Text preview for : M1-2.pdf part of Cyrix 6x86 Cyrix 6x86 Datasheet
Back to : CYRIX.zip | Home
6x86 PROCESSOR
Superscalar, Superpipelined, Sixth-generation, x86 Compatible CPU
®
Advancing the Standards
Programming Interface
2.
PROGRAMMING INTERFACE
2.1
Processor Initialization
In this chapter, the internal operations of the 6x86 CPU are described mainly from an application programmer's point of view. Included in this chapter are descriptions of processor initialization, the register set, memory addressing, various types of interrupts and the shutdown and halt process. An overview of real, virtual 8086, and protected operating modes is also included in this chapter. The FPU operations are described separately at the end of the chapter. This manual does not--and is not intended to--describe the 6x86 microprocessor or its operations at the circuit level.
The 6x86 CPU is initialized when the RESET signal is asserted. The processor is placed in real mode and the registers listed in Table 2-1 (Page 2-2) are set to their initialized values. RESET invalidates and disables the cache and turns off paging. When RESET is asserted, the 6x86 CPU terminates all local bus activity and all internal execution. During the entire time that RESET is asserted, the internal pipelines are flushed and no instruction execution or bus activity occurs. Approximately 150 to 250 external clock cycles after RESET is negated, the processor begins executing instructions at the top of physical memory (address location FFFF FFF0h). Typically, an intersegment JUMP is placed at FFFF FFF0h. This instruction will force the processor to begin execution in the lowest 1 MByte of address space. Note: The actual time depends on the clock scaling in use. Also an additional 220 clock cycles are needed if self-test is requested.
PRELIMINARY
2-1
®
Processor Initialization
Advancing the Standards
Table 2-1.
REGISTER REGISTER NAME
Initialized Register Controls
INITIALIZED CONTENTS COMMENTS
EAX EBX ECX EDX EBP ESI EDI ESP EFLAGS EIP ES CS SS DS FS GS IDTR GDTR LDTR TR CR0 CR2 CR3 CCR (0-5) ARR (0-7) RCR (0-7) DIR0 DIR1 DR7
Accumulator Base Count Data Base Pointer Source Index Destination Index Stack Pointer Flag Word Instruction Pointer Extra Segment Code Segment Stack Segment Data Segment Extra Segment Extra Segment Interrupt Descriptor Table Register Global Descriptor Table Register Local Descriptor Table Register Task Register Machine Status Word Control Register 2 Control Register 3 Configuration Control (0-5) Address Region Registers (0-7) Region Control Registers (0-7) Device Identification 0 Device Identification 1 Debug Register 7
xxxx xxxxh xxxx xxxxh xxxx xxxxh 05 + Device ID xxxx xxxxh xxxx xxxxh xxxx xxxxh xxxx xxxxh 0000 0002h 0000 FFF0h 0000h F000h 0000h 0000h 0000h 0000h Base = 0, Limit = 3FFh xxxx xxxxh, xxxxh xxxx xxxxh, xxxxh xxxxh 6000 0010h xxxx xxxxh xxxx xxxxh 00h 00h 00h 31h or 33h (2X clock) 35h or 37h (3X clock) Step ID + Revision ID 0000 0400h
0000 0000h indicates self-test passed.
Device ID = 31h or 33h (2X clock) Device ID = 35h or 37h (3X clock)
Base address set to 0000 0000h. Limit set to FFFFh. Base address set to FFFF 0000h. Limit set to FFFFh. Base address set to 0000 0000h. Limit set to FFFFh. Base address set to 0000 0000h. Limit set to FFFFh. Base address set to 0000 0000h. Limit set to FFFFh. Base address set to 0000 0000h. Limit set to FFFFh.
Note: x = Undefined value
2-2
PRELIMINARY
Instruction Set Overview
2
2.2
Instruction Set Overview
The 6x86 CPU instruction set performs nine types of general operations:
· · · · · Arithmetic Bit Manipulation Control Transfer Data Transfer Floating Point · · · · High-Level Language Support Operating System Support Shift/Rotate String Manipulation
of an operand can be overridden by placing one or more instruction prefixes in front of the opcode. For example, by using prefixes, a 32-bit operand can be used with 16-bit code, or a 16-bit operand can be used with 32-bit code. Chapter 6 of this manual lists each instruction in the 6x86 CPU instruction set along with the associated opcodes, execution clock counts, and effects on the FLAGS register. 2.2.1 Lock Prefix
All 6x86 CPU instructions operate on as few as zero operands and as many as three operands. An NOP instruction (no operation) is an example of a zero operand instruction. Two operand instructions allow the specification of an explicit source and destination pair as part of the instruction. These two operand instructions can be divided into eight groups according to operand types:
· · · · Register to Register Register to Memory Memory to Register Memory to Memory · · · · Register to I/O I/O to Register Immediate Data to Register Immediate Data to Memory
The LOCK prefix may be placed before certain instructions that read, modify, then write back to memory. The prefix asserts the LOCK# signal to indicate to the external hardware that the CPU is in the process of running multiple indivisible memory accesses. The LOCK prefix can be used with the following instructions: Bit Test Instructions (BTS, BTR, BTC) Exchange Instructions (XADD, XCHG, CMPXCHG) One-operand Arithmetic and Logical Instructions (DEC, INC, NEG, NOT) Two-operand Arithmetic and Logical Instructions (ADC, ADD, AND, OR, SBB, SUB, XOR). An invalid opcode exception is generated if the LOCK prefix is used with any other instruction, or with the above instructions when no write operation to memory occurs (i.e., the destination is a register). The LOCK# signal can be negated to allow weak-locking for all of memory or on a regional basis. Refer to the descriptions of the NO-LOCK bit (within CCR1) and the WL bit (within RCRx) later in this chapter.
An operand can be held in the instruction itself (as in the case of an immediate operand), in one of the processor's registers or I/O ports, or in memory. An immediate operand is prefetched as part of the opcode for the instruction. Operand lengths of 8, 16, or 32 bits are supported as well as 64-or 80-bit associated with floating point instructions. Operand lengths of 8 or 32 bits are generally used when executing code written for 386- or 486-class (32-bit code) processors. Operand lengths of 8 or 16 bits are generally used when executing existing 8086 or 80286 code (16-bit code). The default length
PRELIMINARY
2-3
®
Register Sets
Advancing the Standards
2.3
Register Sets
2.3.1
Application Register Set
From the programmer's point of view there are 58 accessible registers in the 6x86 CPU. These registers are grouped into two sets. The application register set contains the registers frequently used by application programmers, and the system register set contains the registers typically reserved for use by operating system programmers. The application register set is made up of general purpose registers, segment registers, a flag register, and an instruction pointer register. The system register set is made up of the remaining registers which include control registers, system address registers, debug registers, configuration registers, and test registers. Each of the registers is discussed in detail in the following sections.
The application register set, (Figure 2-1, Page 2-5) consists of the registers most often used by the applications programmer. These registers are generally accessible and are not protected from read or write access. The General Purpose Register contents are frequently modified by assembly language instructions and typically contain arithmetic and logical instruction operands. Segment Registers in real mode contain the base address for each segment. In protected mode the segment registers contain segment selectors. The segment selectors provide indexing for tables (located in memory) that contain the base address and limit for each segment, as well as access control information. The Flag Register contains control bits used to reflect the status of previously executed instructions. This register also contains control bits that affect the operation of some instructions. The Instruction Pointer register points to the next instruction that the processor will execute. This register is automatically incremented by the processor as execution progresses.
2-4
PRELIMINARY
Register Sets
2
31
0 EAX (Accumulator) EBX (Base) ECX (Count) EDX (Data) ESI (Source Index) EDI (Destination Index) EBP (Base Pointer) ESP (Stack Pointer) General Purpose Registers 15 0 CS (Code Segment Selector) SS (Stack Segment Selector) DS (Data Segment Selector) ES (Extra Segment Selector) FS (Extra Segment F Selector) GS (Extra Segment G Selector) Segment Registers
31
16 15 IP Instruction Pointer Register
0 EIP (Instruction Pointer)
31
16 15 FLAGS Flag Register
0 EFLAGS (Flag Register)
1700405
Figure 2-1. Application Register Set
2.3.2
General Purpose Registers
An "E" prefix identifies the complete 32-bit register. An "X" suffix without the "E" prefix identifies the lower 16 bits of the register. The lower two bytes of a data register can be addressed with an "H" suffix (identifies the upper byte) or an "L" suffix (identifies the lower byte). The _L and _H portions of a data registers act as independent registers. For example, if the AH register is written to by an instruction, the AL register bits remain unchanged.
