1380 lines
32 KiB
Plaintext
1380 lines
32 KiB
Plaintext
[File provided by Alex V. Potemkin <avk@netserv2.free.net>]
|
|
Last Change 10/23/94
|
|
|
|
------------------------------------------------------------
|
|
This is DOC about undocumented instructions and documented
|
|
instructions of any last processors
|
|
------------------------------------------------------------
|
|
(C) (P) Potemkin's Hackers Group 1994
|
|
------------------------------------------------------------
|
|
Revision 1. 1 September 1994
|
|
------------------------------------------------------------
|
|
|
|
|
|
--------------------------------------------------
|
|
BSWAP - Bytes Swap
|
|
---------------------------------------------------
|
|
|
|
CPU: I486 +
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: BSWAP dwordr
|
|
|
|
Description:
|
|
|
|
XCHG BYTE dwordr[31:24], dwordr[7:0]
|
|
XCHG BYTE dwordr[23:16], dwordr[15:8]
|
|
|
|
; Need Good Picture to Show It
|
|
|
|
Notes: This instruction used for converting big-endian
|
|
(Intel) format to little-endian (Motorolla etc.) format.
|
|
|
|
|
|
Flags Affected: None
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
Physical Form: BSWAP r32
|
|
COP (Code of Operation): 0FH 11001rrr
|
|
Clocks: Cyrix Cx486SLC : 4
|
|
i486 : 1
|
|
Pentium : 1
|
|
|
|
|
|
---------------------------------------------------
|
|
CMPXCHG8B - Compare and exchange 8 bytes
|
|
---------------------------------------------------
|
|
|
|
CPU: Pentium (tm)
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: CMPXCHG8B dest
|
|
|
|
Note: dest is memory operand: QWORD PTR [memory]
|
|
|
|
Description:
|
|
|
|
IF (QWORD (EDX:EAX) = dest) THEN
|
|
{
|
|
ZF <- 1;
|
|
dest <- QWORD (ECX:EBX);
|
|
}
|
|
ELSE
|
|
{
|
|
ZF <- 0;
|
|
EDX:EAX <- dest
|
|
}
|
|
END
|
|
|
|
Flags Affected: ZF
|
|
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
Physical Form: CMPXCHG8B mem64
|
|
COP (Code of Operation) : 0FH C7H Postbyte
|
|
Clocks: Pentium : 10
|
|
|
|
Note: Postbyte MMRRRMMM: MM<>11 if (==) then INT 6
|
|
|
|
|
|
---------------------------------------------------
|
|
CMPXCHG - Compare and exchange
|
|
---------------------------------------------------
|
|
|
|
CPU: i486+
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: CMPXCHG dest, src
|
|
|
|
|
|
Description:
|
|
|
|
Acc = if OperationSize (8) -> AL
|
|
OperationSize (16) -> AX
|
|
OperationSize (32) -> EAX
|
|
|
|
IF (Acc = dest) THEN
|
|
{
|
|
ZF <- 1;
|
|
dest <- sorc;
|
|
}
|
|
ELSE
|
|
{
|
|
ZF <- 0;
|
|
Acc <- dest;
|
|
}
|
|
END
|
|
|
|
Note: This instruction used to support semaphores
|
|
|
|
|
|
Flags Affected: ZF (see description)
|
|
OF, SF, AF, PF, CF (like CMP instruction) (see description)
|
|
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
+++++++++++++++++++++++
|
|
Physical Form: CMPXCHG r/m8, r8
|
|
COP (Code of Operation) : 0FH A6H Postbyte ; i486 (A-B0 step)
|
|
: 0FH B0H Postbyte ; i486 (B1+ step clones
|
|
; and upgrades)
|
|
|
|
Clocks:
|
|
Intel i486 : 6/7 if compare OK
|
|
: 6/10 if compare FAIL
|
|
Cyrix Cx486SLC : 5/7
|
|
Pentium (tm) : 6
|
|
|
|
Penalty if cache miss :
|
|
Intel i486 : 2
|
|
Cyrix Cx486SLC : 1
|
|
+++++++++++++++++++++
|
|
Physical Form: CMPXCHG r/m16, r16
|
|
CMPXCHG r/m32, r32
|
|
COP (Code of Operation) : 0FH A7H Postbyte ; i486 (A-B0 step)
|
|
: 0FH B1H Postbyte ; i486 (B1+ step clones
|
|
; and upgrades)
|
|
|
|
Clocks:
|
|
Intel i486 : 6/7 if compare OK
|
|
: 6/10 if compare FAIL
|
|
Cyrix Cx486SLC : 5/7
|
|
Pentium (tm) : 6
|
|
|
|
Penalty if cache miss :
|
|
Intel i486 : 2
|
|
Cyrix Cx486SLC : 1
|
|
|
|
|
|
|
|
---------------------------------------------------
|
|
CPUID - CPU Identification
|
|
---------------------------------------------------
|
|
|
|
CPU: Intel 486DX/SX/DX2 SL Enhanced and all later
|
|
Intel processors include (IntelDX4, IntelSX2,
|
|
Pentium etc.)
|
|
|
|
Note: i.e. 1993+ years processors produced by Intel
|
|
Note: To know if your CPU support CPUID instruction
|
|
try to set ID flag (bit 21 of EFLAGS) to 1, and
|
|
if it sets this mean that CPUID support.
