This file includes new knowledge about many Intel processors and their clones.
If you're writing system software, then you should read this file. Thank you!
(C) Copyright Christian Ludloff
(M) 07/1994 Dallas, Texas, USA
(P) 01.03.1996
(V) 3.2.2 eMail : ludloff@anet-dfw.com
(?) 80x86.CPU webpage : http://webusers.anet-dfw.com/~ludloff
This file is mine! And remember: What's mine is mine!
Please, send updates or corrections directly to me and do not modify this file
yourself. I will mention your name at the end of the file when adding your new
knowledge. That's the only way to fight against xxx versions. Thank you!
==============================================================================
The new flags in the EFLAGS register
====================================
------------------------------------------------------------------------------
bit description
------------------------------------------------------------------------------
21 CPUID instruction support flag
If you can use this bit (set/reset), then your CPU supports the new
CPUID instruction. So you must not install a handler for the invalid
opcode exception before you execute this new processor instruction.
20 VIP - Virtual Interrupt Pending flag
19 VIF - Virtual Interrupt Flag
These two bits are used by the virtual interrupt feature of the V86-
enhanced CPUs from Intel. You can use the CPUID instruction to check
your processor for the support of this feature.
------------------------------------------------------------------------------
The new Control Register CR4
============================
This register contains some flag bits to enable or disable the new features.
You will find it only on iPentium processors and on some newer Intel CPUs. To
find out, whether your CPU contains the CR4 or not, you should use the CPUID
instruction (feature flags). If your processor supports the enhanced virtual
mode, then it will support at least bit 0 and 1 of CR4 (as the newer i486 do).
A good method is comparing the CPUID feature flags from EDX with a mask 209Eh:
it indicates all features which "cause" the presence of the CR4. Do not try to
set bits, which are not supported by your CR4 register!
------------------------------------------------------------------------------
bit description
------------------------------------------------------------------------------
31..7 reserved
8 PCE - enable read performance counter instruction (iPentiumPro)
1=enable RDPMC instruction for CPL=0 only
0=enable RDPMC instruction for all CPLs
7 PGE - page global enable (iPentiumPro)
6 MCE - enable machine check exception (new; exception #12h)
1=enable the machine check exception
0=disable the machine check exception (like a i486)
5 PAE - physical address extension enable (iPentiumPro)
4 PSE - enable page size extension
1=enable the 4MB pages
0=disable the 4MB pages (like a i486)
3 DE - enable debugging extension
1=enable the I/O breakpoints (see DR7.R/W) and disable DR4/5 access
0=disable the I/O breakpoints (like a i486)
2 TSD - enable read time stamp counter instruction
1=enable RDTSC instruction for CPL=0 only
0=enable RDTSC instruction for all CPLs
1 PVI - enable protected mode virtual interrupts
1=enable virtual interrupts in protected mode
0=disable virtual interrupts in protected mode (like a i386)
0 VME - enable virtual mode virtual interrupts
1=enable virtual interrupts in virtual mode
0=disable virtual interrupts in virtual mode (like a i386)
------------------------------------------------------------------------------
The new Probe Mode Control Register
===================================
This register is normally visible through an iPentiumICE (In-Circuit-Emulator)
only. Nevertheless it can be accessed through MSR #8000:001Dh on the iPentium.
------------------------------------------------------------------------------
bit description
------------------------------------------------------------------------------
31 SMM (SMM active, read only, similar to former DR6.bit12)
1=SMM is active
0=SMM is not active
30..7 reserved
2 PB1 (performance monitoring or breakpoint monitoring, see MSR #11h.25)
1=pin PM1/BP1 monitors breakpoint #1 matches
0=pin PM1/BP1 monitors performance monitoring counter #1
1 PB0 (performance monitoring or breakpoint monitoring, see MSR #11h.9)
1=pin PM0/BP0 monitors breakpoint #0 matches
0=pin PM0/BP0 monitors performance monitoring counter #0
0 ICEBP (ICEBP enabled, similar to former DR7.bit12)
1=every debug exception activates PRDY and enters the Probe Mode
0=normal behaviour
------------------------------------------------------------------------------
The new R/W-bits in the Debug Register DR7
==========================================
R/W=1-0 - set a breakpoint for I/O accesses
(new; but if CR4.DE=0, then reserved like on i386)
The GD-bit in the Debug Register DR7
====================================
The DR7 contains the GD bit too (bit13). This bit is supported on the i386 and
the i486 too. If it is set to 1, then any access (read and write) to any Debug
register causes the exception #01h. The exception handler is called with GD=0,
so that it can access the Debug Registers. This former undocumented bit can be
used to crash almost all modern debuggers. But remember: If your own code trys
to set the GD bit to 1 and it is always set to 1, then your access to DR7 will
cause the exception #01h too! So I don't recommend you to use this bit, if you
want your software to run as stable and to be as compatible, as possible!
There's only one way, to clear the GD bit and you must be in real mode for the
following routine: install your own IDT by loading a new value to the IDTR and
create a handler for the exception #01h, which leaves the GD bit in DR7 set to
0 and which returns directly to the code, to re-install the old IDTR value. As
you can see, the GD-clearing is not possible (for CPL=3 code) in virtual mode,
because you have to install an 'incomplete' exception #01h handler.
The new implemented model specific registers MSR
================================================
Only the iPentium processor contains these new registers. They are 64 bit wide
and you must use EDX:EAX to handle them. You will find some MSRs on the newer
IBM 386/486SLC processors too. On the new iPentiumPro processor the MSRs are
included too, but Intel has changed their layout and their functions.
Here Intel implemented the Machine Check Exception Registers, the new added
Test Registers (old TR0-7 don't exist any longer!), the Time Stamp Counter and
the two Performance Monitoring Counters #0 and #1 with the Counter Control and
Event Selection Register.
------------------------------------------------------------------------------
MSR description (Intel Pentium processor only!)
------------------------------------------------------------------------------
00h MCA - machine check exception address register (read only)
This register contains the physical address after a data parity er-
ror occured on the CPU bus. This may end up in a machine check ex-
ception (#12h), when you enable it via CR4.MCE.
bit63..0 ADDRESS (64 bit wide)
------------------------------------------------------------------------------
01h MCT - machine check exception type register (read only)
Describes the type of the bus cycle if a machine check exception oc-
cured on your processor's bus.
bit63..6 reserved
bit5 THERR (1=thermal error, 0=no thermal error )
This bit is set to one, if the cooling fan is removed. The
THERR also indicates, if the cooling fan fails (fan state)
and the processor is set to 1:1 clock speed ratio (to save
power). The CHK bit will not be affected by the THERR bit!
bit4 LOCK-state (1=LOCK active, 0=LOCK inactive )
bit3 M/IO-state (1=memory access, 0=I/O access )
bit2 D/C-state (1=data access, 0=code access )
bit1 W/R-state (1=write, 0=read )
bit0 CHK-state (1=MSR #00/01h valid, 0=MSR #00/01h invalid)
------------------------------------------------------------------------------
02h TR1 - parity reversal test register ('write only')
bit63..14 reserved
bit13 MC microcode (reverse parity on read)
bit12 DTD data TLB data
bit11 DTT data TLB tag
bit10 DD data cache data (use byte writes for individual access)
bit9 DT data cache tag
bit8 ITD code TLB data
bit7 ITT code TLB tag
bit6 ID3 code cache data odd bits (255,253..131,129)
bit5 ID2 code cache data even bits (254,252..130,128)
bit4 ID1 code cache data odd bits (127,125..3,1)
bit3 ID0 code cache data even bits (126,124..2,0)
bit2 IT code (instruction) cache tag
bit1 NS no shutdown
1=assert IERR# only on parity error
0=assert IERR# and shutdown on parity error
bit0 PES parity error summary (read&write, set on any par. err.)
Writing a one into bits12..2 reverses the sense of the parity ge-
neration for any write into the corresponding array (for normal and
for testability accesses). For the microcode bad parity may be for-
ced on a read by setting TR1.MC to one.
------------------------------------------------------------------------------
03h reserved by Intel (don't try to read it)
------------------------------------------------------------------------------
04h TR2 - instruction cache end bit test register (read and write)
bit63..4 reserved
bit3..0 END BITS
These bits indicate instruction boundaries. If the given
byte is the last byte in an instruction, the corresponding
end bit is set to one. This mechanism aids the decode of
two variable length instructions per clock by providing
information on where the boundary between instructions is.
------------------------------------------------------------------------------
05h TR3 - cache data test register (read and write)
bit63..32 reserved
bit31..0 DATA
This is where the data is held on its way into or out of
the internal L1 cache.
------------------------------------------------------------------------------
06h TR4 - cache tag test register (read and write)
bit63..32 reserved
bit31..8 TAG
bit7..3 reserved
bit2 LRU
1=points to way #1 0=points to way #0
bit1..0 VALID
if TR5.CD=0 (code cache)
x-1=cache line valid x-0=cache line invalid
if TR5.CD=1 (data cache)
1-1=cache line in M state 1-0=cache line in E state
0-1=cache line in S state 0-0=cache line in I state
------------------------------------------------------------------------------
07h TR5 - cache control test register ('write only')
bit63..15 reserved
bit14 WB - selects writeback or writethrough
1=writeback (for that particular line; data cache only)
0=writethrough (for that particular line; both caches)
bit13 CD - selects code or data cache
1=data cache 0=code cache
bit12 ENTRY - selects one of the two ways in the cache
1=way #1 0=way #0
bit11..5 SET
0..127h - select one of the 128 sets
bit4..2 BUFFER
0..7h - select one of the 8 portions of a cache line to be
visible through TR3
bit1..0 CONTROL - select the operation
1-1=flush 1-0=testability read
0-1=testability write 0-0=normal operation
------------------------------------------------------------------------------
08h TR6 - TLB command test register (read and write)
bit63..32 reserved
bit31..12 LINEAR ADDRESS
bit11 V - valid state (valid or invalid TLB entry)
1=valid TLB-entry 0=invalid TLB-entry
bit10 D - dirty state (write access made to page; data TLB only)
1=write access was made 0=write access was not made
bit9 U - user state (privilege level access allowed)
1=CPL=0 0=CPL=0..3
bit8 W - writeable state (writes allowed; data TLB only)
1=allows writes 0=no writes, read only
bit7..3 reserved
bit2 PS - selects the page size (data TLB only)
1=4MB pages 0=4KB pages
bit1 CD - selects code or data TLB
1=data TLB 0=code TLB
bit0 OP - selects the operation
1=TLB read 0=TLB write
------------------------------------------------------------------------------
09h TR7 - TLB data test register (read and write)
bit63..32 reserved
bit31..12 PHYSICAL ADDRESS
bit11 PCD - page level cache disable bit (paging attribute PCD)
bit10 PWT - page level write through bit (paging attribute PWT)
bit9 L2 \
bit8 L1 > three LRU bits (entry to be replaced)
bit7 L0 /
bit6..5 reserved
bit4 H - hit indicator (set to 1 during testability writes)
1=input linear address matches a valid entry
0=input linear address don't matches a valid entry
bit3..2 ENTRY - select one of the four ways
testability write -> way to write
testability read -> way that resulted in a read hit
bit1..0 reserved
------------------------------------------------------------------------------
0Ah reserved by Intel (don't try to read it)
Because the iPentium A-step processor was supposed to include a 36bit-
addressing and 2MB-paging, there has been the TR8 too. But at the last
minute Intel has removed these features and the TR8 from the iPentium.
TR8 - TLB data test register (part II)
bit63..4 reserved
bit3..0 PHYSICAL ADDRESS (A35..A32)
------------------------------------------------------------------------------
0Bh TR9 - BTB tag test register (read and write)
bit63..32 reserved
bit31..6 TAG ADDRESS
bit5..2 reserved
bit1..0 HISTORY
------------------------------------------------------------------------------
0Ch TR10 - BTB target test register (read and write)
bit63..32 reserved
bit31..0 TARGET ADDRESS
------------------------------------------------------------------------------
0Dh TR11 - BTB control test register (read and write)
bit63..12 reserved
bit11..6 SET
0..63h - select one of the 64 sets to access
bit5..4 reserved
bit3..2 ENTRY - select a way
0..3h - select one of the four ways within the set
bit1..0 CONTROL - select the operation
1-1=flush 1-0=testability read
0-1=testability write 0-0=normal operation
------------------------------------------------------------------------------
0Eh TR12 - new feature control register ('write only')
bit63..15 ? reserved
bit14 II ignore interrupt (iP54C 052Bh, 052Ch)
1=ignore interrupt, asserted during a window that in-
terrupts are disabled (after CLI and before STI)
0=behave as earlier steppings
bit13..10 ? unknown
bit9 ITR interrupt priority
1=enable I/O instruction restart feature for the SMM
and change the interrupt priority
0=disable I/O instruction restart feature for the SMM
and use the standard interrupt priority
See Pentium Family User's Manual volume #1 (data book)
table 19-2 for some details. This bit should be suppor-
ted only on the iP54C models with the new added I/O in-
struction restart feature for the SMM.
bit8 fTR fast tracing (see TR12.TR too)
1=CPU generates fast branch-trace-message bus-cycles
0=CPU don't generates fast branch-trace-message bus-
cycles
The fast tracing feature should exist only on such Pen-
tium processors working with different ex- and internal
speeds (like the new iP54C model). So the new fast mes-
sages produce only the second bus-cycle.
bit7 FDP? unknown (but used!)
bit6 AHD auto halt disable (iP54C only)
1=auto halt feature disabled
0=auto halt feature enabled
bit5 ? unknown (but used!)
bit4 AD APIC disable (iP54C 0521h, 0522h, 0524h and 0525h only)
1=internal APIC disabled
0=internal APIC enabled
To re-enable the APIC, a warm reset of the part must be
performed, after clearing this bit.
bit3 CI cache inhibit
1=internal L1 cache disabled (L2 cache unchanged)
0=internal L1 cache enabled (L2 cache unchanged)
bit2 SE single pipe execution
1=v-pipeline disabled and not used
0=both pipelines enabled and used
bit1 TR tracing
1=CPU generates branch-trace-message bus-cycles for
the external execution control
0=CPU don't generates the branch-trace-message bus-
cycles
bit0 NBP no branch prediction
1=BTB not used (then a move to CR3 disables BTB use!)