The general purpose registers are divided into four data registers, two pointer registers, and two index registers as shown in Figure 2-2 (Page 2-6). The Data Registers are used by the applications programmer to manipulate data structures and to hold the results of logical and arithmetic operations. Different portions of the general data registers can be addressed by using different names.
PRELIMINARY
2-5
®
Register Sets
Advancing the Standards
31
16 15
AH
87
AX AL BX BH CX BL CL DX DH DL
0 EAX (Accumulator) EBX (Base) ECX (Count) EDX (Data) ESI (Source Index) EDI (Destination Index) EBP (Base Pointer) ESP (Stack Pointer)
1746400
CH
SI DI BP SP
Figure 2-2. General Purpose Registers
The Pointer and Index Registers are listed below. SI or ESI DI or EDI SP or ESP BP or EBP Source Index Destination Index Stack Pointer Base Pointer
The 6x86 CPU processor implements a stack using the ESP register. This stack is accessed during the PUSH and POP instructions, procedure calls, procedure returns, interrupts, exceptions, and interrupt/exception returns. The microprocessor automatically adjusts the value of the ESP during operation of these instructions.The EBP register may be used to reference data passed on the stack during procedure calls. Local data may also be placed on the stack and referenced relative to BP. This register provides a mechanism to access stack data in high-level languages.
These registers can be addressed as 16- or 32-bit registers, with the "E" prefix indicating 32 bits. The pointer and index registers can be used as general purpose registers, however, some instructions use a fixed assignment of these registers. For example, repeated string operations always use ESI as the source pointer, EDI as the destination pointer, and ECX as the counter. The instructions using fixed registers include multiply and divide, I/O access, string operations, translate, loop, variable shift and rotate, and stack operations.
2-6
PRELIMINARY
Register Sets
2
2.3.3
Segment Registers and Selectors
Segmentation provides a means of defining data structures inside the memory space of the microprocessor. There are three basic types of segments: code, data, and stack. Segments are used automatically by the processor to determine the location in memory of code, data, and stack references. There are six 16-bit segment registers: CS DS ES SS FS GS Code Segment Data Segment Extra Segment Stack Segment Additional Data Segment Additional Data Segment.
tual 8086 mode with paging disabled, the linear address is also the physical address. In virtual 8086 mode with paging enabled, the linear address is translated to the physical address using the current page tables. Paging is described in Section 2.6.4 (Page 2-45). In protected mode a segment register holds a Segment Selector containing a 13-bit index, a Table Indicator (TI) bit, and a two-bit Requested Privilege Level (RPL) field as shown in Figure 2-3. The Index points into a descriptor table in memory and selects one of 8192 (213) segment descriptors contained in the descriptor table. A segment descriptor is an eight-byte value used to describe a memory segment by defining the segment base, the segment limit, and access control information. To address data within a segment, a 16-bit or 32-bit offset is added to the segment's base address. Once a segment selector has been loaded into a segment register, an instruction needs only to specify the segment register and the offset.
In real and virtual 8086 operating modes, a segment register holds a 16-bit segment base. The 16-bit segment is multiplied by 16 and a 16-bit or 32-bit offset is then added to it to create a linear address. The offset size is dependent on the current address size. In real mode and in vir-
Segment Selector 15 INDEX 3 2 TI 1 0
RPL
8191 Limit Descriptor Segment Base
0 Descriptor Table Main Memory
1741701
Figure 2-3. Segment Selector in Protected Mode PRELIMINARY 2-7
®
Register Sets
Advancing the Standards
The Table Indicator (TI) bit of the selector defines which descriptor table the index points into. If TI=0, the index references the Global Descriptor Table (GDT). If TI=1, the index references the Local Descriptor Table (LDT). The GDT and LDT are described in more detail in Section 2.4.2. Protected mode addressing is discussed further in Sections 2.6.2 and 2.6.3. The Requested Privilege Level (RPL) field in a segment selector is used to determine the Effective Privilege Level of an instruction (where RPL=0 indicates the most privileged level, and RPL=3 indicates the least privileged level). If the level requested by RPL is less than the Current Program Level (CPL), the RPL level is accepted and the Effective Privilege Level is changed to the RPL value. If the level requested by RPL is greater than CPL, the CPL overrides the requested RPL and Effective Privilege Level remains unchanged.
When a segment register is loaded with a segment selector, the segment base, segment limit and access rights are loaded from the descriptor table entry into a user-invisible or hidden portion of the segment register (i.e., cached on-chip). The CPU does not access the descriptor table entry again until another segment register load occurs. If the descriptor tables are modified in memory, the segment registers must be reloaded with the new selector values by the software. The processor automatically selects an implied (default) segment register for memory references. Table 2-2 describes the selection rules. In general, data references use the selector contained in the DS register, stack references use the SS register and instruction fetches use the CS register. While some of these selections may be overridden, instruction fetches, stack operations, and the destination write of string operations cannot be overridden. Special segment override instruction prefixes allow the use of alternate segment registers including the use of the ES, FS, and GS segment registers.
Table 2-2.
Segment Register Selection Rules
IMPLIED (DEFAULT) SEGMENT SEGMENT OVERRIDE PREFIX
TYPE OF MEMORY REFERENCE
Code Fetch Destination of PUSH, PUSHF, INT, CALL, PUSHA instructions Source of POP, POPA, POPF, IRET, RET instructions Destination of STOS, MOVS, REP STOS, REP MOVS instructions Other data references with effective address using base registers of: EAX, EBX, ECX, EDX, ESI, EDI EBP ESP ,
CS SS SS ES
None None None None
DS SS
CS, ES, FS, GS, SS CS, DS, ES, FS, GS
2-8
PRELIMINARY
Register Sets
2
2.3.4
Instruction Pointer Register
2.3.5
Flags Register
The Instruction Pointer (EIP) register contains the offset into the current code segment of the next instruction to be executed. The register is normally incremented with each instruction execution unless implicitly modified through an interrupt, exception or an instruction that changes the sequential execution flow (e.g., JMP, CALL).
The Flags Register, EFLAGS, contains status information and controls certain operations on the 6x86 CPU microprocessor. The lower 16 bits of this register are referred to as the FLAGS register that is used when executing 8086 or 80286 code. The flag bits are shown in Figure 2-4 and defined in Table 2-3 (Page 2-10).
Flags
3 1 0 0 0 0 0 0 0
2 4 0 S S S D S S A C S D A A A A A
2 3 0 0
2 1 I 0 D
1 1 1 1 1 1 9 8 7 6 5 4 0 A V R 0 N C M F T
1 3
1 2
IO PL
1 1 O F
1 0 9 D I F F
8 7 6 T S Z F F F
5 0
4 A F
3 0
2 1 0 P C F 1 F
Identification Alignment Check Virtual 8086 Mode Resume Flag Nested Task Flag I/O Privilege Level Overflow Direction Flag Interrupt Enable Trap Flag Sign Flag Zero Flag Auxiliary Carry Parity Flag Carry Flag
A = Arithmetic Flag, D = Debug Flag, S = System Flag, C = Control Flag 0 or 1 Indicates Reserved
1701105
Figure 2-4.
EFLAGS Register
PRELIMINARY
2-9
®
Register Sets
Advancing the Standards
Table 2-3.