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: CPUID
|
|
|
|
Description:
|
|
|
|
IF (EAX=0) THEN
|
|
{
|
|
EAX <- Maximum value of EAX to CALL CPUID instruction
|
|
1 for all processors (date 1 September 1994)
|
|
may be >1 in future microprocessors
|
|
EBX <- 756E6547H i.e. 'Genu'
|
|
EDX <- 49656E69H i.e. 'ineI'
|
|
ECX <- 6C65746EH i.e. 'ntel'
|
|
;; EBX, EDX and ECX contain a OEM name string
|
|
;; for Intel this string is 'GenuineIntel'
|
|
}
|
|
ELSEIF (EAX=1) THEN
|
|
{
|
|
EAX[3:0] <- Stepping ID
|
|
EAX[7:4] <- Model
|
|
EAX[11:8] <- Family
|
|
; 4 - i486 family
|
|
; 5 - Pentium family
|
|
EAX[15:12] <- Reserved
|
|
; set to 0 now
|
|
; but I'm sure that for Pentium OverDrive for P54C
|
|
;this field will be set to 1
|
|
EAX[31:16] <- Reserved and set to 0s now
|
|
|
|
EDX <- Compability flags
|
|
;; below all info if bit flag =1
|
|
EDX[0] <- FPU on Chip
|
|
EDX[1] <- Virtual Mode Extention present
|
|
EDX[2] ??
|
|
EDX[3] ??
|
|
EDX[4] ?? somethere here TSC support
|
|
EDX[5] ??
|
|
EDX[6] ??
|
|
EDX[7] <- Machine Check exception present
|
|
EDX[8] <- CMPXCHG8B instruction present
|
|
EDX[9] <- APIC on Chip
|
|
EDX[31:10] <- Reserved and set to 0s now
|
|
}
|
|
ELSEIF (EAX > 1) THEN
|
|
{
|
|
EAX, EBX, ECX, EDX <- Undefined
|
|
}
|
|
END.
|
|
|
|
|
|
|
|
|
|
Global Note:
|
|
This file contain open i.e nonconfiderential information about
|
|
CPUID information.
|
|
If you want MORE try to contact Intel, may be (but I'm sure that not)
|
|
Intelers give you "Yellow Pages" (i.e Supplement to Pentium (tm)
|
|
Processor User's Manual) to read inside office if you not a
|
|
designer of compiler or operation system.
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
Physical Form: CPUID
|
|
COP (Code of Operation): 0FH A2H
|
|
Clocks: 486s & Pentium (EAX=1) : 14
|
|
486s & Pentium (EAX=0 or EAX>1) : 9
|
|
|
|
|
|
---------------------------------------------------
|
|
F4X4 - FPU: Multiplicate vector on Matrix 4x4
|
|
---------------------------------------------------
|
|
|
|
FPU: IIT FPUs.
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: F4X4
|
|
|
|
Description:
|
|
|
|
; This Instruction Multiplicate vector on
|
|
; Matrix 4X4
|
|
|
|
_ _ _ _ _ _
|
|
| | | | | |
|
|
| Xn | | A00 A01 A02 A03 | | X0 |
|
|
| Yn | = | A10 A11 A12 A13 | X | Y0 |
|
|
| Zn | | A20 A21 A22 A23 | | Z0 |
|
|
| Wn | | A30 A31 A31 A33 | | W0 |
|
|
|_ _| |_ _| |_ _|
|
|
|
|
|
|
; Data fetches/stores from/to FPU registers:
|
|
|
|
# of F E T C H E S STORE
|
|
Register Bank0 Bank1 Bank2 Bank0
|
|
ST X0 A33 A31 Xn
|
|
ST (1) Y0 A23 A21 Yn
|
|
ST (2) Z0 A13 A11 Zn
|
|
ST (3) W0 A03 A01 Wn
|
|
ST (4) A32 A30
|
|
ST (5) A22 A20
|
|
ST (6) A12 A10
|
|
ST (7) A02 A00
|
|
|
|
|
|
|
|
Note: See FSBP0, FSBP1, FSBP2 for more information
|
|
|
|
|
|
FPU Flags Affected: S
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: F4X4
|
|
COP (Code of Operation): DBH F1H
|
|
Clocks: IIT 2c87 : 242
|
|
IIT 3c87 : 242
|
|
IIT 3c87SX : 242
|
|
|
|
|
|
---------------------------------------------------
|
|
FNSTDW - FPU Not wait Store Device Word register
|
|
---------------------------------------------------
|
|
|
|
FPU: i387SL Mobile
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FNSTDW dest
|
|
|
|
Description:
|
|
|
|
dest <- Device Word
|
|
|
|
Format of Device word:
|
|
bit (s) Description
|
|
0-7 Reserved
|
|
8 S - Status bit:
|
|
if S=1 then FP device is a static design and OS
|
|
or APM Bios may set CLK slow to 0 Mhz without
|
|
lost any data.