0=BTB used to predict branches
------------------------------------------------------------------------------
0Fh reserved by Intel (don't try to read it)
------------------------------------------------------------------------------
10h time stamp counter (read and write)
This counter counts the internal CPU clock cycles since the last re-
set. It has a capacity of about 5850 years when you have a 100 MHz
processor. You can read the value via the RDTSC / RDMSR instruction.
bit63..0 time stamp counter value (64 bit wide, read/write)
------------------------------------------------------------------------------
11h counter event selection and control register (read and write)
This register controls the two internal counters #0 and #1. They can
be programmed to count about 40 different events.
bit63..32 reserved (for two more counters in future models?)
bit31..26 reserved
bit25 external pin PM1 selection
1=pin shows counter overflows
0=pin shows counter increments
bit24 counter type for counter #1
1=count clock cycles only
0=count events
bit23 enable counting in CPL=3 for counter #1
1=enable counting when CPL=3 ('count user software')
0=disable counting when CPL=3
bit22 enable couning in CPL=2..0 for counter #1
1=enable counting when CPL=2..0 ('count system overhead')
0=disable counting when CPL=2..0
bit21..16 event type to count with counter #1 (see list below!)
bit15..10 reserved
bit 9 external pin PM0 selection
1=pin shows counter overflows
0=pin shows counter increments
bit8 counter type for counter #0
1=count clock cycles only
0=count events
bit7 enable counting in CPL=3 for counter #0
1=enable counting when CPL=3 ('count user software')
0=disable counting when CPL=3
bit6 enable counting in CPL=2..0 for counter #0
1=enable counting when CPL=2..0 ('count system overhead')
0=disable counting when CPL=2..0
bit5..0 event type to count with counter #0 (see list below!)
------------------------------------------------------------------------------
12h counter #0 (read and write)
bit63..40 reserved
bit39..0 counter #0 value (40 bit wide)
------------------------------------------------------------------------------
13h counter #1 (read and write)
bit63..40 reserved
bit39..0 counter #1 value (40 bit wide)
------------------------------------------------------------------------------
14h APIC related? (only visible when the integrated APIC is enabled?)
------------------------------------------------------------------------------
>13/14h reserved by Intel (don't try to read them)
------------------------------------------------------------------------------
The IBM 386/486SLC processors include the following Model Specific Registers:
------------------------------------------------------------------------------
MSR description (IBM 386/486SLC and IBM 486BL3 'Blue Lightning' only!)
------------------------------------------------------------------------------
1000h processor operation register (IBM 386/486SLC)
bit63..19 reserved
bit18 LPPLA - low power PLA mode (IBM 486SLC only?)
1=power down additional dynamic parts during halt-state
0=don't power down these parts during low-power halt-state
bit17 BUSRD - factory read test (ignores cache, IBM 486SLC only?)
1=force all reads from ext. memory, even if cache is on
0=don't force all reads from external memory
bit16 CPGE - factory internal cache parity test (IBM 486SLC only?)
1=use odd parity (generates a cache parity error)
0=use even parity (normal operation)
bit15 CNPX - enable cacheability of floating point operand reads
1=boosts performance, if an external Cyrix FPU is used
0=normal operation (if an external Intel FPU is used!!!)
bit14 switch the ERROR input line...
1=...to a hidden memory address strobe output line
You can set this bit only at the first WRMSR after a CPU
reset. Further attempts at changing the bit are ignored!
0=...to the ERROR input pin to Intel compatible ERROR
bit13 LPH - low power halt mode (HLT stops internal clock)
1=enable low power halt mode
0=disable low power halt mode
bit12 XTOUT - wait for READY after output
1=the processor waits until READY is active after all out-
put instructions, before executing the next instruction
0=don't wait for READY
bit11 CRLD - cache reload status (set, when cache reload occurs)
bit10 IKEN - internal L1 cache enable set source
1=use MSR #1001h for the limits set
You can set this bit only at the first WRMSR after a CPU
reset. Further attempts at changing the bit are ignored!
0=use external hardware line input
bit9 DCLM - disable cache lock mode
1=allows the CPU to recognize the locked read-modify-write
cycle, but does not cache the line
0=normal operation
bit8 reserved for unknown function or unused
bit7 CE - enable internal L1 cache (not via CR0.CD!)
1=enable internal L1 cache
0=disable internal L1 cache
bit6 DBCS - disable caching for E0000h to E0FFFh (4K)
1=disable caching (if Double Byte Character Support used)
0=enable caching (if DBCS not used on japanes systems)
bit5 PMI - enable power interrupt PWI
1=enable power interrupt PWI
0=disable power interrupt PWI
bit4 ASNP - enable flush snooping
1=enable flush snooping (can be used, if bit3=0)
0=disable flush snooping
bit3 SNP - enable snoop input
1=enable snoop input
0=disable snoop input
bit2 A20M - enable A20 mask
1=line A20 disabled, unless paging is active (see CR0.PG)
0=external control or entire address range is accessable
bit1 CPC - enable cache parity
1=if a parity error occurs, then the internal L1 cache is
flushed, disabled (bit7=0), the flag is set (bit0=1) and
cache parity is disabled (bit1=0); NMI handler is called
0=disable cache parity
bit0 CPE - parity error occured
1=parity error occured (even, if bit1=1 -> no action)
0=no parity error occured (set bit0=0 to clear this flag)
------------------------------------------------------------------------------
1001h cache region control register (IBM 386/486SLC)
bit63..48 reserved
bit47..32 EMCL - extended memory cache limit
number of 64K blocks starting at the 1M boundary, that can
be cached (so 0Fh means 15MB are cacheable...)
bit31..16 LMRO - read only cache blocks
each bit represents a 64K region in the 1st MB, that has a
ROM memory (bit31=1 -> ROM at F000h...), a write into area
marked as ROM will not be updated in cache memory
bit15..0 LMC - first 1MB cacheable
each bit represents a 64K region in the first MB, that can
be cached (bit15=1 -> cache F000h ... bit0=1 -> cache 0h)
------------------------------------------------------------------------------
1002h processor clock control register (not on IBM 386SLC)
bit63..30 reserved
bit29 EDFS - enable external dynamic frequency shift
1=enable external dynamic frequency shift
0=disable external dynamic frequency shift
bit28 DFSRDY - dynamic frequency shift ready
1=CPU is ready for the shift (requested by hardware or by
setting bit27=1) -> clock can be changed
0=CPU is not ready for the shift
bit27 DFSREQ - dynamic frequency shift request
1=request the CPU to prepare for a clock input frq. change
0=normal operation
bit26..24 clock mode
000=1:1 (divide incoming clock by 2 (same as i386SX))
011=2:1 (use the incoming clock; make no divide; used for
doubling the internal CPU speed)
100=3:1 clock mode
bit23..0 reserved
------------------------------------------------------------------------------
1004h processor control register (at least IBM 486BL3)
bit63-24 reserved
bit23 OS2B - OS/2 boot
0=for DD1-hardware
1=for DD0-hardware: for OS/2 boot
bit22 CR0D - MOV CR0 decode
0=for DD0-, DD1A-, DD1B-, DD1D-hardware
1=for DD1C-hardware
bit21 reserved
bit20 CLP - cache low power
0=DD0: ever, DD1: cache stays on
1=DD1: disable cache when not in use
bit19 reserved
bit18 NOP
0=DD0: NOP=2 cycles, DD1: NOP=3 cycles
1=DD0: NOP=3 cycles, DD1: NOP=2 cycles
bit17 NA16 (bus pipelining for 16 bit)
bit16..5 unknown
bit4 MOVS split
bit3 power saving cache feature
bit2 reserved
bit1 enable MOV CRx decode (DD1B, DD1C: reserved)
bit0 reserved
------------------------------------------------------------------------------
The iPentiumPro processor contains the following Model Specific Registers. The
registers are mapped at every 4000h between 0000:0000h and FFFF:FFFFh, similar
to the 'illegal' MSRs above 8000:0000h on an iPentium (see below). The indexes
of these MSRs were collected, using the MSR searching program, coming with 4P.
The names can be obtained from the American Arium iPentiumPro ICE manual which
is available without a non-disclosure agreement (NDA).
------------------------------------------------------------------------------
MSR description (Intel PentiumPro processor only!)
------------------------------------------------------------------------------
00h Machine Check Address Register (?)
01h Machine Check Type Register (?)
10h Time Stamp Counter
------------------------------------------------------------------------------
18h,1Bh,2Ah,32h,33h,34h,3Ah,50h,51h,52h,53h,54h,79h,88h,89h,8Ah,8Bh,AEh,C1h,
C2h,FEh,116h,118h,119h,11Bh,131h,14Eh,14Fh,150h,151h,154h,15Bh,15Fh,174h,175h,
176h,179h,17Ah,186h,187h,1D3h,1D9h,1DBh,1DCh,1DDh,1DEh,1E0h,200h,201h,202h,
203h,204h,205h,206h,207h,208h,209h,20Ah,20Bh,20Ch,20Dh,20Eh,20Fh,250h,258h,
259h,268h,269h,26Ah,26Bh,26Ch,26Dh,26Eh,26Fh,2FFh,400h,401h,402h,404h,405h,
406h,408h,409h,40Ah,40Ch,410h,411h,412h are valid MSRs, which contain the:
------------------------------------------------------------------------------
Range Model Specific Registers which set various memory attributes; PentiumPro
processor architecture also introduces two more newer memory attributes in ad-
dition to the usual Write Through (WT) and Write Back (WB) types; the new me-
mory attributes are Write Combining (WC) and Write Protected (WP); the WC type
is used on frame buffers and the WP type is used for ROM shadow regions
fixed Memory Type Range Registers (MTRRs), as:
MTRRCap (info about included MTRRs), MTRRdefType,
MTRRfix_64K_00000, MTRRfix_16K_80000, MTRRfix_16K_A0000,
MTRRfix_4K_C0000, MTRRfix_4K_C8000, MTRRfix_4K_D0000, MTRRfix_4K_D8000,
MTRRfix_4K_E0000, MTRRfix_4K_E8000, MTRRfix_4K_F0000, MTRRfix_4K_F8000,
variable Memory Type Range Registers (MTRRs), as:
MTRRphysBase0, MTRRphysBase1, MTRRphysBase2, MTRRphysBase3,
MTRRphysBase4, MTRRphysBase5, MTRRphysBase6, MTRRphysBase7,
Debug/Performance Model Specific Registers, as:
TSC (=#10h), PerfEvtSel0, PerfCtr0, PerfEvtSel1, PerfCtr1, DebugCtlMSR,
LastBranchFromIP, LastBranchToIP, LastExceptionFromIP, LastExceptionToIP
Machine Check Model Specific Registers, as:
MCG_CAP, MCG_STATUS, P5_MC_ADDR (=#00h?), P5_MC_TYPE (=#01h?),
MC0_CTL, MC0_STATUS, MC0_ADDR, MC0_MISC,
MC1_CTL, MC1_STATUS, MC1_ADDR, MC1_MISC,
MC2_CTL, MC2_STATUS, MC2_ADDR, MC2_MISC,
MC3_CTL, MC3_STATUS, MC3_ADDR, MC3_MISC,
MC4_CTL, MC4_STATUS, MC4_ADDR, MC4_MISC,
MC5_CTL, MC5_STATUS, MC5_ADDR, MC5_MISC
other Model Specific Registers, as:
APIC_Base_MSR
The PentiumPro processor has the capability to correct specific errata through
the loading of an Intel-supplied data block. A "hidden" MSR #79h is related to
this new feature (see: BIOS writer's guide, 8.2.1 update loading procedure). A
MSR #8Bh may contain an updated value for the CPUID instruction. This happens,
when you load the BIOS update, mentioned above.
------------------------------------------------------------------------------
Appendix H -- supplemental information
--------------------------------------
Some non-essential information regarding other iPentiumPro MSRs are considered
confidential and proprietary and have not been documented in this publication.
This information is provided in my new Supplement to the 80x86.CPU file and is
available with the appropriate non-disclosure agreements in place. Please con-
tact Christian Ludloff for details.
My new Supplement to the 80x86.CPU file contains confidential information on
architecture extensions to the iPentiumPro processor which are non-essential
for standard applications. This includes some low-level registers that provide
access to internal features.
This information is specifically targeted at writers of the following type of
software:
* operating system kernels
* virtual memory managers
* BIOS software
* any other 80x86 software
If you are writing software that does not fall into one of these categories,
this information is non-essential and all required details are contained in my
publicly available 80x86.CPU file.
------------------------------------------------------------------------------
Some MSRs could exist on every ≥386 CPU. They are used by the vendor during a
test at the factory. I wish you a happy searching. But if you find one, you're
not able to use it, before you know it's structure. Send me the no., please!
The iPentium processor's RDMSR/WRMSR instruction bug
====================================================
Introduction
------------
This part contains information about another microcode bug of an iPentium CPU.
One of the last 'specification updates' for the iPentium processor manuals [1]
states the RDMSR and WRMSR instruction to be buggy, when executed with illegal
indices on all iPentium processors (iP5, iP54 and iP24T).
Because the Intel documentation states this bug not to be fixed in the future,
I believe, that it isn't a bug, but a hidden feature of the iPentium processor
for testing MSRs and accessing hidden MSRs.
The search
----------
Of course I have tried to find out a little bit more about these MSRs. So I've
started some searching, using an iPentium P54 processor with the C2-mask (this
means: CPUID=0525h; SX968; 90MHz-CPU, STD voltage). Another iPentium processor
was used to compare the results (CPUID=0517h; SX948; 60MHz-CPU).
Only illegal MSRs from 8000:0000h to FFFF:FFFFh seem to be legal. First I have
dumped them into a file, using my new 'range MSR search' feature from the last
4P package v3.1.2 [2].