BIT POSITION NAME
EFLAGS Bit Definitions
FUNCTION
0 2 4 6 7 8 9 10
CF PF AF ZF SF TF IF DF
11
OF
12, 13
IOPL
14 16
NT RF
17
VM
18
AC
21
ID
Carry Flag: Set when a carry out of (addition) or borrow into (subtraction) the most significant bit of the result occurs; cleared otherwise. Parity Flag: Set when the low-order 8 bits of the result contain an even number of ones; cleared otherwise. Auxiliary Carry Flag: Set when a carry out of (addition) or borrow into (subtraction) bit position 3 of the result occurs; cleared otherwise. Zero Flag: Set if result is zero; cleared otherwise. Sign Flag: Set equal to high-order bit of result (0 indicates positive, 1 indicates negative). Trap Enable Flag: Once set, a single-step interrupt occurs after the next instruction completes execution. TF is cleared by the single-step interrupt. Interrupt Enable Flag: When set, maskable interrupts (INTR input pin) are acknowledged and serviced by the CPU. Direction Flag: If DF=0, string instructions auto-increment (default) the appropriate index registers (ESI and/or EDI). If DF=1, string instructions auto-decrement the appropriate index registers. Overflow Flag: Set if the operation resulted in a carry or borrow into the sign bit of the result but did not result in a carry or borrow out of the high-order bit. Also set if the operation resulted in a carry or borrow out of the high-order bit but did not result in a carry or borrow into the sign bit of the result. I/O Privilege Level: While executing in protected mode, IOPL indicates the maximum current privilege level (CPL) permitted to execute I/O instructions without generating an exception 13 fault or consulting the I/O permission bit map. IOPL also indicates the maximum CPL allowing alteration of the IF bit when new values are popped into the EFLAGS register. Nested Task: While executing in protected mode, NT indicates that the execution of the current task is nested within another task. Resume Flag: Used in conjunction with debug register breakpoints. RF is checked at instruction boundaries before breakpoint exception processing. If set, any debug fault is ignored on the next instruction. Virtual 8086 Mode: If set while in protected mode, the microprocessor switches to virtual 8086 operation handling segment loads as the 8086 does, but generating exception 13 faults on privileged opcodes. The VM bit can be set by the IRET instruction (if current privilege level=0) or by task switches at any privilege level. Alignment Check Enable: In conjunction with the AM flag in CR0, the AC flag determines whether or not misaligned accesses to memory cause a fault. If AC is set, alignment faults are enabled. Identification Bit: The ability to set and clear this bit indicates that the CPUID instruction is supported. The ID can be modified only if the CPUID bit in CCR4 is set.
2-10
PRELIMINARY
System Register Set
2
2.4
System Register Set The Configuration Registers are used to configure the 6x86 CPU on-chip cache operation, power management features and System Management Mode. The configuration registers also provide information on the CPU device type and revision. The Debug Registers provide debugging facilities to enable the use of data access breakpoints and code execution breakpoints. The Test Registers provide a mechanism to test the contents of both the on-chip 16 KByte cache and the Translation Lookaside Buffer (TLB). In the following sections, the system register set is described in greater detail.
The system register set, shown in Figure 2-5 (Page 2-12), consists of registers not generally used by application programmers. These registers are typically employed by system level programmers who generate operating systems and memory management programs. The Control Registers control certain aspects of the 6x86 microprocessor such as paging, coprocessor functions, and segment protection. When a paging exception occurs while paging is enabled, some control registers retain the linear address of the access that caused the exception. The Descriptor Table Registers and the Task Register can also be referred to as system address or memory management registers. These registers consist of two 48-bit and two 16-bit registers. These registers specify the location of the data structures that control the segmentation used by the 6x86 microprocessor. Segmentation is one available method of memory management.
PRELIMINARY
2-11
®
System Register Set
Advancing the Standards
31
16 15 Page Fault Linear Address Register Page Directory Base Register 16 15 Limit Limit Selector Selector Linear Breakpoint Address 0 Linear Breakpoint Address 1 Linear Breakpoint Address 2 Linear Breakpoint Address 3 Breakpoint Status Breakpoint Control 7
CCR = Configuration Control Register
0 CR0 CR2 CR3 0 GDTR IDTR LDTR TR 0 DR0 DR1 DR2 DR3 DR6 DR7 0 CCR0 CCR1 CCR2 CCR3 CCR4 CCR5 ARR0 ARR1 ARR2 ARR3 ARR4 ARR5 ARR6 ARR7 DIR0 DIR1 Configuration Registers Descriptor Table Registers Task Register Control Registers
47 Base Base
31
Debug Registers
7 RCR0 RCR1 RCR2 RCR3 RCR4 RCR5 RCR6 RCR7
CCR0 CCR1 CCR2 CCR3 CCR4 0 23 CCR5 Address Region Register 0 Address Region Register 1 Address Region Register 2 Address Region Register 3 Address Region Register 4 Address Region Register 5 Address Region Register 6 Address Region Register 7 DIR0 DIR1
DIR = Device Identification Register
RCR = Region Control Register
31 Cache Test Cache Test Cache Test TLB Test Control TLB Test Status
0 TR3 TR4 TR5 TR6 TR7 Test Registers
1728200
Figure 2-5.
System Register Set
2-12
PRELIMINARY
System Register Set
2
2.4.1
Control Registers
CR3 contains the Page Cache Disable (PCD) and Page Write Through (PWT) bits. During bus cycles that are not paged, the state of the PCD bit is reflected on the PCD pin and the PWT bit is driven on the PWT pin. These bus cycles include interrupt acknowledge cycles and all When paging is enabled and a page fault is gen- bus cycles, when paging is not enabled. The erated, the CR2 register retains the 32-bit linear PCD pin should be used to control caching in an address of the address that caused the fault. external cache. The PWT pin should be used to When a double page fault occurs, CR2 contains control write policy in an external cache. the address for the second fault. Register CR3
The Control Registers (CR0, CR2 and CR3), are shown in Figure 2-6. The CR0 register contains system control bits which configure operating modes and indicate the general state of the CPU. The lower 16 bits of CR0 are referred to as the Machine Status Word (MSW). The CR0 bit definitions are described in Table 2-4 and Table 2-5 (Page 2-14). The reserved bits in CR0 should not be modified.
contains the 20 most significant bits of the physical base address of the page directory. The page directory must always be aligned to a 4-KByte page boundary, therefore, the lower 12 bits of CR3 are not required to specify the base address.
31 PAGE DIRECTORY BASE REGISTER (PDBR)
12 11 RESERVED
4 3 P P C W D T
0 RESV.
CR3 CR2
PAGE FAULT LINEAR ADDRESS P C N G D W
31 30 29
RESERVED
A M
18
W P
16
RESERVED
N E
5 MSW
E P 1 T M M E S P
4 3 2 1 0
CR0
1700703
Figure 2-6. Control Registers
PRELIMINARY
2-13
®
System Register Set
Advancing the Standards
Table 2-4.
BIT POSITION NAME
CR0 Bit Definitions
FUNCTION
0
PE
1
MP
2 3
EM TS
4 5 16
1 NE WP
18 29
AM NW
30
CD
31
PG
Protected Mode Enable: Enables the segment based protection mechanism. If PE=1, protected mode is enabled. If PE=0, the CPU operates in real mode and addresses are formed as in an 8086-style CPU. Monitor Processor Extension: If MP=1 and TS=1, a WAIT instruction causes Device Not Available (DNA) fault 7. The TS bit is set to 1 on task switches by the CPU. Floating point instructions are not affected by the state of the MP bit. The MP bit should be set to one during normal operations. Emulate Processor Extension: If EM=1, all floating point instructions cause a DNA fault 7. Task Switched: Set whenever a task switch operation is performed. Execution of a floating point instruction with TS=1 causes a DNA fault. If MP=1 and TS=1, a WAIT instruction also causes a DNA fault. Reserved: Do not attempt to modify. Numerics Exception. NE=1 to allow FPU exceptions to be handled by interrupt 16. NE=0 if FPU exceptions are to be handled by external interrupts. Write Protect: Protects read-only pages from supervisor write access. WP=0 allows a read-only page to be written from privilege level 0-2. WP=1 forces a fault on a write to a read-only page from any privilege level. Alignment Check Mask: If AM=1, the AC bit in the EFLAGS register is unmasked and allowed to enable alignment check faults. Setting AM=0 prevents AC faults from occurring. Not Write-Back: If NW=1, the on-chip cache operates in write-through mode. In write-through mode, all writes (including cache hits) are issued to the external bus. If NW=0, the on-chip cache operates in write-back mode. In write-back mode, writes are issued to the external bus only for a cache miss, a line replacement of a modified line, or as the result of a cache inquiry cycle. Cache Disable: If CD=1, no further cache line fills occur. However, data already present in the cache continues to be used if the requested address hits in the cache. Writes continue to update the cache and cache invalidations due to inquiry cycles occur normally. The cache must also be invalidated to completely disable any cache activity. Paging Enable Bit: If PG=1 and protected mode is enabled (PE=1), paging is enabled. After changing the state of PG, software must execute an unconditional branch instruction (e.g., JMP, CALL) to have the change take effect.