|
|
9-15 Reserved
|
|
|
|
|
|
Note: Device word register valid only after FNINIT
|
|
|
|
|
|
FPU Flags Affected: None
|
|
|
|
CPU mode: Any
|
|
|
|
Physical Form: FNSTDW AX
|
|
COP (Code of Operation): DFH E1H
|
|
Clocks: i387SL Mobile: 13
|
|
|
|
|
|
---------------------------------------------------
|
|
FNSTSG - FPU Not wait Store Signature Word register
|
|
---------------------------------------------------
|
|
|
|
FPU: i387SL Mobile
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FNSTSG dest
|
|
|
|
Description:
|
|
|
|
dest <- Signature Word
|
|
|
|
Format of Signature word:
|
|
bit (s) Description
|
|
3-0 Revision
|
|
7-4 Steppin
|
|
11-8 Family
|
|
15-12 Version
|
|
|
|
Note:
|
|
For i387 (tm) SL Mobile Signature is:
|
|
Version = 2
|
|
Family = 3 ; 387
|
|
Stepping = 1 ; Ax step
|
|
Revision = 0 ; x0 step
|
|
i.e i387 (tm) SL is A0 step
|
|
|
|
Note: This FPU is out of life
|
|
|
|
|
|
Note: Signature word register valid only after FNINIT
|
|
|
|
|
|
FPU Flags Affected: None
|
|
|
|
CPU mode: Any
|
|
|
|
Physical Form: FNSTSG AX
|
|
COP (Code of Operation): DFH E2H
|
|
Clocks: i387SL Mobile: 13
|
|
|
|
---------------------------------------------------
|
|
FRICHOP - FPU: Round to Integer chop method
|
|
---------------------------------------------------
|
|
|
|
FPU: Cyrix FPUs and 486s with FPU on chip
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FRICHOP
|
|
|
|
Description:
|
|
|
|
ST <- ROUND (ST, CHOP)
|
|
|
|
Note:
|
|
This instruction calculate rounding ST toward zero
|
|
i.e. ignoring part righter that decimal .
|
|
|
|
Examples:
|
|
|
|
1.2 -> 1.0
|
|
-1.2 -> -1.0
|
|
3.0 -> 3.0
|
|
0.0 -> 0.0
|
|
1.5 -> 1.0
|
|
-2.0 -> -2.0
|
|
|
|
|
|
FPU Flags Affected: S, P, D, I, C1
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: FRICHOP
|
|
COP (Code of Operation): DDH FCH
|
|
Clocks: Cx83D87 : 15
|
|
Cx83S87 : 15
|
|
CxEMC87 : 15
|
|
Cx487DLC :
|
|
|
|
|
|
---------------------------------------------------
|
|
FRINEAR - FPU: Round to Integer Nearest method
|
|
---------------------------------------------------
|
|
|
|
FPU: Cyrix FPUs and 486s with FPU on chip
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FRINEAR
|
|
|
|
Description:
|
|
|
|
ST <- ROUND (ST, NEAREST)
|
|
|
|
Note:
|
|
This instruction calculate rounding ST toward nearest
|
|
|
|
Examples:
|
|
|
|
1.2 -> 1.0
|
|
-1.2 -> -1.0
|
|
3.0 -> 3.0
|
|
0.0 -> 0.0
|
|
1.5 -> 1.0
|
|
1.8 -> 2.0
|
|
-2.0 -> -2.0
|
|
|
|
|
|
FPU Flags Affected: S, P, D, I, C1
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: FRINEAR
|
|
COP (Code of Operation): DFH FCH
|
|
Clocks: Cx83D87 : 15
|
|
Cx83S87 : 15
|
|
CxEMC87 : 15
|
|
Cx487DLC :
|
|
|
|
|
|
---------------------------------------------------
|
|
FRINT2 - FPU: Round to Integer
|
|
---------------------------------------------------
|
|
|
|
FPU: Cyrix FPUs and 486s with FPU on chip
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FRINT2
|
|
|
|
Description:
|
|
|
|
IF (exact half) THEN
|
|
{
|
|
ST <- SIGN (ST) * ROUND (ABS (ST)+0.5, NEAREST)
|
|
}
|
|
ELSE
|
|
{
|
|
ST <- ROUND (ST, NEAREST)
|
|
}
|
|
END
|
|
|
|
Note:
|
|
This instruction calculate rounding ST toward nearest,
|
|
but if number is exact half then this instruction round
|
|
it toward signed infinity. Sign of this infinity is same
|
|
with sign of number.
|
|
|
|
Examples:
|
|
|
|
1.2 -> 1.0
|
|
-1.2 -> -1.0
|
|
3.0 -> 3.0
|
|
0.0 -> 0.0
|
|
1.5 -> 2.0
|
|
1.8 -> 2.0
|
|
-2.0 -> -2.0
|
|
-1.5 -> -2.0
|
|
|
|
FPU Flags Affected: S, P, D, I, C1
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: FRINT2
|
|
COP (Code of Operation): DBH FCH
|
|
Clocks: Cx83D87 : 15
|
|
Cx83S87 : 15
|
|
CxEMC87 : 15
|
|
Cx487DLC :
|
|
|
|
|
|
---------------------------------------------------
|
|
FRSTPM - FPU Reset Protected Mode
|
|
---------------------------------------------------
|
|
|
|
FPU: i287XL i287XLT
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FRSTPM
|
|
|
|
Description:
|
|
|
|
Reset Cooprocessor from Protected Mode
|
|
to Real Address mode.
|
|
|
|
FPU Flags Affected: None
|
|
|
|
CPU mode:Any ???
|
|
|
|
Physical Form: FRSTPM
|
|
COP (Code of Operation): DBH E5H
|
|
Clocks: i287XL : 12
|
|
i287XLT : 12
|
|
|
|
---------------------------------------------------
|
|
FSBP0 - FPU: Set Bank pointer to Bank # 0
|
|
---------------------------------------------------
|
|
|
|
FPU: IIT FPUs.