Then I have tried to find out whether there are repeated values or not. What a
surprise -- they are repeated. :) Only 20h (32dec) different MSRs seem to be
accessable. (I have found this, because MSR 8000:0010h has a very large value,
as MSR 8000:0030h, 8000:0050h etc. too -- like the TSC...)
The next idea must have been, that the legal MSRs from 0000:0000h - 0000:0013h
(or 0000:0014h on some iPentium processors; maybe that MSR #14h is related to
the integrated APIC?) could be mapped to these illegal MSRs.
Of course this is true. And here is, what I have found:
The results
-----------
MSR MSR base address base address base address
#xxh name 8000:0000h 8000:0020h... FFFF:FFE0h (highest possible)
-------------------------------------------------------------------------------
00 MCA changing changing changing (okay)
The Machine Check Exception Address register changes its value,
even when CR4.MCE is disabled.
01 MCT changing changing changing (okay)
The Machine Check Exception Type register changes its value, if
the MCA changes its value, to indicate the MCE type.
02 TR1 MSR# * 2 dito + 40h FF80:3FC4h (instead FFFF:FFC4h)
The Test Register #1 is 'write only' (means: you can read a TR1
value, but it isn't the true value of the register). The bit#13
is the last documented and implemented TR1 bit. Here I've found
a mysterious value at the highest possible base address. (Other
machines had the predicted correct value.)
03 --- MSR# * 2 dito + 40h dito + 40h
This MSR is documented to be reserved and never implemented. So
the RDMSR microcode doubles the MSR# from ECX to EDX:EAX and it
cleares bit#32 then. Probably this has been included to be able
to test unimplemented or 'write only' MSRs.
04 TR2 0000:0001h dito dito (okay)
05 TR3 0000:0080h dito dito (okay)
06 TR4 0000:0000h dito dito (okay)
07 TR5 MSR# * 2 dito + 40h dito + 40h
The Test Register #5 is 'write only' (see TR1).
08 TR6 0000:0000h dito dito (okay)
09 TR7 0000:0000h dito dito (okay)
0A TR8 MSR# * 2 dito + 40h dito + 40h
TR8 is documented to be removed and not longer implemented.
0B TR9 0000:0000h dito dito (okay)
0C TR10 0000:0000h dito dito (okay)
0D TR11 MSR# * 2 dito + 40h dito + 40h
The Test Register #11 seems to be 'write only' (see TR1). Older
Intel documents have described it to be 'read/write'.
0E TR12 0000:0000h dito + 40h FFFF:1800h instead FFFF:FFC0h
The Test Register #12 is 'write only' (see TR1). The TR12 bit#9
is the last documented and implemented bit. Here I have found a
mysterious value at the highest possible base address (as TR1).
(Other machines had the predicted correct value.)
0F --- MSR# * 2 dito + 40h dito + 40h
This MSR is documented to be reserved and never implemented. It
is possible to set all bits, except bit#0, which hangs the chip
immediately, causing a stop of all bus activity. Restarting the
machine is only possible with a reset then. So the iPentium CPU
enters the tristate mode, which can only be leaved via a reset.
10 TSC changing changing changing (okay)
11 CESR changing dito dito (okay)
12 CTR#0 changing changing changing (okay)
13 CTR#1 changing changing changing (okay)
The Time Stamp Counter and the 3 Performance Monitoring related
registers change their values.
14 --- 0000:0000 dito dito (APIC?)
This register is not implemented in all iPentium processors. It
may be APIC related. (Just check, whether the iPentium includes
an APIC via the feature flag bits in EDX after CPUID level #1.)
My iPentium had none of its bits (reason: no integrated APIC).
15 --- MSR# * 2 dito + 40h dito + 40h
16 --- MSR# * 2 dito + 40h dito + 40h
17 --- MSR# * 2 dito + 40h dito + 40h
Maybe these MSRs are 'write only'?
18 --- unknown dito dito (4h,8h have been found)
Without a memory manager the value was 4h. When loading an EMM-
driver, then its value changed to 8h. A switch to the protected
mode only did not changed the value, but enabling the paging by
setting CR0.PG did.
19 --- 'read only' dito dito FP last prefetched OC
1A --- 'read only' dito dito FP last non-control OC
1B --- 'read/write' dito dito FP last exception OC
These MSRs provide access to the floating point unit's instruc-
tion stream. The first register contains the most-recently pre-
fetched FP opcode, while the second register contains the most-
recently executed non-control opcode (i.e. instructions such as
FSTENV or FRSTOR don't change the MSR). The third register con-
tains the opcode of the last non-control instruction encounte-
ring an exception, and it is a part of the environment accessed
through the FSTENV, FLDENV, FSAVE, and FRSTOR instructions. Any
value written to this MSR will appear in the opcode field of an
immediately following FSTENV or FSAVE environment image. All 3
registers consist of 11 bits, the high 3 bits of which are the
low 3 bits of the instruction's opcode, and the low 8 bits of
which are the 2nd byte of the floating-point instruction (there
is an ambiguity because FWAIT is stored in MSR #8000:0019h as
09Bh, as is the variant of FCOMP coded by D8h-9Bh). The most-
recently prefetched instruction needn't be the same as the most
recently executed instruction, the most recent instruction may
have been a control instruction (not stored in MSRs #8000:001Ah
or #8000:001Bh) or the processor may have branched to another
location before reaching the prefetched instruction [3].
1C --- unknown dito dito (0h,4h have been found)
1D --- 0000:0000 dito dito (bit#3-0 can be set)
This is the Probe Mode Control register, which normally is only
visible through an iPentium ICE (In-Circuit-Emulator) [4].
1E --- 0000:0000 dito dito (bit#31-0 can be set)
1F --- 0000:0000 dito dito (bit#31-0 can be set)
These MSRs are implemented. They seem to contain some hidden or
temporary registers, which indeed exist.
The timing
----------
I have done some timing for the RDMSR instruction. Only the MCA, TSC, CTR#0 or
CTR#1 accesses need 4 more clock cycles than all the other valid MSR accesses.
Indeed all other valid MSRs are 32 bit wide only...
The sources
-----------
[1] Pentium Processor Specification Update, release 6/95, order #242480-005
[2] 4P package v3.1.2 (released October 1st 1995, pointing to illegal MSRs)
[3] private eMail from Ralf Brown (ralf@pobox.com) to C. Ludloff
[4] private eMail from Robert Collins (rcollins@metronet.com) to C. Ludloff
This part owes a great deal to discussions with Ralf Brown and Robert Collins.
The events for the two iPentium counters #0 and #1
==================================================
------------------------------------------------------------------------------
bits no description
------------------------------------------------------------------------------
000000 00h data reads
000001 01h data writes
000010 02h data TLB misses
000011 03h data read misses
000100 04h data write misses
000101 05h writes (hits) to M or E state lines
000110 06h data cache lines written back
000111 07h external snoops
001000 08h data cache snoop hits
001001 09h memory accesses in both pipes
001010 0Ah bank conflicts
001011 0Bh misaligned data memory references
001100 0Ch code reads
001101 0Dh code TLB misses
001110 0Eh code cache misses
001111 0Fh any segment register loaded
010000 10h segment descriptor cache accesses
010001 11h segment descriptor cache hits
010010 12h branches
010011 13h BTB hits
010100 14h taken branches or BTB hits
010101 15h pipeline flushes
010110 16h instructions executed in both pipes
010111 17h instructions executed in the v-pipe
011000 18h clocks while bus cycle in progress (bus utilization)
011001 19h pipe stalled by full write buffers (writes backup)
011010 1Ah pipe stalled by waiting for data memory reads
011011 1Bh pipe stalled by writes to M or E lines
011100 1Ch locked bus cycles
011101 1Dh I/O read or write cycles
011110 1Eh non-cacheable memory references
011111 1Fh pipeline stalled by address generation interlock
100000 20h unknown, but counts
100001 21h unknown, but counts
100010 22h floating-point operations
100011 23h breakpoint matches on DR0 register
100100 24h breakpoint matches on DR1 register
100101 25h breakpoint matches on DR2 register
100110 26h breakpoint matches on DR3 register
100111 27h hardware interrupts
101000 28h data reads or data writes
101001 29h data read misses or data write misses
2Ah..3Fh reserved and unused (no counting)
------------------------------------------------------------------------------
It seems, that the list described above is not totally correct. We should test
every possible event now, because Intel has hidden some things here too.
The configuration registers on Cyrix processors
===============================================
Most Cyrix processors contain special registers, which can be accessed via I/O
operations on port 22h (command port) and 23h (data port). The following short
sequences should be used to read or write such a register:
READ: OUT 22h,reg# WRITE: OUT 22h,reg#
IN 23h,value OUT 23h,value
The Cyrix Cx486SLC/DLC and TI486 processors contain the following registers:
------------------------------------------------------------------------------
name reg# description
------------------------------------------------------------------------------
CCR0 C0h configuration control register #0 (=0h after reset)
bit7 SUSP - enable SUSPI# input pin and SUSPA# output pin
1=enabled, 0=disabled (=pins float)
bit6 CO - cache organisation
1=direct mapped, 0=2-way set assiociative
bit5 BARB - enable L1 cache flush when beginning HOLD state
1=enabled, 0=disabled
bit4 FLUSH - enable FLUSH# input pin
1=enabled, 0=disabled
bit3 KEN - enable KEN# input pin
1=enabled, 0=disabled
bit2 A20M - enable A20M# input pin
1=enabled, 0=disabled
bit1 NC1 - caching for 640K..1M area (bug in A4/A5-step?)
1=disabled (=never), 0=enabled (but see NCRx!)
bit0 NC0 - caching for 1M..1M+64K area (real and V86 mode)
1=disabled, 0=enabled
------------------------------------------------------------------------------
CCR1 C1h configuration control register #1 (=xxxxxxx0b after reset)
bit7..1 reserved
bit0 RPL - enable RPLSET# and RPLVAL# pins
1=enabled, 0=disabled (=pins float)
------------------------------------------------------------------------------
NCR1 C4..C6h non-cacheable region #1 (=0h,0h,0Fh after reset (on SLC))
NCR2 C7..C9h non-cacheable region #2 (=0h,0h,0h after reset)
NCR3 CA..CCh non-cacheable region #3 (=0h,0h,0h after reset)
NCR4 CD..CFh non-cacheable region #4 (=0h,0h,0h after reset)
+0h bit7..0 address bits A31..A24 of non-cacheable region start
(reserved on SLC, see value after reset)
+1h bit7..0 address bits A23..A16 of non-cacheable region start
+2h bit7..4 address bits A15..A12 of non-cacheable region start
bit3..0 size of non-cacheble block
0000=dis. 0100=32K 1000=512K 1100=8M
0001=4K 0101=64K 1001=1M 1101=16M
0010=8K 0110=128K 1010=2M 1110=32M
0011=16K 0111=256K 1011=4M 1111=4G
------------------------------------------------------------------------------
The Cyrix Cx486S/S2/D/D2/DX/DX2 processors contain the following registers:
------------------------------------------------------------------------------
name reg# description
------------------------------------------------------------------------------
CCR1 C1h configuration control register #1 (=0h after reset)
bit7..5 reserved
bit4 N_LOCK - negate LOCK#
1=enabled, 0=disabled
bit3 MMAC - enable main memory accesses when CCR1.SMAC=1
1=enabled, 0=disabled
bit2 SMAC - enable SMM memory accesses with SMAADS# active
1=enabled (SMI# ignored), 0=disabled
bit1 SMI - enable SMM pins (SMI# I/O pin and SMADS# output pin)
1=enabled, 0=disabled (=pins float)
bit0 RPL - enable RPLSET# and RPLVAL# pins
1=enabled, 0=disabled (=pins float)
------------------------------------------------------------------------------
CCR2 C2h configuration control register #2 (=0h after reset)
bit7 SUSP - enable SUSP# input pin and SUSPA# ouput pin
1=enabled, 0=disabled (=pins float)
bit6 BWRT - enable (16byte WB) burst write cycle
1=enabled, 0=disabled
bit5 BARB - enable cache coherency on bus arbitration
1=enable write back of all dirty cache data when HOLD is
requered and prior to asserting HLDA
0=disabled
bit4 WT1 - caching for 640K..1M area
1=force all writes to 640K..1M area that hit in cache
issued on the external bus
0=disabled
bit3 HALT - enable entering suspend mode on HLT inctructions
1=enabled, 0=disabled
bit2 LockNW - prohibits changing the state of the CR0.NW bit
1=enabled (=prohibited), 0=disabled (=allowed)
bit1 WBAK - enable WB cache pins (INVAL, WM_RST, HITM#)
1=enabled, 0=disabled (=pins float)
bit0 reserved
------------------------------------------------------------------------------
CCR3 C3h configuration control register #3 (=0h after reset)
(not on Cyrix Cx486S A-step processors but on newer Cx486SLC/DLC)
bit7..2 reserved
bit1 NMIEN - enable NMI during SMM
1=enabled, 0=disabled
bit0 SMI_LOCK - SMM register lock
1=CCR1.bit3..1 and CCR3.bit1 can't be changed in SMM;
CCR3.bit0 can be changed in SMM; only RESET clears it!
0=disabled
------------------------------------------------------------------------------
SMAR CD..CFh SMM address region (=0h,0h,0h after reset)
CDh bit7..0 address bits A32..A24 of SMM region start
CEh bit7..0 address bits A23..A16 of SMM region start
CFh bit7..4 address bits A15..A12 of SMM region start
bit3..0 size of SMM region
0000=dis. 0100=32K 1000=512K 1100=8M
0001=4K 0101=64K 1001=1M 1101=16M
0010=8K 0110=128K 1010=2M 1110=32M
0011=16K 0111=256K 1011=4M 1111=4G
------------------------------------------------------------------------------
DIR0 FEh device identification register #0
(not on Cyrix Cx486S A-step processors but on newer Cx486SLC/DLC)
bit7..0 processor model
00h - Cx486SLC 08h - Cx486SRu 1Ah - Cx486DX
01h - Cx486DLC 09h - Cx486DRu 1Bh - Cx486DX2
02h - Cx486SLC2 0Ah - Cx486SRu2 1Fh - Cx486DX4
03h - Cx486DLC2 0Bh - Cx486DRu2 2xh - Cyrix 5x86
04h - Cx486SRx 10h - Cx486S 3xh - Cyrix 6x86
05h - Cx486DRx 11h - Cx486S2
06h - Cx486SRx2 12h - Cx486Se FFh - probably not a
07h - Cx486DRx2 13h - Cx486S2e Cyrix processor
-------------------------------------------------------------------
28h/2Ah - Cyrix 5x86 1x clock mode The first value indicates a
29h/2Bh - Cyrix 5x86 2x clock mode Cyrix 5x86 / 6x86 processor
2Dh/2Fh - Cyrix 5x86 3x clock mode "S"-part, and the second is
2Ch/2Eh - Cyrix 5x86 4x clock mode an indicator for a "P" part
------------------------------------ processor. Even an engineer
30h/32h - Cyrix 6x86 1x clock mode from Cyrix had no idea what
31h/33h - Cyrix 6x86 2x clock mode the difference is.
