOVS is followed by an instruction which uses a different address size, or by an instruction which implicitly references the stack (like POP, PUSH, IRET, RET, CALL, ENTER, LEAVE, PUSHA, POPA, PUSHF and POPF) while the D-bit for the stack is different from the current address size used by the MOVS instruction, the destination register updated will depend on the address size of the instruction that follows, rather than that of the MOVS. This can result in the updating of only DI when EDI was meant or EDI when only DI was meant. The repeated form REPx MOVS has the same bug, but in addition to (E)DI, also (E)SI is affected. A workaround is to always code a NOP with the same address size after MOVS and REPx MOVS. Example: (16-bit code segment) MOVSW ; 16-bit addressing MOVS NOP ; 16-bit addressing NOP db 67h MOVSW ; 32-bit addressing MOVS db 67h NOP ; 32-bit addressing NOP (32-bit code segment) MOVSD ; 32-bit addressing MOVS NOP ; 32-bit addressing NOP db 67h MOVSD ; 16-bit addressing MOVS db 67h NOP ; 16-bit addressing NOP MUL Unsigned Multiply 16 & 32-bit versions ────────────────────────────────────────────────────────────────────────────── Mnemonic: MUL reg Opcode : (66) F7 Ex Bug in : 386 Function: MUL multiplies ax with a 16-bit operand to form a 32-bit result in dx:ax. The 32-bit version multiplies eax with a 32-bit operand to form a 64-bit result in edx:eax. Some 386es have a problem which redirects output from the 32-bit MUL to the wrong parts of the wrong registers. Typically the following happens: Properly operating 32-bit version: Properly operating 16-bit version: EAX: 'A':'B' EAX: 'A':'B' EBX: 'C':'D' EBX: 'C':'D' EDX: 'E':'F' EDX: 'E':'F' CD x AB gives a result in EF:AB D x B gives a result in F:B While executing the 32-bit MUL, the faulty CPU(Central Processing Unit) The microprocessor which executes programs on your computer. takes CD times AB and puts the value it should have added to 'A' into 'F' while at the same time adding the value it should have put into EF to AB. No workaround other than to use 16-bit multiply. Some 386's have a bug which generates incorrect values in 16-bit mode. The iAPX program from IGEL (Chris Lueders) tests for this bug. Intel apparently organized a replacement project to get the faulty chips returned to factory for screening. After testing at Intel the faulty CPUs were sold again to bulk buyers who installed them in 16-bit only machines. These tested and failed chips carry the text "16-bit S/W only" or a single sigma. The tested and passed chips carry a double sigma (ΣΣ) on the package. (supplied by Chris Lueders) NEC V20/V30 introduction ────────────────────────────────────────────────────────────────────────────── The NEC V series microprocessors are functionally similar to the 8086 design which NEC licensed from Intel. The internal microcode and most NEC mnemonics are different from Intel's, to avoid Intel copyright claims. Only the NEC V20 & V30, pin compatible with 8088 & 8086 respectively, are usually found in IBMInternational Busiuness MachinesInternational Busiuness Machines) A hardware, software and other service technology company founded in 1911. compatible PCs. The V20 and V30 are often supplied as an "upgrade kit" for PCs originally equipped with an 88/86, as they execute most instructions in fewer clocks and can be used at a higher clock rate than the Intel parts. Occasionally single board PCs use the V40 & V50, which are based on the same CPU(Central Processing Unit) The microprocessor which executes programs on your computer. core and have integrated peripheral functions. Other V series family members diverge further from the Intel x86 series and are used in controllers and instrumentation rather than PCs. The V20 and V30 have four classes of extra instructions beyond those present on the 86/88: * the instructions Intel introduced on the 186/188 * unique instructions for the NEC V series * instructions to switch to/from 8O8O emulation mode * 8O8O instructions in 8O8O emulation mode (8080 is written here as 8O8O to avoid visual confusion with the 8088). Since the 188/186 instructions are widely documented, and the 8O8O instructions are of use only if you are writing a CP/M(Control Program for Microcomputers) An early operating system for micros based on the 8-bit Intel 8080 CPU (and later the compatible 8085 and Zilog Z80 CPUs). MSDOS version 1.0 was essentially a clone of CP/M for the Intel 8086. emulator or similar, these instructions are not listed. The special instructions which can be used in Intel x86 mode are listed in the <NEC mnemonics page> (Supplied by Anthony Naggs) NEC V20/V30-specific mnemonics list ────────────────────────────────────────────────────────────────────────────── Bit field instructions: <INS> (NECINS) Insert bit field <EXT> Extract bit field <TEST1> Test a specific bit <NOT1> Invert a specific bit <CLEAR1> Clear a specific bit <SET1> Set a specific bit Packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. support: <ADD4S> Add packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. numbers <SUB4S> Subtract BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. strings <CMP4S> Compare BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. strings (subtract without storing) <ROL4> Rotate left 4 bits <ROR4> Rotate right 4 bits Instruction prefixes: <REPC> Repeat while Carry <REPNC> Repeat while No Carry Floating point escape: Start 8O8O emulation: <FPO2> NEC equivalent of ESC <BRKEM> Break to 8O8O emulation mode (Supplied by Anthony Naggs) NOT1 Invert a specific bit (NOT operation) (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: NOT1 reg/mem,CL/immediate Opcode : NOT1 r/m8,CL : 0F 16 [mod:000:r/m] (4/18 clocks) NOT1 r/m8,imm3 : 0F 1E [mod:000:r/m] imm (5/19 clocks) NOT1 r/m16,CL : 0F 17 [mod:000:r/m] (4/18 clocks) NOT1 r/m16,imm4: 0F 1F [mod:000:r/m] imm (5/19 clocks) NOT1 CY : F5 (NEC nomenclature for Intel's CMC) Bug in : Rarely documented, except in NEC manuals Function: NOTs the specified bit in the register/memory operand. The bit number (CL or immediate) is ANDed with 07 (for 8-bit operands) or 0F (for 16-bit operands) to get a valid bit number. No flags are affected by this operation, except by NOT1 CY. The first (smaller) clock count in each pair is for register operands. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: NECINS, EXT, TEST1, CLEAR1, SET1 POP Pop register from stack ────────────────────────────────────────────────────────────────────────────── Mnemonic: POP Opcode : 51+reg (01011rrr) for general purpose registers, 0F for POP CS Bug in : POP CS is a valid opcode for 88, 86, invalid opcode for 186 0F is prefix byte on NEC V20/30 and 286+ POP SS and breakpoints on some 386 Function: POP retrieves data from the stack while adjusting the stackpointer. The 88 and 86 allow the encoding of 0f for POP CS. The NEC V20 and V30, as well as the 286+ CPUs use that encoding to indicate new instructions. On the 88 and 86 POP CS causes an unconditional jump. Executing 0F on the 186 generates an Invalid opcode exception (6). On some 386es a code or data breakpoint set to the instruction following POP SS will not be taken if the instruction takes more than two clocks. (see also <debugging>) (POP CS supplied by Anthony Naggs) POPA / POPAD Pop all general purpose registers ────────────────────────────────────────────────────────────────────────────── Mnemonic: POPA / POPAD Opcode : 61 / 66 61 Bug in : some 386 Function: POPA and POPAD pop all general purpose registers from the stack. POPA pops 16-bit registers and POPAD pops 32-bit registers. The opcode is the same. POPAD is POPA with an operand size prefix (66h). If either POPA or POPAD is followed by an instruction which uses an effective address calculation consisting of a base register and another register other than (E)AX as an index, the contents of EAX is corrupted. Also, if POPA or POPAD in 16-bit mode is followed by an instruction which uses an effective