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FSBP0
|
|
|
|
Description:
|
|
|
|
; This Instruction set current bank pointer to
|
|
; Bank # 0.
|
|
|
|
; Each bank contain eight 80bit registers
|
|
; There are 3 banks (0, 1, 2) in Chip
|
|
|
|
; After initialization FPU select bank # 0.
|
|
|
|
|
|
FPU Flags Affected: None
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: FSBP0
|
|
COP (Code of Operation): DBH E8H
|
|
Clocks: IIT 2c87 : 6
|
|
IIT 3c87 : 6
|
|
IIT 3c87SX : 6
|
|
|
|
|
|
---------------------------------------------------
|
|
FSBP1 - FPU: Set Bank pointer to Bank # 1
|
|
---------------------------------------------------
|
|
|
|
FPU: IIT FPUs.
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FSBP1
|
|
|
|
Description:
|
|
|
|
; This Instruction set current bank pointer to
|
|
; Bank # 1.
|
|
|
|
; Each bank contain eight 80bit registers
|
|
; There are 3 banks (0, 1, 2) in Chip
|
|
|
|
; After initialization FPU select bank # 0.
|
|
|
|
|
|
FPU Flags Affected: None
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: FSBP1
|
|
COP (Code of Operation): DBH EBH
|
|
Clocks: IIT 2c87 : 6
|
|
IIT 3c87 : 6
|
|
IIT 3c87SX : 6
|
|
|
|
|
|
---------------------------------------------------
|
|
FSBP2 - FPU: Set Bank pointer to Bank # 2
|
|
---------------------------------------------------
|
|
|
|
FPU: IIT FPUs.
|
|
|
|
Type of Instruction: FPU instruction
|
|
|
|
Instruction: FSBP2
|
|
|
|
Description:
|
|
|
|
; This Instruction set current bank pointer to
|
|
; Bank # 2.
|
|
|
|
; Each bank contain eight 80bit registers
|
|
; There are 3 banks (0, 1, 2) in Chip
|
|
|
|
; After initialization FPU select bank # 0.
|
|
|
|
|
|
FPU Flags Affected: None
|
|
|
|
FPU mode: Any
|
|
|
|
Physical Form: FSBP2
|
|
COP (Code of Operation): DBH EAH
|
|
Clocks: IIT 2c87 : 6
|
|
IIT 3c87 : 6
|
|
IIT 3c87SX : 6
|
|
|
|
|
|
---------------------------------------------------
|
|
INVD - Invalidate Cache Buffer
|
|
---------------------------------------------------
|
|
|
|
CPU: I486 +
|
|
|
|
Type of Instruction: System
|
|
|
|
Instruction: INVD
|
|
|
|
Description:
|
|
|
|
FLUSH INTERNAL CACHE
|
|
(It means that all lines of internal caches sets as
|
|
invalid)
|
|
SIGNAL EXTERNAL CACHE TO FLUSH
|
|
|
|
|
|
Notes: This instruction not work in Real Mode and in
|
|
Protected mode work only in ring 0 ;
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: PM0, SMM?
|
|
|
|
Physical Form: INVD
|
|
COP (Code of Operation): 0FH 08H
|
|
Clocks: Cyrix Cx486SLC : 4
|
|
i486 : 4
|
|
Pentium : 15
|
|
|
|
|
|
---------------------------------------------------
|
|
INVLPG - Invalidate Page Entry In TLB
|
|
---------------------------------------------------
|
|
|
|
CPU: I486 +
|
|
|
|
Type of Instruction: System
|
|
|
|
Instruction: INVLPG mem
|
|
|
|
Description:
|
|
|
|
IF found in data or code (if both) (or common if single)
|
|
TLB entry with linear address (page part) same as
|
|
memory operand <mem> then mark this entry as Invalid;
|
|
|
|
Notes: This instruction not work in Real Mode and in
|
|
Protected mode work only in ring 0 ;
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
Physical Form: INVLPG mem
|
|
COP (Code of Operation): 0FH 01H mm111mmm
|
|
Clocks: Cyrix Cx486SLC : 4
|
|
i486 : 12 if hit
|
|
: 11 if not hit
|
|
Pentium : 25
|
|
|
|
|
|
---------------------------------------------------
|
|
LOADALL - Load All Registers
|
|
---------------------------------------------------
|
|
|
|
CPU: Intel 386+ +all clones
|
|
|
|
|
|
Type of Instruction: System Operation
|
|
(Work only then CPL=0)
|
|
|
|
Instruction: LOADALL
|
|
|
|
Description:
|
|
Load All Registers (Include Shadow Registers) from Table
|
|
Which Begin on place pointed ES:EDI
|
|
|
|
Format of LOADALL Table:
|
|
|
|
Offset Len Description
|
|
0H 4 CR0
|
|
4H 4 EFLAGS
|
|
8H 4 EIP
|
|
CH 4 EDI
|
|
10H 4 ESI
|
|
14H 4 EBP
|
|
18H 4 ESP
|
|
1CH 4 EBX
|
|
20H 4 EDX
|
|
24H 4 ESX
|
|
28H 4 EAX
|
|
2CH 4 DR6
|
|
30H 4 DR7
|
|
34H 4 TR (16 bit, zero filled up)