Table 2-5. Effects of Various Combinations of EM, TS, and MP Bits
CR0 BIT EM TS MP INSTRUCTION TYPE WAIT ESC
0 0 0 0 1 1 1 1 2-14
0 0 1 1 0 0 1 1
0 1 0 1 0 1 0 1
Execute Execute Execute Fault 7 Execute Execute Execute Fault 7
Execute Execute Fault 7 Fault 7 Fault 7 Fault 7 Fault 7 Fault 7
PRELIMINARY
System Register Set
2
2.4.2
Descriptor Table grammer by using a SGDT instruction. The first Registers and Descriptors descriptor in the GDT (location 0) is not used by the CPU and is referred to as the "null descripDescriptor Table Registers tor". The GDTR is initialized using a LGDT instruction. The Global, Interrupt, and Local Descriptor Table Registers (GDTR, IDTR and LDTR), shown The Interrupt Descriptor Table Register in Figure 2-7, are used to specify the location of (IDTR) holds a 32-bit linear base address and the data structures that control segmented 16-bit limit for the Interrupt Descriptor Table memory management. The GDTR, IDTR and (IDT). The IDT is an array of 256 interrupt LDTR are loaded using the LGDT, LIDT and descriptors, each of which is used to point to an LLDT instructions, respectively. The values of interrupt service routine. Every interrupt that these registers are stored using the correspond- may occur in the system must have an associing store instructions. The GDTR and IDTR ated entry in the IDT. The contents of the IDTR load instructions are privileged instructions are completely visible to the programmer by when operating in protected mode. The LDTR using a SIDT instruction. The IDTR is initialized can only be accessed in protected mode. using the LIDT instruction. The Global Descriptor Table Register (GDTR) holds a 32-bit linear base address and 16-bit limit for the Global Descriptor Table (GDT). The GDT is an array of up to 8192 8-byte descriptors. When a segment register is loaded from memory, the TI bit in the segment selector chooses either the GDT or the Local Descriptor Table (LDT) to locate a descriptor. If TI = 0, the index portion of the selector is used to locate the descriptor within the GDT table. The contents of the GDTR are completely visible to the pro47 BASE ADDRESS BASE ADDRESS
The Local Descriptor Table Register (LDTR) holds a 16-bit selector for the Local Descriptor Table (LDT). The LDT is an array of up to 8192 8-byte descriptors. When the LDTR is loaded, the LDTR selector indexes an LDT descriptor that must reside in the Global Descriptor Table (GDT). The base address and limit are loaded automatically and cached from the LDT descriptor within the GDT.
16 15 LIMIT LIMIT SELECTOR
0 GDTR IDTR LDTR
1708003
Figure 2-7.
Descriptor Table Registers
PRELIMINARY
2-15
®
System Register Set
Advancing the Standards
Subsequent access to entries in the LDT use the hidden LDTR cache to obtain linear addresses. If the LDT descriptor is modified in the GDT, the LDTR must be reloaded to update the hidden portion of the LDTR. When a segment register is loaded from memory, the TI bit in the segment selector chooses either the GDT or the LDT to locate a segment descriptor. If TI = 1, the index portion of the selector is used to locate a given descriptor within the LDT. Each task in the system may be given its own LDT, managed by the operating system. The LDTs provide a method of isolating a given task's segments from other tasks in the system. The LDTR can be read or written by the LLDT and SLDT instructions.
Descriptors There are three types of descriptors:
· Application Segment Descriptors that
define code, data and stack segments.
· System Segment Descriptors that define an
LDT segment or a Task State Segment (TSS) table described later in this text. · Gate Descriptors that define task gates, interrupt gates, trap gates and call gates. Application Segment Descriptors can be located in either the LDT or GDT. System Segment Descriptors can only be located in the GDT. Dependent on the gate type, gate descriptors may be located in either the GDT, LDT or IDT. Figure 2-8 illustrates the descriptor format for both Application Segment Descriptors and System Segment Descriptors. Table 2-6 (Page 2-17) lists the corresponding bit definitions.
31
BASE 31-24
24 23 22 21 20 19 16 15 14 13 12 11 A D G D 0 V LIMIT 19-16 P DPL T L BASE 15-0
87 TYPE BASE 23-16
0
+4
+0
LIMIT 15-0
1707803
Figure 2-8.
Application and System Segment Descriptors
2-16
PRELIMINARY
System Register Set
2
Table 2-6. Segment Descriptor Bit Definitions
BIT POSITION MEMORY OFFSET NAME DESCRIPTION
31-24 7-0 31-16 19-16 15-0 23 22 20 15 14-13 12 11-8
+4 +4 +0 +4 +0 +4 +4 +4 +4 +4 +4 +4
BASE
Segment base address. 32-bit linear address that points to the beginning of the segment. Segment limit. Limit granularity bit: 0 = byte granularity, 1 = 4 KBytes (page) granularity. Default length for operands and effective addresses. Valid for code and stack segments only: 0 = 16 bit, 1 = 32-bit. Segment available. Segment present. Descriptor privilege level. Descriptor type: 0 = system, 1 = application. Segment type. See Tables 2-7 and 2-8.
LIMIT G D AVL P DPL DT TYPE
Table 2-7. TYPE Field Definitions with DT = 0
TYPE (BITS 11-8) DESCRIPTION
0001 0010 0011 1001 1011
TSS-16 descriptor, task not busy. LDT descriptor. TSS-16 descriptor, task busy. TSS-32 descriptor, task not busy TSS-32 descriptor, task busy.
PRELIMINARY
2-17
®
System Register Set
Advancing the Standards
Table 2-8. TYPE Field Definitions with DT = 1
TYPE E C/D R/W A APPLICATION DECRIPTOR INFORMATION
0 0 1 1 0 0 1 1 x x
0 1 0 1 x x x x x x
x x x x 0 1 0 1 x x
x x x x x x x x 0 1
data, expand up, limit is upper bound of segment data, expand down, limit is lower bound of segment executable, non-conforming executable, conforming (runs at privilege level of calling procedure) data, non-writable data, writable executable, non-readable executable, readable not-accessed accessed
2-18
PRELIMINARY
System Register Set
System Register Set
2
Gate Descriptors provide protection for executable segments operating at different privilege levels. Figure 2-9 illustrates the format for Gate Descriptors and Table 2-9 lists the corresponding bit definitions. Task Gate Descriptors are used to switch the CPU's context during a task switch. The selector portion of the task gate descriptor locates a Task State Segment. These descriptors can be located in the GDT, LDT or IDT tables.
Interrupt Gate Descriptors are used to enter a hardware interrupt service routine. Trap Gate Descriptors are used to enter exceptions or software interrupt service routines. Trap Gate and Interrupt Gate Descriptors can only be located in the IDT. Call Gate Descriptors are used to enter a procedure (subroutine) that executes at the same or a more privileged level. A Call Gate Descriptor primarily defines the procedure entry point and the procedure's privilege level.
13 12 11 8 7
31
OFFSET 31-16
16 15 14
0 PARAMETERS +4 +0
1707903
P
DPL
0
TYPE OFFSET 15-0
0 0 0
SELECTOR 15-0
Figure 2-9. Table 2-9.
BIT POSITION MEMORY OFFSET NAME
Gate Descriptor
Gate Descriptor Bit Definitions
DESCRIPTION
31-16 15-0 31-16 15 14-13 11-8
+4 +0 +0 +4 +4 +4
OFFSET SELECTOR P DPL TYPE
Offset used during a call gate to calculate the branch target.