35h/37h - Cyrix 6x86 3x clock mode
34h/36h - Cyrix 6x86 4x clock mode
------------------------------------------------------------------------------
DIR1 FFh device identification register #1
(not on Cyrix Cx486S A-step processors but on newer Cx486SLC/DLC)
bit7..4 processor stepping (0..Fh)
bit3..0 processor revision (0..Fh)
------------------------------------------------------------------------------
The Cyrix and IBM 5x86 processors contains the following registers:
------------------------------------------------------------------------------
name reg# description
------------------------------------------------------------------------------
CCR1 C1h configuration control register #1 (=0h after reset)
bit7..4 reserved
bit3 MMAC - enable main memory accesses when CCR1.SMAC=1
1=enabled, 0=disabled
bit2 SMAC - enable SMM memory accesses with SMAADS# active
1=enabled (SMI# ignored), 0=disabled
bit1 SMI - enable SMM pins (SMI# I/O pin and SMADS# output pin)
1=enabled, 0=disabled (=pins float)
bit0 reserved
------------------------------------------------------------------------------
CCR2 C2h configuration control register #2 (=0h after reset)
bit7 SUSP - enable SUSP# input pin and SUSPA# ouput pin
1=enabled, 0=disabled (=pins float)
bit6 BWRT - enable (16byte WB) burst write cycle
1=enabled, 0=disabled
bit5 reserved
bit4 WT1 - caching for 640K..1M area
1=force all writes to 640K..1M area that hit in cache
issued on the external bus
0=disabled
bit3 HALT - enable entering suspend mode on HLT inctructions
1=enabled, 0=disabled
bit2 LockNW - prohibits changing the state of the CR0.NW bit
1=enabled (=prohibited), 0=disabled (=allowed)
bit1 WBAK - enable WB cache pins (INVAL, WM_RST, HITM#)
1=enabled, 0=disabled (=pins float)
bit0 reserved
------------------------------------------------------------------------------
CCR3 C3h configuration control register #3 (=0h after reset)
bit7..4 MAPEN - select active control register set for D0h..FDh
0001=default (others are not valid at the moment)
bit3 SMIACT - enable Intel compatible SMM (i486SL?)
1=enabled, 0=disabled
bit2 LINBRST - enable linear address sequence for burst cycles
1=enabled, 0=disabled
bit1 NMIEN - enable NMI during SMM
1=enabled, 0=disabled
bit0 SMI_LOCK - SMM register lock
1=CCR1.bit3..1 and CCR3.bit1 can't be changed in SMM;
CCR3.bit0 can be changed in SMM; only RESET clears it!
0=disabled
------------------------------------------------------------------------------
CCR4 E8h configuration control register #4 (set CCR3.MAPEN=0001 before)
bit7 CPUID
1=enable EFLAGS.bit21 and CPUID instruction
0=disable EFLAGS.bit21 and CPUID instruction
bit6 reserved
bit5 FP_FAST - enable fast FPU exception reporting
1=enabled, 0=disabled
bit4 DTE_EN - enable directory table entry cache
1=enabled, 0=disabled
bit3 MEM_BYP - enable memory bypassing
1=enabled, 0=disabled
bit2..0 IORT - I/O recovery time
xxx=2^0..7 bus clock cycles
------------------------------------------------------------------------------
PMR F0h power management register (set CCR3.MAPEN=0001 before)
bit7 SMCC - self modifying code checking
1=disabled, 0=enabled
bit6..3 reserved
bit2 CCLK - core clock
1=1/2external bus clock, if bus is idle, 0=normal
bit1..0 clock mode core/bus
11=reserved (4:1?), 10=3:1, 01=2:1, 00=1:1
------------------------------------------------------------------------------
PCR 20h performance control register (set CCR3.MAPEN=0001 before)
bit7 LSO - load/store ordering
1=strong, 0=weak
bit6 BTBTR - enable BTB test register
1=enabled, 0=disabled
bit5 reserved
bit4 MLR - enable reordering of misaligned loads
1=enabled, 0=disabled
bit3 AIS - enable all instructions stalled to serialize pipe
1=enabled, 0=disabled
bit2 LOOP - enable loopmode
1=enabled, 0=disabled
bit1 BTB - enable BTB
1=enabled, 0=disabled
bit0 RS - enable return stack
1=enabled, 0=disabled
------------------------------------------------------------------------------
??? 60h unknown existing register
??? 61h unknwon existing register
------------------------------------------------------------------------------
SMAR CD..CFh SMM address region (see description above!)
------------------------------------------------------------------------------
DIR0 FEh device identification register #0 (see description above!)
DIR1 FFh device identification register #1 (see description above!)
A DIR1 value of 13h indicates the revision 1.30, as 15h indicates a
revision 1.50 processor. I don't know how the sub-stepping (so i.e.
1.41 or 1.42) can be differed. Do you? BTW: Why do I believe that a
substepping like 1.41 or 1.42 exists? Because I have a document for
the 5x86 processor, containing exactly this information.
------------------------------------------------------------------------------
The Cyrix and IBM 6x86 processors contains the following registers:
------------------------------------------------------------------------------
CCR0 C0h configuration control register #0 (=0h after reset)
bit7..2 reserved
bit1 NC1 - caching for 640K..1M area
1=disabled (=never), 0=enabled
bit0 reserved
------------------------------------------------------------------------------
CCR1 C1h configuration control register #1 (=0h after reset)
bit7 SM3 - SMM address space address region register #3
1=enable address region register #3 for SMM addr. space
0=disabled (see also CCR5.ARREN, independent!)
bit6..4 reserved
bit4 N_LOCK - negate LOCK#
1=enabled, 0=disabled
bit3 reserved
bit2 SMAC - enable SMM memory accesses with SMAADS# active
1=enabled (SMI# ignored), 0=disabled
bit1 SMI - enable SMM pins (SMI# I/O pin and SMADS# output pin)
1=enabled, 0=disabled (=pins float)
bit0 reserved
------------------------------------------------------------------------------
CCR2 C2h configuration control register #2 (=0h after reset)
bit7 SUSP - enable SUSP# input pin and SUSPA# ouput pin
1=enabled, 0=disabled (=pins float)
bit6..5 reserved
bit4 WT1 - caching for 640K..1M area
1=force all writes to 640K..1M area that hit in cache
issued on the external bus
0=disabled
bit3 HALT - enable entering suspend mode on HLT inctructions
1=enabled, 0=disabled
bit2 LockNW - prohibits changing the state of the CR0.NW bit
1=enabled (=prohibited), 0=disabled (=allowed)
bit1..0 reserved
------------------------------------------------------------------------------
CCR3 C3h configuration control register #3 (=0h after reset)
bit7..4 MAPEN - select active control register set for D0h..FDh
0001=default (others are not valid at the moment)
bit3 reserved
bit2 LINBRST - enable linear address sequence for burst cycles
1=enabled, 0=disabled
bit1 NMIEN - enable NMI during SMM
1=enabled, 0=disabled
bit0 SMI_LOCK - SMM register lock
1=CCR1.bit3..1 and CCR3.bit1 can't be changed in SMM;
CCR3.bit0 can be changed in SMM; only RESET clears it!
0=disabled
------------------------------------------------------------------------------
CCR4 E8h configuration control register #4 (set CCR3.MAPEN=0001 before)
bit7 CPUID
1=enable EFLAGS.bit21 and CPUID instruction
0=disable EFLAGS.bit21 and CPUID instruction
bit6..5 reserved
bit4 DTE_EN - enable directory table entry cache
1=enabled, 0=disabled
bit3 reserved
bit2..0 IORT - I/O recovery time
xxx=2^0..7 bus clock cycles
------------------------------------------------------------------------------
CCR5 E9h configuration control register #5 (set CCR3.MAPEN=0001 before)
bit7..6 reserved
bit5 ARREN - address region registers enabled
1=enabled, 0=disabled (see also CCR1.SM3, independent!)
bit4 LBR1 - LBR# pin
1=assert LBR# for all accesses to 640K-1M, 0=disabled
bit3..1 resreved
bit0 WT_ALLOC - WT allocation
1=allocate new cache lines for read and write misses
0=allocate new cache lines for read misses only
------------------------------------------------------------------------------
ARR0 C4..C6h address region register #0
ARR1 C7..C9h address region register #1
ARR2 CA..CCh address region register #2
ARR3 CD..CFh address region register #3
ARR4 D0..D2h address region register #4 (set CCR3.MAPEN=0001 before)
ARR5 D3..D5h address region register #5 (set CCR3.MAPEN=0001 before)
ARR6 D6..D8h address region register #6 (set CCR3.MAPEN=0001 before)
ARR7 D9..DBh address region register #7 (set CCR3.MAPEN=0001 before)
+0h bit7..0 address bits A31..A24 of region start
+1h bit7..0 address bits A23..A16 of region start
+2h bit7..4 address bits A15..A12 of region start
bit3..0 size of non-cacheble block for ARR0..ARR6
0000=dis. 0100=32K 1000=512K 1100=8M
0001=4K 0101=64K 1001=1M 1101=16M
0010=8K 0110=128K 1010=2M 1110=32M
0011=16K 0111=256K 1011=4M 1111=4G
bit3..0 size of non-cacheble block for ARR7
0000=dis. 0100=2M 1000=32M 1100=512M
0001=256K 0101=4M 1001=64M 1101=1G
0010=512K 0110=8M 1010=128M 1110=2G
0011=1M 0111=16M 1011=256M 1111=4G
------------------------------------------------------------------------------
RCR0 DCh region control register #0 (set CCR3.MAPEN=0001 before)
RCR1 DDh region control register #1 (set CCR3.MAPEN=0001 before)
RCR2 DEh region control register #2 (set CCR3.MAPEN=0001 before)
RCR3 DFh region control register #3 (set CCR3.MAPEN=0001 before)
RCR4 E0h region control register #4 (set CCR3.MAPEN=0001 before)
RCR5 E1h region control register #5 (set CCR3.MAPEN=0001 before)
RCR6 E2h region control register #6 (set CCR3.MAPEN=0001 before)
RCR7 E3h region control register #7 (set CCR3.MAPEN=0001 before)
bit7..6 reserved
bit5 NLB - negate LBA#
1=enabled, 0=disabled
bit4 WT - write through caching
1=enabled, 0=disabled
bit3 WG - write gathering
1=enabled, 0=disabled
bit2 WL - weak locking
1=enabled, 0=disabled
bit1 WWO - weak write ordering
1=enabled, 0=disabled
bit0 RCD - cache disabled region (for RCR0..6 only)
1=enabled, 0=disabled
RCE - cache enabled region (for RCR7 only)
1=enabled (implies that the address space outside of the
region specified by ARR7 is non-cacheable), 0=disabled
------------------------------------------------------------------------------
DIR0 FEh device identification register #0 (see description above!)
DIR1 FFh device identification register #1 (see description above!)
------------------------------------------------------------------------------
The new instructions
====================
i486: The newer processors with "&" printed on the package will support the
CPUID-flag in EFLAGS, the CPUID instruction, the CR4 register bits1/0
and instructions for access to the CR4 register, the enhanced virtual
mode, the system management mode SMM and the RSM instruction. The new
i486DX2WB processor supports the 4MB-pages too. If this CPU runs with
writeback mode, then the CPUID value is '0470'. If it is running with
writethrough mode, then you receive the value '0436'. The real mask-
revision (stepping) you will get only after the processor reset!
Pentium: The iPentium processors support all the news listed above and the new
instructions listed below.
PentPro: The iPentiumPro processors support all the news listed above and some
new instructions listed below.
UMC,AMD: The UMC U5S and U5D, the AMD enhanced DX2/DX4 processors and newer Nx
NexGen, 586/686 CPUs support the CPUID instruction. The Nx586 doesn't support
Cyrix the CPUID bit #21 in EFLAGS. The Cyrix 5x86/6x86 processors support a
CPUID instruction and the EFLAGS bit, but only if CCR4.bit7 is set to
one. Please, refer to the Cyrix control register description. Neither
the Cyrix 5x86, nor the Cyrix 6x86 support other features reported by
a CPUID feature flag field, than the FPU (no enhanced V86 mode etc.).
IBM: The IBM 386/486SLC and the IBM 486BL3 'Blue Lightning' processors are
supporting some MSRs (see above) and the instructions to use them.
------------------------------------------------------------------------------
name opcodes description
------------------------------------------------------------------------------
CPUID 0F A2 CPU identification
in: EAX=0 get max. identification level and vendor
out: EAX=1/2 max. identification level is 1 or 2 now
EBX-EDX-ECX vendor identification
'GenuineIntel' - Intel i486, iPentium or iPentiumPro
'UMC UMC UMC ' - UMC U5S or U5D processor
'AuthenticAMD' - AMD 486DX2 or DX4 (enh.) processor
'CyrixInstead' - Cyrix 6x86 processor
'NexGenDriven' - NexGen Nx586 or Nx686 processor
in: EAX=1 get chip type and the supported features
out: EAX=0:TFMS CPU type (type, family, model, stepping)
type The type is encoded in the bits13/12.
