1INTEL 80386 PROGRAMMER'S REFERENCE MANUAL 1986 2 3Intel Corporation makes no warranty for the use of its products and 4assumes no responsibility for any errors which may appear in this document 5nor does it make a commitment to update the information contained herein. 6 7Intel retains the right to make changes to these specifications at any 8time, without notice. 9 10Contact your local sales office to obtain the latest specifications before 11placing your order. 12 13The following are trademarks of Intel Corporation and may only be used to 14identify Intel Products: 15 16Above, BITBUS, COMMputer, CREDIT, Data Pipeline, FASTPATH, Genius, i, , 17ICE, iCEL, iCS, iDBP, iDIS, IICE, iLBX, im, iMDDX, iMMX, Inboard, 18Insite, Intel, intel, intelBOS, Intel Certified, Intelevision, 19inteligent Identifier, inteligent Programming, Intellec, Intellink, 20iOSP, iPDS, iPSC, iRMK, iRMX, iSBC, iSBX, iSDM, iSXM, KEPROM, Library 21Manager, MAPNET, MCS, Megachassis, MICROMAINFRAME, MULTIBUS, MULTICHANNEL, 22MULTIMODULE, MultiSERVER, ONCE, OpenNET, OTP, PC BUBBLE, Plug-A-Bubble, 23PROMPT, Promware, QUEST, QueX, Quick-Pulse Programming, Ripplemode, RMX/80, 24RUPI, Seamless, SLD, SugarCube, SupportNET, UPI, and VLSiCEL, and the 25combination of ICE, iCS, iRMX, iSBC, iSBX, iSXM, MCS, or UPI and a numerical 26suffix, 4-SITE. 27 28MDS is an ordering code only and is not used as a product name or 29trademark. MDS(R) is a registered trademark of Mohawk Data Sciences 30Corporation. 31 32Additional copies of this manual or other Intel literature may be obtained 33from: 34 35Intel Corporation 36Literature Distribution 37Mail Stop SC6-59 383065 Bowers Avenue 39Santa Clara, CA 95051 40 41(c)INTEL CORPORATION 1987 CG-5/26/87 42 43 44Customer Support 45 46 47 48Customer Support is Intel's complete support service that provides Intel 49customers with hardware support, software support, customer training, and 50consulting services. For more information contact your local sales offices. 51 52After a customer purchases any system hardware or software product, 53service and support become major factors in determining whether that 54product will continue to meet a customer's expectations. Such support 55requires an international support organization and a breadth of programs 56to meet a variety of customer needs. As you might expect, Intel's customer 57support is quite extensive. It includes factory repair services and 58worldwide field service offices providing hardware repair services, 59software support services, customer training classes, and consulting 60services. 61 62Hardware Support Services 63 64Intel is committed to providing an international service support package 65through a wide variety of service offerings available from Intel Hardware 66Support. 67 68Software Support Services 69 70Intel's software support consists of two levels of contracts. Standard 71support includes TIPS (Technical Information Phone Service), updates and 72subscription service (product-specific troubleshooting guides and COMMENTS 73Magazine). Basic support includes updates and the subscription service. 74Contracts are sold in environments which represent product groupings 75(i.e., iRMX environment). 76 77Consulting Services 78 79Intel provides field systems engineering services for any phase of your 80development or support effort. You can use our systems engineers in a 81variety of ways ranging from assistance in using a new product, developing 82an application, personalizing training, and customizing or tailoring an 83Intel product to providing technical and management consulting. Systems 84Engineers are well versed in technical areas such as microcommunications, 85real-time applications, embedded microcontrollers, and network services. 86You know your application needs; we know our products. Working together we 87can help you get a successful product to market in the least possible time. 88 89Customer Training 90 91Intel offers a wide range of instructional programs covering various 92aspects of system design and implementation. In just three to ten days a 93limited number of individuals learn more in a single workshop than in 94weeks of self-study. For optimum convenience, workshops are scheduled 95regularly at Training Centers woridwide or we can take our workshops to 96you for on-site instruction. Covering a wide variety of topics, Intel's 97major course categories include: architecture and assembly language, 98programming and operating systems, bitbus and LAN applications. 99 100Training Center Locations 101 102To obtain a complete catalog of our workshops, call the nearest Training 103Center in your area. 104 105Boston (617) 692-1000 106Chicago (312) 310-5700 107San Francisco (415) 940-7800 108Washington D.C. (301) 474-2878 109Isreal (972) 349-491-099 110Tokyo 03-437-6611 111Osaka (Call Tokyo) 03-437-6611 112Toronto, Canada (416) 675-2105 113London (0793) 696-000 114Munich (089) 5389-1 115Paris (01) 687-22-21 116Stockholm (468) 734-01-00 117Milan 39-2-82-44-071 118Benelux (Rotterdam) (10) 21-23-77 119Copenhagen (1) 198-033 120Hong Kong 5-215311-7 121 122 123Table of Contents 124 125Chapter 1 Introduction to the 80386 126 1271.1 Organization of This Manual 128 1.1.1 Part I Applications Programming 129 1.1.2 Part II Systems Programming 130 1.1.3 Part III Compatibility 131 1.1.4 Part IV Instruction Set 132 1.1.5 Appendices 133 1341.2 Related Literature 1351.3 Notational Conventions 136 1.3.1 Data-Structure Formats 137 1.3.2 Undefined Bits and Software Compatibility 138 1.3.3 Instruction Operands 139 1.3.4 Hexadecimal Numbers 140 1.3.5 Sub- and Super-Scripts 141 142 PART I APPLICATIONS PROGRAMMING 143 144Chapter 2 Basic Programming Model 145 1462.1 Memory Organization and Segmentation 147 2.1.1 The"Flat" Model 148 2.1.2 The Segmented Model 149 1502.2 Data Types 1512.3 Registers 152 2.3.1 General Registers 153 2.3.2 Segment Registers 154 2.3.3 Stack Implementation 155 2.3.4 Flags Register 156 2.3.4.1 Status Flags 157 2.3.4.2 Control Flag 158 2.3.4.3 Instruction Pointer 159 1602.4 Instruction Format 1612.5 Operand Selection 162 2.5.1 Immediate Operands 163 2.5.2 Register Operands 164 2.5.3 Memory Operands 165 2.5.3.1 Segment Selection 166 2.5.3.2 Effective-Address Computation 167 1682.6 Interrupts and Exceptions 169 170Chapter 3 Applications Instruction Set 171 1723.1 Data Movement Instructions 173 3.1.1 General-Purpose Data Movement Instructions 174 3.1.2 Stack Manipulation Instructions 175 3.1.3 Type Conversion Instructions 176 1773.2 Binary Arithmetic Instructions 178 3.2.1 Addition and Subtraction Instructions 179 3.2.2 Comparison and Sign Change Instruction 180 3.2.3 Multiplication Instructions 181 3.2.4 Division Instructions 182 1833.3 Decimal Arithmetic Instructions 184 3.3.1 Packed BCD Adjustment Instructions 185 3.3.2 Unpacked BCD Adjustment Instructions 186 1873.4 Logical Instructions 188 3.4.1 Boolean Operation Instructions 189 3.4.2 Bit Test and Modify Instructions 190 3.4.3 Bit Scan Instructions 191 3.4.4 Shift and Rotate Instructions 192 3.4.4.1 Shift Instructions 193 3.4.4.2 Double-Shift Instructions 194 3.4.4.3 Rotate Instructions 195 3.4.4.4 Fast"bit-blt" Using Double Shift 196 Instructions 197 3.4.4.5 Fast Bit-String Insert and Extract 198 199 3.4.5 Byte-Set-On-Condition Instructions 200 3.4.6 Test Instruction 201 2023.5 Control Transfer Instructions 203 3.5.1 Unconditional Transfer Instructions 204 3.5.1.1 Jump Instruction 205 3.5.1.2 Call Instruction 206 3.5.1.3 Return and Return-From-Interrupt Instruction 207 208 3.5.2 Conditional Transfer Instructions 209 3.5.2.1 Conditional Jump Instructions 210 3.5.2.2 Loop Instructions 211 3.5.2.3 Executing a Loop or Repeat Zero Times 212 213 3.5.3 Software-Generated Interrupts 214 2153.6 String and Character Translation Instructions 216 3.6.1 Repeat Prefixes 217 3.6.2 Indexing and Direction Flag Control 218 3.6.3 String Instructions 219 2203.7 Instructions for Block-Structured Languages 2213.8 Flag Control Instructions 222 3.8.1 Carry and Direction Flag Control Instructions 223 3.8.2 Flag Transfer Instructions 224 2253.9 Coprocessor Interface Instructions 2263.10 Segment Register Instructions 227 3.10.1 Segment-Register Transfer Instructions 228 3.10.2 Far Control Transfer Instructions 229 3.10.3 Data Pointer Instructions 230 2313.11 Miscellaneous Instructions 232 3.11.1 Address Calculation Instruction 233 3.11.2 No-Operation Instruction 234 3.11.3 Translate Instruction 235 236 PART II SYSTEMS PROGRAMMING 237 238Chapter 4 Systems Architecture 239 2404.1 Systems Registers 241 4.1.1 Systems Flags 242 4.1.2 Memory-Management Registers 243 4.1.3 Control Registers 244 4.1.4 Debug Register 245 4.1.5 Test Registers 246 2474.2 Systems Instructions 248 249Chapter 5 Memory Management 250 2515.1 Segment Translation 252 5.1.1 Descriptors 253 5.1.2 Descriptor Tables 254 5.1.3 Selectors 255 5.1.4 Segment Registers 256 2575.2 Page Translation 258 5.2.1 Page Frame 259 5.2.2 Linear Address 260 5.2.3 Page Tables 261 5.2.4 Page-Table Entries 262 5.2.4.1 Page Frame Address 263 5.2.4.2 Present Bit 264 5.2.4.3 Accessed and Dirty Bits 265 5.2.4.4 Read/Write and User/Supervisor Bits 266 267 5.2.5 Page Translation Cache 268 2695.3 Combining Segment and Page Translation 270 5.3.1 "Flat" Architecture 271 5.3.2 Segments Spanning Several Pages 272 5.3.3 Pages Spanning Several Segments 273 5.3.4 Non-Aligned Page and Segment Boundaries 274 5.3.5 Aligned Page and Segment Boundaries 275 5.3.6 Page-Table per Segment 276 277Chapter 6 Protection 278 2796.1 Why Protection? 