|
|
38H 4 LDT ---------
|
|
3CH 4 GS ---------
|
|
40H 4 FS ---------
|
|
44H 4 DS ---------
|
|
48H 4 SS ---------
|
|
4CH 4 CS ---------
|
|
50H 4 ES ---------
|
|
54H 4 TSS.attrib
|
|
58H 4 TSS.base
|
|
5CH 4 TSS.limit
|
|
60H 4 0s
|
|
64H 4 IDT.base
|
|
68H 4 IDT.limit
|
|
6CH 4 0s
|
|
70H 4 GDT.base
|
|
74H 4 GDT.limit
|
|
78H 4 LDT.attrib
|
|
7CH 4 LDT.base
|
|
80H 4 LDT.limit
|
|
84H 4 GS.attrib
|
|
88H 4 GS.base
|
|
8CH 4 GS.limit
|
|
90H 4 FS.attrib
|
|
94H 4 FS.base
|
|
98H 4 FS.limit
|
|
9CH 4 DS.attrib
|
|
A0H 4 DS.base
|
|
A4H 4 DS.limit
|
|
A8H 4 SS.attrib
|
|
ACH 4 SS.base
|
|
B0H 4 SS.limit
|
|
B4H 4 CS.attrib
|
|
B8H 4 CS.base
|
|
BCH 4 CS.limit
|
|
C0H 4 ES.attrib
|
|
C4H 4 ES.base
|
|
C8H 4 ES.limit
|
|
|
|
Format of Attrib field:
|
|
|
|
Byte Description
|
|
0 0s
|
|
1 AR (Access Right) byte in the Descriptor format
|
|
Note:
|
|
P bit is a valid bit
|
|
if valid bit=0 then Shadow Register is invalid and
|
|
INT 0DH - General Protection Fault call
|
|
DPL of SS, CS det. CPL
|
|
2-3 0s
|
|
|
|
|
|
Flags Affected: All (FLAGS Register Reload)
|
|
|
|
CPU mode: RM, PM0
|
|
|
|
Physical Form: LOADALL
|
|
COP (Code of Operation): 0FH 07H
|
|
Clocks: i386XX : n/a
|
|
i486XX : n/a
|
|
|
|
Note: This operation used 102 data transfer cycles on 32bit bus
|
|
Typical clocks:
|
|
i386SX: ~350
|
|
i386DX: ~290
|
|
i486XX: ~220
|
|
|
|
|
|
---------------------------------------------------
|
|
LOADALL - Load All Registers From Table
|
|
---------------------------------------------------
|
|
|
|
CPU: Intel 80286 and all its clones
|
|
|
|
|
|
Type of Instruction: System Operation
|
|
(Work only then CPL=0)
|
|
|
|
Instruction: LOADALL
|
|
|
|
Description:
|
|
Load All Registers (Include Shadow Registers) from Table
|
|
Which Begin on 000800H Address, Len of this table is
|
|
66H
|
|
|
|
Format of LOADALL Table:
|
|
|
|
Address Len Description
|
|
800H 6 None
|
|
806H 2 MSW
|
|
808H 14 None
|
|
816H 2 TR
|
|
818H 2 FLAGS
|
|
81AH 2 IP
|
|
81CH 2 LDTR
|
|
81EH 2 DS
|
|
820H 2 SS
|
|
822H 2 CS
|
|
824H 2 ES
|
|
826H 2 DI
|
|
828H 2 SI
|
|
82AH 2 BP
|
|
82CH 2 SP
|
|
82EH 2 BX
|
|
830H 2 DX
|
|
832H 2 CX
|
|
834H 2 AX
|
|
836H 6 ES Shadow Descriptor
|
|
83CH 6 CS Shadow Descriptor
|
|
842H 6 SS Shadow Descriptor
|
|
848H 6 DS Shadow Descriptor
|
|
84EH 6 GDTR
|
|
854H 6 LDT Shadow Descriptor
|
|
85AH 6 IDTR
|
|
860H 6 TSS Shadow Descriptor
|
|
|
|
Format of Shadow Descriptor:
|
|
|
|
Byte Description
|
|
0-2 24bit Phisical Address
|
|
3 AR (Access Right) byte
|
|
4-5 16bit Segment Limit
|
|
|
|
|
|
Format of GDTR and IDTR:
|
|
|
|
Byte Description
|
|
0-2 24bit Phisical Address
|
|
3 0s
|
|
4-5 16bit Segment Limit
|
|
|
|
|
|
Flags Affected: All (FLAGS Register Reload)
|
|
|
|
CPU mode: RM, PM0
|
|
|
|
Physical Form: LOADALL
|
|
COP (Code of Operation): 0FH 05H
|
|
Clocks: 80286 : 195
|
|
|
|
---------------------------------------------------
|
|
RDMSR - Read From Model Specified Register
|
|
---------------------------------------------------
|
|
|
|
CPU: Pentium (tm)
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: RDMSR
|
|
|
|
Description:
|
|
|
|
IF (ECX is valid number of MSR) and (CPL=0) THEN
|
|
{
|
|
EDX:EAX <- MSR [ECX];
|
|
}
|
|
ELSE
|
|
{
|
|
General Protection Fault INT 0DH (0)
|
|
}
|
|
END
|
|
|
|
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM, PM0, SMM
|
|
|
|
Physical Form: RDMSR
|
|
COP (Code of Operation): 0FH 32H
|
|
Clocks: Pentium : 20-24
|
|
|
|
|
|
---------------------------------------------------
|
|
RDTSC - Read From Time Stamp Counter
|
|
---------------------------------------------------
|
|
|
|
CPU: Pentium (tm)
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: RDTSC
|
|
|
|
Description:
|
|
|
|
IF (CR4.TSD=0) or ( (CR4.TSD=1) and (CPL=0)) THEN
|
|
{
|
|
EDX:EAX <- TSC;
|
|
}
|
|
ELSE
|
|
{
|
|
General Protection Fault INT 0DH (0)
|
|
}
|
|
END
|
|
|
|
|
|
|
|
Note: TSC is one of MSR and after global hardware reset (not SRESET , but
|
|
RESET) it clear to 0000000000000000H.