00=1st dual iPentium CPU (iP54C)
01=iPentium OverDrive processor
10=2nd dual iPentium CPU (iP54C)
11=reserved
family 4=486, 5=iPentium, 6=iPentiumPro
model Intel486: 0=DX, 1=DX50, 2=SX, 3=DX2,
4=SL, 5=SX2, 7=DX2WB, 8=DX4,
9=DX4WB
UMC486: 1=U5D, 2=U5S
AMD486: 3=DX2, 7=DX2WB, 8=DX4, 9=DX4WB
E=X5WT, F=X5WB
Cyrix: 9=Cyrix 5x86
iPentium: 0=5V-60/66 MHz A-step chips,
1=5V-60/66 MHz, 2=3.3V-75/90/
100/120/133MHz, 3=P24T, 4=OvDr
for iPentium-3.3V, 5=OvDr for
iDX4, 6=OvDr for iPentium-5V
Nx586: 0=newer Nx586 or Nx586FPU
Cyrix: 3=Cyrix 6x86
iPentPro: 0=iPentiumPro A-step chips,
1=iPentiumPro, 4=P55CT iP54C
socket OverDrive (droped?)
stepping steppings sometimes cover several masks
comment iPentium-5V: no fDIVbug since step no.7
iPentium-3V: no fDIVbug since step no.4
EDX=flags supported features (i486, iPentium, iP6)
bit31..16 reserved (=0)
bit15=1 CMOVcc (and FCMOVcc/FCOMI) supported
bit14=1 machine check architecture supported
bit13=1 page global enable supported
bit12=1 memory type range registers supported
bit11=0 reserved
bit10=0 reserved
bit9=1 CPU contains an enabled local APIC
bit8=1 CMPXCHG8B instruction supported
bit7=1 machine check exception supported
bit6=1 physical address extension supported
bit5=1 iPentium-style MSRs supported
bit4=1 time stamp counter TSC supported
bit3=1 page size extensions supported
bit2=1 I/O breakpoints supported
bit1=1 enhanced virtual 8086 mode supported
bit0=1 CPU contains a floating-point unit (FPU)
comment At the moment all Intel clones support a
FPU presence bit only (bit0), because no
clone supports other listed features.
in: EAX=2 get cache configuration descriptors
out: AL=01h configuration descriptors are valid
AL<>1 reserved for future use
EAX..EDX 4x4 8bit configuration descriptors
00h=null descriptor (=unused descriptor)
01h=code TLB, 4K pages, 4 ways, 64 entries
02h=code TLB, 4M pages, 4 ways, 4 entries
03h=data TLB, 4K pages, 4 ways, 64 entries
04h=data TLB, 4M pages, 4 ways, 8 entries
06h=code L1 cache, 8KB, 4 ways, 32 byte lines
0Ah=data L1 cache, 8KB, 2 ways, 32 byte lines
41h=c+d L2 cache, 128KB, 4 ways, 32 byte lines
42h=c+d L2 cache, 256KB, 4 ways, 32 byte lines
43h=c+d L2 cache, 512KB, 4 ways, 32 byte lines
xxh=other values are reserved for future use
A descriptor is only valid if its highest bit is 0!
EAX=03020101h on an iPentiumPro (example)
EBX=00000000h on an iPentiumPro (example)
ECX=00000000h on an iPentiumPro (example)
EDX=06040A42h on an iPentiumPro (example)
Because AL is 01h, the descriptors are valid. All of
the descriptors are valid, because their highest bit
is 0. This iPentiumPro includes the 4K/M c/d TLB, an
8+8 KB c/d L1 cache and a 256 KB c+d L2 cache.
in: EAX>maximum max. supported CPUID level can be higher
than the max. returned level from CPUID,
so hidden levels are not impossible now!
out: undefined EAX, EBX, ECX, EDX values are undefined
info: can be used in all CPLs; serializes the pipelines; the
A-step iPentiums did not support several CPUID levels
and they show EAX=FMS and EBX-EDX-ECX=vendor only! (so
they seem to provide more than 500h CPUID levels); bug
in i486DX2 processor? (level #2..7FFFFFFFh=zero, level
#80000000..FFFFFFFFh=as level #1; has no side effect),
this bug is not present in the i486DX2WB processor
------------------------------------------------------------------------------
RDMSR 0F 32 read a model specific register value
in: ECX number of the MSR
out: EDX:EAX value of the MSR (64 bit wide, filled with 0)
clks: 24 (MCA, TSC, C#0, C#1) or 20 (other MSRs) (iPentium)
info: instruction can only be used when CPL=0 (but many EMMs
do allow the usage from CPL>0 without problems; if the
instruction is used in a Windows 3.1 DOS-box, then the
DOS-session will be 'crashed' due to an opcode error)
------------------------------------------------------------------------------
WRMSR 0F 30 write a value to a model specific register
in: ECX number of the MSR
EDX:EAX value (64 bit wide, filled with 0)
clks: 30-45 (iPentium)
info: instruction can only be used when CPL=0 (but some EMMs
like QEMM 7.04 do allow the usage from CPL>0)
------------------------------------------------------------------------------
RDTSC 0F 31 read time stamp counter value
out: EDX:EAX time stamp counter value (64 bit wide)
clks: 6 (iPentium, CPL=0), 11 (iPentium, CPL=1-3)
info: instruction can be disabled for CPL=1..3 via CR4.TSD
------------------------------------------------------------------------------
RDPMC 0F 33 read performance monitoring counter (iPentiumPro only)
in: ECX number of the counter (supported: 0 or 1)
out: EDX:EAX performance monitoring counter value (64 bit)
info: instruction can be enabled for CPL=1..3 via CR4.PCE
------------------------------------------------------------------------------
CMPXCHG8B 0F C7 compare & exchange 64 bits, similar to CMPXCHG
RSM 0F AA resume from system management mode (only in SMM!)
MOV EAX,CR4 0F 20 E0 read the CR4 register value
MOV CR4,EAX 0F 22 E0 write a value to the CR4 register
------------------------------------------------------------------------------
CMOVcc 0F 40-4F supported by iPentiumPro processors, similar to 70-7F
FCMOVcc, FCOMI supported by iPentiumPro processors with a FPU
------------------------------------------------------------------------------
The iPentiumPro also supports the new opcodes 0Fh,18-1Fh and 0Fh,34-35h.
------------------------------------------------------------------------------
The MOV ...,TRxh and MOV TRxh,... instructions are not longer supported by the
iPentium/Pro processors, because the Test Registers were placed into the MSRs.
The iPentium and iPentiumPro stepping values
============================================
Intel Pentium P5 processor
------------------------------------------------------------------------------
type family model step mask clock SX-no Vcc in V °C note
------------------------------------------------------------------------------
0 5 1 3 B1 50/50 Q0399 4.75-5.25 85 1,2
0 5 1 3 B1 60/60 Q0352 4.75-5.25 85 1
0 5 1 3 B1 60/60 Q0400 4.75-5.25 75 1,2
0 5 1 3 B1 60/60 Q0394 4.75-5.25 80 2,3
0 5 1 3 B1 66/66 Q0353 4.90-5.25 75 1
0 5 1 3 B1 66/66 Q0395 4.90-5.25 70 2,3
0 5 1 3 B1 60/60 Q0412 4.75-5.25 85 1
0 5 1 3 B1 60/60 SX753 4.75-5.25 85 1
0 5 1 3 B1 66/66 Q0413 4.90-5.40 75 1
0 5 1 3 B1 66/66 SX754 4.90-5.40 75 1,4
------------------------------------------------------------------------------
0 5 1 5 C1 60/60 Q0466 4.75-5.25 80 3
0 5 1 5 C1 60/60 SX835 4.75-5.25 80 3
0 5 1 5 C1 60/60 SZ949 4.75-5.25 80 3,5
0 5 1 5 C1 66/66 Q0467 4.90-5.40 70 3
0 5 1 5 C1 66/66 SX837 4.90-5.40 70 3
0 5 1 5 C1 66/66 SZ950 4.90-5.40 70 3,5
------------------------------------------------------------------------------
0 5 1 7 D1 60/60 Q0625 4.75-5.25 80 3
0 5 1 7 D1 60/60 SX948 4.75-5.25 80 3
0 5 1 7 D1 60/60 SX974 5.15-5.40 70 3
0 5 1 7 D1 60/60 ----- 4.75-5.25 80 3,5,6
0 5 1 7 D1 66/66 Q0626 4.90-5.40 70 3
0 5 1 7 D1 66/66 SX950 4.90-5.40 70 3
0 5 1 7 D1 66/66 Q0627 5.15-5.40 70 3
0 5 1 7 D1 66/66 SX949 5.15-5.40 70 3
0 5 1 7 D1 66/66 ----- 4.90-5.40 70 3,5,6
------------------------------------------------------------------------------
1: non-heat spreader package
2: engineering samples only
3: heat spreader package
4: 66 MHz B1 shipped after work week 34 of 1993 were tested to Vcc=4.90-5.40V
5: boxed iPentium processor
6: not marked with a S-spec number
Intel Pentium P54 processor
------------------------------------------------------------------------------
type family model step mask clock SX-no comment
------------------------------------------------------------------------------
0 5 2 1 B1 75/50 Q0540 ES
0 5 2 1 B1 75/50 Q0541 ES
0 5 2 1 B1 90/60 Q0542 STD
0 5 2 1 B1 90/60 Q0613 VR
0 5 2 1 B1 90/60 Q0543 DP
0 5 2 1 B1 100/66 Q0563 STD
0 5 2 1 B1 100/66 Q0587 VR
0 5 2 1 B1 100/66 Q0614 VR
0 5 2 1 B1 75/50 Q0601 TCP
0 5 2 1 B1 90/60 SX879 STD
0 5 2 1 B1 90/60 SX885 MD
0 5 2 1 B1 90/60 SX909 VR
0 5 2 1 B1 90/60 SX874 DP,STD
0 5 2 1 B1 100/66 SX886 MD
0 5 2 1 B1 100/66 SX910 VR,MD
------------------------------------------------------------------------------
0 5 2 2 B3 90/60 Q0628 STD
0/2 5 2 2 B3 90/60 Q0611 STD
0/2 5 2 2 B3 90/60 Q0612 VR
0 5 2 2 B3 100/66 Q0677 VRE,MD
0 5 2 2 B3 75/50 Q0606 TCP
0 5 2 2 B3 75/50 SX951 TCP
0 5 2 2 B3 90/60 SX923 STD
0 5 2 2 B3 90/60 SX922 VR
0 5 2 2 B3 90/60 SX921 MD
2 5 2 2 B3 90/60 SX942 DP,STD
2 5 2 2 B3 90/60 SX943 DP,VR
2 5 2 2 B3 90/60 SX944 DP,MD
0 5 2 2 B3 90/50 SZ951 STD,#5
0 5 2 2 B3 100/66 SX960 VRE,MD
------------------------------------------------------------------------------
0/2 5 2 4 B5 75/50 Q0704 TCP
0/2 5 2 4 B5 75/50 Q0666 STD
0/2 5 2 4 B5 90/60 Q0653 STD
0/2 5 2 4 B5 90/60 Q0654 VR
0/2 5 2 4 B5 90/60 Q0655 MD
0/2 5 2 4 B5 100/66 Q0656 MD
0/2 5 2 4 B5 100/66 Q0657 VR,MD
0/2 5 2 4 B5 100/66 Q0658 VRE,MD
0/2 5 2 4 B5 120/60 Q0707 VRE,MD,#1
0/2 5 2 4 B5 120/60 Q0708 STD,#1
0/2 5 2 4 B5 75/50 SX975 TCP
0/2 5 2 4 B5 75/50 SX961 STD
0/2 5 2 4 B5 75/50 SZ977 STD,#5
0/2 5 2 4 B5 90/60 SX957 STD
0/2 5 2 4 B5 90/60 SX958 VR
0/2 5 2 4 B5 90/60 SX959 MD
0/2 5 2 4 B5 90/60 SZ978 STD,#5
0/2 5 2 4 B5 100/66 SX962 VRE,MD
------------------------------------------------------------------------------
0/2 5 2 5 C2 75/50 Q0725 TCP
0/2 5 2 5 C2 75/50 Q0700 STD
0/2 5 2 5 C2 75/50 Q0749 MD
0/2 5 2 5 C2 90/60 Q0699 STD
0/2 5 2 5 C2 100/50,66 Q0698 VRE,MD
0/2 5 2 5 C2 100/50,66 Q0697 STD
0/2 5 2 5 C2 120/60 Q0711 VRE,MD
0/2 5 2 5 C2 120/60 Q0732 VRE,MD
0/2 5 2 5 C2 133/66 Q0733 MD
0/2 5 2 5 C2 133/66 Q0751 MD
0/2 5 2 5 C2 133/66 Q0775 VRE,MD
0/2 5 2 5 C2 75/50 SK079 TCP
0/2 5 2 5 C2 75/50 SX969 STD
0/2 5 2 5 C2 75/50 SX998 MD
0/2 5 2 5 C2 75/50 SZ994 STD,#5
0/2 5 2 5 C2 90/60 SX968 STD
0/2 5 2 5 C2 90/60 SZ995 STD,#5
0/2 5 2 5 C2 90/60 SU031 STD,#6
0/2 5 2 5 C2 100/50,66 SX970 VRE,MD
0/2 5 2 5 C2 100/50,66 SX963 STD
0/2 5 2 5 C2 100/50,66 SZ996 STD,#5
0/2 5 2 5 C2 100/66,50 SU032 STD,#6
0/2 5 2 5 C2 120/60 SK086 VRE,MD
0/2 5 2 5 C2 120/60 SX994 VRE,MD
0/2 5 2 5 C2 120/60 SU033 VRE,MD,#6
0/2 5 2 5 C2 133/66 SK098 MD
0/2 5 2 5 C2 133/66 SK103 VRE,MD
------------------------------------------------------------------------------
0 5 2 5 mA1 75/50 Q0686 VRT,TCP,#4
0 5 2 5 mA1 75/50 Q0689 VRT,SPGA,#4
0 5 2 5 mA1 90/60 Q0694 VRT,TCP,#4
0 5 2 5 mA1 90/60 Q0695 VRT,SPGA,#4
0 5 2 5 mA1 75/50 SK089 VRT,TCP,#4
0 5 2 5 mA1 75/50 SK091 VRT,SPGA,#4
0 5 2 5 mA1 90/60 SK090 VRT,TCP,#4
0 5 2 5 mA1 90/60 SK092 VRT,SPGA,#4
------------------------------------------------------------------------------
0/2 5 2 B cB1 120/60 Q0776 STD,no kit,#3,#4
0/2 5 2 B cB1 133/66 Q0772 STD,no kit,#3,#4