4-0
+4
Segment selector used during a call gate to calculate the branch target. Segment present. Descriptor privilege level. Segment type: 0100 = 16-bit call gate 0101 = task gate 0110 = 16-bit interrupt gate 0111 = 16-bit trap gate 1100 = 32-bit call gate 1110 = 32-bit interrupt gate 1111 = 32-bit trap gate. PARAMETERS Number of 32-bit parameters to copy from the caller's stack to the called procedure's stack (valid for calls).
PRELIMINARY
2-19
®
System Register Set
Advancing the Standards
2.4.3
Task Register
The Task Register (TR) holds a 16-bit selector for the current Task State Segment (TSS) table as shown in Figure 2-10. The TR is loaded and stored via the LTR and STR instructions, respectively. The TR can only be accessed during protected mode and can only be loaded when the privilege level is 0 (most privileged). When the TR is loaded, the TR selector field indexes a TSS descriptor that must reside in the Global
Descriptor Table (GDT). The contents of the selected descriptor are cached on-chip in the hidden portion of the TR. During task switching, the processor saves the current CPU state in the TSS before starting a new task. The TR points to the current TSS. The TSS can be either a 386/486-style 32-bit TSS (Figure 2-11, Page 2-21) or a 286-style 16-bit TSS type (Figure 2-12, Page 2-22). An I/O permission bit map is referenced in the 32-bit TSS by the I/O Map Base Address.
15 SELECTOR
0
1708103
Figure 2-10.
Task Register
2-20
PRELIMINARY
System Register Set
2
31 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 I/O 0 0 0 0 0 0 0 0 0 0 0 0 0 0 MAP BASE 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ADDRESS 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ESP 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ESP 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ESP 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 = RESERVED.
0 16 15 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 T +64h 0 SELECTOR FOR TASK'S LDT +60h 0 GS +5Ch 0 FS +58h DS 0 +54h 0 SS +50h CS 0 +4Ch 0 ES +48h EDI +44h ESI +40h EBP +3Ch ESP +38h EBX +34h EDX +30h ECX +2Ch EAX +28h EFLAGS +24h EIP +20h CR3 +1Ch SS for CPL = 2 0 +18h for CPL = 2 +14h SS for CPL = 1 0 +10h for CPL = 1 +Ch SS for CPL = 0 0 +8h for CPL = 0 +4h 0 BACK LINK (OLD TSS SELECTOR) +0h
1708203
Figure 2-11.
32-Bit Task State Segment (TSS) Table
PRELIMINARY
2-21
®
System Register Set
Advancing the Standards
SELECTOR FOR TASK'S LDT
+2Ah
DS SS CS ES DI SI BP SP BX DX CX AX FLAGS IP SS FOR PRIVILEGE LEVEL 2 SP FOR PRIVILEGE LEVEL 2
SS FOR PRIVILEGE LEVEL 1
+28h +26h +24h +22h
+20h
+1Eh
+1Ch
+1Ah +18h +16h +14h
+12h
+10h +Eh +Ch +Ah +8h +6h +4h +2h +0h
SP FOR PRIVILEGE LEVEL 1
SS FOR PRIVILEGE LEVEL 0
SP FOR PRIVILEGE LEVEL 0 BACK LINK (OLD TSS SELECTOR)
1708803
Figure 2-12. 2-22
16-Bit Task State Segment (TSS) Table PRELIMINARY
System Register Set
2
2.4.4
6x86 Configuration Registers
CCR3 are set to 1h. See Figure 2-16 (Page 2-28) for more information on the MAPEN(3-0) bit locations. If MAPEN[3-0] = 1h, any access to indexes in the range 00-FFh will not create external I/O bus cycles. Registers with indexes C0-CFh, FE, FFh are accessible regardless of the state of MAPEN[3-0]. If the register index number is outside the C0-CFh or FE-FFh ranges, and MAPEN[3-0] are set to 0h, external I/O bus cycles occur. Table 2-10 (Page 2-24) lists the MAPEN[3-0] values required to access each 6x86 configuration register. All bits in the configuration registers are initialized to zero following reset unless specified otherwise. Valid register index numbers include C0h to E3h, E8h, E9h, FEh and FFh (if MAPEN[3-0] = 1). 2.4.4.1 Configuration Control Registers
A set of 24 on-chip 6x86 configuration registers are used to enable features in the 6x86 CPU. These registers assign non-cached memory areas, set up SMM, provide CPU identification information and control various features such as cache write policy, and bus locking control. There are four groups of registers within the 6x86 configuration register set:
· · · ·
6 Configuration Control Registers (CCRx) 8 Address Region Registers (ARRx) 8 Region Control Registers (RCRx) 2 Device Identification Registers (DIRx)
Access to the configuration registers is achieved by writing the register index number for the configuration register to I/O port 22h. I/O port 23h is then used for data transfer. Each I/O port 23h data transfer must be preceded by a valid I/O port 22h register index selection. Otherwise, the current 22h, and the second and later I/O port 23h operations communicate through the I/O port to produce external I/O cycles. All reads from I/O port 22h produce external I/O cycles. Accesses that hit within the on-chip configuration registers do not generate external I/O cycles. After reset, configuration registers with indexes CO-CFh and FE-FFh are accessible. To prevent potential conflicts with other devices which may use ports 22 and 23h to access their registers, the remaining registers (indexes D0-FDh) are accessible only if the MAPEN(3-0) bits in
(CCR0 - CCR5) control several functions, including non-cacheable memory, write-back regions, and SMM features. A list of the configuration registers is listed in Table 2-10 (Page 2-24). The configuration registers are described in greater detail in the following pages.
PRELIMINARY
2-23
®
System Register Set
Advancing the Standards
Table 2-10.
REGISTER NAME
6x86 CPU Configuration Registers
ACRONYM REGISTER INDEX WIDTH (Bits) MAPEN VALUE NEEDED FOR ACCESS
Configuration Control 0 Configuration Control 1 Configuration Control 2 Configuration Control 3 Configuration Control 4 Configuration Control 5 Address Region 0 Address Region 1 Address Region 2 Address Region 3 Address Region 4 Address Region 5 Address Region 6 Address Region 7 Region Control 0 Region Control 1 Region Control 2 Region Control 3 Region Control 4 Region Control 5 Region Control 6 Region Control 7 Device Identification 0 Device Identification 1
Note: x = Don't Care
CCR0 CCR1 CCR2 CCR3 CCR4 CCR5 ARR0 ARR1 ARR2 ARR3 ARR4 ARR5 ARR6 ARR7 RCR0 RCR1 RCR2 RCR3 RCR4 RCR5 RCR6 RCR7 DIR0 DIR1
C0h C1h C2h C3h E8h E9h C4h - C6h C7h - C9h CAh - CCh CDh - CFh D0h - D2h D3h - D5h D6h - D8h D9h - DBh DCh DDh DEh DFh E0h E1h E2h E3h FEh FFh
8 8 8 8 8 8 24 24 24 24 24 24 24 24 8 8 8 8 8 8 8 8 8 8
x x x x 1 1 x x x x 1 1 1 1 1 1 1 1 1 1 1 1 x x
2-24
PRELIMINARY
System Register Set
2
0
7 Reserved
6 Reserved
5 Reserved
4 Reserved
3 Reserved
2 Reserved
1 NC1
Reserved
Figure 2-13. 6x86 Configuration Control Register 0 (CCR0) Table 2-11. CCR0 Bit Definitions
BIT POSITION NAME DESCRIPTION
1
NC1
No Cache 640 KByte - 1 MByte If = 1: Address region 640 KByte to 1 MByte is non-cacheable. If = 0: Address region 640 KByte to 1 MByte is cacheable.
Note: Bits 0, 2 through 7 are reserved.
PRELIMINARY
2-25
®
System Register Set
Advancing the Standards
7 SM3
6 Reserved
5 Reserved
4
NO_LOCK
3 Reserved
2 SMAC
1 USE_SMI
0 Reserved
Figure 2-14. 6x86 Configuration Control Register 1 (CCR1) Table 2-12. CCR1 Bit Definitions
BIT POSITION NAME DESCRIPTION
1
2
4
7
Enable SMM and SMIACT# Pins If = 1: SMI# and SMIACT# pins are enabled. If = 0: SMI# pin ignored and SMIACT# pin is driven inactive. SMAC System Management Memory Access If = 1: Any access to addresses within the SMM address space, access system management memory instead of main memory. SMI# input is ignored. Used when initializing or testing SMM memory. If = 0: No effect on access. NO_LOCK Negate LOCK# If = 1: All bus cycles are issued with LOCK# pin negated except page table accesses and interrupt acknowledge cycles. Interrupt acknowledge cycles are executed as locked cycles even though LOCK# is negated. With NO_LOCK set, previously noncacheable locked cycles are executed as unlocked cycles and therefore, may be cached. This results in higher performance. Refer to Region Control Registers for information on eliminating locked CPU bus cycles only in specific address regions. SM3 SMM Address Space Address Region 3 If = 1: Address Region 3 is designated as SMM address space.