2806.2 Overview of 80386 Protection Mechanisms 2816.3 Segment-Level Protection 282 6.3.1 Descriptors Store Protection Parameters 283 6.3.1.1 Type Checking 284 6.3.1.2 Limit Checking 285 6.3.1.3 Privilege Levels 286 287 6.3.2 Restricting Access to Data 288 6.3.2.1 Accessing Data in Code Segments 289 290 6.3.3 Restricting Control Transfers 291 6.3.4 Gate Descriptors Guard Procedure Entry Points 292 6.3.4.1 Stack Switching 293 6.3.4.2 Returning from a Procedure 294 295 6.3.5 Some Instructions are Reserved for Operating System 296 6.3.5.1 Privileged Instructions 297 6.3.5.2 Sensitive Instructions 298 299 6.3.6 Instructions for Pointer Validation 300 6.3.6.1 Descriptor Validation 301 6.3.6.2 Pointer Integrity and RPL 302 3036.4 Page-Level Protection 304 6.4.1 Page-Table Entries Hold Protection Parameters 305 6.4.1.1 Restricting Addressable Domain 306 6.4.1.2 Type Checking 307 308 6.4.2 Combining Protection of Both Levels of Page Tables 309 6.4.3 Overrides to Page Protection 310 3116.5 Combining Page and Segment Protection 312 313Chapter 7 Multitasking 314 3157.1 Task State Segment 3167.2 TSS Descriptor 3177.3 Task Register 3187.4 Task Gate Descriptor 3197.5 Task Switching 3207.6 Task Linking 321 7.6.1 Busy Bit Prevents Loops 322 7.6.2 Modifying Task Linkages 323 3247.7 Task Address Space 325 7.7.1 Task Linear-to-Physical Space Mapping 326 7.7.2 Task Logical Address Space 327 328Chapter 8 Input/Output 329 3308.1 I/O Addressing 331 8.1.1 I/O Address Space 332 8.1.2 Memory-Mapped I/O 333 3348.2 I/O Instructions 335 8.2.1 Register I/O Instructions 336 8.2.2 Block I/O Instructions 337 3388.3 Protection and I/O 339 8.3.1 I/O Privilege Level 340 8.3.2 I/O Permission Bit Map 341 342Chapter 9 Exceptions and Interrupts 343 3449.1 Identifying Interrupts 3459.2 Enabling and Disabling Interrupts 346 9.2.1 NMI Masks Further NMls 347 9.2.2 IF Masks INTR 348 9.2.3 RF Masks Debug Faults 349 9.2.4 MOV or POP to SS Masks Some Interrupts and Exceptions 350 3519.3 Priority Among Simultaneous Interrupts and Exceptions 3529.4 Interrupt Descriptor Table 3539.5 IDT Descriptors 3549.6 Interrupt Tasks and Interrupt Procedures 355 9.6.1 Interrupt Procedures 356 9.6.1.1 Stack of Interrupt Procedure 357 9.6.1.2 Returning from an Interrupt Procedure 358 9.6.1.3 Flags Usage by Interrupt Procedure 359 9.6.1.4 Protection in Interrupt Procedures 360 361 9.6.2 Interrupt Tasks 362 3639.7 Error Code 3649.8 Exception Conditions 365 9.8.1 Interrupt 0 Divide Error 366 9.8.2 Interrupt 1 Debug Exceptions 367 9.8.3 Interrupt 3 Breakpoint 368 9.8.4 Interrupt 4 Overflow 369 9.8.5 Interrupt 5 Bounds Check 370 9.8.6 Interrupt 6 Invalid Opcode 371 9.8.7 Interrupt 7 Coprocessor Not Available 372 9.8.8 Interrupt 8 Double Fault 373 9.8.9 Interrupt 9 Coprocessor Segment Overrun 374 9.8.10 Interrupt 10 Invalid TSS 375 9.8.11 Interrupt 11 Segment Not Present 376 9.8.12 Interrupt 12 Stack Exception 377 9.8.13 Interrupt 13 General Protection Exception 378 9.8.14 Interrupt 14 Page Fault 379 9.8.14.1 Page Fault during Task Switch 380 9.8.14.2 Page Fault with Inconsistent Stack Pointer 381 382 9.8.15 Interrupt 16 Coprocessor Error 383 3849.9 Exception Summary 385 3869.10 Error Code Summary 387 388Chapter 10 Initialization 389 39010.1 Processor State after Reset 39110.2 Software Initialization for Real-Address Mode 392 10.2.1 Stack 393 10.2.2 Interrupt Table 394 10.2.3 First Instructions 395 39610.3 Switching to Protected Mode 39710.4 Software Initialization for Protected Mode 398 10.4.1 Interrupt Descriptor Table 399 10.4.2 Stack 400 10.4.3 Global Descriptor Table 401 10.4.4 Page Tables 402 10.4.5 First Task 403 40410.5 Initialization Example 40510.6 TLB Testing 406 10.6.1 Structure of the TLB 407 10.6.2 Test Registers 408 10.6.3 Test Operations 409 410Chapter 11 Coprocessing and Multiprocessing 411 41211.1 Coprocessing 413 11.1.1 Coprocessor Identification 414 11.1.2 ESC and WAIT Instructions 415 11.1.3 EM and MP Flags 416 11.1.4 The Task-Switched Flag 417 11.1.5 Coprocessor Exceptions 418 11.1.5.1 Interrupt 7 Coprocessor Not Available 419 11.1.5.2 Interrupt 9 Coprocessor Segment Overrun 420 11.1.5.3 Interrupt 16 Coprocessor Error 421 42211.2 General Multiprocessing 423 11.2.1 LOCK and the LOCK# Signal 424 11.2.2 Automatic Locking 425 11.2.3 Cache Considerations 426 427Chapter 12 Debugging 428 42912.1 Debugging Features of the Architecture 43012.2 Debug Registers 431 12.2.1 Debug Address Registers (DRO-DR3) 432 12.2.2 Debug Control Register (DR7) 433 12.2.3 Debug Status Register (DR6) 434 12.2.4 Breakpoint Field Recognition 435 43612.3 Debug Exceptions 437 12.3.1 Interrupt 1 Debug Exceptions 438 12.3.1.1 Instruction Address Breakpoint 439 12.3.1.2 Data Address Breakpoint 440 12.3.1.3 General Detect Fault 441 12.3.1.4 Single-Step Trap 442 12.3.1.5 Task Switch Breakpoint 443 444 12.3.2 Interrupt 3 Breakpoint Exception 445 446 PART III COMPATIBILITY 447 448Chapter 13 Executing 80286 Protected-Mode Code 449 45013.1 80286 Code Executes as a Subset of the 80386 45113.2 Two Ways to Execute 80286 Tasks 45213.3 Differences from 80286 453 13.3.1 Wraparound of 80286 24-Bit Physical Address Space 454 13.3.2 Reserved Word of Descriptor 455 13.3.3 New Descriptor Type Codes 456 13.3.4 Restricted Semantics of LOCK 457 13.3.5 Additional Exceptions 458 459Chapter 14 80386 Real-Address Mode 460 46114.1 Physical Address Formation 46214.2 Registers and Instructions 46314.3 Interrupt and Exception Handling 46414.4 Entering and Leaving Real-Address Mode 465 14.4.1 Switching to Protected Mode 466 46714.5 Switching Back to Real-Address Mode 46814.6 Real-Address Mode Exceptions 46914.7 Differences from 8086 47014.8 Differences from 80286 Real-Address Mode 471 14.8.1 Bus Lock 472 14.8.2 Location of First Instruction 473 14.8.3 Initial Values of General Registers 474 14.8.4 MSW Initialization 475 476Chapter 15 Virtual 8088 Mode 477 47815.1 Executing 8086 Code 479 15.1.1 Registers and Instructions 480 15.1.2 Linear Address Formation 481 48215.2 Structure of a V86 Task 483 15.2.1 Using Paging for V86 Tasks 484 15.2.2 Protection within a V86 Task 485 48615.3 Entering and Leaving V86 Mode 487 15.3.1 Transitions Through Task Switches 488 15.3.2 Transitions Through Trap Gates and Interrupt Gates 489 49015.4 Additional Sensitive Instructions 491 15.4.1 Emulating 8086 Operating System Calls 492 15.4.2 Virtualizing the Interrupt-Enable Flag 493 49415.5 Virtual I/O 495 15.5.1 I/O-Mapped I/O 496 15.5.2 Memory-Mapped I/O 497 15.5.3 Special I/O Buffers 498 49915.6 Differences from 8086 50015.7 Differences from 80286 Real-Address Mode 501 502Chapter 16 Mixing 16-Bit and 32-Bit Code 503 50416.1 How the 80386 Implements 16-Bit and 32-Bit Features 50516.2 Mixing 32-Bit and 16-Bit Operations 50616.3 Sharing Data Segments among Mixed Code Segments 50716.4 Transferring Control among Mixed Code Segments 508 16.4.1 Size of Code-Segment Pointer 509 16.4.2 Stack Management for Control Transfers 510 16.4.2.1 Controlling the Operand-Size for a CALL 511 16.4.2.2 Changing Size of Call 512 513 16.4.3 Interrupt Control Transfers 514 16.4.4 Parameter Translation 515 16.4.5 The Interface Procedure 516 517 PART IV INSTRUCTION SET 518 519Chapter 17 80386 Instruction Set 520 52117.1 Operand-Size and Address-Size Attributes 522 17.1.1 Default Segment Attribute 523 17.1.2 Operand-Size and Address-Size Instruction Prefixes 524 17.1.3 Address-Size Attribute for Stack 525 52617.2 Instruction Format 527 17.2.1 ModR/M and SIB Bytes 528 17.2.2 How to Read the Instruction Set Pages 529 17.2.2.1 Opcode 530 17.2.2.2 Instruction 531 17.2.2.3 Clocks 532 17.2.2.4 Description 533 17.2.2.5 Operation 534 17.2.2.6 Description 535 17.2.2.7 Flags Affected 536 17.2.2.8 Protected Mode Exceptions 537 17.2.2.9 Real Address Mode Exceptions 538 17.2.2.10 Virtual-8086 Mode Exceptions 539 