0/2 5 2 B cB1 133/66 Q0773 STD,#4
0/2 5 2 B cB1 133/66 Q0774 VRE,MD,no kit,#3,#4
0/2 5 2 B cB1 120/60 SK110 STD,no kit,#3,#4
0/2 5 2 B cB1 133/66 SK106 STD,no kit,#3,#4
0/2 5 2 B cB1 133/66 SK106J STD,no kit,#3,#4,#7
0/2 5 2 B cB1 133/66 SK107 STD,#4
0/2 5 2 B cB1 133/66 SU038 STD,no kit,#3,#4,#6
------------------------------------------------------------------------------
0 5 2 B mcB1 120/60 Q0779 VRT,TCP,#4
0 5 2 B mcB1 120/60 Q0808 3.3V,SPGA,#4
0 5 2 B mcB1 120/60 SK113 VRT,TCP,#4
0 5 2 B mcB1 120/60 SK118 VRT,TCP,#4,#7
0 5 2 B mcB1 120/60 SX999 3.3V,SPGA,#4
------------------------------------------------------------------------------
0/2 5 2 C cC0 150/60 Q0835 STD
0/2 5 2 C cC0 166/66 Q0836 VRE,no kit,#3
0/2 5 2 C cC0 166/66 Q0841 VRE/STD
0/2 5 2 C cC0 150/60 SY015 STD
0/2 5 2 C cC0 166/66 SY016 VRE,no kit,#3
0/2 5 2 C cC0 166/66 SY017 VRE/STD
------------------------------------------------------------------------------
STD : Vcc=3.135-3.465V DP : dual processor
VR : Vcc=3.300-3.465V MD : modified timing
VRE : Vcc=3.450-3.600V ES : engineering sample
VRT : see #2
TCP : TCP package
SPGA : SPGA package
#1 : Tcase max. 60°C
#2 : VRT Intel's Voltage Reduction Technology: Vcc for I/O is 3.3V, core Vcc
(accounting for about 90% of power usage) is reduced to 2.9V, to reduce
power consumption and heating
#3 : that part meets the EDS specifications but is not tested to support the
82498/82493 and 82497/82492 cache timings
#4 : cB1 stepping is logically equivalent to the C2 step, but on a different
manufacturing process; mcB1 stepping is logically equivalent to the cB1
step (except it does not support DP, APIC or FRC); mcB1 or mA1 step use
VRT (see #2) and are available in the TCP and SPGA package primarily to
support mobile applications; these steppings are distinguished by this
additional "m" prefix, for "mobile"
#5 : boxed iPentium processor without the attached fan heatsink
#6 : boxed iPentium processor with an attached fan heatsink
#7 : this part does not support boundary scan
Intel Pentium OverDrive P24T processor
------------------------------------------------------------------------------
type family model step mask clock SX-no comment
------------------------------------------------------------------------------
1 5 3 1 B1 63/25 SZ953 version 1.0
1 5 3 1 B2 63/25 SZ990 version 1.1
1 5 3 2 C0 83/33 SU014 version 2.1
------------------------------------------------------------------------------
Intel PentiumPro P6 processor
------------------------------------------------------------------------------
type family model step mask clock SX-no Vcc °C notes
------------------------------------------------------------------------------
0 6 1 1 B0 150/60 SY002 3.1V 0-85 #1
0 6 1 1 B0 150/60 SY011 3.1V 0-85
0 6 1 1 B0 150/60 SY014 3.1V 0-85
------------------------------------------------------------------------------
0 6 1 2 C0 150/60 SY010 3.1V 0-85
------------------------------------------------------------------------------
0 6 1 6 sA0 180/60 SY012 3.3V 0-85 #2
0 6 1 6 sA0 200/66 SY013 3.3V 0-85 #2
0 6 1 6 sA0 166/60 SY024 3.3V 0-85 #2,#3
0 6 1 6 sA0 200/66 SY025 3.3V 0-85 #2,#3
------------------------------------------------------------------------------
#1 : The VID pins are not supported on these parts.
#2 : The sA0 stepping is logically equivalent to the C0 stepping (shrinked).
#3 : These parts are equipped with a 512KB L2 cache.
The (known) iPentium and iPentiumPro bugs
=========================================
Intel Pentium processors
------------------------------------------------------------------------------
P5 P54C P24T <-- the 1st columns indicate the affected iPentium steppings
BCD BBBCABBC BBC P5=B1/C1/D1; P54=B1/B3/B5/C2/mA1/cB1/mcB1/cC0; P24T=B1/B2/C0
111 13521110 120 errata descriptions; see Intel order #242480 for all details
------------------------------------------------------------------------------
E.. ........ ... BOFF# hold timing
E.. ........ ... incomplete initialization may flush the internal pipeline
E.. ........ ... IV pin may not be asserted under certain conditions
E.. ........ ... testability writes to data TLB may store wrong parity
E.. ........ ... LRU bits in the data cache TLBs are updated incorrectly
E.. ........ ... a replacement writeback cycle may invade a locked seqeunce
E.. ........ ... RUNBIST instruction generates incorrect BIST signature
EE. ........ ... data BP mistakenly remembered on a faulty instruction
EEE ........ ... RESET affects RUNBIST instruction execution in boundary scan
EE. EEE..... EEE locked operation during instr. exec tracing may hang CPU
EE. EEE..... EEE BP or single-step may be missed for one instr. after STI
EE. ........ ... internal snoop problem due to reflection on address bus
EE. ........ ... internal parity error on uninitialized data cache entry
EE. EEE..... EEE missing shutdown after an IERR#
EE. E....... ... processor core may not serialize on bus idle
EE. EEEEEE.. EEE SMIACT# assertion during replacement writeback cycle
EEE EEE..... ... overflow undetected on some number on FIST
EEE EEE..... ... six operands result in unexpected FIST operation
EE. E....... ... snoop with tablewalk violation may not invalid. snooped line
EE. EE...... ... FDIV bug (Intel: 'slight precision loss')
EEE ........ ... power-up BIST failure
EEE EEE..... EEE FLUSH#, INIT or MCE dropped due to floating-point exception
EEE EEEEEE.E EEE floating point operations may clear alignment check bit (AC)
EEE EEEEEE.E EEE CMPXCHG8B accross page bound. may cause invalid opcode exc.
EEE EEE..... EEE single step debug exception breaks out of HALT
EEE EEEEEEE. EEE EIP altered after specific FP oper. followed by MOV Sreg,Reg
EEE EEEEEEEE EEE WRMSR into illegal MSR does not generate GP fault
EEE EEE..... EEE inconsist. data cache state from concurr. snoop/memory write
EEE EEEEEEEE EEE incorrect FIP after RESET
EEE EEEEEEEE EEE second assertion of FLUSH# not ignored
EEE EEEEEEEE EEE segment limit violation by FPU operand may corrupt FPU state
EEE EEEEEEEE EEE FP exception inside SMM with pending NMI hangs system
EEE EEEEEEE. ... incorrect decode of certain 0F instructions
EEE EEEEEEEE EEE data breakpoint deviations
EEE EEEEEEEE EEE event monitor discrepancies
EEE EEEEEEEE EEE VERR type instr. causing PGF TSW with T=1 may corrupt CS:EIP
EEE EEEEEEEE ... BUSCHK# interrupt has wrong priority
EEE EEEEEEEE EEE fault causing a page fault can execute instructions twice
EEE EEEEEEEE ... MCE pending, then HLT, can incorrect/skip instr. or hang
EEE EEEEEEEE EEE FBSTP stores BCD incorrectly if address wrap and FPU error
EEE EEEEEEEE EEE V86 int routine at illegal CPL causes spurious pushes
EEE EEEEEEEE EEE corrupted HLT flag can incorrect/skip instructions or hang
EEE EEEEEEEE EEE benign exceptions can erronemously cause double fault
EEE EEEEEEEE EEE double fault counter may not increment correctly
... ....E.E. ... input pins may float hi if core Vcc powers up after I/O Vcc
EEE EEEEEEEE EEE short form of MOV EAX/AX/AL may not pair
EEE EEEEEEEE EEE turning off paging may result in prefetch to random location
... EEE..... EEE no I/O restart during single-stepping or data BP exceptions
... EEE..... EEE NMI or INIT in SMM with I/O restart during single-stepping
... EEE..... EEE SMI# and FLUSH# during shutdown
... EEE..... EEE FLUSH# with a breakpoint pending causes false DR6 values
... EEEEEEEE EEE STPCLK# deassertion not recognized for 5 CLKs after BRDY#
... EEE..... ... future Pentium OvDr CPU FERR# contention in 2-socket systems
... E....... ... code cache lines not invalidated if snooped on AutoHALT/stop
... E....... ... STPCLK# assertion during HALT instruction hangs system
... EEEEEEEE EEE NMI or INIT during HALT within SMM causes bus activity
... EEEEEEEE ... RUNBIST restrictions when run through bound. scan circuitry
... EEEE.E.E ... FRC mode miscompare due to uninitialized internal register
... EEEEEEEE EEE STPCLK# restrictions during EWBE#
... EEE..... EE. multiple allocations into branch target buffer
... EEE..... ... 100 MHz REP MOVS speed path
... EEE..... EEE branche trace message corruption in slow trace mode
... EEEE.E.E ... FRC lock-step failure during APIC write
... EEEEEEE. ... BE4#-BE0# sampled incorrectly at Min Vih
... EEEE.E.. ... incorrect PCHK# output during boundary scan if in DP mode
... EEE..... ... BE3#-BE0# not driven during boundary scan if RESET high
... EEEEEEE. EEE current in stop clock state exceeds specification
... EEEEEEE. ... STPCLK# buffer samples incorr. during bound. scan testing
... EEEEE... ... BF&CPUTYP buffers sample incorr. during bound. scan testing
... EEEEEEEE EEE matched but disabled data BP can be lost by STPCLK# assert.
... EEEEEEEE EEE STPCLK# ignored in SMM when INT or NMI pending
... EEEEEEEE ... STPCLK# pullup not engaged at RESET
... EEEEEEEE EEE STPCLK# or FLUSH# after STI
... EEEEEEEE EEE REP string instruction not interruptable by STPCLK#
... EEEEEEEE EEE single step may not be reported on first instr. after FLUSH#
... EEEE.E.E ... double fault may generate illegal bus cycle
... ........ EE. BIST disabled
... ........ EEE maximum Icc usage
... ........ EE. CLK required for UP# to be driven
... ........ E.. FMUL bug (errors in least signif. bit with spec. operands)
... ........ E.. A4 pin connected to Vcc (incomp. with many older boards)
------------------------------------------------------------------------------
... DDD..... ... problem with ext. snooping while 2 cycles are pending on bus
... DDD..... ... STPCLK# assertion and the stop grant bus cycle
... DDD..... ... external snooping with AHOLD asserted may cause CPU to hang
... DDD..... ... address parity check not supported in dual processing mode
... DD...... ... incons. cache state from interCPU pipelined READ -> WRITE
... DDD..... ... processors hang during zero WS, pipelined bus cycles
... DDD..... ... bus lock-up problem in spec. dual processing mode sequence
... DDDD.D.. ... incorrect assertion of PHITM# without PHIT#
... DDDD.D.. ... double issuance of read cycles
... DDDD.D.. ... line invalidation may occur on read or prefetch cycles
... DDDD.D.D ... EADS# or floating ADS# may cause extra invalidates
... DDDD.D.. ... HOLD&BOFF# during APIC cycle may cause DP arbitrition prob.
... DDDD.D.. ... system hang after hold during local APIC 2nd INTA cycle
... DDDD.D.D ... external snoop can be incorrectly invalidated
------------------------------------------------------------------------------
... AAA..... ... remote read message shows valid status after a checksum err.