USE_SMI
Note: Bits 0, 3, 5 and 6 are reserved.
2-26
PRELIMINARY
System Register Set
2
0
7 USE_SUSP
6 Reserved
5 Reserved
4 WPR1
3 SUSP_HLT
2 LOCK_NW
1 Reserved
Reserved
Figure 2-15. 6x86 Configuration Control Register 2 (CCR2) Table 2-13. CCR2 Bit Definitions
BIT POSITION NAME DESCRIPTION
2
LOCK_NW
3
SUSP_HLT
4
WPR1
7
USE_SUSP
Lock NW If = 1: NW bit in CR0 becomes read only and the CPU ignores any writes to the NW bit. If = 0: NW bit in CR0 can be modified. Suspend on Halt If = 1: Execution of the HLT instruction causes the CPU to enter low power suspend mode. Write-Protect Region 1 If = 1: Designates any cacheable accesses in 640 KByte to 1 MByte address region are write protected. Use Suspend Mode (Enable Suspend Pins) If = 1: SUSP# and SUSPA# pins are enabled. If = 0: SUSP# pin is ignored and SUSPA# pin floats.
Note: Bits 0,1, 5 and 6 are reserved.
PRELIMINARY
2-27
®
System Register Set
Advancing the Standards
7
6 MAPEN
5
4
3 Reserved
2 LINBRST
1 NMI_EN
0 SMI_LOCK
Figure 2-16. 6x86 Configuration Control Register 3 (CCR3) Table 2-14. CCR3 Bit Definitions
BIT POSITION NAME DESCRIPTION
0
SMI_LOCK
1
NMI_EN
2
LINBRST
4-7
MAPEN
SMI Lock If = 1: The following SMM configuration bits can only be modified while in an SMI service routine: CCR1: USE_SMI, SMAC, SM3 CCR3: NMI_EN ARR3: Starting address and block size. Once set, the features locked by SMI_LOCK cannot be unlocked until the RESET pin is asserted. NMI Enable If = 1: NMI interrupt is recognized while servicing an SMI interrupt. NMI_EN should be set only while in SMM, after the appropriate SMI interrupt service routine has been setup. If = 1: Use linear address sequence during burst cycles. If = 0: Use "1 + 4" address sequence during burst cycles. The "1 + 4" address sequence is compatible with Pentium's burst address sequence. MAP Enable If = 1h: All configuration registers are accessible. If = 0h: Only configuration registers with indexes C0-CFh, FEh and FFh are accessible.
Note: Bit 3 is reserved.
2-28
PRELIMINARY
System Register Set
2
7 CPUID
6 Reserved
5 Reserved
4 DTE_EN
3 Reserved
2
1 IORT
0
Figure 2-17. 6x86 Configuration Control Register 4 (CCR4) Table 2-15. CCR4 Bit Definitions
BIT POSITION NAME DESCRIPTION
0-2
IORT
4 7
DTE_EN CPUID
I/O Recovery Time Specifies the minimum number of bus clocks between I/O accesses: 0h = 1 clock delay 1h = 2 clock delay 2h = 4 clock delay 3h = 8 clock delay 4h = 16 clock delay 5h = 32 clock delay (default value after RESET) 6h = 64 clock delay 7h = no delay Enable Directory Table Entry Cache If = 1: the Directory Table Entry cache is enabled. Enable CPUID instruction. If = 1: the ID bit in the EFLAGS register can be modified and execution of the CPUID instruction occurs as documented in section 6.3. If = 0: the ID bit in the EFLAGS register can not be modified and execution of the CPUID instruction causes an invalid opcode exception.
Note: Bits 3 and bits 5 and 6 are reserved.
.
PRELIMINARY
2-29
®
System Register Set
Advancing the Standards
7 Reserved
6 Reserved
5 ARREN
4 LBR1
3 Reserved
2 Reserved
1 Reserved
0 WT_ALLOC
Figure 2-18. 6x86 Configuration Control Register 5 (CCR5) Table 2-16. CCR5 Bit Definitions
BIT POSITION NAME DESCRIPTION
0
WT_ALLOC
4
LBR1
5
ARREN
Write-Through Allocate If = 1: New cache lines are allocated for read and write misses. If = 0: New cache lines are allocated only for read misses. Local Bus Region 1 If = 1: LBA# pin is asserted for all accesses to the 640 KByte to 1 MByte address region. Enable ARR Registers If = 1: Enables all ARR registers. If = 0: Disables the ARR registers. If SM3 is set, ARR3 is enabled regardless of the setting of ARREN.
Note: Bits 1 through 3 and 6 though 7 are reserved.
2-30
PRELIMINARY
System Register Set
2
2.4.4.2
Address Region Registers
RCRs, the region is not cached. The RCRs take precedence in this case. A register index, shown in Table 2-17 (Page 2-32) is used to select one of three bytes in each ARR. The starting address of the ARR address region, selected by the START ADDRESS field, must be on a block size boundary. For example, a 128 KByte block is allowed to have a starting address of 0 KBytes, 128 KBytes, 256 KBytes, and so on. The SIZE field bit definition is listed in Table 2-18 (Page 2-32). If the SIZE field is zero, the address region is of zero size and thus disabled.
The Address Region Registers (ARR0 - ARR7) (Figure 2-19) are used to specify the location and size for the eight address regions. Attributes for each address region are specified in the Region Control Registers (RCR0-RCR7). ARR7 and RCR7 are used to define system main memory and differ from ARR0-6 and RCR0-6. With non-cacheable regions defined on-chip, the 6x86 CPU delievers optimum performance by using advanced techniques to eliminate data dependencies and resource conflicts in its execution pipelines. If KEN# is active for accesses to regions defined as non-cacheable by the
START ADDRESS Memory Address Bits A31-A24 7 0 7 Memory Address Bits A23-A16 Memory Address Bits A15-A12 0 7 4 3
SIZE Size Bits 3-0 0
Figure 2-19. Address Region Registers (ARR0 - ARR7)
PRELIMINARY
2-31
®
System Register Set
Advancing the Standards
Table 2-17. ARR0 - ARR7 Register Index Assignments
ARR Register Memory Address (A31 - A24) Memory Address (A23 - A16) Memory Address (A15 - A12) Address Region Size (3 - 0)
ARR0 ARR1 ARR2 ARR3 ARR4 ARR5 ARR6 ARR7
C4h C7h CAh CDh D0h D3h D6h D9h
C5h C8h CBh CEh D1h D4h D7h DAh
C6h C9h CCh CFh D2h D5h D8h DBh
C6h C9h CCh CFh D2h D5h D8h DBh
.
Table 2-18. Bit Definitions for SIZE Field
SIZE (3-0) BLOCK SIZE ARR0-6 ARR7 SIZE (3-0) BLOCK SIZE ARR0-6 ARR7
0h 1h 2h 3h 4h 5h 6h 7h
Disabled 4 KBytes 8 KBytes 16 KBytes 32 KBytes 64 KBytes 128 KBytes 256 KBytes
Disabled 256 KBytes 512 KBytes 1 MBytes 2 MBytes 4 MBytes 8 MBytes 16 MBytes
8h 9h Ah Bh Ch Dh Eh Fh
512 KBytes 1 MBytes 2 MBytes 4 MBytes 8 MBytes 16 MBytes 32 MBytes 4 GBytes
32 MBytes 64 MBytes 128 MBytes 256 MBytes 512 MBytes 1 GBytes 2 GBytes 4 GBytes
2-32
PRELIMINARY
System Register Set
2
2.4.4.3
Region Control Registers
The Region Control Registers (RCR0 - RCR7) specify the attributes associated with the ARRx address regions. The bit definitions for the region control registers are shown in Figure 2-20 (Page 2-34) and in Table 2-19 (Page 2-34). Cacheability, weak write ordering, weak locking, write gathering, cache write through policies and control of the LBA# pin can be activated or deactivated using the attribute bits. If an address is accessed that is not in a memory region defined by the ARRx registers, the following conditions will apply:
Overlapping Conditions Defined. If two regions specified by ARRx registers overlap and conflicting attributes are specified, the following attributes take precedence:
· · · · · ·
LBA# pin is asserted Write-back is disabled Writes are not gathered Strong locking takes place Strong write ordering takes place The overlapping regions are non-cacheable.