540Instruction Sets 541 542AAA 543AAD 544AAM 545AAS 546ADC 547ADD 548AND 549ARPL 550BOUND 551BSF 552BSR 553BT 554BTC 555BTR 556BTS 557CALL 558CBW/CWDE 559CLC 560CLD 561CLI 562CLTS 563CMC 564CMP 565CMPS/CMPSB/CMPSW/CMPSD 566CWD/CDQ 567DAA 568DAS 569DEC 570DIV 571ENTER 572HLT 573IDIV 574IMUL 575IN 576INC 577INS/INSB/INSW/INSD 578INT/INTO 579IRET/IRETD 580Jcc 581JMP 582LAHF 583LAR 584LEA 585LEAVE 586LGDT/LIDT 587LGS/LSS/LDS/LES/LFS 588LLDT 589LMSW 590LOCK 591LODS/LODSB/LODSW/LODSD 592LOOP/LOOPcond 593LSL 594LTR 595MOV 596MOV 597MOVS/MOVSB/MOVSW/MOVSD 598MOVSX 599MOVZX 600MUL 601NEG 602NOP 603NOT 604OR 605OUT 606OUTS/OUTSB/OUTSW/OUTSD 607POP 608POPA/POPAD 609POPF/POPFD 610PUSH 611PUSHA/PUSHAD 612PUSHF/PUSHFD 613RCL/RCR/ROL/ROR 614REP/REPE/REPZ/REPNE/REPNZ 615RET 616SAHF 617SAL/SAR/SHL/SHR 618SBB 619SCAS/SCASB/SCASW/SCASD 620SETcc 621SGDT/SIDT 622SHLD 623SHRD 624SLDT 625SMSW 626STC 627STD 628STI 629STOS/STOSB/STOSW/STOSD 630STR 631SUB 632TEST 633VERR,VERW 634WAIT 635XCHG 636XLAT/XLATB 637XOR 638 639Appendix A Opcode Map 640 641Appendix B Complete Flag Cross-Reference 642 643Appendix C Status Flag Summary 644 645Appendix D Condition Codes 646 647 648Figures 649 6501-1 Example Data Structure 651 6522-1 Two-Component Pointer 6532-2 Fundamental Data Types 6542-3 Bytes, Words, and Doublewords in Memory 6552-4 80386 Data Types 6562-5 80386 Applications Register Set 6572-6 Use of Memory Segmentation 6582-7 80386 Stack 6592-8 EFLAGS Register 6602-9 Instruction Pointer Register 6612-10 Effective Address Computation 662 6633-1 PUSH 6643-2 PUSHA 6653-3 POP 6663-4 POPA 6673-5 Sign Extension 6683-6 SAL and SHL 6693-7 SHR 6703-8 SAR 6713-9 Using SAR to Simulate IDIV 6723-10 Shift Left Double 6733-11 Shift Right Double 6743-12 ROL 6753-13 ROR 6763-14 RCL 6773-15 RCR 6783-16 Formal Definition of the ENTER Instruction 6793-17 Variable Access in Nested Procedures 6803-18 Stack Frame for MAIN at Level 1 6813-19 Stack Frame for Prooedure A 6823-20 Stack Frame for Procedure B at Level 3 Called from A 6833-21 Stack Frame for Procedure C at Level 3 Called from B 6843-22 LAHF and SAHF 6853-23 Flag Format for PUSHF and POPF 686 6874-1 Systems Flags of EFLAGS Register 6884-2 Control Registers 689 6905-1 Address Translation Overview 6915-2 Segment Translation 6925-3 General Segment-Descriptor Format 6935-4 Format of Not-Present Descriptor 6945-5 Descriptor Tables 6955-6 Format of a Selector 6965-7 Segment Registers 6975-8 Format of a Linear Address 6985-9 Page Translation 6995-10 Format of a Page Table Entry 7005-11 Invalid Page Table Entry 7015-12 80386 Addressing Mechanism 7025-13 Descriptor per Page Table 703 7046-1 Protection Fields of Segment Descriptors 7056-2 Levels of Privilege 7066-3 Privilege Check for Data Access 7076-4 Privilege Check for Control Transfer without Gate 7086-5 Format of 80386 Call Gate 7096-6 Indirect Transfer via Call Gate 7106-7 Privilege Check via Call Gate 7116-8 Initial Stack Pointers of TSS 7126-9 Stack Contents after an Interievel Call 7136-10 Protection Fields of Page Table Entries 714 7157-1 80386 32-Bit Task State Segment 7167-2 TSS Descriptor for 32-Bit TSS 7177-3 Task Register 7187-4 Task Gate Descriptor 7197-5 Task Gate Indirectly Identifies Task 7207-6 Partially-Overlapping Linear Spaces 721 7228-1 Memory-Mapped I/O 7238-2 I/O Address Bit Map 724 7259-1 IDT Register and Table 7269-2 Pseudo-Descriptor Format for LIDT and SIDT 7279-3 80386 IDT Gate Descriptors 7289-4 Interrupt Vectoring for Procedures 7299-5 Stack Layout after Exception of Interrupt 7309-6 Interrupt Vectoring for Tasks 7319-7 Error Code Format 7329-8 Page-Fault Error Code Format 7339-9 CR2 Format 734 73510-1 Contents of EDX after RESET 73610-2 Initial Contents of CRO 73710-3 TLB Structure 73810-4 Test Registers 739 74012-1 Debug Registers 741 74214-1 Real-Address Mode Address Formation 743 74415-1 V86 Mode Address Formation 74515-2 Entering and Leaving an 8086 Program 74615-3 PL 0 Stack after Interrupt in V86 Task 747 74816-1 Stack after Far 16-Bit and 32-Bit Calls 749 75017-1 80386 Instruction Format 75117-2 ModR/M and SIB Byte Formats 75217-3 Bit Offset for BIT[EAX, 21] 75317-4 Memory Bit Indexing 754 755 756Tables 757 7582-1 Default Segment Register Selection Rules 7592-2 80386 Reserved Exceptions and Interrupts 760 7613-1 Bit Test and Modify Instructions 7623-2 Interpretation of Conditional Transfers 763 7646-1 System and Gate Descriptor Types 7656-2 Useful Combinations of E, G, and B Bits 7666-3 Interievel Return Checks 7676-4 Valid Descriptor Types for LSL 7686-5 Combining Directory and Page Protection 769 7707-1 Checks Made during a Task Switch 7717-2 Effect of Task Switch on BUSY, NT, and Back-Link 772 7739-1 Interrupt and Exception ID Assignments 7749-2 Priority Among Simultaneous Interrupts and Exceptions 7759-3 Double-Fault Detection Classes 7769-4 Double-Fault Definition 7779-5 Conditions That Invalidate the TSS 7789-6 Exception Summary 7799-7 Error-Code Summary 780 78110-1 Meaning of D, U, and W Bit Pairs 782 78312-1 Breakpeint Field Recognition Examples 78412-2 Debug Exception Conditions 785 78614-1 80386 Real-Address Mode Exceptions 78714-2 New 80386 Exceptions 788 78917-1 Effective Size Attributes 79017-2 16-Bit Addressing Forms with the ModR/M Byte 79117-3 32-Bit Addressing Forms with the ModR/M Byte 79217-4 32-Bit Addressing Forms with the SIB Byte 79317-5 Task Switch Times for Exceptions 79417-6 80386 Exceptions 795 796 797Chapter 1 Introduction to the 80386 798 799 800 801The 80386 is an advanced 32-bit microprocessor optimized for multitasking 802operating systems and designed for applications needing very high 803performance. The 32-bit registers and data paths support 32-bit addresses 804and data types. The processor can address up to four gigabytes of physical 805memory and 64 terabytes (2^(46) bytes) of virtual memory. The on-chip 806memory-management facilities include address translation registers, 807advanced multitasking hardware, a protection mechanism, and paged virtual 808memory. Special debugging registers provide data and code breakpoints even 809in ROM-based software. 810 811 8121.1 Organization of This Manual 813 814This book presents the architecture of the 80386 in five parts: 815 816 Part I Applications Programming 817 Part II Systems Programming 818 Part III Compatibility 819 Part IV Instruction Set 820 Appendices 821 822These divisions are determined in part by the architecture itself and in 823part by the different ways the book will be used. As the following table 824indicates, the latter two parts are intended as reference material for 825programmers actually engaged in the process of developing software for the 82680386. The first three parts are explanatory, showing the purpose of 827architectural features, developing terminology and concepts, and describing 828instructions as they relate to specific purposes or to specific 829architectural features. 830 831Explanation Part I Applications Programming 832 Part II Systems Programming 833 Part III Compatibility 834 835Reference Part IV Instruction Set 836 Appendices 837 838The first three parts follow the execution modes and protection features of 839the 80386 CPU. The distinction between applications features and systems 840features is determined by the protection mechanism of the 80386. One purpose 841of protection is to prevent applications from interfering with the operating 842system; therefore, the processor makes certain registers and instructions 843inaccessible to applications programs. The features discussed in Part I are 844those that are accessible to applications; the features in Part II are 845available only to systems software that has been given special privileges or 846in unprotected systems. 847 848The processing mode of the 80386 also determines the features that are 849accessible. The 80386 has three processing modes: 850 851 1. Protected Mode. 852 2. Real-Address Mode. 853 3. Virtual 8086 Mode. 854 855Protected mode is the natural 32-bit environment of the 80386 processor. In 856this mode all instructions and features are available. 857 858Real-address mode (often called just "real mode") is the mode of the 859processor immediately after RESET. In real mode the 80386 appears to 860programmers as a fast 8086 with some new instructions. Most applications of 861the 80386 will use real mode for initialization only. 862 863Virtual 8086 mode (also called V86 mode) is a dynamic mode in the sense 864that the processor can switch repeatedly and rapidly between V86 mode and 865protected mode. The CPU enters V86 mode from protected mode to execute an 8668086 program, then leaves V86 mode and enters protected mode to continue 867executing a native 80386 program. 