address using EAX as a base or index, the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. will hang. The workaround is to always code a NOP after POPA as well as POPAD. Prefetch queue, bus & cache parameters per CPU(Central Processing Unit) The microprocessor which executes programs on your computer. ────────────────────────────────────────────────────────────────────────────── NEC NEC sx dx sx dx 88 V20 188 86 V30 186 286 386 386 486 486 Pentium ┌─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─┬─┴─────┐ SPQB───┼ 4 │ 4 │ 4 │ 6 │ 6 │ 6 │ 6 │16 │16 │32 │32 │32 x 2 │ NEBIPQ──┼ 1 │ 1 │ 1 │ 2 │ 2 │ 2 │ 2 │ 2 │ 4 │16 │16 │ ? │ MPBRMP──┼ 1 │ 1 │ 1 │ 1 │ 1 │ 1 │ 1 │ 1 │ 1 │16b│16b│ 32a│ DIQL───┼ - │ - │ - │ - │ - │ - │ 3 │ 3 │ 3 │ - │ - │ ? │ OCSKB──┼ - │ - │ - │ - │ - │ - │ - │ - │ - │ 8 │ 8 │ 8 x 2 │ DBSB───┼ 8 │ 8 │ 8 │16 │16 │16 │16 │16 │32 │32 │32 │ 64 │ ABSB───┼20 │20 │20 │20 │20 │20 │24 │24 │32 │32 │32 │ 32 │ └───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───┴───────┘ Legend: SPQB = Size of the Prefetch Queue (PQueue) in Bytes NEBIPQ = Number of Empty Bytes In PQueue to initiate prefetch cycle *MPBRMP = Minimum possible number of Bytes to Read from Memory to Prefetch DIQL = Decoded Instruction Queue Length, measured in instructions OCSKB = On-chip CacheCaching is a method of increasing performance by keeping frequently-used data in a location which is more quickly accessed. The most common caches are disk caches (store disk sectors in RAM) and RAM caches (store portions of main memory in special high-speed RAM which may be accessed as fast as the CPU is capable of accessing memory). See also Delayed Write, Write-Through. Size in KiloBytes DBSB = Data Bus Size in Bits ABSB = Address Bus Size in Bits - = None b = 16-byte burst mode cache line fill a = 32-byte burst mode cache line fill * note that starting with the 486, prefetches are read from the cache. A cache line fill is performed in case of a cache miss and starts to read on paragraph boundaries only. A cache line on the 486 is 16 bytes in size. On the Pentium, a line fill starts on a boundary which lies at an even number of paragraphs (32-byte chunks). (NEC & 188/186 prefetches supplied by Anthony Naggs) PUSH Pushes value or register onto the stack. ────────────────────────────────────────────────────────────────────────────── Mnemonic: PUSH reg / PUSH mem Opcode : 01010rrr / FF [mod:110:r/m] Bug in : PUSH (E)SP different operation on 286+, PUSH mem on some 286 in PM Function: PUSH pushes a value or register onto the stack. Normally, the value pushed is placed in the location pointed to by SS:SP (or SS:ESP on 386+), after which (E)SP is decremented by a word or dword. When pushing any register or value, the difference between 286+ and previous CPUs is not visible and causes no problems. However, when pushing SP (or ESP on 386+) the value pushed is different between 286 and previous CPUs. On CPUs prior to the 286, SP would be decremented and then pushed. On 286+ however, SP gets pushed and then decremented, leaving a different value on the stack for SP. On the 386+ the same is in effect when pushing ESP If PUSH mem on the 286 in Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode. causes a stack limit violation - exception 0bh, the saved CS:IP(Internet Protocol) The lower level (transport layer) of the TCP/IP protocol suite. See also TCP, TCP/IP. will point after the PUSH instead of to it on some early 286. RDTSC Read Time Stamp Counter ────────────────────────────────────────────────────────────────────────────── Mnemonic: RDTSC Opcode : 0F 31 Bug in : Poorly documented for Pentium Processor Function: RDTSC reads a Pentium internal 64 bit register which is being incremented from 0000 0000 0000 0000 at every CPU(Central Processing Unit) The microprocessor which executes programs on your computer. internal clockcycle. Note that this gives a clockcycle-accurate timer with a range of more than 8800 years at 66 Mhz... The instruction places the counter in the EDX:EAX register pair. REPNC / REPC Repeat next string operation while (No) Carry ────────────────────────────────────────────────────────────────────────────── Mnemonic: REPC / REPNC Opcode : 65 / 64 ( ? clocks) (GS/FS override on 386+) Bug in : Rarely documented except in NEC manuals, invalid on Intel CPUs Conflicting opcode for GS and FS segment override for 386+ Function: REPC repeats the following string instruction while the Carry Flag is set. REPNC repeats the following string instruction while the Carry Flag is clear. CX should hold the maximum number of iterations, just as with REPZ/REPNZ. Note that since these instructions works with the Carry Flag, they have no special effect on MOVS and LODS. A simple REP should be used in these cases. These instructions are NEC specific. They are not implemented on the Intel CPUs. Note that the 386+ implements the listed opcodes 64 and 65 for the segment override instructions FS and GS respectively. If your software will run on a NEC, they may be handy. ROL4 Rotate left 4 bits (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: ROL4 reg8/mem8 Opcode : 0F 28 [mod:000:r/m] (25/28 clocks) Bug in : Rarely documented, except in NEC manuals Function: Rotates a BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. digit (4 bits) left out of the operand, through the low 4 bits of AX. AL reg/mem 7 . . . . . . 0 7 . . . . . . 0 ┌───────┬───────┐ ┌───────┬───────┐ │ │ │<──────┤ │ │<───┐ └───────┴───┬───┘ └───────┴───────┘ │ └──>─────────────────────────────┘ The first (smaller) clock count is for a register operand. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: ADD4S, SUB4S, CMP4S, ROR4 ROR4 Rotate right 4 bits (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: ROR4 reg8/mem8 Opcode : 0F 2A [mod:000:r/m] (29/33 clocks) Bug in : Rarely documented, except in NEC manuals Function: Rotates a BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. digit (4 bits) right out of the operand, through the low 4 bits of AX. AL reg/mem 7 . . . . . . 0 7 . . . . . . 0 ┌───────┬───────┐ ┌───────┬───────┐ │ │ ├──────>│ │ ├>───┐ └───────┴───┬───┘ └───────┴───────┘ │ └──<─────────────────────────────┘ The first (smaller) clock count is for a register operand. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: ADD4S, SUB4S, CMP4S, ROL4 SET1 Set a specific bit (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: SET1 reg/mem,CL/immediate Opcode : SET1 r/m8,CL : 0F 14 [mod:000:r/m] (4/13 clocks) SET1 r/m8,imm3 : 0F 1C [mod:000:r/m] imm (5/14 clocks) SET1 r/m16,CL : 0F 15 [mod:000:r/m] (4/13 clocks) SET1 r/m16,imm4: 0F 1D [mod:000:r/m] imm (5/14 clocks) SET1 CY : F9 (NEC nomenclature for Intel's STC) SET1 DIR : FD (NEC nomenclature for Intel's STD) Bug in : Rarely documented, except in NEC manuals Function: Sets the specified bit in the register/memory operand. The bit number (CL or immediate) is ANDed with 07 (for 8-bit operands) or 0F (for 16-bit operands) to get a valid bit number. No flags are affected by this operation, except the Carry and Direction Flag with SET1 CY and SET1 DIR. The first (smaller) clock count in each pair is for register operands. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: NECINS, EXT, TEST1, NOT1, CLEAR1 SETALC Set AL according to Carry ────────────────────────────────────────────────────────────────────────────── Mnemonic: SETALC Opcode : D6 ( ? clocks) Bug in : Is an undocumentedInformation about a product which is not publicly available from the manufacturer, and must be determined by reverse-engineering (disassembly, trial-and-error, etc.). Undocumented information tends to change -- often dramatically -- between successive revisions of a product, since the manufacturer has no obligation to maintain compatibility in behavior which is not explicitly stated. opcode on 88,86,286,386,486 Does not work on NEC and Sony V20+ (is alias for XLATB there) Function: This instruction copies the Carry Flag to the AL register without changing any flags. In case of a CY, AL becomes ffh. When the Carry Flag is cleared, AL becomes 00. (NEC & Sony difference, and 86/88 availability supplied by Anthony Naggs) Shift and Rotate operand limitations ────────────────────────────────────────────────────────────────────────────── Mnemonic: SHL, SAL, SHR, SAR, ROL, RCL, ROR, RCR, and all xxxD variants Opcode : various Bug in : 186+ will AND the shift- or rotate count with 1f before execution NEC V20 and V30 act like 88 / 86 and do not limit the count. Function: The instructions mentioned above will limit the actual number of bits shifted or rotated to the number of bits to be shifted AND 1f. The remainder is actually shifted or rotated. A shift of 21h will actually be a shift of 1. This is also the case for the double shifts on 386+. (186 and NEC difference supplied by Anthony Naggs) SUB4S Subtraction of packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. strings (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: SUB4S Opcode : 0F 22 (7+19n clocks, n is the number of bytes per operand) Bug in : Rarely documented, except in NEC manuals, is conflicting opcode on 386+ (MOV) Function: Subtracts the packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. string at DS:SI from the packed BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. string at ES:DI. The length of the string, in BCD(Binary Coded Decimal) A method of data storage where two decimal digits are stored in each byte, one in the upper four bits and the other in the lower four bits. Since only the values 0 through 9 are used in each half of a byte, BCD values can be read as decimal numbers on a hexadecimal display of memory or a file. digits, is specified in CL. Unlike Intel string operations CL, DI & SI are unchanged by the operation. The Zero Flag (ZF) is set if the result is zero. The Carry Flag (CF) and Overflow Flag (OF) appear to be set by the subtraction of the most significant digits. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+ CPUs. (Supplied by Anthony Naggs) See Also: ADD4S, CMP4S, ROL4, ROR4 TEST1 Test a specific bit (NEC V20/30 only) ────────────────────────────────────────────────────────────────────────────── Mnemonic: TEST1 reg/mem,CL/immediate Opcode : TEST1 r/m8,CL : 0F 10 [mod:000:r/m] (3/12 clocks) TEST1 r/m8,imm3 : 0F 18 [mod:000:r/m] imm (4/13 clocks) TEST1 r/m16,CL : 0F 11 [mod:000:r/m] (3/12 clocks) TEST1 r/m16,imm4: 0F 19 [mod:000:r/m] imm (4/13 clocks) Bug in : Rarely documented, except in NEC manuals, opcodes 0f 10 and 0f 11 are conflicting opcodes on 386+ (MOV aliases for 88-8b) Function: Tests the specified bit in the register/memory operand, if it is zero the Z flag is set otherwise it is cleared. The bit number (CL or immediate) is ANDed with 07 (for 8-bit operands) or 0F (for 16-bit operands) to get a valid bit number. The first (smaller) clock count in each pair is for register operands. Note that 0F is treated as <POP CS> on the 88/86 and prefixes newer instructions on 286+. (Supplied by Anthony Naggs) See Also: NECINS, EXT, NOT1, CLEAR1, SET1 UNKNOWN opcode, info wanted ────────────────────────────────────────────────────────────────────────────── Mnemonic: UNKNOWN Opcode : 0F 04 ( ? clocks) Bug in : Is an unknown opcode on 286 Function: Exact purpose unknown, when executed it hangs the machine, likely bringing it into protected mode, anyone with a hardware debugger may check to find out. This instruction is likely to be an alias for the LOADALL on the 286. It does not generate an exception. >> info wanted << VERR / VERW Verify a segment selector for Reading or Writing ────────────────────────────────────────────────────────────────────────────── Mnemonic: VERR op / VERW op Opcode : 0F 00 [mod:100:r/m] / 0f 00 [mod:101:r/m] Bug in : some 386 Function: VERR verifies that the segment selector in memory, pointed to by op, is readable and accessible with the current privilege level (CPL). If so, the Zero Flag is set to 1, if not, the Zero Flag is cleared. VERW verifies that the segment selector in memory, pointed to by op, is writable and accessible with the current privilege level (CPL). If so, the Zero Flag is set to 1, if not, the Zero Flag is cleared. On some 386 both instructions allow a NULL selector to be specified, accessing selector zero in the GDT, instead of failing unconditionally with ZF=0, which would be the normal procedure. Workaround is to fill descriptor zero in the GDT with all zeroes. Accessing it will then always fail and produce the desired effect. On some 386 both VERR and VERW can hang the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. until an INTR, NMIsee Non-Maskable Interrupt or RESET occurs. This bug occurs when there is no memory operand, JMP or CALL instruction in the <prefetch queue> along with the VERR or VERW. Workaround is to code a JMP or Jcondition instruction right after the VERR or VERW, with the added condition that _the last byte_ of the VERR / VERW and the complete JMP instruction must fit in the same aligned doubleword. A data breakpoint set to the mem16 operand of either VERR or VERR can be missed on some 386es if the segment with the selector at mem16 is not accessible. (see also <debugging>) WBINVD Write back & invalidate both internal & external caches ────────────────────────────────────────────────────────────────────────────── Mnemonic: WBINVD Opcode : 0F 09 Bug in : some 486 Function: WBINVD tells the processor that all data in both the internal as well as the external caches is invalid. Data held in external write-back caches is written back to memory before the flush. If on some 486's a cache line fill is in progress while the WBINVD instruction is being executed, that line is NOT invalidated and the buffer contents is moved into the cache. Valid cache lines are ALWAYS used to satisfy read requests on all 486's, regardless whether the cache is enabled or not. Workaround is to disable the cache prior to flushing it like this: MOV EAX,CR0 OR EAX,60000000h ; cache disable bits PUSHFD CLI MOV BL,CS:here OUT dummyport,dummydata MOV CR0,EAX here: WBINVD AND EAX,9fffffff ; cache enable, write-through MOV CR0,EAX POPFD Write / Read Model Specific Register (Pentium+ compatible) ────────────────────────────────────────────────────────────────────────────── Mnemonic: WRMSR / RDMSR Opcode : 0F 30 / 0f 32 Bug in : Are minimally documented opcodes for Pentium+ compatible CPUs Function: It should be possible to use the WRMSR & RDMSR instructions on any CPU(Central Processing Unit) The microprocessor which executes programs on your computer. which A: supports the CPUID instruction and B: has the extension bit 5 in the feature bitmap of EDX set after executing function 1 (EAX=1) with CPUID. WRMSR writes to a Model Specific Register. EDX:EAX contain the value to write into the register whose number is given in ECX. RDMSR reads from a Model Specific Register. EDX:EAX will receive the value from the MSR(Model-Specific Register) Additional, indirectly-accessible, registers containing control or status information about various aspects of the processor such as caches, performance counters, and the like. These registers, accessible via the RDMSR and WRMSR instructions, were added with the Pentium and later-model 486 processors. whose number is given in ECX. List of Model Specific Registers: 00h Machine Check Exception-Address register (Read-only) 01h Machine Check Exception-Type register (Read-only) 02h Unknown .. 