· LBA# pin is asserted · If the memory address is cached, · · · ·
write-back is enabled if WB/WT# is returned high. Writes are not gathered Strong locking takes place Strong write ordering takes place The memory access is cached, if KEN# is returned asserted.
PRELIMINARY
2-33
®
System Register Set
Advancing the Standards
7 Reserved
6 Reserved
5 NLB
4 WT
3 WG
2 WL
1 WWO
0 RCD / RCE*
*Note: RCD is defined for RCR0-RCR6. RCE is defined for RCR7.
Figure 2-20. Region Control Registers (RCR0-RCR7)
Table 2-19. RCR0-RCR7 Bit Definitions
RCRx BIT POSITION NAME DESCRIPTION
0-6 7 0-7 0-7 0-7 0-7 0-7
0 0 1 2 3 4 5
RCD RCE WWO WL WG WT NLB
If = 1: Disables caching for address region specified by ARRx. If = 1: Enables caching for address region ARR7. If = 1: Weak write ordering for address region specified by ARRx. If = 1: Weak locking for address region specified by ARRx. If = 1: Write gathering for address region specified by ARRx. If = 1: Address region specified by ARRx is write-through. If = 1:LBA# pin is not asserted for access to address region specified by ARRx
Note: Bits 6 and 7 are reserved.
Region Cache Disable (RCD). Setting RCD to a one defines the address region as non-cacheable. Whenever possible, the RCRs should be used to define non-cacheable regions rather than using external address decoding and driving the KEN# pin. Region Cache Enable (RCE). Setting RCE to a one defines the address region as cacheable. RCE is used to define the system main memory as cacheable memory. It is implied that memory outside the region is non-cacheable. Weak Write Ordering (WWO). Setting WWO=1 enables weak write ordering for that address region. Enabling WWO allows the 6x86 CPU to issue writes in its internal cache in an order different than their order in the code stream. External writes always occur in order (strong ordering). Therefore,
2-34
this should only be enabled for memory regions that are NOT sensitive to this condition. WWO should not be enabled for memory mapped I/O. WWO only applies to memory regions that have been cached and designated as write-back. It also applies to previously cached addresses even if the cache has been disabled (CD=1). Enabling WWO removes the write-ordering restriction and improves performance due to reduced pipeline stalls. Weak Locking (WL). Setting WL=1 enables weak locking for that address region. With WL enabled, all bus cycles are issued with the LOCK# pin negated except for page table accesses and interrupt ackowleddge cycles. Interrupt acknowledge cycles are executed as locked cycles even though LOCK# is negated. With WL=1, previously non-cacheable locked cycles are executed as unlocked cycles and therefore, may be cached, resulting in higher performance. The
PRELIMINARY
System Register Set
2
NO_LOCK bit of CCR1 enables weak locking for the entire address space. The WL bit allows weak locking only for specific address regions. WL is independent of the cacheability of the address region. Write Gathering (WG). Setting WG=1 enables write gathering for the associated address region. Write gathering allows multiple byte, word, or dword sequential address writes to accumulate in the on-chip write buffer. (As instructions are executed, the results are placed in a series of output buffers. These buffers are gathered into the finial output buffer). When access is made to a non-sequential memory location or when the 8-byte buffer becomes full, the contents of the buffer are written on the external 64-bit data bus. Performance is enhanced by avoiding as many as seven memory write cycles.
WG should not be used on memory regions that are sensitive to write cycle gathering. WG can be enabled for both cacheable and non-cacheable regions. Write Through (WT). Setting WT=1 defines the address region as write-through instead of write-back, assuming the region is cacheable. Regions where system ROM are loaded (shadowed or not) should be defined as write-through. LBA# Not Asserted (NLB). Setting NLB=1 prevents the microprocessor from asserting the Local Bus Access (LBA#) output pin for accesses to that address region. The RCR regions may be used to define non-local bus address regions. The LBA# pin could then be asserted for all regions, except those defined by the RCRs. The LBA# signal may be used by the external hardware (e.g., chipsets) as an indication that local bus accesses are occurring.
PRELIMINARY
2-35
®
System Register Set
Advancing the Standards
2.4.4.4
Device Identification Registers
The Device Identification Registers (DIR0, DIR1) contain CPU identification, CPU stepping and CPU revision information. Bit definitions are shown in Figure 2-21, Table 2-20, Figure 2-22 and Table 2-21 respectively. Data in these registers cannot be changed. These registers can be read by using I/O ports 22 and 23. The register index for DIR0 is FEh and the register index for DIR1 is FFh.
7 DEVID
0
Figure 2-21. Device Identification Register 0 (DIR0)
Table 2-20. DIR0 Bit Definitions
BIT NAME POSITION DESCRIPTION
7-0
DEVID CPU Device Identification Number (read only).
7 SID
4 3 RID
0
Figure 2-22. Device Identification Register 1 (DIR1)
Table 2-21. DIR1 Bit Definitions
BIT POSITION NAME DESCRIPTION
7-4 3-0
SID RID
CPU Step Identification Number (read only). CPU Revision Identification (read only).
2-36
PRELIMINARY
System Register Set
2
2.4.5
Debug Registers
Six debug registers (DR0-DR3, DR6 and DR7), shown in Figure 2-23, support debugging on the 6x86 CPU. The bit definitions for the debug registers are listed in Table 2-22 (Page 2-38). Memory addresses loaded in the debug registers, referred to as "breakpoints", generate a debug exception when a memory access of the specified type occurs to the specified address. A data breakpoint can be specified for a particular kind of memory access such as a read or a write. Code breakpoints can also be set allowing debug exceptions to occur whenever a given code access (execution) occurs. The size of the debug target can be set to 1, 2, or 4 bytes. The debug registers are accessed via MOV instructions which can be executed only at privilege level 0.
The Debug Address Registers (DR0-DR3) each contain the linear address for one of four possible breakpoints. Each breakpoint is further specified by bits in the Debug Control Register (DR7). For each breakpoint address in DR0-DR3, there are corresponding fields L, R/W, and LEN in DR7 that specify the type of memory access associated with the breakpoint. The R/W field can be used to specify instruction execution as well as data access breakpoints. Instruction execution breakpoints are always taken before execution of the instruction that matches the breakpoint. The Debug Status Register (DR6) reflects conditions that were in effect at the time the debug exception occurred. The contents of the DR6 register are not automatically cleared by the processor after a debug exception occurs and, therefore, should be cleared by software at the appropriate time.
3 3 1 0 LEN 3
2 9
2 8
2 7
2 6
2 5
2 2 4 3
2 2 2 1
2 1 0 9
1 8
1 7
1 1 6 5
1 4
1 1 1 1 9 3 2 1 0 G G 0 0 1 D E 0 0 1 1 1
8
7
6 L 3 1
5 G 2 1
4 L 2 1
3 G 1 B 3
2 L 1 B 2
1 G 0 B 1
0 L 0 B 0 DR7 DR6
R/W 3 0 0
LEN 2 0 0
R/W 2 0 0
LEN 1 0 0
R/W 1 0 0
LEN 0 0 0
R/W 0 0 0
0 0 B T B S
L G E 3 1 1
0
0
BREAKPOINT 3 LINEAR ADDRESS
DR3 DR2
DR1
BREAKPOINT 2 LINEAR ADDRESS
BREAKPOINT 1 LINEAR ADDRESS BREAKPOINT 0 LINEAR ADDRESS
ALL BITS MARKED AS 0 OR 1 ARE RESERVED AND SHOULD NOT BE MODIFIED.