868 869The features that are available to applications programs in protected mode 870and to all programs in V86 mode are the same. These features form the 871content of Part I. The additional features that are available to systems 872software in protected mode form Part II. Part III explains real-address 873mode and V86 mode, as well as how to execute a mix of 32-bit and 16-bit 874programs. 875 876Available in All Modes Part I Applications Programming 877 878Available in Protected Part II Systems Programming 879Mode Only 880 881Compatibility Modes Part III Compatibility 882 883 8841.1.1 Part I Applications Programming 885 886This part presents those aspects of the architecture that are customarily 887used by applications programmers. 888 889Chapter 2 Basic Programming Model: Introduces the models of memory 890organization. Defines the data types. Presents the register set used by 891applications. Introduces the stack. Explains string operations. Defines the 892parts of an instruction. Explains addressing calculations. Introduces 893interrupts and exceptions as they may apply to applications programming. 894 895Chapter 3 Application Instruction Set: Surveys the instructions commonly 896used for applications programming. Considers instructions in functionally 897related groups; for example, string instructions are considered in one 898section, while control-transfer instructions are considered in another. 899Explains the concepts behind the instructions. Details of individual 900instructions are deferred until Part IV, the instruction-set reference. 901 902 9031.1.2 Part II Systems Programming 904 905This part presents those aspects of the architecture that are customarily 906used by programmers who write operating systems, device drivers, debuggers, 907and other software that supports applications programs in the protected mode 908of the 80386. 909 910Chapter 4 Systems Architecture: Surveys the features of the 80386 that 911are used by systems programmers. Introduces the remaining registers and data 912structures of the 80386 that were not discussed in Part I. Introduces the 913systems-oriented instructions in the context of the registers and data 914structures they support. Points to the chapter where each register, data 915structure, and instruction is considered in more detail. 916 917Chapter 5 Memory Management: Presents details of the data structures, 918registers, and instructions that support virtual memory and the concepts of 919segmentation and paging. Explains how systems designers can choose a model 920of memory organization ranging from completely linear ("flat") to fully 921paged and segmented. 922 923Chapter 6 Protection: Expands on the memory management features of the 92480386 to include protection as it applies to both segments and pages. 925Explains the implementation of privilege rules, stack switching, pointer 926validation, user and supervisor modes. Protection aspects of multitasking 927are deferred until the following chapter. 928 929Chapter 7 Multitasking: Explains how the hardware of the 80386 supports 930multitasking with context-switching operations and intertask protection. 931 932Chapter 8 Input/Output: Reveals the I/O features of the 80386, including 933I/O instructions, protection as it relates to I/O, and the I/O permission 934map. 935 936Chapter 9 Exceptions and Interrupts: Explains the basic interrupt 937mechanisms of the 80386. Shows how interrupts and exceptions relate to 938protection. Discusses all possible exceptions, listing causes and including 939information needed to handle and recover from the exception. 940 941Chapter 10 Initialization: Defines the condition of the processor after 942RESET or power-up. Explains how to set up registers, flags, and data 943structures for either real-address mode or protected mode. Contains an 944example of an initialization program. 945 946Chapter 11 Coprocessing and Multiprocessing: Explains the instructions 947and flags that support a numerics coprocessor and multiple CPUs with shared 948memory. 949 950Chapter 12 Debugging: Tells how to use the debugging registers of the 95180386. 952 953 9541.1.3 Part III Compatibility 955 956Other parts of the book treat the processor primarily as a 32-bit machine, 957omitting for simplicity its facilities for 16-bit operations. Indeed, the 95880386 is a 32-bit machine, but its design fully supports 16-bit operands and 959addressing, too. This part completes the picture of the 80386 by explaining 960the features of the architecture that support 16-bit programs and 16-bit 961operations in 32-bit programs. All three processor modes are used to 962execute 16-bit programs: protected mode can directly execute 16-bit 80286 963protected mode programs, real mode executes 8086 programs and real-mode 96480286 programs, and virtual 8086 mode executes 8086 programs in a 965multitasking environment with other 80386 protected-mode programs. In 966addition, 32-bit and 16-bit modules and individual 32-bit and 16-bit 967operations can be mixed in protected mode. 968 969Chapter 13 Executing 80286 Protected-Mode Code: In its protected mode, 970the 80386 can execute complete 80286 protected-mode systems, because 80286 971capabilities are a subset of 80386 capabilities. 972 973Chapter 14 80386 Real-Address Mode: Explains the real mode of the 80386 974CPU. In this mode the 80386 appears as a fast real-mode 80286 or fast 8086 975enhanced with additional instructions. 976 977Chapter 15 Virtual 8086 Mode: The 80386 can switch rapidly between its 978protected mode and V86 mode, giving it the ability to multiprogram 8086 979programs along with "native mode" 32-bit programs. 980 981Chapter 16 Mixing 16-Bit and 32-Bit Code: Even within a program or task, 982the 80386 can mix 16-bit and 32-bit modules. Furthermore, any given module 983can utilize both 16-bit and 32-bit operands and addresses. 984 985 9861.1.4 Part IV Instruction Set 987 988Parts I, II, and III present overviews of the instructions as they relate 989to specific aspects of the architecture, but this part presents the 990instructions in alphabetical order, providing the detail needed by 991assembly-language programmers and programmers of debuggers, compilers, 992operating systems, etc. Instruction descriptions include algorithmic 993description of operation, effect of flag settings, effect on flag settings, 994effect of operand- or address-size attributes, effect of processor modes, 995and possible exceptions. 996 997 9981.1.5 Appendices 999 1000The appendices present tables of encodings and other details in a format 1001designed for quick reference by assembly-language and systems programmers. 1002 1003 10041.2 Related Literature 1005 1006The following books contain additional material concerning the 80386 1007microprocessor: 1008 1009 Introduction to the 80386, order number 231252 1010 1011 80386 Hardware Reference Manual, order number 231732 1012 1013 80386 System Software Writer's Guide, order number 231499 1014 1015 80386 High Performance 32-bit Microprocessor with Integrated Memory 1016 Management (Data Sheet), order number 231630 1017 1018 10191.3 Notational Conventions 1020 1021This manual uses special notations for data-structure formats, for symbolic 1022representation of instructions, for hexadecimal numbers, and for super- and 1023sub-scripts. Subscript characters are surrounded by {curly brackets}, for 1024example 10{2} = 10 base 2. Superscript characters are preceeded by a caret 1025and enclosed within (parentheses), for example 10^(3) = 10 to the third 1026power. A review of these notations will make it easier to read the 1027manual. 1028 10291.3.1 Data-Structure Formats 1030 1031In illustrations of data structures in memory, smaller addresses appear at 1032the lower-right part of the figure; addresses increase toward the left and 1033upwards. Bit positions are numbered from right to left. Figure 1-1 1034illustrates this convention. 1035 1036 10371.3.2 Undefined Bits and Software Compatibility 1038 1039In many register and memory layout descriptions, certain bits are marked as 1040undefined. When bits are marked as undefined (as illustrated in Figure 10411-1), it is essential for compatibility with future processors that 1042software treat these bits as undefined. Software should follow these 1043guidelines in dealing with undefined bits: 1044 1045 Do not depend on the states of any undefined bits when testing the 1046 values of registers that contain such bits. Mask out the undefined bits 1047 before testing. 1048 1049 Do not depend on the states of any undefined bits when storing them in 1050 memory or in another register. 