|
|
(But what about frequency ???)
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM, PM0, SMM
|
|
; PM, VM if enable
|
|
|
|
Physical Form: RDTSC
|
|
COP (Code of Operation): 0FH 31H
|
|
Clocks: Pentium : n/a [20-24]
|
|
|
|
|
|
---------------------------------------------------
|
|
REPC - Repeat While Carry Flag
|
|
---------------------------------------------------
|
|
|
|
CPU: NEC V20, NEC V30, etc [ Vxx seria ]
|
|
Sony V20, Sony V30
|
|
|
|
Type of Instruction: Prefix
|
|
|
|
Instruction: REPC
|
|
|
|
Description:
|
|
|
|
DO
|
|
CX=CX-1;
|
|
SERVICE_PENDING_INTERRUPT;
|
|
STRING_INSTRUCTION;
|
|
LOOPWHILE ( (CX<>0) AND (CF==1));
|
|
|
|
|
|
Flags Affected: None
|
|
|
|
CPU Mode: RM 8086
|
|
|
|
Physical Form: REPC
|
|
COP (Code of Operation): 65H
|
|
Clocks: NEC V20 : 2
|
|
NEC V30 : 2
|
|
|
|
---------------------------------------------------
|
|
REPNC - Repeat While Not Carry Flag
|
|
---------------------------------------------------
|
|
|
|
CPU: NEC V20, NEC V30, etc [ Vxx seria ]
|
|
Sony V20, Sony V30
|
|
|
|
Type of Instruction: Prefix
|
|
|
|
Instruction: REPNC
|
|
|
|
Description:
|
|
|
|
DO
|
|
CX=CX-1;
|
|
SERVICE_PENDING_INTERRUPT;
|
|
STRING_INSTRUCTION;
|
|
LOOPWHILE ( (CX<>0) AND (CF<>1));
|
|
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM 8086
|
|
|
|
Physical Form: REPNC
|
|
COP (Code of Operation): 64H
|
|
Clocks: NEC V20 : 2
|
|
NEC V30 : 2
|
|
|
|
---------------------------------------------------
|
|
RES3 - Restore All CPU Registers
|
|
---------------------------------------------------
|
|
|
|
CPU: AMD Am386SXLV, Am386DXLV
|
|
also all AMD's 486 which support SMM
|
|
|
|
|
|
Type of Instruction: System Operation
|
|
(Work only then CPL=0)
|
|
|
|
Instruction: RES3
|
|
|
|
Description:
|
|
Load All Registers (Include Shadow Registers) from Table
|
|
Which Begin on place pointed ES:EDI
|
|
|
|
Note:
|
|
This instruction is AMD analog Intel's LOADALL instruction
|
|
but it's more i.c. return from SMM used this instruction.
|
|
|
|
Then in SMM table is in SMRAM, then non SMM then table is
|
|
in main memory.