DR0
1 7 03 2 03
Figure 2-23. Debug Registers
PRELIMINARY
2-37
®
System Register Set
Advancing the Standards
Code execution breakpoints may also be generated by placing the breakpoint instruction (INT 3) at the location where control is to be regained. Additionally, the single-step feature may be enabled by setting the TF flag in the EFLAGS register. This causes the processor to perform a debug exception after the execution of every instruction.
Table 2-22. DR6 and DR7 Debug Register Field Definitions
REGISTER FIELD NUMBER OF BITS DESCRIPTION
DR6
Bi
1
BT BS DR7 R/Wi
1 1 2
LENi
2
Gi Li GD
1 1 1
Bi is set by the processor if the conditions described by DRi, R/Wi, and LENi occurred when the debug exception occurred, even if the breakpoint is not enabled via the Gi or Li bits. BT is set by the processor before entering the debug handler if a task switch has occurred to a task with the T bit in the TSS set. BS is set by the processor if the debug exception was triggered by the single-step execution mode (TF flag in EFLAGS set). Specifies type of break for the linear address in DR0, DR1, DR3, DR4: 00 - Break on instruction execution only 01 - Break on data writes only 10 - Not used 11 - Break on data reads or writes. Specifies length of the linear address in DR0, DR1, DR3, DR4: 00 - One byte length 01 - Two byte length 10 - Not used 11 - Four byte length. If set to a 1, breakpoint in DRi is globally enabled for all tasks and is not cleared by the processor as the result of a task switch. If set to a 1, breakpoint in DRi is locally enabled for the current task and is cleared by the processor as the result of a task switch. Global disable of debug register access. GD bit is cleared whenever a debug exception occurs.
2-38
PRELIMINARY
System Register Set
2
2.4.6
Test Registers
The test registers can be used to test the on-chip unified cache and to test the main TLB. The test registers are also used to enable 6x86 CPU variable-size paging. Test registers TR3, TR4, and TR5 are used to test the unified cache. Use of these registers is described with the memory caches later in this chapter in Section 2.7.1.1. Test registers TR6 and TR7 are used to test the TLB. Use of these test registers is described in Section 2.6.4.2.
PRELIMINARY
2-39
®
Address Space
Advancing the Standards
2.5
Address Space memory space can be accessed using byte, word (16 bits), or doubleword (32 bits) format. Words and doublewords are stored in consecutive memory bytes with the low-order byte located in the lowest address. The physical address of a word or doubleword is the byte address of the low-order byte.
The 6x86 CPU can directly address 64 KBytes of I/O space and 4 GBytes of physical memory (Figure 2-24). Memory Address Space. Access can be made to memory addresses between 0000 0000h and FFFF FFFFh. This 4 GByte
Physical Memory Space
I/O Address Space FFFF FFFFh
FFFF FFFFh
Physical Memory 4 GBytes
Not Accessible
0000 FFFFh 64 KBytes 0000 0000h 0000 0000h
6x86 Configuration Register I/O Space 0000 0023h 0000 0022h
1730900
Figure 2-24. Memory and I/O Address Spaces
2-40
PRELIMINARY
Memory Addressing Methods
2
I/O Address Space The 6x86 I/O address space is accessed using IN and OUT instructions to addresses referred to as "ports". The accessible I/O address space size is 64 KBytes and can be accessed through 8-bit, 16-bit or 32-bit ports. The execution of any IN or OUT instruction causes the M/IO# pin to be driven low, thereby selecting the I/O space instead of memory space. The accessible I/O address space ranges between locations 0000 0000h and 0000 FFFFh (64 KBytes). The I/O locations (ports) 22h and 23h can be used to access the 6x86 configuration registers.
2.6
Memory Addressing Methods
With the 6x86 CPU, memory can be addressed using nine different addressing modes (Table 2-23, Page 2-42). These addressing modes are used to calculate an offset address often referred to as an effective address. Depending on the operating mode of the CPU, the offset is then combined using memory management mechanisms to create a physical address that actually addresses the physical memory devices. Memory management mechanisms on the 6x86 CPU consist of segmentation and paging. Segmentation allows each program to use several independent, protected address spaces. Paging supports a memory subsystem that simulates a large address space using a small amount of RAM and disk storage for physical memory. Either or both of these mechanisms can be used for management of the 6x86 CPU memory address space.
PRELIMINARY
2-41
®
Memory Addressing Methods
Advancing the Standards
2.6.1
Offset Mechanism
The offset mechanism computes an offset (effective) address by adding together one or more of three values: a base, an index and a displacement. When present, the base is the value of one of the eight 32-bit general registers. The index if present, like the base, is a value that is in one of the eight 32-bit general purpose registers (not including the ESP register). The index differs from the base in that the index is first multiplied by a scale factor of 1, 2, 4 or 8 before the summation is made. The third component added to the memory address calculation is the displacement. The displacement is a value of up to 32-bits in length supplied as part of the instruction. Figure 2-25 illustrates the calculation of the offset address. Nine valid combinations of the base, index, scale factor and displacement can be used with the 6x86 CPU instruction set. These combinations are listed in Table 2-23. The base and index both refer to contents of a register as indicated by [Base] and [Index].
Table 2-23.
ADDRESSING MODE BASE INDEX
Index
Base
Displacement
Scaling x1, x2, x4, x8
Offset Address (Effective Address)
1706603
Figure 2-25.
Offset Address Calculation
Memory Addressing Modes
SCALE FACTOR (SF) DISPLACEMENT (DP) OFFSET ADDRESS (OA) CALCULATION
Direct Register Indirect Based Index Scaled Index Based Index Based Scaled Index Based Index with Displacement Based Scaled Index with Displacement
x x x x x x x x x x x x x x x x x
x x x x
OA = DP OA = [BASE] OA = [BASE] + DP OA = [INDEX] + DP OA = ([INDEX] * SF) + DP OA = [BASE] + [INDEX] OA = [BASE] + ([INDEX] * SF) OA = [BASE] + [INDEX] + DP OA = [BASE] + ([INDEX] * SF) + DP
2-42
PRELIMINARY
Memory Addressing Methods
2
2.6.2
Memory Addressing
Protected Mode Memory Addressing In protected mode three mechanisms calculate a physical memory address (Figure 2-27, Page 2-44).
Real Mode Memory Addressing In real mode operation, the 6x86 CPU only addresses the lowest 1 MByte of memory. To calculate a physical memory address, the 16-bit segment base address located in the selected segment register is multiplied by 16 and then the 16-bit offset address is added. The resulting 20-bit address is then extended. Three hexadecimal zeros are added as upper address bits to create the 32-bit physical address. Figure 2-26 illustrates the real mode address calculation. The addition of the base address and the offset address may result in a carry. Therefore, the resulting address may actually contain up to 21 significant address bits that can address memory in the first 64 KBytes above 1 MByte.
· Offset Mechanism that produces the
offset or effective address as in real mode.
· Selector Mechanism that produces the
base address. · Optional Paging Mechanism that translates a linear address to the physical memory address. The offset and base address are added together to produce the linear address. If paging is not enabled, the linear address is used as the physical memory address. If paging is enabled, the paging mechanism is used to translate the linear address into the physical address. The offset mechanism is described earlier in this section and applies to both real and protected mode. The selector and paging mechanisms are described in the following paragraphs.
000h Offset Address Offset Mechanism
16 12
+
Selected Segment Register
16
20
32
Linear Address (Physical Address)
X 16
20
1708304
Figure 2-26.
Real Mode Address Calculation
PRELIMINARY
2-43
®
Memory Addressing Methods
Advancing the Standards
Offset Mechanism
32
Offset Address
32
Linear Address
32
Selector Mechanism
Segment Base Address
Optional Paging Mechanism
32
Physical Memory Address
1706504
Figure 2-27.
Protected Mode Address Calculation
2.6.3
Selector Mechanism
Using segmentation, memory is divided into an arbitrary number of segments, each containing usually much less than the 232 byte (4 GByte) maximum. The six segment registers (CS, DS, SS, ES, FS and GS) each contain a 16-bit selector that is used when the register is loaded to locate a segment descriptor in either the global descriptor table (GDT) or the local descri