0dh Unknown 0eh Test register T12 0fh Unknown 10h Time Stamp Counter (See RDTSC) 11h Counter / Event Selection register (See CESR Map) 12h Counter #0 (40 bit resolution) 13h Counter #1 (40 bit resolution) CESR Map. Note that CESR is a 64-bit register, of which only the bottom 32 bits are currently known to be used. Bit 31 16 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┐ │r│r│r│r│r│r│r│c│3│2│t│t│t│t│t│t│r│r│r│r│r│r│r│C│3│2│T│T│T│T│T│T│ └─┴─┴─┴─┴─┴─┴─┴┼┴┼┴┼┴┼┴─┴─┴─┴─┴┼┴─┴─┴─┴─┴─┴─┴─┴┼┴┼┴┼┴┼┴─┴─┴─┴─┴┼┘ │ │ │ └─────┬───┘ │ │ │ └────┬────┘ Counting method┘ │ └─────┐ │ ──────────────────┘ │ │ │ Allow counting in CPL3 │ │ ────────────────────┘ │ │ Allow counting in CPL0-2─┘ │ ──────────────────────┘ │ Event type (what to count)─┘ ─────────────────────────────┘ (see list below) └──────────┬──────────────────┘ └────────────┬────────────────┘ Counter #1:─┘ Counter #0:─┘ Counting methods: 1= count CPU(Central Processing Unit) The microprocessor which executes programs on your computer. cycles 0= count events Allow count in CPL3: 1= Yes 0= No Allow count in CPL0-2: 1= Yes 0= No Event Type List: 00h data read 01h data write 02h data TLB miss 03h data read miss 04h data write miss 05h Write (hit) to M (modified) or E (exclusive) cacheline (MESI protocol) 06h data cache lines written back 07h data cache snoops 08h data cache snoop hits 09h memory accesses in both pipes (cumulative ?) 0ah data bank access conflicts (U & V pipe access same data line in data cache). 0bh misaligned data memory references 0ch code read 0dh code TLB miss 0eh code cache miss 0fh any segment register load 10h segment descriptor cache accesses 11h segment descriptor cache hits 12h branches 13h Branch Target Buffer (BTB) hits 14h taken branch or BTB hit 15h pipeline flushes 16h instructions executed 17h instructions executed in V pipe 18h bus utilization (apparently events in which the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. has to wait for bus access). 19h pipeline stalled by write backups 1ah pipeline stalled by data memory read 1bh pipeline stalled by write to M or E line 1ch locked bus cycle (for instance during xchg) 1dh I/O read or write cycles 1eh noncacheable memory references 1fh pipeline stalled by Address Generation Interlock (AGI) 20h unknown 21h unknown 22h floating point operations 23h breakpoint 0 match 24h breakpoint 1 match 25h breakpoint 2 match 26h breakpoint 3 match 27h hardware interrupts 28h data read or data write 29h data read miss or data write miss (All info provided by Christian Ludloff) All mentioned x86 CPU(Central Processing Unit) The microprocessor which executes programs on your computer. instructions by Mnemonic ────────────────────────────────────────────────────────────────────────────── Click on any instruction mnemonic to see details. See <BreakpointWhen debugging, a memory location which when accessed causes a break in the normal flow of execution and the invocation of the debugger. Used to let a program run at full speed until a certain instruction is reached or (less frequently) a particular data item is accessed or changed. errors> for CPU(Central Processing Unit) The microprocessor which executes programs on your computer. bugs relating to debugging. See <Chip Step info> for a summary on revision codes. See <General FPU bugs> for FPU bugs unrelated to instructions. See <FPU mnemonics> for FPU bugs related to FPU instructions. See <List of NEC mnemonics> for a list of NEC instructions. See <NEC general info> for a summary of special features in NECs. <AAA> Adjust after addition <AAD> Adjust after division <AAM> Adjust after multiply <AAS> Adjust after subtraction <BOUND> Bounds check <BSF> Bit scan forward <BSWAP> 4-Byte swap (e-registers) <BT> Bit test <BTC> Bit test & complement <BTR> Bit test & reset <BTS> Bit test & set <CHKIND> Alias mnemonic for BOUND on NEC <CMPS> CMPSB CMPSW CMPSD String compare, Byte, Word, Doubleword <CMPXCHG> Compare & exchange <CPUID> Identify CPU(Central Processing Unit) The microprocessor which executes programs on your computer. (486+) <CR0> CR1 CR2 CR3 CR4 Map of control registers <EFLAGS> Map of EFLAGS register <HLT> Halt the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. <IBTS> Insert bit string <IMUL> Integer multiply <INS> INSB INSW INSD Input of string from I/O port, Byte, Word, Doubleword <INVD> Invalidate cache <JMP> Unconditional jump <LAR> Load access rights <LOADALL> Load all registers. <LSL> Load segment limit <MOV> Move data to/from registers <MOVS> Move string <MUL> Multiply unsigned <POP> Pop data from stack <POPA> Pop all registers <PUSH> Push value onto stack <RDTSC> Read time stamp counter <RDMSR> Read Model Specific Register (Pentium+) <Rotate and Shift> Concerns all Rotation and Shift instructions <SETALC> Carry bit to all of al <UNKNOWN> An unknown opcode <VERR> Verify segment for Read <VERW> Verify segment for Write <WBINVD> Write Back and Invalidate CacheCaching is a method of increasing performance by keeping frequently-used data in a location which is more quickly accessed. The most common caches are disk caches (store disk sectors in RAM) and RAM caches (store portions of main memory in special high-speed RAM which may be accessed as fast as the CPU is capable of accessing memory). See also Delayed Write, Write-Through. (486+) <WRMSR> Write Model Specific Register (Pentium+) All mentioned FPU instructions by Mnemonic ────────────────────────────────────────────────────────────────────────────── Alphabetic listing on FPU Mnemonics for instructions behaving different than expected. Instructions marked with * are considered undocumentedInformation about a product which is not publicly available from the manufacturer, and must be determined by reverse-engineering (disassembly, trial-and-error, etc.). Undocumented information tends to change -- often dramatically -- between successive revisions of a product, since the manufacturer has no obligation to maintain compatibility in behavior which is not explicitly stated.. * <FCOS> FPU Cosine in radians on IIT math coprocessor <FDISI / FNDISI> Disable Floating point interrupts <FDIV / FDIVP> Divide <FDIVR / FDIVRP> Divide reversed <FENI / FNENI> Enable Floating point interrupts <FLDENV> Load Floating point Environment <FMUL4X4> Matrix multiply on IIT math coprocessor <FPREM> Modulus of ST by ST(1) into ST <FPTAN> Tangent ratio of ST into ST & ST(1) <FRSTPM> Tells the FPU to use Real (or V86see Virtual-86 Mode) Mode formats <FRSTOR> Loads the FPU state from memory see FSAVE <FSAVE> Saves the FPU state to memory see FRSTOR * <FSBP0,1,2,3> Bankswitching on IIT math coprocessor <FSCALE> Adds the value in ST to the exponent in ST(1) <FSETPM> Tells the FPU to use Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode. formats * <FSIN> FPU Sine in radians on IIT math coprocessor <FSINCOS> calculates FPU sine and cosine in radians <FSTENV> Store Floating point Environment General Intel FPU bugs, unrelated to opcodes ────────────────────────────────────────────────────────────────────────────── Mnemonic: N/A Opcode : N/A Bug in : some 486 / 487 Function: While using a maths coprocessor (also referred to as floating point unit FPU), errors may occur and invalid numbers may be generated. While most FPUs don't have any problem handling these situations, some steps may lock up or misbehave otherwise. The list below shows known malfunctions which may arise during FPU operations on some systems. True bugs: <FERR# not handled correctly by FPU> <FPU performance degradation because IGNNE# active> Incompatibilities between different types of FPU: <Four indications for 'empty' in Condition Code Bits after FXAM> '87 to 287 specific differences: <Error signal does not go through PIC on 287+> <Exceptions are different> <ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. pointers saved by 287+ save prefixes> <287+ need no synchronization> <287 & 387 use reserved I/O ports> FERR# not handled correctly by FPU ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * FERR# not handled correctly by FPU: In some cases an FPU operation may generate a floating point error, which will not be recognized by the CPU(Central Processing Unit) The microprocessor which executes programs on your computer.. The workaround for this is to replace all FWAIT with FNOP or follow all FWAIT with a NOP, while masking all floating point errors. FPU performance degradation because IGNNE# active ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * FPU