|
|
|
|
Format of RES3 Table:
|
|
|
|
Offset Len Description
|
|
0H 4 CR0
|
|
4H 4 EFLAGS
|
|
8H 4 EIP
|
|
CH 4 EDI
|
|
10H 4 ESI
|
|
14H 4 EBP
|
|
18H 4 ESP
|
|
1CH 4 EBX
|
|
20H 4 EDX
|
|
24H 4 ESX
|
|
28H 4 EAX
|
|
2CH 4 DR6
|
|
30H 4 DR7
|
|
34H 4 TR (16 bit, zero filled up)
|
|
38H 4 LDT ---------
|
|
3CH 4 GS ---------
|
|
40H 4 FS ---------
|
|
44H 4 DS ---------
|
|
48H 4 SS ---------
|
|
4CH 4 CS ---------
|
|
50H 4 ES ---------
|
|
54H 4 TSS.attrib
|
|
58H 4 TSS.base
|
|
5CH 4 TSS.limit
|
|
60H 4 Reserved
|
|
64H 4 IDT.base
|
|
68H 4 IDT.limit
|
|
6CH 4 REP OUTS overrun flag
|
|
70H 4 GDT.base
|
|
74H 4 GDT.limit
|
|
78H 4 LDT.attrib
|
|
7CH 4 LDT.base
|
|
80H 4 LDT.limit
|
|
84H 4 GS.attrib
|
|
88H 4 GS.base
|
|
8CH 4 GS.limit
|
|
90H 4 FS.attrib
|
|
94H 4 FS.base
|
|
98H 4 FS.limit
|
|
9CH 4 DS.attrib
|
|
A0H 4 DS.base
|
|
A4H 4 DS.limit
|
|
A8H 4 SS.attrib
|
|
ACH 4 SS.base
|
|
B0H 4 SS.limit
|
|
B4H 4 CS.attrib
|
|
B8H 4 CS.base
|
|
BCH 4 CS.limit
|
|
C0H 4 ES.attrib
|
|
C4H 4 ES.base
|
|
C8H 4 ES.limit
|
|
Unknown Unusable area
|
|
100H 4 Temporary register
|
|
104H 4 -------------
|
|
108H 4 -------------
|
|
10CH 4 -------------
|
|
110H 4 -------------
|
|
114H 4 -------------
|
|
118H 4 -------------
|
|
11CH 4 -------------
|
|
120H 4 -------------
|
|
124H 4 Last EIP (Last instruction EIP for Restart)
|
|
|
|
Format of Attrib field:
|
|
|
|
Byte Description
|
|
0 0s
|
|
1 AR (Access Right) byte in the Descriptor format
|
|
Note:
|
|
P bit is a valid bit
|
|
if valid bit=0 then Shadow Register is invalid and
|
|
INT 0DH - General Protection Fault call
|
|
DPL of SS, CS det. CPL
|
|
2-3 0s
|
|
|
|
|
|
Flags Affected: All (FLAGS Register Reload)
|
|
|
|
CPU mode: RM, PM0, SMM
|
|
|
|
Physical Form: RES3
|
|
COP (Code of Operation): 0FH 07H Note: Code is same with Intel's LOADALL
|
|
Clocks: Am386SXLV : 366
|
|
Am386DXLV : 291
|
|
|
|
---------------------------------------------------
|
|
RSM - Resume from System Managment Mode
|
|
---------------------------------------------------
|
|
|
|
CPU: I486 SL Enhanced+, i486SL, i386CX, i386EX
|
|
|
|
Type of Instruction: System
|
|
|
|
Instruction: RSM
|
|
|
|
Description:
|
|
|
|
Restore execution state from SMRAM and
|
|
return to previous CPU mode
|
|
|
|
|
|
CPU mode: SMM only
|
|
(INT 6 - Undefined Opcode in all other mode)
|
|
|
|
Flags Affected: All
|
|
|
|
Note: CPU state restored from dump created entrance to SMM.
|
|
The CPU leave SMM and return to previous mode.
|
|
If CPU detect any invalid state it enters shutdown.
|
|
This invalid states is:
|
|
* The value stored in State Dump Base field is not 32K aligned
|
|
address
|
|
* Any Reserved bit of CR4 is set to 1 (Pentium only)
|
|
* Any illegal Combination of CR0:
|
|
** (PG=1 and PE=0)
|
|
** (NW=1 and CD=0)
|
|
|
|
Physical Form: RSM
|
|
COP (Code of Operation) : 0FH AAH
|
|
Clocks: i386CX : 338
|
|
i486 SL Enhanced : ???
|
|
IntelDX4 : 452 ; SMBASE relocation
|
|
: 456 ; AutoHALT restart
|
|
: 465 ; I/O Trap restart
|
|
Pentium : 83
|
|
|
|
---------------------------------------------------
|
|
SETALC - Set AL to Carry Flag
|
|
---------------------------------------------------
|
|
|
|
CPU: Intel 80286 and all its clones and upward
|
|
compatibility chips
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: SETALC
|
|
|
|
Description:
|
|
|
|
IF (CF=0) THEN AL:=0 ELSE AL:=FFH;
|
|
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
Physical Form: SETALC
|
|
COP (Code of Operation): D6H
|
|
Clocks: 80286 : n/a [3]
|
|
80386 : n/a [3]
|
|
Cx486SLC : n/a [2]
|
|
i486 : n/a [3]
|
|
Pentium : n/a [3]
|
|
|
|
|
|
---------------------------------------------------
|
|
SMI - System Managment Interrupt
|
|
---------------------------------------------------
|
|
|
|
CPU: AMD Am386SXLV, Am386DXLV
|
|
AMD 486s
|
|
|
|
Type of Instruction: System
|
|
|
|
Instruction: SMI
|
|
|
|
Description:
|
|
|
|
IF (SMIE=1) THEN
|
|
{
|
|
SAVE STATUS OF EXECUTION TO SMRAM;
|
|
ENTER SMM;
|
|
SMMS <- 1;
|
|
}
|
|
ELSE
|
|
{
|
|
INT 1;
|
|
}
|
|
END
|
|
|
|
Notes: SMIE is <Soft SMI Enable> (DR7.bit12)
|
|
=1 Enable soft SMI
|
|
=0 Disable soft SMI
|
|
SMMS is <SMM status bit> (DR6.bit12)
|
|
=1 SMM was entered
|
|
=0 SMM status cleared
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM?, PM0
|
|
|
|
Physical Form: SMI
|
|
COP (Code of Operation): F1H
|
|
Clocks: Am386SXLV : 357
|
|
Am386DXLV : 325
|
|
Am486xxxx : Don't know, do you?