1051 1052 Do not depend on the ability to retain information written into any 1053 undefined bits. 1054 1055 When loading a register, always load the undefined bits as zeros or 1056 reload them with values previously stored from the same register. 1057 1058 1059NOTE 1060 Depending upon the values of undefined register bits will make software 1061 dependent upon the unspecified manner in which the 80386 handles these 1062 bits. Depending upon undefined values risks making software incompatible 1063 with future processors that define usages for these bits. AVOID ANY 1064 SOFTWARE DEPENDENCE UPON THE STATE OF UNDEFINED 80386 REGISTER BITS. 1065 1066 1067 1068Figure 1-1. Example Data Structure 1069 1070 GREATEST DATA STRUCTURE 1071 ADDRESS 1072 31 23 15 7 0 BIT 1073 ͻ OFFSET 1074 28 1075 1076 24 1077 1078 20 1079 1080 16 1081 1082 12 1083 1084 8 1085 1086 UNDEFINED 4 1087 SMALLEST 1088 BYTE 3 BYTE 2 BYTE 1 BYTE 0 0 ADDRESS 1089 ͼ 1090 BYTE OFFSET 1091 1092 10931.3.3 Instruction Operands 1094 1095When instructions are represented symbolically, a subset of the 80386 1096Assembly Language is used. In this subset, an instruction has the following 1097format: 1098 1099label: prefix mnemonic argument1, argument2, argument3 1100 1101where: 1102 1103 A label is an identifier that is followed by a colon. 1104 1105 A prefix is an optional reserved name for one of the instruction 1106 prefixes. 1107 1108 A mnemonic is a reserved name for a class of instruction opcodes that 1109 have the same function. 1110 1111 The operands argument1, argument2, and argument3 are optional. There 1112 may be from zero to three operands, depending on the opcode. When 1113 present, they take the form of either literals or identifiers for data 1114 items. Operand identifiers are either reserved names of registers or 1115 are assumed to be assigned to data items declared in another part of 1116 the program (which may not be shown in the example). When two operands 1117 are present in an instruction that modifies data, the right operand is 1118 the source and the left operand is the destination. 1119 1120For example: 1121 1122LOADREG: MOV EAX, SUBTOTAL 1123 1124In this example LOADREG is a label, MOV is the mnemonic identifier of an 1125opcode, EAX is the destination operand, and SUBTOTAL is the source operand. 1126 11271.3.4 Hexadecimal Numbers 1128 1129Base 16 numbers are represented by a string of hexadecimal digits followed 1130by the character H. A hexadecimal digit is a character from the set (0, 1, 11312, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F). In some cases, especially in 1132examples of program syntax, a leading zero is added if the number would 1133otherwise begin with one of the digits A-F. For example, 0FH is equivalent 1134to the decimal number 15. 1135 11361.3.5 Sub- and Super-Scripts 1137 1138This manual uses special notation to represent sub- and super-script 1139characters. Sub-script characters are surrounded by {curly brackets}, for 1140example 10{2} = 10 base 2. Super-script characters are preceeded by a 1141caret and enclosed within (parentheses), for example 10^(3) = 10 to the 1142third power. 1143 1144 1145 PART I APPLICATIONS PROGRAMMING 1146 1147 1148Chapter 2 Basic Programming Model 1149 1150 1151 1152This chapter describes the 80386 application programming environment as 1153seen by assembly language programmers when the processor is executing in 1154protected mode. The chapter introduces programmers to those features of the 115580386 architecture that directly affect the design and implementation of 115680386 applications programs. Other chapters discuss 80386 features that 1157relate to systems programming or to compatibility with other processors of 1158the 8086 family. 1159 1160The basic programming model consists of these aspects: 1161 1162 Memory organization and segmentation 1163 Data types 1164 Registers 1165 Instruction format 1166 Operand selection 1167 Interrupts and exceptions 1168 1169Note that input/output is not included as part of the basic programming 1170model. Systems designers may choose to make I/O instructions available to 1171applications or may choose to reserve these functions for the operating 1172system. For this reason, the I/O features of the 80386 are discussed in Part 1173II. 1174 1175This chapter contains a section for each aspect of the architecture that is 1176normally visible to applications. 1177 1178 11792.1 Memory Organization and Segmentation 1180 1181The physical memory of an 80386 system is organized as a sequence of 8-bit 1182bytes. Each byte is assigned a unique address that ranges from zero to a 1183maximum of 2^(32) -1 (4 gigabytes). 1184 118580386 programs, however, are independent of the physical address space. 1186This means that programs can be written without knowledge of how much 1187physical memory is available and without knowledge of exactly where in 1188physical memory the instructions and data are located. 1189 1190The model of memory organization seen by applications programmers is 1191determined by systems-software designers. The architecture of the 80386 1192gives designers the freedom to choose a model for each task. The model of 1193memory organization can range between the following extremes: 1194 1195 A "flat" address space consisting of a single array of up to 4 1196 gigabytes. 1197 1198 A segmented address space consisting of a collection of up to 16,383 1199 linear address spaces of up to 4 gigabytes each. 1200 1201Both models can provide memory protection. Different tasks may employ 1202different models of memory organization. The criteria that designers use to 1203determine a memory organization model and the means that systems programmers 1204use to implement that model are covered in Part IISystems Programming. 1205 1206 12072.1.1 The "Flat" Model 1208 1209In a "flat" model of memory organization, the applications programmer sees 1210a single array of up to 2^(32) bytes (4 gigabytes). While the physical 1211memory can contain up to 4 gigabytes, it is usually much smaller; the 1212processor maps the 4 gigabyte flat space onto the physical address space by 1213the address translation mechanisms described in Chapter 5. Applications 1214programmers do not need to know the details of the mapping. 1215 1216A pointer into this flat address space is a 32-bit ordinal number that may 1217range from 0 to 2^(32) -1. Relocation of separately-compiled modules in this 1218space must be performed by systems software (e.g., linkers, locators, 1219binders, loaders). 1220 1221 12222.1.2 The Segmented Model 1223 1224In a segmented model of memory organization, the address space as viewed by 1225an applications program (called the logical address space) is a much larger 1226space of up to 2^(46) bytes (64 terabytes). The processor maps the 64 1227terabyte logical address space onto the physical address space (up to 4 1228gigabytes) by the address translation mechanisms described in Chapter 5. 1229Applications programmers do not need to know the details of this mapping. 1230 1231Applications programmers view the logical address space of the 80386 as a 1232collection of up to 16,383 one-dimensional subspaces, each with a specified 1233length. Each of these linear subspaces is called a segment. A segment is a 1234unit of contiguous address space. Segment sizes may range from one byte up 1235to a maximum of 2^(32) bytes (4 gigabytes). 1236 1237A complete pointer in this address space consists of two parts (see Figure 12382-1): 1239 1240 1. A segment selector, which is a 16-bit field that identifies a 1241 segment. 1242 1243 2. An offset, which is a 32-bit ordinal that addresses to the byte level 1244 within a segment. 1245 1246During execution of a program, the processor associates with a segment 1247selector the physical address of the beginning of the segment. Separately 1248compiled modules can be relocated at run time by changing the base address 1249of their segments. The size of a segment is variable; therefore, a segment 1250can be exactly the size of the module it contains. 