performance degradation because IGNNE# active: If an unmasked exception occurs with bit NE (Numeric Error or Numeric ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning.) in CR0 cleared (recognize exceptions), while IGNNE# is active, all following FPU instructions will require an additional 17 to 22 clocks. This because the exception remains pending due to the logic conflict caused by contradicting signals. It lets the 486/487 execute microcode in order to classify and analyze the exception, but it does not let it handle it, prior to executing the next FPU opcode. A workaround is to clear all unmasked exceptions with FCLEX or FINIT within an exception handler before it finishes or to make sure IGNNE# is not made active so exceptions are recognized and handled immediately as they occur (when NE is cleared). Four indications for 'empty' in Condition Code Bits after FXAM ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * Four different indications for 'empty' in Condition Code Bits after FXAM: The various FPUs use different bit patterns to indicate an empty FPU register after the FXAM instruction. You should rely only on bits C0 and C3 to be 1 in case an FPU register is to be considered empty. (See <FPU Condition Code Bits>) Error signal does not go through PIC on 287+ ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * Error signal does not go through PIC on 287+ On the 86, an FPU error is signalled through the PIC (Programmable Interrupt Controller). Starting with the 287, FPU errors are signalled over a dedicated pin on the CPU(Central Processing Unit) The microprocessor which executes programs on your computer. / FPU combination, namely ERROR#. There may be code which depends on the PIC handling the error. These error handlers will need to be rewritten. Exceptions are different ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * Exceptions are different The coprocessor segment overrun exception (09) is issued when the FPU attempts to read the second or subsequent words of a data operand beyond a segment limit on a 286. On a 386 it is not normally used. The 486 signals exception 0dh instead. The segment wraparound exception (General Protection exception 0dh) will be issued if the FPU attempts to execute an instruction that spans into or lies beyond a segment limit. All other errors are signalled through interrupt 10h in 286 systems. ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. pointers saved by 287+ save prefixes ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. pointers saved by 287+ save prefixes The exception pointers on the 87 would point to the ESC instruction itself, regardless of any segment overrides (or other prefixes for that matter). The 287+ pointers point to the first prefix before the ESC instruction, if any. 287+ need no synchronization ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * 287+ need no synchronization On the 87, the FPU and CPU(Central Processing Unit) The microprocessor which executes programs on your computer. worked separated from each other. Any communication between the FPU and CPU(Central Processing Unit) The microprocessor which executes programs on your computer. had to be coordinated with WAITs. On the 287+, no WAITs are required except for control instructions. The CPU(Central Processing Unit) The microprocessor which executes programs on your computer. examines the BUSY# signal before communicating with the FPU to assure the FPU can accept commands. The 387 also examines BUSY# before sending commands to the FPU. Data transfers are regulated by monitoring the PEREQ# pin. 287 & 387 use reserved I/O ports ────────────────────────────────────────────────────────────────────────────── <Back> (General Intel FPU bugs, unrelated to opcodes) * 287 & 387 use reserved I/O ports On the 287, FPU instructions and data are sent to and received from the FPU via I/O ports. These ports are f0-ff on the 286 / 287. This property is important to consider when the number of I/O waitstates on the mainboard can be changed. To safely increase the FPU performance some experimentation may be necessary, but a 25% speed increase has been accomplished on a 12 MHz 286 with 20 MHz IIT 2c87 by decreasing the number of I/O waitstates from 6 to 4. On the 387, FPU instructions and data are sent to and received from the FPU via I/O ports too. These ports are 800000f0 - 800000ff. Note that the I/O waitstate trick may very well work on 386 / 387 systems as well. FPU Condition Code Bits after a test, compare or reduction ────────────────────────────────────────────────────────────────────────────── Vatious FPU test instructions set the Condition Code bits C0 to C3 based on the values tested. Below is a list of possible bit combinations. These C-bits map to the flags register as follows after stswax and sahf: Eflags map: ZF PF - CF (C1 has no flag assigned to it) C3 C2 C1 C0 Examine 0 0 0 0 +Unnormal (positive, valid, unnormalized) 0 0 0 1 +NaN (positive, invalid, exponent is 0) 0 0 1 0 -Unnormal (negative, valid, unnormalized) 0 0 1 1 -NaN (negative, invalid, exponent is 0) 0 1 0 0 +Normal (positive, valid, normalized) 0 1 0 1 +Infinity (positive, infinity) 0 1 1 0 -Normal (negative, valid, normalized) 0 1 1 1 -Infinity (negative, infinity) 1 0 0 0 +Zero (positive, zero) 1 0 0 1 Empty (empty register) 1 0 1 0 -Zero (negative, zero) 1 0 1 1 Empty (empty register) 1 1 0 0 +Denormal (positive, invalid, exponent is 0) 1 1 0 1 Empty (empty register) 1 1 1 0 -Denormal (negative, invalid, exponent is 0) 1 1 1 1 Empty (empty register) FCOM or STST 0 0 ? 0 ST > Source with FCOM or ST > 0 with FSTST 0 0 ? 1 ST < Source with FCOM or ST < 0 with FSTST 1 0 ? 0 ST = Source with FCOM or ST = 0 with FSTST 1 1 ? 1 ST cannot be compared ot tested Reduction b1 0 b0 b2 If reduction was complete, bits 0,1 and 2 equal the three lowest bits of the qoutient ? 1 ? ? Reduction was incomplete FPU Status Word, Control Word and Tag Word layout ────────────────────────────────────────────────────────────────────────────── The layout of the Status-, Control- and Tag Word of the FPU. FPU Status Word Bit 15 8 0 ┌──┬──┬──┬──┼──┬──┬──┬──┼──┬──┬──┬──┼──┬──┬──┬─┴┐ │ B│c3│ ST n │c2│c1│c0│ES│sf│Pe│Ue│Oe│Ze│De│Ie│ └─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┘ │ │ └──┼──┘ └──┼──┘ │ │ │ │ │ │ │ │ Busy ╘═════╪════════╡ │ │ │ │ │ │ │ │ Stack Top──┘ │ │ │ │ │ │ │ │ │ Condition Code Bits─┘ │ │ │ │ │ │ │ │ ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. Summary * ──────┘ │ │ │ │ │ │ │ Stack fault──────────────────┘ │ │ │ │ │ │ Precision exception (1=occurred)┘ │ │ │ │ │ Underflow exception (1=occurred)───┘ │ │ │ │ Overflow exception (1=occurred)───────┘ │ │ │ Zero divison exception (1=occurred)──────┘ │ │ Denormalized operand exception (1=occurred)─┘ │ Invalid operation exception (1=occurred)───────┘ * The ExceptionA signal by the CPU that some error condition has been encountered that it can not deal with without a program's intervention. The most commonly encountered exceptions on Intel processors are Exceptions 12 and 13 (decimal, how Intel specifies exception numbers), which are stack and general problems, respectively. Exception 13 is typically caused by a memory access which wraps from the end of a segment back to the beginning. summary is called Interrupt request on 8087. FPU Control Word Bit 15 8 0 ┌──┬──┬──┬──┼──┬──┬──┬──┼──┬──┬──┬──┼──┬──┬──┬─┴┐ │ r│ r│ r│ic│round│prec.│ie│ r│Pm│Um│Om│Zm│Dm│Im│ └──┴──┴──┴─┼┴──┴─┼┴─┼┴──┴─┼┴──┴─┼┴─┼┴─┼┴─┼┴─┼┴─┼┘ Infinity │ │ │ │ │ │ │ │ │ │ control────┘ │ │ │ │ │ │ │ │ │ Rounding control─┘ │ │ │ │ │ │ │ │ Precision control───┘ │ │ │ │ │ │ │ Interrupt enable mask─────┘ │ │ │ │ │ │ └┐ │ │ │ │ │ Precision exception Mask 1=masked┘ │ │ │ │ │ Underflow exception Mask 1=masked──┘ │ │ │ │ Overflow exception Mask 1=masked──────┘ │ │ │ Zero divison exception Mask 1=masked─────┘ │ │ Denormalized operand exception Mask 1=masked┘ │ Invalid operation exception Mask 1=masked──────┘ Infinity control is supported on the 8087 and 287 only. The 87 and 287 (not the 287xl) have ic cleared by default and then support projective closure. The 287xl+ only support affine closure. To make sure an 87 or 287 will handle the numbers in the same way as the 287xl+, set bit ic to make 87 & 287 support affine closure as well. Note that a FINIT will clear ic again. The ic setting is ignored on 287xl+. Rounding control is set to 00 by default. 