|
|
|
|
|
|
---------------------------------------------------
|
|
UMOV - Mov Data to Main (User) Memory
|
|
---------------------------------------------------
|
|
|
|
CPU: AMD Am386SXLV, Am386DXLV
|
|
AMD 486s
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: UMOV dest, sorc
|
|
|
|
|
|
Description:
|
|
|
|
dest <- sorc;
|
|
|
|
Note!!!!!: But all memory operands placed in Main memory only !
|
|
(i.e. not in SMRAM then in SMM)
|
|
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM?, PM?, VM?, SMM
|
|
|
|
+++++++++++++++++++++++
|
|
Physical Form: UMOV r/m8, r8
|
|
COP (Code of Operation) : 0FH 10H Postbyte
|
|
|
|
Clocks:
|
|
Am386SXLV or AM386DXLV: 2/2
|
|
|
|
+++++++++++++++++++++
|
|
Physical Form: UMOV r/m16, r16
|
|
UMOV r/m32, r32
|
|
COP (Code of Operation) : 0FH 11H Postbyte
|
|
|
|
Clocks:
|
|
Am386SXLV or AM386DXLV: 2/2
|
|
|
|
+++++++++++++++++++++++
|
|
Physical Form: UMOV r8, r/m8
|
|
COP (Code of Operation) : 0FH 12H Postbyte
|
|
|
|
Clocks:
|
|
Am386SXLV or AM386DXLV: 2/4
|
|
|
|
+++++++++++++++++++++
|
|
Physical Form: UMOV r16, r/m16
|
|
UMOV r32, r/m32
|
|
COP (Code of Operation) : 0FH 13H Postbyte
|
|
|
|
Clocks:
|
|
Am386SXLV or AM386DXLV: 2/4
|
|
|
|
|
|
|
|
---------------------------------------------------
|
|
WBINVD - Write Back and Invalidate Cache
|
|
---------------------------------------------------
|
|
|
|
CPU: I486 +
|
|
|
|
Type of Instruction: System
|
|
|
|
Instruction: WBINVD
|
|
|
|
Description:
|
|
IF (internal cache is WB) THEN
|
|
{
|
|
Write Back Internal Cache;
|
|
}
|
|
Flush internal cache;
|
|
Signal external cache to Write Back;
|
|
Signal external cache to Flush;
|
|
|
|
|
|
Notes: This instruction not work in Real Mode and in
|
|
Protected mode work only in ring 0 ;
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: PM0, SMM
|
|
|
|
Physical Form: INVD
|
|
COP (Code of Operation): 0FH 09H
|
|
Clocks: Cyrix Cx486SLC : 4
|
|
i486 : 5
|
|
Pentium : 2000+
|
|
|
|
---------------------------------------------------
|
|
WRMSR - Write to From Model Specified Register
|
|
---------------------------------------------------
|
|
|
|
CPU: Pentium (tm)
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: WRMSR
|
|
|
|
Description:
|
|
|
|
IF (ECX is valid number of MSR) and (CPL=0) THEN
|
|
{
|
|
MSR [ECX] <- EDX:EAX;
|
|
}
|
|
ELSE
|
|
{
|
|
General Protection Fault INT 0DH (0)
|
|
}
|
|
END
|
|
|
|
|
|
|
|
Flags Affected: None
|
|
|
|
CPU mode: RM, PM0, SMM
|
|
|
|
Physical Form: WRMSR
|
|
COP (Code of Operation): 0FH 30H
|
|
Clocks: Pentium : 30-45
|
|
|
|
---------------------------------------------------
|
|
XADD - Exchange and addition
|
|
---------------------------------------------------
|
|
|
|
CPU: i486+
|
|
|
|
Type of Instruction: Operation
|
|
|
|
Instruction: XADD dest, sorc
|
|
|
|
|
|
Description:
|
|
|
|
Temporary <- dest;
|
|
dest <- dest + sorc;
|
|
sorc <- Temporary;
|
|
|
|
|
|
Flags Affected: ZF, OF, SF, AF, PF, CF (like ADD instruction) (see description)
|
|
|
|
CPU mode: RM, PM, VM, SMM
|
|
|
|
+++++++++++++++++++++++
|
|
Physical Form: XADD r/m8, r8
|
|
COP (Code of Operation) : 0FH C0H Postbyte
|
|
|
|
Clocks:
|
|
Intel i486 : 3/4
|
|
Cyrix Cx486SLC : 3/6
|
|
Pentium (tm) : 3/4
|
|
|
|
Penalty if cache miss :
|
|
Intel i486 : 6/2 ; Unlocked/Locked
|
|
Cyrix Cx486SLC : 0 ; N/A
|
|
+++++++++++++++++++++
|
|
Physical Form: XADD r/m16, r16
|
|
XADD r/m32, r32
|
|
COP (Code of Operation) : 0FH C1H Postbyte
|
|
|
|
Clocks:
|
|
Intel i486 : 3/4
|
|
Cyrix Cx486SLC : 3/6
|
|
Pentium (tm) : 3/4
|
|
|
|
Penalty if cache miss :
|
|
Intel i486 : 6/2 ; Unlocked/Locked
|
|
Cyrix Cx486SLC : 1 ; N/A
|
|
|
|
---end of file---end of file---
|
|
|