1251 1252 12532.2 Data Types 1254 1255Bytes, words, and doublewords are the fundamental data types (refer to 1256Figure 2-2). A byte is eight contiguous bits starting at any logical 1257address. The bits are numbered 0 through 7; bit zero is the least 1258significant bit. 1259 1260A word is two contiguous bytes starting at any byte address. A word thus 1261contains 16 bits. The bits of a word are numbered from 0 through 15; bit 0 1262is the least significant bit. The byte containing bit 0 of the word is 1263called the low byte; the byte containing bit 15 is called the high byte. 1264 1265Each byte within a word has its own address, and the smaller of the 1266addresses is the address of the word. The byte at this lower address 1267contains the eight least significant bits of the word, while the byte at the 1268higher address contains the eight most significant bits. 1269 1270A doubleword is two contiguous words starting at any byte address. A 1271doubleword thus contains 32 bits. The bits of a doubleword are numbered from 12720 through 31; bit 0 is the least significant bit. The word containing bit 0 1273of the doubleword is called the low word; the word containing bit 31 is 1274called the high word. 1275 1276Each byte within a doubleword has its own address, and the smallest of the 1277addresses is the address of the doubleword. The byte at this lowest address 1278contains the eight least significant bits of the doubleword, while the byte 1279at the highest address contains the eight most significant bits. Figure 2-3 1280illustrates the arrangement of bytes within words anddoublewords. 1281 1282Note that words need not be aligned at even-numbered addresses and 1283doublewords need not be aligned at addresses evenly divisible by four. This 1284allows maximum flexibility in data structures (e.g., records containing 1285mixed byte, word, and doubleword items) and efficiency in memory 1286utilization. When used in a configuration with a 32-bit bus, actual 1287transfers of data between processor and memory take place in units of 1288doublewords beginning at addresses evenly divisible by four; however, the 1289processor converts requests for misaligned words or doublewords into the 1290appropriate sequences of requests acceptable to the memory interface. Such 1291misaligned data transfers reduce performance by requiring extra memory 1292cycles. For maximum performance, data structures (including stacks) should 1293be designed in such a way that, whenever possible, word operands are aligned 1294at even addresses and doubleword operands are aligned at addresses evenly 1295divisible by four. Due to instruction prefetching and queuing within the 1296CPU, there is no requirement for instructions to be aligned on word or 1297doubleword boundaries. (However, a slight increase in speed results if the 1298target addresses of control transfers are evenly divisible by four.) 1299 1300Although bytes, words, and doublewords are the fundamental types of 1301operands, the processor also supports additional interpretations of these 1302operands. Depending on the instruction referring to the operand, the 1303following additional data types are recognized: 1304 1305Integer: 1306A signed binary numeric value contained in a 32-bit doubleword,16-bit word, 1307or 8-bit byte. All operations assume a 2's complement representation. The 1308sign bit is located in bit 7 in a byte, bit 15 in a word, and bit 31 in a 1309doubleword. The sign bit has the value zero for positive integers and one 1310for negative. Since the high-order bit is used for a sign, the range of an 13118-bit integer is -128 through +127; 16-bit integers may range from -32,768 1312through +32,767; 32-bit integers may range from -2^(31) through +2^(31) -1. 1313The value zero has a positive sign. 1314 1315Ordinal: 1316An unsigned binary numeric value contained in a 32-bit doubleword, 131716-bit word, or 8-bit byte. All bits are considered in determining 1318magnitude of the number. The value range of an 8-bit ordinal number 1319is 0-255; 16 bits can represent values from 0 through 65,535; 32 bits 1320can represent values from 0 through 2^(32) -1. 1321 1322Near Pointer: 1323A 32-bit logical address. A near pointer is an offset within a segment. 1324Near pointers are used in either a flat or a segmented model of memory 1325organization. 1326 1327Far Pointer: 1328A 48-bit logical address of two components: a 16-bit segment selector 1329component and a 32-bit offset component. Far pointers are used by 1330applications programmers only when systems designers choose a 1331segmented memory organization. 1332 1333String: 1334A contiguous sequence of bytes, words, or doublewords. A string may 1335contain from zero bytes to 2^(32) -1 bytes (4 gigabytes). 1336 1337Bit field: 1338A contiguous sequence of bits. A bit field may begin at any bit position 1339of any byte and may contain up to 32 bits. 1340 1341Bit string: 1342A contiguous sequence of bits. A bit string may begin at any bit position 1343of any byte and may contain up to 2^(32) -1 bits. 1344 1345BCD: 1346A byte (unpacked) representation of a decimal digit in the range0 through 13479. Unpacked decimal numbers are stored as unsigned byte quantities. One 1348digit is stored in each byte. The magnitude of the number is determined from 1349the low-order half-byte; hexadecimal values 0-9 are valid and are 1350interpreted as decimal numbers. The high-order half-byte must be zero for 1351multiplication and division; it may contain any value for addition and 1352subtraction. 1353 1354Packed BCD: 1355A byte (packed) representation of two decimal digits, each in the range 13560 through 9. One digit is stored in each half-byte. The digit in the 1357high-order half-byte is the most significant. Values 0-9 are valid in each 1358half-byte. The range of a packed decimal byte is 0-99. 1359 1360Figure 2-4 graphically summarizes the data types supported by the 80386. 1361 1362 1363Figure 2-1. Two-Component Pointer 1364 1365 1366 1367 Ŀ 1368 32 0 1369 ͻ ͻ 1370 OFFSET Ķ + OPERAND 1371 ͼ ͼ SELECTED SEGMENT 1372 1373 16 0 1374 ͻ 1375 SEGMENT 1376 ͼ 1377 1378 1379 1380 1381 1382Figure 2-2. Fundamental Data Types 1383 1384 7 0 1385 ͻ 1386 BYTE BYTE 1387 ͼ 1388 1389 15 7 0 1390 ͻ 1391 HIGH BYTE LOW BYTE WORD 1392 ͼ 1393 address n+1 address n 1394 1395 31 23 15 7 0 1396 ͻ 1397 HIGH WORD LOW WORD DOUBLEWORD 1398 ͼ 1399 address n+3 address n+2 address n+1 address n 1400 1401 1402Figure 2-3. Bytes, Words, and Doublewords in Memory 1403 1404 MEMORY 1405 BYTE VALUES 1406All values in hexadecimal 1407 ADDRESS ͻ 1408 E 1409 Ŀ 1410 D 7A DOUBLE WORD AT ADDRESS A 1411 Ŀ CONTAINS 7AFE0636 1412 C FE 1413 WORD AT ADDRESS B 1414 B 06 CONTAINS FE06 1415 ٳ 1416 A 36 1417 ͵ 1418 9 1F WORD AT ADDRESS 9 1419 CONTAINS IF 1420 8 1421 Ŀ 1422 7 23 1423 WORD AT ADDRESS 6 1424 6 OB CONTAINS 23OB 1425 1426 5 1427 1428 4 1429 Ŀ 1430 3 74 1431 Ŀ WORD AT ADDRESS 2 1432 2 CB CONTAINS 74CB 1433 1434 1 31 WORD AT ADDRESS 1 1435 CONTAINS CB31 1436 0 1437 ͼ 1438 1439 1440Figure 2-4. 80386 Data Types 1441 1442 +1 0 1443 7 0 7 0 15 14 8 7 0 1444 BYTE ѻ BYTE ѻ WORD ѻ 1445 INTEGER ORDINAL INTEGER 1446 ͼ ͼ ͼ 1447 SIGN BIT SIGN BITMSB 1448 MAGNITUDE MAGNITUDE 1449 MAGNITUDE 1450 1451 1452 +1 0 +3 +2 +1 0 1453 15 0 31 16 15 0 1454 WORD ѻ DOUBLEWORD ѻ 1455 ORDINAL INTEGER 1456 ͼ ͼ 1457 SIGN BITMSB 1458 1459 MAGNITUDE MAGNITUDE 1460 1461 1462 +3 +2 +1 0 1463 31 0 1464 DOUBLEWORD ѻ 1465 ORDINAL 1466 ͼ 1467 1468 MAGNITUDE 1469 1470 +N +1 0 1471 7 0 7 0 7 0 1472 BINARY CODED ѻ ѻ 1473 DECIMAL (BCD) 1474 ͼ ͼ 1475 BCD BCD BCD 1476 DIGIT N DIGIT 1 DIGIT 0 1477 1478 +N +1 0 1479 7 0 7 0 7 0 1480 PACKED ѻ ѻ 1481 BCD 1482 ͼ ͼ 1483 1484 MOST LEAST 1485 SIGNIFICANT SIGNIFICANT 1486 DIGIT DIGIT 1487 1488 +N +1 0 1489 7 0 7 0 7 0 1490 BYTE ѻ ѻ 1491 STRING 1492 ͼ ͼ 1493 1494 -2 GIGABYTES 1495 +2 GIGABYTES 210 1496 BIT ѻ 1497 STRING 1498 ϼ 1499 BIT 0 1500 1501 +3 +2 +1 0 1502 31 0 1503NEAR 32-BIT ѻ 1504 POINTER 1505 ͼ 1506 1507 OFFSET 1508 1509 +5 +4 +3 +2 +1 0 1510 48 0 1511FAR 48-BIT ѻ 1512 POINTER 1513 ͼ 1514 1515 SELECTOR OFFSET 1516 1517 +5 +4 +3 +2 +1 0 1518 32-BIT ѻ 1519 BIT FIELD 1520 ͼ 1521 BIT FIELD 1522 1 TO 32 BITS 1523 1524 15252.3 Registers 1526 1527The 80386 contains a total of sixteen registers that are of interest to the 1528applications programmer. As Figure 2-5 shows, these registers may be 1529grouped into these basic categories: 1530 1531 1. General registers. These eight 32-bit general-purpose registers are 1532 used primarily to contain operands for arithmetic and logical 1533 operations. 1534 1535 2. Segment registers. These special-purpose registers permit systems 1536 software designers to choose either a flat or segmented model of 1537 memory organization. These six registers determine, at any given time, 1538 which segments of memory are currently addressable. 1539 1540 3. Status and instruction registers. These special-purpose registers are 1541 used to record and alter certain aspects of the 80386 processor state. 