00 = Round to nearest or even 01 = Round down (towards negative infinity) 10 = Round up (towards positive infinity) 11 = Chop towards zero Precision control is set to 11 by default. 00 = 24 bit precision (mantissa) 01 = reserved 10 = 53 bit precision (mantissa) 11 = 64 bit precision (mantissa) Note: lesser precision does not significantly reduce execution time. FPU Tag Word Bit 15 8 0 ┌──┬──┬──┬──┼──┬──┬──┬──┼──┬──┬──┬──┼──┬──┬──┬─┴┐ │ x x│ x x│ x x│ x x│ x x│ x x│ x x│ x x│ └──┴─┼┴──┴─┼┴──┴─┼┴──┴─┼┴──┴─┼┴──┴─┼┴──┴─┼┴──┴─┼┘ 7 6 5 4 3 2 1 0 Tag number The tag number 0 corresponds to the register which is currently ST0. The bits for each tag have the same meaning: 0 0 Valid 0 1 Zero 1 0 Special (NaN,Infinity,Denormal,Unnormal,Unsupported) 1 1 Empty IIT bankswitching (IIT math coprocessor) ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSBP0, FSBP1, FSBP2, FSBP3 Opcode : DB E8, DB Eb, EB EA, DB E9 (6 clocks) Bug in : Are IIT 2c87+ instructions Function: FSBP0 Selects the original bank. (default) FSBP1 Selects bank 1 from <FMUL4X4> instruction diagram FSBP2 Selects bank 2 from FMUL4X4 instruction diagram FSBP3 Selects the scratchpad bank3 used by the FMUL4X4 internally. The FSBP3 instruction is not publicly supported by IIT, it can be used to select the last bank of registers, which unfortunately cannot be used for regular operation. However, it is listed for completeness. FSIN / FCOS Floating point sine and cosine ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSIN / FCOS Opcode : D9 FE / D9 FF Bug in : Undocumented instructions on IIT 2c87 math chips Function: FSIN calculates the radial sine of the value in ST(0), leaving the result in ST(0). Apparently the IIT FSIN functions according to Intel's 287xl and 387+ specifications. FCOS calculates the radial cosine of the value in ST(0), leaving the result in ST(0). Apparently the IIT FCOS functions according to Intel's 287xl and 387+ specifications. Both these instructions are not officially supported by IIT for the 2c87. Both instructions are available on Intel 287xl and 387+ processors using the listed opcodes. FDIV / FDIVP Floating point division / divide & POP ────────────────────────────────────────────────────────────────────────────── Mnemonic: FDIV / FDIVP Opcode : various Bug in : some 486 Function: FDIV divides destination by source and returns the result in destination. FDIVP does the same but pops the FPU stack afterwards. The bug occurs when the instruction operates on an FPU register which is tagged as empty, but holds a nonzero value and the next FPU instruction occurs within 35 FPU clock counts. In that case, the current instruction will use the invalid number in the empty location, producing an invalid result and causing the following instruction to generate an invalid result as well. There is no workaround. FDIVR / FDIVRP Floating point division reversed / divide & POP ────────────────────────────────────────────────────────────────────────────── Mnemonic: FDIVR / FDIVRP Opcode : various Bug in : some 486 Function: FDIVR divides source by destination and returns the result in destination. FDIVRP does the same but pops the FPU stack afterwards. The bug occurs when the instruction operates on an FPU register which is tagged as empty, but holds a nonzero value and the next FPU instruction occurs within 35 FPU clock counts. In that case, the current instruction will use the invalid number in the empty location, producing an invalid result and causing the following instruction to generate an invalid result as well. There is no workaround. FLDENV Load Floating point Environment ────────────────────────────────────────────────────────────────────────────── Mnemonic: FLDENV Opcode : D9 [mod:100:r/m] disp Bug in : some 387 Function: FLDENV loads the entire FPU environment from the address given by the memory operand. See <FPU environment layout>. If either of the two last bytes of the environment cannot be read for whatever reason, the instruction cannot be restarted on some 387s. A workaround is to attempt to read those bytes before the FLDENV is executed or to align the environment on a 128 byte boundary so it is unlikely to fall outside a segment or page boundary. Should that be the case, the integer unit can cause an exception or make sure the page (in case of a swapped page) is read into memory before FLDENV starts. FMUL4X4 Matrix Multiply (IIT math coprocessor) ────────────────────────────────────────────────────────────────────────────── Mnemonic: FMUL4X4 or F4X4 Opcode : DB F1 (2c87=242, 3c87sx=242, 3c87=242 clocks) Bug in : Is an IIT special instruction Function: This instruction is available only on the IIT (Integrated Information Technology Inc.) math processors. The instruction performs a 4x4 matrix multiply in one instruction using three banks of 8 floating point registers. The operands must be loaded to a specific bank in a specific order using Xn = (A00 * Xo) + (A01 * Xo) + (A02 * Xo) + (A03 * Xo) Yn = (A10 * Yo) + (A11 * Yo) + (A12 * Yo) + (A13 * Yo) Zn = (A20(Address line 20) The 80286 and higher CPUs allow addresses in real mode to extend slightly beyond the one megabyte mark, which causes an incompatibility with some older programs which expect such addresses to wrap back to the beginning of the address space. For complete compatibility with the 8088, newer machines thus contain circuitry which permits the twenty-first address line (A20) to be disabled. The CPU then effectively has only twenty address lines in real mode, just as the 8088 does, and addresses which would extend beyond the one megabyte mark wrap to the beginning of the address space. See also High Memory Area, Real Mode. * Zo) + (A21 * Zo) + (A22 * Zo) + (A23 * Zo) Vn = (A30 * Vo) + (A31 * Vo) + (A32 * Vo) + (A33 * Vo) Where Xo stands for the original X value and Xn for the result. Operands must be loaded to the following registers in the specified banks in the specified order. Before FMUL4X4 After FMUL4X4 bank bank Register: 0 1 2 0 ST(0) Xo A33 A31 Xn ST(1) Yo A23 A21 Yn ST(2) Zo A13 A11 Zn ST(3) Vo A03 A01 Vn ST(4) A32 A30 ? ST(5) A22 A20(Address line 20) The 80286 and higher CPUs allow addresses in real mode to extend slightly beyond the one megabyte mark, which causes an incompatibility with some older programs which expect such addresses to wrap back to the beginning of the address space. For complete compatibility with the 8088, newer machines thus contain circuitry which permits the twenty-first address line (A20) to be disabled. The CPU then effectively has only twenty address lines in real mode, just as the 8088 does, and addresses which would extend beyond the one megabyte mark wrap to the beginning of the address space. See also High Memory Area, Real Mode. ? ST(6) A12 A10 ? ST(7) A02 A00 ? All four banks can be selected by using the bankswitching instructions, but only bank 0, 1 and 2 make sense since bank 3 is an internal scratchpad. The separate banks can contain 8 floating point numbers and may be used with normal instructions. Each bank acts like an independent 287. Provided the status of the status word is saved inbetween and restored properly after a bankswitch each bank can be used simultaneously. Alternatively you could keep an eye on the TOP and STACKPOINTER indicators, making sure they are the same as before when initiating a bankswitch. By using FFREE, FFREEP and FINCSTP or FDECSTP instructions you may manually manipulate the stack. This feature of the IIT chips can be used to perform complex