... AAA..... ... change of clearing an unread error in the error register
... AAA..... ... writes to error register clear register
... AAA..... ... 3 interrupts of the same priority cause lost local interrupt
... AAA..... ... APIC bus synch lost due to checksum error on remote read msg
... AAA..... ... HOLD during READ from local APIC reg. causes incorr. PCHK#
... AAA..... ... HOLD during outstanding interCPU pipel. APIC cycle hangs CPU
... AAA..... ... PICCLK reflection may cause an APIC checksum error
... AAAA.A.A ... spurious interrupt in APIC through local mode
... AAA..... ... pot. for lost INTs while using APIC in through local mode
... AAAA.A.. ... back to back asserts of HOLD may cause lost APIC write cycle
... AAAA.A.A ... system hangs when BOFF# is asserted during 2nd INTA cycle
... AAAA.A.A ... APIC pipe cycle during cache LF cause restarted cycle
... AAAA.A.A ... INIT and SMI via APIC three wire bus may be lost
... .......A ... IERR# in FRC lock-step mode during APIC write
... AAAAAAAA ... inadvertent BRDY# during external INT A cycle with BOFF#
------------------------------------------------------------------------------
... T....... ... CPU may not reset correctly due to floating FRCMC# pin
... T..TT.T. ... BRDY# does not have buffer selection capability
------------------------------------------------------------------------------
. : error does not exist in this mask revision
E : error exists in this mask revision
D : dual processing related errata
A : APIC related errata
T : 75 MHz TCP related errata
Intel PentiumPro processor
------------------------------------------------------------------------------
P6 <-- the 1st columns indicate the affected iPentiumPro steppings
BCA P6=B0/C0/sA0
000 errata descriptions; see Intel order #242689 for all details
------------------------------------------------------------------------------
EEE mixed cacheability of lock variables is problematic in MP systems
EEE FEA incorr. calculated after FP access which wraps 64K in 16 bit code
EEE differences exist in debug exception reporting
EEE FLUSH# servicing delayed while waiting for STARTUP_IPI in MP systems
E.. fast string REP MOVS may not transfer all data
E.. CR3 change during task switch using mode C paging may corrupt EIP
EEE code fetch matching disabled debug register may cause debug exception
EEE mode C paging in SMM causes use of incorrect page tables
E.. memory indirect near call may corrupt EIP
E.. L2 single bit correctable error may cancel simultaneous valid data
E.. page split access before write to CR3 may cause hang
E.. active A20# during SMM dump
E.. split access across 4K page boundary may cause hang
EEE checker BIST failure in FRC mode not signaled
EEE BINIT# assertion causes FRCERR assertion in FRC mode
EEE extra page fault may occur on IRET during task switch
E.. some caching models in SMM may cause shutdown
E.. fast strings feature re-enabled after INIT event
E.. THERMTRIP# feature not present
EEE OUT instruction, branch trace message may write incorrect data
.EE THERMTRIP# pin not asserted for catastrophic thermal condition
EEE LBR data may be written to LBER
EEE BTM for SMI will contain incorrect FROM EIP
EEE task switch fault may allow read access of linear address 0h
E.. low frequencies with 5:2 core:bus clock ratio may fail in FRC
EEE RDPMC cannot be used in conjunction with SMM
EEE PWRGOOD forced to 0 during boundary scan resets TAP
EEE BIST failure not indicated when RUNBIST TAP command used
EEE INVLPG may not invalidate targeted cTLB entry
EEE SMI does not flush TLB entries with PGE enabled
EEE I/O restart in SMM may fail after simultaneous MCE
EEE SMBASE reset on INIT# or INIT_IPI
EEE MCE due to L2 ECC error gives L1 MCACOD.LL
EEE INVLPG does not invalidate entire 0 to 4M region
E.. BINIT# assertion during snoop hit may cause double MCE
EEE MCE handler may not always execute successfully
EEE double ECC error on read may result in BINIT#
EEE RSM cannot return to HALT or SHUTDOWN in 32bit OS
EEE accesses of modified data may hang system
EEE branch traps do not function if BTMs are also enabled
EEE cache line may exist in two different ways in MP systems
EEE HALT, SHUTDOWN and STPCLK special cycles not issued
------------------------------------------------------------------------------
AAA APIC access to cacheable memory causes shutdown
AAA MP systems may hang due to catastrophic errors during BSP determination
AAA INIT_IPI after 2xSTARTUP_IPI sequence may cause AP to execute at 0h
------------------------------------------------------------------------------
. : error does not exist in this mask revision
E : error exists in this mask revision
A : APIC related errata
The (newer) iPentium P54 processor package bottom prints
========================================================
SX-no/vtm
SX-no = SX number (production code, see list of iPentium steppings)
v = voltage (S=3.135-3.600V, V=3.400-3.600V)
t = timing (S=standard, M=min. valid delay spec.)
m = MP support (S=standard (with DP/MP/UP support), U=no DP support)
DP = dual processing (two CPUs with shared memory environment)
MP = multi processing (two or more CPUs with seperate L2 caches)
UP = uni processing (only one CPU)
The NexGen Nx586 processor package top prints
=============================================
Nx586-xxxx-vvv-ppt-sss
xxxx = performance id value (P75, P80, P90 (84MHz), P100 (93MHz), P120)
vvv = voltage (ie. 4.0=4V)
pp = package type (ie. CP=ceramic PGA)
t = temperature (ie. C=commercial)
sss = stepping id value (ie. 201=D0, 202=D1)
The AMD 80486 processor package top prints
==========================================
p80486DXn-xxx-svct
p = package type (A=PGA, S=SQFP)
n = processor model (2=DX2, 4=DX4)
xxx = internal clock speed (66, 75, 80, 100, 120 MHz)
s = SMM microcode ( =Intel code, N=no (disabled) Intel code, S=AMD code)
v = voltage (V=3.3V core and 5V I/O tolerance)
c = L1 cache size (8=8KB, 1=16KB)
t = L1 cache type (T=WT, B=WB)
The AMD X5 processor package top prints
=======================================
AMD-X5-xxx-pvt
xxx = internal clock speed (133 MHz)
p = package type (A=PGA, S=SQFP)
v = voltage (F=3.3V, D=3.45V)
t = max. case temperature (W=55°C, Y=75°C, Z=85°C)
The RESET-EDX-CPUID-method
==========================
All the ≥i386 processors will show their CPUID value after the processor reset
in the DX register. Sometimes the value seems to be stored in the high part or
in both, the high and the low part of the EDX register. This shift is done by
some BIOS versions (probably to save the value during the power on self test).
You can get access to the EDX-after-reset-value via generating a processor re-
set using the triple-fault-method or the keyboard-controller-reset-method. The
reset test will only be useable when running under real mode!
On the iPentium processor there are two different resets: the standard and the
fast reset (only two clock cycles, without erasing caches...). I sometimes re-
ceived a hang-up on the iPentium-60 I checked my reset-software on.
Please, remember, that this reset test will not work with all BIOS versions!!!
------------------------------------------------------------------------------
some register values after a processor reset
------------------------------------------------------------------------------
EAX processor is okay, if zero (if not, then contact me and the vendor)
EDX value like the CPUID instruction xFMS value
386-xFMS 03xx=i386DX, 13xx=i376?, 23xx=i386SX/CX/EX, 033xx=i376,
034x=iRapidCAD, 43xx=i386SL
486-xFMS A3xx=IBM386SLC, A41x=IBM486SLC, A42x=IBM486SLC2, 84xx=IBM486BLC3
0005=CyrixM5, 0006=CyrixM6, 0007=CyrixM7,
d1d0=Cyrix 5x86 (d1=DIR1 value, d0=DIR0 value), 0490=newer 5x86
586-xFMS 15xx=NexGen Nx586 (similar to iPentium, 1=OverDrive?)
03D5=Nx586-100 or -100FPU (CPUID=0504), 15FB=Nx586 (D1/B0-step),
15F9=Nx586-120 (E2/C0-step, CPUID=0506),
existing CPU/FPU steppings: C3/-- (for VLB), D1/B0, D1/B1, E2/C0
053x=Cyrix 6x86 (similar to iPentium OverDrive?)
family 04=i486, 05=iPentium, 06=iPentiumPro
model i486: 0=DX, 1=DX50, 2=SX, 3=DX2, 4=SL, 5=SX2, 7=DX2WB, 8=DX4
9=DX4WB, E=X5WT, F=X5WB
iPentium: 0/1=5V-60/66 MHz, 2=3V-75/90/100/120/133 MHz, 3=P24T,
4=OvDr for iP5-3.3V, 5=OvDr for iDX4, 6=OvDr for iP5-5V
iPentPro: 0/1=iPentiumPro, 4=iP55CT (iP6 OvDr for iP54C socket)
stepping steppings sometimes cover several masks
------------------------------------------------------------------------------
Known 386/486 processor mask revisions
======================================
------------------------------------------------------------------------------
CPU known mask revisions for the RESET-EDX-CPUID stepping value
------------------------------------------------------------------------------
i386SX 4=A0, 5=B, 6=C?, 8=C-E, 9=D
i386CX/EX 9=A
i386DX 0=A, 3=B0-B10, 5=D0, 8=D1-D2
i386SL 10=A0-A3, 11=B0-B1
iRapidCAD 0=A, 1=B
i376 5=A, 8=B
------------------------------------------------------------------------------
AMD386SX 5=A, 8=B
AMD386DX 5=A, 8=B
------------------------------------------------------------------------------
i486DX25/33 0=A0-A1, 1=B2-B6, 2=C0, 3=C1, 4=D0
i486DX50 0=cA2-cA3, 1=cB0-cB1, 3=cC0, 4=aA0-aA1, 5=aB0
i486SL 0=A
i486DX2 2=A0-A2, 3=B1, 4=aA0-aA1, 5=aB0/aC0
i486SX 0=A0, 2=B0, 4=gAx, 7=cA0, 8=cB0, 3=D, A=E/aA0-aA1, B=aB0/aC0
i486SX2 B=aC0
------------------------------------------------------------------------------
AMD486DX 12=any (means: DX up to 40MHz)
AMD486DX2 32=any (means: DX2)
------------------------------------------------------------------------------
iP5 3=B1, 5=C1, 7=D1
iP54 1=B1, 2=B3, 4=B5, 5=C2/mA1, B=cB1/mcB1, C=cC0
iP24T 1=B1/B2, 2=C0
------------------------------------------------------------------------------
iP6 1=B0, 2=C0, 6=sA0
------------------------------------------------------------------------------
Used 'short-cuts'
=================
------------------------------------------------------------------------------
P9 Intel 80386SX processor
P4 Intel 80486DX processor
P4S Intel 80486SX processor
P23S Intel 80487SX processor
P23T Intel 80486 OverDrive processor (169 pin PGA)
P4T Intel 80486 OverDrive processor (168 pin PGA)
P24S Intel 80486DX2 processor
P24D Intel 80486DX2WB processor (integrated 8 KB writeback L1 cache)
P24C Intel 80486DX4 processor
P24T Intel Pentium OverDrive processor (with 63 or 83 MHz; Vcc=5V)
P24CT Intel Pentium OverDrive processor (with 63 or 83 MHz; Vcc=3.3V)
P5 Intel Pentium processor (with 60 or 66 MHz; Vcc=5V)
P54C Intel Pentium processor (with 75, 90, 100, 120, 133, 150, 166 Mhz)
P54CT Intel Pentium processor (with 125 to 180 MHz; ZIF socket #5)
P54CTB Intel Pentium processor (with 160, 180 or 200 MHz; ZIF socket #7)
P55C Intel Pentium processor (like P54CTB: new mask with 16+16K L1 cache)
P55CT Intel PentiumPro OverDrive processor (for the iP54C socket)
P6 Intel PentiumPro processor (with 133, 150, 166, 180 or 200 MHz)
------------------------------------------------------------------------------
i386 Intel 80386 CPU (i386SX/CX/EX, i386DX)
i486 Intel 80486 CPU (i486SX, i486SX2, i486DX, i486DX2(WB), i486DX4(WB))
------------------------------------------------------------------------------
Saturn Intel 82420TX chipset for i80486 processors
82423TX - data path unit
82424TX - cache and DRAM controller
82378IB/ZB - system I/O (for PCI to ISA bridge)
82374EB - EISA system component (for PCI to EISA bridge)
82375EB - PCI-EISA bridge (for PCI to EISA bridge)
------------------------------------------------------------------------------
Saturn2 Intel 82420ZX chipset for i80486 processors
82423TX - data path unit
82424ZX - cache and DRAM controller
82378ZB - system I/O (for PCI to ISA bridge)
82374EB - EISA system component (for PCI to EISA bridge)
82375EB - PCI-EISA bridge (for PCI to EISA bridge)
------------------------------------------------------------------------------
Aries Intel 82420EX chipset for i80486 processors
82425EX - PCI system controller
82426EX - ISA bridge
------------------------------------------------------------------------------
Mercury Intel 82430LX chipset for iPentium processors
82434LX - PCI cache and memory controller
82433LX - local bus accelerator
82378ZB - system I/O (for PCI to ISA bridge)
82374EB - EISA system component (for PCI to EISA bridge)
82375EB - PCI-EISA bridge (for PCI to EISA bridge)
------------------------------------------------------------------------------
Neptune Intel 82430NX chipset for iPentium processors
82434NX - PCI cache and memory controller
82433NX - local bus accelerator
82378ZB - system I/O (for PCI to ISA bridge)
82374EB/SB - EISA system component (for PCI to EISA bridge)
82375EB/SB - PCI-EISA bridge (for PCI to EISA bridge)
------------------------------------------------------------------------------
Triton Intel 82430FX chipset for iPentium processors
82437FX - Triton system controller
82438FX - Triton data path (there are two of these in the system)
82371FB - PCI ISA IDE accelerator (PIIX)
Triton2 Intel Triton-II Xcelerated Controller for iPentium processors (TCX)
BGA (Ball Grid Array), burst-EDO-DRAM support, new PCI bus buffers, up
to 512MB cacheable RAM, parity or ECC, DP support, PIIX3: PCI 2.1, two
seperate EIDE channels, USB support (Universal Serial Bus)
------------------------------------------------------------------------------
OrionKX Intel 82450KX chipset for iPentiumPro processors
82452KX, 82453KX, 82454KX, 82451KX (4x), 82371AB or 82378/9ZB
one PCI bus, 2 CPU MP support
OrionGX Intel 82450GX chipset for iPentiumPro processors
ECC, address and data bus parity, two PCI busses, 4 CPU MP support
Mars Intel chipset for iPentiumPro processors (codename 'Natoma')
==============================================================================
Nx586 This is the NexGen586 processor. It has iPentium-like structures. This
CPU has been created as a competitor for the iPentium processor. There
are the following technical parameters: 33 MHz external and 2.5x33 MHz
internal clock speed; no FPU (there will be a Nx587 part including the
FPU which replaces the Nx586); integrated L2 cache controller; 3.3V; a
i386 compatible core (no enhanced virtual mode, MSRs and so on); a L1-
cache with 2x16 KB; features like branch prediction, register renaming
and data forwarding or speculative execution; a 463 pin PGA package; a
0.5µ CMOS technology. The Nx586VL chipset has been created to use this
processor in an environment with Vesa Local Bus (VLB). This processor
will not fit in the original iPentium socket and it is not compatible
to the iPentium by internal (programming) details, but by the speed!
------------------------------------------------------------------------------
Nx686 NexGen Nx686 processor (samples: NexGen pinout, finals: iP54C pinout)
This processor will contain 16K code and 32K data integrated L1 cache,
an integrated L2 cache controller (up to 2MB) and the L2 cache bus (at
core speed). Also included: seven units (INT,INT,FPU,load,store,branch
and multimedia). The first chips will probably run at 180 MHz.