1542 1543 15442.3.1 General Registers 1545 1546The general registers of the 80386 are the 32-bit registers EAX, EBX, ECX, 1547EDX, EBP, ESP, ESI, and EDI. These registers are used interchangeably to 1548contain the operands of logical and arithmetic operations. They may also be 1549used interchangeably for operands of address computations (except that ESP 1550cannot be used as an index operand). 1551 1552As Figure 2-5 shows, the low-order word of each of these eight registers 1553has a separate name and can be treated as a unit. This feature is useful for 1554handling 16-bit data items and for compatibility with the 8086 and 80286 1555processors. The word registers are named AX, BX, CX, DX, BP, SP, SI, and DI. 1556 1557Figure 2-5 also illustrates that each byte of the 16-bit registers AX, BX, 1558CX, and DX has a separate name and can be treated as a unit. This feature is 1559useful for handling characters and other 8-bit data items. The byte 1560registers are named AH, BH, CH, and DH (high bytes); and AL, BL, CL, and DL 1561(low bytes). 1562 1563All of the general-purpose registers are available for addressing 1564calculations and for the results of most arithmetic and logical 1565calculations; however, a few functions are dedicated to certain registers. 1566By implicitly choosing registers for these functions, the 80386 architecture 1567can encode instructions more compactly. The instructions that use specific 1568registers include: double-precision multiply and divide, I/O, string 1569instructions, translate, loop, variable shift and rotate, and stack 1570operations. 1571 1572 15732.3.2 Segment Registers 1574 1575The segment registers of the 80386 give systems software designers the 1576flexibility to choose among various models of memory organization. 1577Implementation of memory models is the subject of Part II Systems 1578Programming. Designers may choose a model in which applications programs do 1579not need to modify segment registers, in which case applications programmers 1580may skip this section. 1581 1582Complete programs generally consist of many different modules, each 1583consisting of instructions and data. However, at any given time during 1584program execution, only a small subset of a program's modules are actually 1585in use. The 80386 architecture takes advantage of this by providing 1586mechanisms to support direct access to the instructions and data of the 1587current module's environment, with access to additional segments on demand. 1588 1589At any given instant, six segments of memory may be immediately accessible 1590to an executing 80386 program. The segment registers CS, DS, SS, ES, FS, and 1591GS are used to identify these six current segments. Each of these registers 1592specifies a particular kind of segment, as characterized by the associated 1593mnemonics ("code," "data," or "stack") shown in Figure 2-6. Each register 1594uniquely determines one particular segment, from among the segments that 1595make up the program, that is to be immediately accessible at highest speed. 1596 1597The segment containing the currently executing sequence of instructions is 1598known as the current code segment; it is specified by means of the CS 1599register. The 80386 fetches all instructions from this code segment, using 1600as an offset the contents of the instruction pointer. CS is changed 1601implicitly as the result of intersegment control-transfer instructions (for 1602example, CALL and JMP), interrupts, and exceptions. 1603 1604Subroutine calls, parameters, and procedure activation records usually 1605require that a region of memory be allocated for a stack. All stack 1606operations use the SS register to locate the stack. Unlike CS, the SS 1607register can be loaded explicitly, thereby permitting programmers to define 1608stacks dynamically. 1609 1610The DS, ES, FS, and GS registers allow the specification of four data 1611segments, each addressable by the currently executing program. Accessibility 1612to four separate data areas helps programs efficiently access different 1613types of data structures; for example, one data segment register can point 1614to the data structures of the current module, another to the exported data 1615of a higher-level module, another to a dynamically created data structure, 1616and another to data shared with another task. An operand within a data 1617segment is addressed by specifying its offset either directly in an 1618instruction or indirectly via general registers. 1619 1620Depending on the structure of data (e.g., the way data is parceled into one 1621or more segments), a program may require access to more than four data 1622segments. To access additional segments, the DS, ES, FS, and GS registers 1623can be changed under program control during the course of a program's 1624execution. This simply requires that the program execute an instruction to 1625load the appropriate segment register prior to executing instructions that 1626access the data. 1627 1628The processor associates a base address with each segment selected by a 1629segment register. To address an element within a segment, a 32-bit offset is 1630added to the segment's base address. Once a segment is selected (by loading 1631the segment selector into a segment register), a data manipulation 1632instruction only needs to specify the offset. Simple rules define which 1633segment register is used to form an address when only an offset is 1634specified. 1635 1636 1637Figure 2-5. 80386 Applications Register Set 1638 1639 GENERAL REGISTERS 1640 1641 31 23 15 7 0 1642 ͻ 1643 EAX AH AX AL 1644 1645 EDX DH DX DL 1646 1647 ECX CH CX CL 1648 1649 EBX BH BX BL 1650 1651 EBP BP 1652 1653 ESI SI 1654 1655 EDI DI 1656 1657 ESP SP 1658 ͼ 1659 1660 1661 15 7 0 1662 ͻ 1663 CS (CODE SEGMENT) 1664 Ķ 1665 SS (STACK SEGMENT) 1666 SEGMENT Ķ 1667 REGISTERS DS (DATA SEGMENT) 1668 Ķ 1669 ES (DATA SEGMENT) 1670 Ķ 1671 FS (DATA SEGMENT) 1672 Ķ 1673 GS (DATA SEGMENT) 1674 ͼ 1675 1676 1677 STATUS AND INSTRUCTION REGISTERS 1678 1679 31 23 15 7 0 1680 ͻ 1681 EFLAGS 1682 Ķ 1683 EIP (INSTRUCTION POINTER) 1684 ͼ 1685 1686 1687Figure 2-6. Use of Memory Segmentation 1688 1689 ͻ ͻ 1690 MODULE MODULE 1691 A Ŀ A 1692 CODE DATA 1693 ͼ ͻ ͼ 1694 Ķ CS (CODE) 1695 1696 ͻ Ķ SS (STACK) ͻ 1697 DATA 1698 STACK DS (DATA) STRUCTURE 1699 1 1700 ͼ ES (DATA) ͼ 1701 1702 Ķ FS (DATA) 1703 ͻ ͻ 1704 DATA GS (DATA) Ŀ DATA 1705 STRUCTURE ͼ STRUCTURE 1706 2 3 1707 ͼ ͼ 1708 1709 17102.3.3 Stack Implementation 1711 1712Stack operations are facilitated by three registers: 1713 1714 1. The stack segment (SS) register. Stacks are implemented in memory. A 1715 system may have a number of stacks that is limited only by the maximum 1716 number of segments. A stack may be up to 4 gigabytes long, the maximum 1717 length of a segment. One stack is directly addressable at a timethe 1718 one located by SS. This is the current stack, often referred to simply 1719 as "the" stack. SS is used automatically by the processor for all 1720 stack operations. 1721 1722 2. The stack pointer (ESP) register. ESP points to the top of the 1723 push-down stack (TOS). It is referenced implicitly by PUSH and POP 1724 operations, subroutine calls and returns, and interrupt operations. 1725 When an item is pushed onto the stack (see Figure 2-7), the processor 1726 decrements ESP, then writes the item at the new TOS. When an item is 1727 popped off the stack, the processor copies it from TOS, then 1728 increments ESP. In other words, the stack grows down in memory toward 1729 lesser addresses. 1730 1731 3. The stack-frame base pointer (EBP) register. The EBP is the best 1732 choice of register for accessing data structures, variables and 1733 dynamically allocated work space within the stack. EBP is often used 1734 to access elements on the stack relative to a fixed point on the stack 1735 rather than relative to the current TOS. It typically identifies the 1736 base address of the current stack frame established for the current 1737 procedure. When EBP is used as the base register in an offset 1738 calculation, the offset is calculated automatically in the current 1739 stack segment (i.e., the segment currently selected by SS). Because 1740 SS does not have to be explicitly specified, instruction encoding in 1741 such cases is more efficient. EBP can also be used to index into 1742 segments addressable via other segment registers. 1743 1744 1745Figure 2-7. 80386 Stack 1746 1747 31 0 1748 ͻ BOTTOM OF STACK 1749 (INITIAL ESP VALUE) 1750 1751 1752 1753 POP 1754 1755 1756 TOP OF ͻ 1757 Ķ ESP 1758 STACK ͼ 1759 1760 1761 PUSH 1762 1763 1764 17652.3.4 Flags Register 1766 1767The flags register is a 32-bit register named EFLAGS. Figure 2-8 defines 1768the bits within this register. The flags control certain operations and 1769indicate the status of the 80386. 