operations in registers with many components remaining the same for a large dataset, only saving intermediary results to one memory location, bankswitching to the next series of operands, loading that one operand and continuing the calculation with the next set of operands already in that bank. This does require another read into the new bank but may save time and memoryspace compared to memory based operands or multiple pass algorithms with multiple arrays of intermediary results. FENI / FDISI Enable /Disable Floating point interrupts ────────────────────────────────────────────────────────────────────────────── Mnemonic: FENI / FNENI / FDISI / FNDISI Opcode : 9B DB E0 / DB E0 / 9B DB E1 / DB E1 Bug in : Opcodes have no meaning on 287+ (are ignored there) Function: FENI Clears the interrupt enable mask in the FPU Control Word, effectively allowing the FPU to generate interrupts. FNENI does not issue a WAIT before doing this. These instruction only have a meaning on 87s. FDISI Sets the interrupt enable mask in the FPU Control Word, effectively denying the FPU to generate interrupts. FNDISI does not issue a WAIT before doing this. These instruction only have a meaning on 87s. All these instructions are effectively ignored on the 287+. They do not cause an invalid opcode exception. FPREM Calculate modulus of ST by ST(1), store in ST ────────────────────────────────────────────────────────────────────────────── Mnemonic: FPREM Opcode : D9 F8 Bug in : all 87 and 287 Function: FPREM calculates the modulus remainder of ST divided by ST(1) and stores the result into ST. The procedure can also be seen as a repeated subtraction of ST by ST(1). There are several interesting things about this instruction: The exponent magnitude difference should be no more than 63 or else the instruction cannot reduce the ST properly in one execution. This means you would have to execute the instruction several times to get a correct result for large magnitude differences. If this is the case, condition code bit C2 is set until the result in ST is ok. Storing the Status Word and checking C2 should be done if the condition could occur in your data set. In addition to that, if the instruction is done, the least-significant three bits of the quotient are stored in C3,C1 and C0. If arguments to the tangent function are reduced by PI/4 the codes represent one of the eight octants of a radius for which the tangent is to be calculated. FPREM does not operate according to the IEEE 754 standard, FPREM1 with opcode d9 f5 does, but is about 15-25 clocks slower than FPREM. The bug appears on the 87 and 287 when 64^a+b is performed with a>=1 and b==1 or 2. In that case the condition code bits represent an incorrect value. There is no FP workaround. Test to prevent the situation. Apparently this bug does not appear in the FPREM1 instruction. FPTAN Calculate tangent of ST ────────────────────────────────────────────────────────────────────────────── Mnemonic: FPTAN Opcode : D9 F2 Bug in : some 486 / 487, difference between pre-287xls and 287xl+ Function: FPTAN calculates the ratio between x and y in the following formula: x - = TAN(original ST) y The y result replaces the original argument in ST and x is then pushed onto the stack. On pre-287xl FPUs, the values for y and x may be anything, the ratio however is correct. On 287xl+ FPUs, x is always 1. ST(1) represents the fractional value itself there. To generate the same set of results on all FPUs, the FPTAN should be followed by FDIV and FLD1. Note that this reproduces the original results on the 287xl+. Note that ST(7) must be free or an invalid operation exception may occur because x is pushed onto the stack. The 486 bug occurs when a specific set of code is executed with a specific set of data. There is no way you can anticipate this and the workaround should always be implemented if code will run on a 486/487. The bug corrupts the FPU stack without signalling it to either FPU or CPU(Central Processing Unit) The microprocessor which executes programs on your computer.. Data corruption is usually the result. Workaround: FPTAN should always be followed by: FCLEX, FINIT, FLDCW, FSTSW, FSTSWAX, <FSAVE> or <FSTENV> or by a WAIT and a non-FPU instruction. Do note that some of these FPU instructions contain bugs themselves. FRSTOR Restore FPU state saved to memory by FSAVE ────────────────────────────────────────────────────────────────────────────── Mnemonic: FRSTOR Opcode : DB [mod:100:r/m] disp Bug in : some 387 Function: FRSTOR loads the FPU internal registers (including ST-registers) and the environment from the memory operand. See <FPU State image layout>. If either of the two last bytes of the image being read by FRSTOR cannot be read for whatever reason, the instruction cannot be restarted on some 387s. A workaround is to attempt to read those bytes before the FRSTOR is executed or to align the image on a 128 byte boundary so it is unlikely to fall outside a segment or page boundary. Should that be the case, the integer unit can cause an exception or make sure the page (in case of a swapped page) is read into memory before FRSTOR starts. FSAVE Save FPU state to memory ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSAVE / FNSAVE Opcode : (9B) DB [mod:110:r/m] disp Bug in : some 387, some 386 Function: FSAVE saves the FPU internal registers (including ST-registers) and the environment to the memory operand. See <FPU State image layout>. The FPU does not execute this instruction until all pending FPU operations have completed (decoded instructions have been processed). After completion, FSAVE initializes the FPU as if it had executed FINIT. Apparently on all FPUs, the contents of the data pointer field is undefined if the last FPU arithmetic instruction did not use a memory operand. On some 386s operating in Real or V86see Virtual-86 Mode mode, the opcode saved is incorrect. The linear address saved for the opcode's address however is correct and can be used to retrieve the opcode. No opcode is saved in Protected mode. If either of the two last bytes of the image being saved by FSAVE cannot be accessed for whatever reason, the instruction cannot be restarted on some 387s. A workaround is to attempt to write to those bytes before the FSAVE is executed or to align the image on a 128 byte boundary so it is unlikely to fall outside a segment or page boundary. Should that be the case, the integer unit can cause an exception or make sure the page (in case of a swapped page) is read into memory before FSAVE starts. FSETPM Make FPU use Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode. format in FSAVE and FSTENV ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSETPM Opcode : DB E4 Bug in : no bug, it only works on 287 and 287xl. ignored on 386+ Function: FSETPM tells the FPU to use the data format specified in the Protected Mode format of the <FSTENV> and <FSAVE> instructions. These instructions save different types of data depending on the current operating mode of the FPU. The instruction only has a meaning on the 287 and 287xl. FRSTPM Make FPU use Real-Mode format in FSAVE and FSTENV ────────────────────────────────────────────────────────────────────────────── Mnemonic: FRSTPM Opcode : DB F4 Bug in : no bug, it only works on 287 and 287xl. ignored on 386+ Function: FRSTPM tells the FPU to use the data format specified in the Real-Mode format of the <FSTENV> and <FSAVE> instructions. These instructions save different types of data depending on the current operating mode of the FPU. The instruction only has a meaning on the 287 and 287xl. FSCALE Adds the integer number in ST(1) to the exponent of ST ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSCALE Opcode : D9 FD Bug in : some 486 Function: FSCALE multiplies the value in ST by a power of two, given in ST(1). Pre-387s assume the value in ST(1) to be an integer in the range -2^15 <= , < +2^15. 