------------------------------------------------------------------------------
NexGen processor detection example (check for i386 compatibility 1st!)
is_a_386: MOV AX,5555h ; To detect the NexGen processor, first do
set_zero: XOR DX,DX ; check, whether it is an i80386 compatible
MOV CX,2h ; processor, or not. If it is a 32 bit CPU,
DIV CX ; then execute the division, which changes
JNZ no_NexGen ; zero flag on non-NexGen processors. Only
JZ is_NexGen ; the NexGen will not change the zero flag.
This test routine is based on the original NexGen processor detection.
----------------------------------------------------------------------
Some Cyrix 486 CPUs may show a similar behaviour on a DIV instruction,
so that you must combine your test routine with an EFLAGS.AC check. Do
a check for the AC-bit in EFLAGS too -- the NexGen processor does not
support toggling this bit, but Cyrix processors do. (So the NexGen CPU
will only be detected as an 80386 clone by the most test programs. The
test, which differs between a 386 and a 486, is normally based on this
AC-bit-toggling in EFLAGS.)
----------------------------------------------------------------------
The newer NexGen processors (about Q4/95) support a CPUID instruction.
==============================================================================
X5-133 AMD Am5x86-P75 80486DX4 processor with 4x33 MHz and 16 KB L1 cache
SS/5 AMD K5 lite processor for the i54C socket with iPentium-75 speed
------------------------------------------------------------------------------
K86 AMD processor with an architecture, similar to the Intel iPentiumPro
compareable to the iPentium-120/133 by the speed (130 MIPS)
==============================================================================
M5 Cyrix Cx80486S(2), Cx80486D(2), Cx80486S(2)-V, Cx80486D(2)-V processor
M6 Cyrix Cx80486DX, Cx80486DX-V processor
M7 Cyrix Cx80486DX2, Cx80486DX2-V processor
------------------------------------------------------------------------------
6x86 Cyrix processor with an architecture, similar to the Intel iPentiumPro
compareable to the iPentium-90..166 by the speed
5x86 Cyrix processor with an architecture, similar to the Intel 80486DX4
compareable to the iPentium-75 by the speed; fits into 80486 sockets
5gx86 Cyrix 5x86 with VGA, PCI and DRAM controller (EDO), L2 cache interface
------------------------------------------------------------------------------
Cyrix processor detection example (check for 80486 compatibility 1st!)
is_a_486: MOV AX,5555h ; To detect a Cyrix processor, first check,
XOR DX,DX ; whether it is an i80486 compatible CPU or
MOV CX,2h ; not. If it is an 80486 CPU, then execute
del_carry: CLC ; the division which changes the carry flag
DIV CX ; on non-Cyrix processors. Then you can do
JC no_Cyrix ; some accesses to the ports 22h/23h to get
JNC is_Cyrix ; more detailed information (see below).
This test routine is based on my own debugging sessions on Cyrix CPUs.
----------------------------------------------------------------------
For differing the Cyrix processors you need the CCR2 and CCR3 register
and the DIR0 and DIR1 register (see description of Cyrix registers).
First check whether CCR2.bit2 (LockNW) can be toggled (="res#1"). Then
check whether CCR3.bit4 (reserved or MAPEN) can be toggled (="res#2").
res#1 res#2 result
no no old Cx486SLC/DLC processor with no DIR0/DIR1 register
yes no A-step Cx486S processor with no DIR0/DIR1 register
no yes Cx486SLC/DLC processor with DIR0/DIR1 register
yes yes Cx486 processor with DIR0/DIR1 register
The old Cx486SLC/DLC processors with no DIR0/1 register can be checked
for A- or B-step, using a test for SMM opcode support. If you need the
detailed information about this complex test, then contact me, please!
==============================================================================
CPL actual Code Privilege Level (0..2=system, 3=user)
When running under real mode you are at CPL=0. If you use a memory ma-
nager like EMM386, WIN/3, QEMM or 386MAX, then the manager is running
at CPL=0 and your DOS-session/-box runs with CPL=3.
------------------------------------------------------------------------------
CRx Control Register x
DRx Debug Register x
TRx Test Register x
CCRx Cyrix Control Register x (accessed via port 22/23h)
------------------------------------------------------------------------------
MSR Model Specific Register (64 bit wide)
TSC Time Stamp Counter (64 bit wide)
------------------------------------------------------------------------------
TLB Translation Lookaside Buffer (≥i486)
BTB Branch Target Buffer (≥iPentium)
------------------------------------------------------------------------------
Used sources
============
------------------------------------------------------------------------------
Intel 386 CXSA embedded microprocessor, #272418-003, 11/94
Intel 386 EX embedded microprocessor, #272420-004, 09/94
------------------------------------------------------------------------------
military Intel 486 processor family, #271329-001, 02/95
ICE 486 in circuit emulator user's guide, #483298-001, 08/90
ICE 486 in circuit emulator installation/configuration, #483299-001, 06/90
ICE 486 in circuit emulator, #484019, 1990
------------------------------------------------------------------------------
Pentium processor family developer's manual volume #1, #241428-004, 1995
Pentium processor family developer's manual volume #2, #241429-004, 1995
Pentium processor family developer's manual volume #3, #241430-004, 1995
Pentium processor specification update, #242480-012, 01/96
Pentium processor ICE (with manuals) from Microtek International
------------------------------------------------------------------------------
PentiumPro processor developer's manual volume #1, #242690-00?, ??/??
PentiumPro processor developer's manual volume #2, #242691-00?, ??/??
PentiumPro processor developer's manual volume #3, #242692-00?, ??/??
PentiumPro processor at 150 MHz, #242769-001, 10/95
PentiumPro processor BIOS writer's guide, #??????-002, 01/96
PentiumPro processor specification update, #242689-003, 01/96
PentiumPro processor ICE (with manuals) from American Arium
------------------------------------------------------------------------------
multiprocessor specification 1.4, #242016-004, 06/95
optimizations for Intel's 32-bit processors, #241799-001, 02/94
processor identification with the CPUID, #241618-004, 12/95
------------------------------------------------------------------------------
Nx586 processor recognition application note, #754006-02
------------------------------------------------------------------------------
AMD 80486DX2 processor description, #19200, rev D, 08/95
AMD 80486DX4 processor description, #19160, rev D, 07/95
AMD enh. 80486DX4 processor description, #19225, rev B, 05/95
AMD 5x86 processor description, #19751, rev B, 12/95
------------------------------------------------------------------------------
IBM 80486BL processor data book addendum, #40018, 06.06.95
IBM 80486DX4 processor BIOS writer's guide, #40030, 03.10.95
IBM 80486DX4 processor application note, #40023, 05.09.95
IBM 5x86 processor BIOS writer's guide, #40038, 27.09.95
IBM 5x86 processor application note, #40036, 22.09.95
IBM 5x86 processor application note, #40040, 28.11.95
IBM 6x86 processor BIOS writer's guide, #40205, 11.01.96
IBM 6x86 processor application note, #40203, 11.01.96
IBM 6x86 processor application note, #40206, 15.01.96
------------------------------------------------------------------------------
Hans-Peter Messmer, Pentium, Addison-Wesley 1994, ISBN 3-89319-630-7
Hans-Peter Messmer, PC-Hardwarebuch, Addison-Wesley 1995, ISBN 3-89319-710-9
Ross P. Nelson, 80386/486, Microsoft Press, ISBN 3-86063-200-0
A. Schulman, Undocumented DOS 2nd ed., Addison-Wesley 1994, ISBN 0-201-63287-X
Frank van Gilluwe, Undocumented PC, Addison-Wesley 1994, ISBN 0-201-62277-7
------------------------------------------------------------------------------
Mike Schmit, Optimizing Pentium Code, Dr. Dobbs 1/94 p.40 - about the iPentium
Terje Mathisen, Pentium Secrets, BYTE 7/94 p.191 - about the iPentium
Georg Schnurer, Noch'n Gedicht, c't 9/94 p.27 - about the UMC U5S
Andreas Stiller, Kontrapunkt, c't 11/94 p.79 - about the Nx586
Christian Ludloff, Zwischen den Zeilen, c't 11/94 p.266 - about the iPentium
Andreas Stiller, Schwindel entlarvt, c't 12/94 p.62 - some CPUID models
Christian Ludloff, Wundersame Wandlung, c't 02/95 p.242 - about the iPentium
Andreas Stiller, Intels Antwort, c't 03/95 p.66 - some CPUID models
Andreas Stiller, Prozessorgeflüster, c't 04/95 p.26 - some CPUID models
Georg Schnurer, Discovery 6, c't 04/95 p.120 - about the new iP6
Georg Schnurer, Wider den Flaschenhals, c't 04/95 p.132 - about the iPentium
Andreas Stiller, Prozessorgeflüster, c't 05/95 p.34 - about the Cyrix M1
Andreas Stiller, Prozessorgeflüster, c't 06/95 p.26 - about the Cyrix M1
Andreas Stiller, Waschzettel, c't 07/95 p.186 - about masks & bugs
Alex Wolfe, Pentium secrets revealed, EE Times 7/3/95 p.1 - about 4p_v302.zip
Alex Wolfe, Embedded Insights, EE Times 7/10/95 p.43 - about 4p_v302.zip
Andreas Stiller, Prozessorgeflüster, c't 08/95 p.24 - about the iP55CT
Georg Schnurer, Offenbarungseid, c't 09/95 p.20 - about the new iP6
Georg Schnurer, Klappe zu, c't 09/95 p.22 - about new packages
Andreas Stiller, Prozessorgeflüster, c't 10/95 p.27 - about no iP55CT :(
Andreas Stiller, Prozessorgeflüster, c't 11/95 p.20 - about the AMD X5
Andreas Stiller, Tarnen und Täuschen, c't 12/95 p.20 - about iP54 SSS/VMU
Andreas Stiller, Herbststürme, c't 12/95 p.22 - about Nx686/AMD X5
Andreas Stiller, Prozessorgeflüster, c't 01/96 p.26 - about the Nx586FPU
Andreas Stiller, Leichte Vollwertkost, c't 01/96 p.84 - about new Nx586s
Andreas Stiller, Pro-Liferation, c't 01/96 p.210 - about iPentiumPros
Andreas Stiller, Prozessorgeflüster, c't 02/96, p.20 - about iP6 bugs
Andreas Stiller, Umdeklariert, c't 02/96, p.22 - about faked "iPP"s
Arno Kral, Im Zweifünftel-Takt, c't 02/96, p.54 - about iP54-150/166
Andreas Stiller, Pro-File, c't 02/96, p.58 - about dual iP6 PCs
------------------------------------------------------------------------------
software package thanks for
INFO.EXE SimCity2000 game CPUID
MFT.EXE QEMM v7.04 memory manager CPUID, Performance Monitoring
QEMM.SYS QEMM v7.04 memory manager CR4use, eV86, enabled WRMSR
TASM 3.2 Borland Pascal 7.0 Professional debugging
TP 7.0 Borland Pascal 7.0 Professional making 'DB 66h' 32bit code
CPUIDF.EXE Intel's Processor Detection Code CPUID, bug-free iPentiums
CPU_ID.ZIP NexGen's Processor Detection Pack NexGen detection code sample
CTCHIP32.ZIP c't magazine chip setter v3.2 Cyrix 5x86 feature control
CACHETST.COM Intel's Cache Type Detection Code differing WT and WB caches
CYRIXID.ZIP Cyrix's Processor Detection Pack 5x86 and 6x86 DIR0 values
------------------------------------------------------------------------------
Thanks to c't magazine author Peter Siering for my 1st article in 11/94.
Thanks to c't magazine author Andreas Stiller for testing all CPUID 'models'.
Thanks to c't magazine author Georg Schnurer for testing and his knowledge.
Thanks to Thomas Mönkemeier and his VGA-COPY/386 with my knowledge added in.
Thanks to Harald Feldmann from the Netherlands for knowledge/letters/faxes.
Thanks to Terje Mathisen from Norway for knowledge and his iPentium article.
Thanks to Ralf Brown for adding some knowledge to his DOS-INT-database.
Thanks to Peter Frühauf, the CBF-iPentium-60 and all the software-ß-testers.
Thanks to Maciej Rozycki from Gdansk (Poland) for his excellent CPU knowledge.
Thanks to Don Donato from Folsom (CA, USA) for the P24T test results (CPUID).
Thanks to Michael Steele from the NexGen corporation for his CPUID support.
Thanks to Alexander Konosevich for the Cyrix processor types and ID values.
Thanks to Alex Wolfe for his articles about the 4P package in the EE Times.
Thanks to Ingo Warnke for his basic knowledge for the V86 mode by-passing.
Thanks to Andrew Piziali for providing information from iPentium spec updates.
Thanks to Ton Plooy for his very useful Windows VxD for some the CPL=0 access.
Thanks to all my unnamed friends and their help. Sorry, if I forgot your name.
------------------------------------------------------------------------------
Peter Siering - ps@ct.ix.de - c't magazine (software)
Andreas Stiller - as@ct.ix.de - c't magazine (processors)
Georg Schnurer - gs@ct.ix.de - c't magazine (hardware)
Michael Steele - michael.steele@nexgen.com - NexGen prod.market.manag.
Harald Feldmann - feldmann@xs4all.nl (new!) - processor programming
Mike Schmit - 76347.3661@compuserve.com - processor programming
Terje Mathisen - terjem@hda.hydro.com - processor programming
Maciej Rozycki - prr09rm@loqi.elka.pg.gda.pl - processor programming
Thomas Mönkemeier - thm@vgasoft.com - VGA-Copy/386 and mailbox
Ralf Brown - ralf@pobox.com - DOS interrupt list
Andrew Schulman - andrew@ora.com - book The undocumented DOS
Frank van Gilluwe - 74000.635@compuserve.com - book The undocumented PC
Robert R. Collins - rcollins@x86.org - Check http://www.x86.org!
------------------------------------------------------------------------------
Trademarks are the property of their respective owners. The file may be copied
and distributed freely as long as it is distributed in its entirety and it is
not distributed for profit. I don't guarantee anything. End of file!
------------------------------------------------------------------------------