387+ do not assume anything about the value. The value in ST(1) is always chopped to the nearest integer closest to zero. There is a bug in some 486s which allows denormal or pseudo-denormals to be returned as a result, apparently without issuing an Invalid Operation exception. For this to happen, ST(1) must be within the range -1 < ST(1) < 1 and ST must be a pseudo-denormal or denormal while underflow exceptions must not be masked. When it occurs, the value from ST is returned as the result. There is no workaround other than to avoid the situation. Leaving underflow exceptions masked may prevent this bug from showing up. FSINCOS Calculate both Sine and Cosine of ST ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSINCOS Opcode : DB FB Bug in : some 486, invalid on pre-287xl and IIT Function: FSINCOS calculates both Sine and Cosine of an argument in ST. The first result, sine, is stored into the original ST, destroying the source value. The second result, cosine, is then pushed onto the stack. Note that ST(7) must be free or an invalid operation exception may occur because the cosine is pushed onto the stack. The 486 bug occurs when a specific set of code is executed with a specific set of data. There is no way you can anticipate this and the workaround should always be implemented if code will run on a 486/487. The bug corrupts the FPU stack without signalling it to either FPU or CPU(Central Processing Unit) The microprocessor which executes programs on your computer.. Data corruption is usually the result. Workaround: FSINCOS should always be followed by: FCLEX, FINIT, FLDCW, FSTSW, FSTSWAX, <FSAVE> or <FSTENV> or by a WAIT and a non-FPU instruction. Do note that some of these FPU instructions contain bugs themselves. FSTENV Store Floating point Environment ────────────────────────────────────────────────────────────────────────────── Mnemonic: FSTENV Opcode : (9B) D9 [mod:110:r/m] disp Bug in : some 386 Function: FSTENV saves the FPU environment to the memory operand. See <FPU environment image layout>. This environment does not include the FPU stack, but does include Control Word, Status Word, Tag Word and exception pointers. The FPU does not execute this instruction until all pending FPU operations have completed (decoded instructions have been processed). After completion, FSTENV initializes the FPU as if it had executed FINIT. Apparently on all FPUs, the contents of the data pointer field is undefined if the last FPU arithmetic instruction did not use a memory operand. On some 386s operating in Real or V86see Virtual-86 Mode mode, the opcode saved is incorrect. The linear address saved for the opcode's address however is correct and can be used to retrieve the opcode. No opcode is saved in Protected mode. If either of the two last bytes of the image being saved by FSTENV cannot be accessed for whatever reason, the instruction cannot be restarted on some 387s. A workaround is to attempt to write to those bytes before the FSTENV is executed or to align the image on a 128 byte boundary so it is unlikely to fall outside a segment or page boundary. Should that be the case, the integer unit can cause an exception or make sure the page (in case of a swapped page) is read into memory before FSTENV starts. Layout of environment & state stored by FSTENV and FSAVE ────────────────────────────────────────────────────────────────────────────── The environment area saved by <FSTENV> and loaded by <FLDENV> depends on the current operating mode of the FPU. Apart from the mode, the current default addressing mode within the operating mode is also important. The state information saved by <FSAVE> and loaded by <FRSTOR> consists of the environment mentioned above but also has the eight FPU stack registers appended to it in temporary real format starting with the current ST register. Note that which register represents ST depends on the values in the Control Word. There are four states in which the 387+ FPU can operate 16-bit real or V86see Virtual-86 Mode mode (like in DOS) 16-bit Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode. (16-bit code segment) 32-bit real or V86see Virtual-86 Mode mode (using 66h and 67h prefixes) 32-bit Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode. (32-bit code segment) 16-bit real or V86see Virtual-86 Mode mode: 15 12 8 4 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┐ │d│d│d│d│0│0│0│0│0│0│0│0│0│0│0│0│ d = Data pointer bits 16 - 19 ├─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┤ │ Data pointer bits 0-15 │ ├─┬─┬─┬─┬─┬─┬─┬─┬─┬─┬─┬─┬─┬─┬─┬─┤ bit 11 is zero, not a typo. │i│i│i│i│0│o│o│o│o│o│o│o│o│o│o│o│ i = Instruction pointer bits 16 - 19 ├─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┤ o = Opcode highest 11 bits │ Instruction pointer bits 0-15 │ ├───────────────────────────────┤ │ Tag Word (16 bit) │ ├───────────────────────────────┤ │ Status Word (16 bit) │ ├───────────────────────────────┤ │ Control Word (16 bit) │ Low memory └───────────────────────────────┘ 16-bit Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode.: 15 12 8 4 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┐ │ Data selector │ ├───────────────────────────────┤ │ Data offset │ ├───────────────────────────────┤ │ Instruction selector │ ├───────────────────────────────┤ │ Instruction offset │ ├───────────────────────────────┤ │ Tag Word (16 bit) │ ├───────────────────────────────┤ │ Status Word (16 bit) │ ├───────────────────────────────┤ │ Control Word (16 bit) │ Low memory └───────────────────────────────┘ 32-bit Real ModeOne of the operating modes of the 80286 and higher Intel processors, and the only operating mode of the 8088, 8086, 80186, and 80188 processors. In this mode, all addresses used by programs correspond directly to real physical addresses (thus the full name, Real Address Mode) and there are no CPU-imposed protections between programs. See also Protected Mode, Virtual-86 Mode.: 31 28 24 20 15 12 8 4 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┬┴┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┐ │0│0│0│0│ Data pointer bits 16-31 │0│0│0│0│0│0│0│0│0│0│0│0│ ├─┴─┴─┴─┼───────────────────────┼───────┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┴─┤ │- - - - - - - - - - - - - - - -│ Data pointer bits 0-15 │ ├─┬─┬─┬─┼───────────────────────┼───────┼─┼─────────────────────┤ │0│0│0│0│ Instruction pointer bits 16-31│0│ Opcode top 11 bits │ ├─┴─┴─┴─┴───────────────────────┼───────┴─┴─────────────────────┤ │- - - - - - - - - - - - - - - -│ Instruction pointer 0-15 │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Tag Word (16 bit) │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Status Word (16 bit) │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Control Word (16 bit) │ └───────────────────────────────┴───────────────────────────────┘ Low memory 32-bit Protected ModeOne of the operating modes of the 80286 and higher Intel processors, in which addresses used by programs no longer correspond to physical addresses and the CPU enforces various protection mechanisms designed to prevent one program from disrupting other programs or the operating system. See also Real Mode, Virtual-86 Mode.: 31 28 24 20 15 12 8 4 0 ┌─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┬┴┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬─┼─┬─┬─┬┴┐ │- - - - - - - - - - - - - - - -│ Data selector │ ├───────────────────────────────┼───────────────────────────────┤ │ Data offset (32-bit) │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Instruction selector │ ├───────────────────────────────┼───────────────────────────────┤ │ Instruction offset (32-bit) │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Tag Word (16 bit) │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Status Word (16 bit) │ ├───────────────────────────────┼───────────────────────────────┤ │- - - - - - - - - - - - - - - -│ Control Word (16 bit) │ └───────────────────────────────┴───────────────────────────────┘ Low memory - = Don't care.