1770 1771The low-order 16 bits of EFLAGS is named FLAGS and can be treated as a 1772unit. This feature is useful when executing 8086 and 80286 code, because 1773this part of EFLAGS is identical to the FLAGS register of the 8086 and the 177480286. 1775 1776The flags may be considered in three groups: the status flags, the control 1777flags, and the systems flags. Discussion of the systems flags is delayed 1778until Part II. 1779 1780 1781Figure 2-8. EFLAGS Register 1782 1783 16-BIT FLAGS REGISTER 1784 A 1785 Ŀ 1786 31 23 15 7 0 1787 ͻ 1788 VR N IOODITSZ A P C 1789 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1790 MF T PLFFFFFF F F F 1791 Ѽ 1792 1793 VIRTUAL 8086 MODEX 1794 RESUME FLAGX 1795 NESTED TASK FLAGX 1796 I/O PRIVILEGE LEVELX 1797 OVERFLOWS 1798 DIRECTION FLAGC 1799 INTERRUPT ENABLEX 1800 TRAP FLAGS 1801 SIGN FLAGS 1802 ZERO FLAGS 1803 AUXILIARY CARRYS 1804 PARITY FLAGS 1805 CARRY FLAGS 1806 1807 S = STATUS FLAG, C = CONTROL FLAG, X = SYSTEM FLAG 1808 1809 NOTE: 0 OR 1 INDICATES INTEL RESERVED. DO NOT DEFINE 1810 1811 18122.3.4.1 Status Flags 1813 1814The status flags of the EFLAGS register allow the results of one 1815instruction to influence later instructions. The arithmetic instructions use 1816OF, SF, ZF, AF, PF, and CF. The SCAS (Scan String), CMPS (Compare String), 1817and LOOP instructions use ZF to signal that their operations are complete. 1818There are instructions to set, clear, and complement CF before execution of 1819an arithmetic instruction. Refer to Appendix C for definition of each 1820status flag. 1821 1822 18232.3.4.2 Control Flag 1824 1825The control flag DF of the EFLAGS register controls string instructions. 1826 1827DF (Direction Flag, bit 10) 1828 1829 Setting DF causes string instructions to auto-decrement; that is, to 1830 process strings from high addresses to low addresses. Clearing DF causes 1831 string instructions to auto-increment, or to process strings from low 1832 addresses to high addresses. 1833 1834 18352.3.4.3 Instruction Pointer 1836 1837The instruction pointer register (EIP) contains the offset address, 1838relative to the start of the current code segment, of the next sequential 1839instruction to be executed. The instruction pointer is not directly visible 1840to the programmer; it is controlled implicitly by control-transfer 1841instructions, interrupts, and exceptions. 1842 1843As Figure 2-9 shows, the low-order 16 bits of EIP is named IP and can be 1844used by the processor as a unit. This feature is useful when executing 1845instructions designed for the 8086 and 80286 processors. 1846 1847 1848Figure 2-9. Instruction Pointer Register 1849 1850 16-BIT IP REGISTER 1851 Ŀ 1852 31 23 15 7 0 1853 ͻ 1854 EIP (INSTRUCTION POINTER) 1855 ͼ 1856 1857 18582.4 Instruction Format 1859 1860The information encoded in an 80386 instruction includes a specification of 1861the operation to be performed, the type of the operands to be manipulated, 1862and the location of these operands. If an operand is located in memory, the 1863instruction must also select, explicitly or implicitly, which of the 1864currently addressable segments contains the operand. 1865 186680386 instructions are composed of various elements and have various 1867formats. The exact format of instructions is shown in Appendix B; the 1868elements of instructions are described below. Of these instruction elements, 1869only one, the opcode, is always present. The other elements may or may not 1870be present, depending on the particular operation involved and on the 1871location and type of the operands. The elements of an instruction, in order 1872of occurrence are as follows: 1873 1874 Prefixes one or more bytes preceding an instruction that modify the 1875 operation of the instruction. The following types of prefixes can be 1876 used by applications programs: 1877 1878 1. Segment override explicitly specifies which segment register an 1879 instruction should use, thereby overriding the default 1880 segment-register selection used by the 80386 for that instruction. 1881 1882 2. Address size switches between 32-bit and 16-bit address 1883 generation. 1884 1885 3. Operand size switches between 32-bit and 16-bit operands. 1886 1887 4. Repeat used with a string instruction to cause the instruction 1888 to act on each element of the string. 1889 1890 Opcode specifies the operation performed by the instruction. Some 1891 operations have several different opcodes, each specifying a different 1892 variant of the operation. 1893 1894 Register specifier an instruction may specify one or two register 1895 operands. Register specifiers may occur either in the same byte as the 1896 opcode or in the same byte as the addressing-mode specifier. 1897 1898 Addressing-mode specifier when present, specifies whether an operand 1899 is a register or memory location; if in memory, specifies whether a 1900 displacement, a base register, an index register, and scaling are to be 1901 used. 1902 1903 SIB (scale, index, base) byte when the addressing-mode specifier 1904 indicates that an index register will be used to compute the address of 1905 an operand, an SIB byte is included in the instruction to encode the 1906 base register, the index register, and a scaling factor. 1907 1908 Displacement when the addressing-mode specifier indicates that a 1909 displacement will be used to compute the address of an operand, the 1910 displacement is encoded in the instruction. A displacement is a signed 1911 integer of 32, 16, or eight bits. The eight-bit form is used in the 1912 common case when the displacement is sufficiently small. The processor 1913 extends an eight-bit displacement to 16 or 32 bits, taking into 1914 account the sign. 1915 1916 Immediate operand when present, directly provides the value of an 1917 operand of the instruction. Immediate operands may be 8, 16, or 32 bits 1918 wide. In cases where an eight-bit immediate operand is combined in some 1919 way with a 16- or 32-bit operand, the processor automatically extends 1920 the size of the eight-bit operand, taking into account the sign. 1921 1922 19232.5 Operand Selection 1924 1925An instruction can act on zero or more operands, which are the data 1926manipulated by the instruction. An example of a zero-operand instruction is 1927NOP (no operation). An operand can be in any of these locations: 1928 1929 In the instruction itself (an immediate operand) 1930 1931 In a register (EAX, EBX, ECX, EDX, ESI, EDI, ESP, or EBP in the case 1932 of 32-bit operands; AX, BX, CX, DX, SI, DI, SP, or BP in the case of 1933 16-bit operands; AH, AL, BH, BL, CH, CL, DH, or DL in the case of 8-bit 1934 operands; the segment registers; or the EFLAGS register for flag 1935 operations) 1936 1937 In memory 1938 1939 At an I/O port 1940 1941Immediate operands and operands in registers can be accessed more rapidly 1942than operands in memory since memory operands must be fetched from memory. 1943Register operands are available in the CPU. Immediate operands are also 1944available in the CPU, because they are prefetched as part of the 1945instruction. 1946 1947Of the instructions that have operands, some specify operands implicitly; 1948others specify operands explicitly; still others use a combination of 1949implicit and explicit specification; for example: 1950 1951Implicit operand: AAM 1952 1953 By definition, AAM (ASCII adjust for multiplication) operates on the 1954 contents of the AX register. 1955 1956Explicit operand: XCHG EAX, EBX 1957 1958 The operands to be exchanged are encoded in the instruction after the 1959 opcode. 1960 1961Implicit and explicit operands: PUSH COUNTER 1962 1963 The memory variable COUNTER (the explicit operand) is copied to the top of 1964 the stack (the implicit operand). 1965 1966Note that most instructions have implicit operands. All arithmetic 1967instructions, for example, update the EFLAGS register. 1968 1969An 80386 instruction can explicitly reference one or two operands. 1970Two-operand instructions, such as MOV, ADD, XOR, etc., generally overwrite 1971one of the two participating operands with the result. A distinction can 1972thus be made between the source operand (the one unaffected by the 1973operation) and the destination operand (the one overwritten by the result). 1974 1975For most instructions, one of the two explicitly specified operandseither 1976the source or the destinationcan be either in a register or in memory. 1977The other operand must be in a register or be an immediate source operand. 1978Thus, the explicit two-operand instructions of the 80386 permit operations 1979of the following kinds: 1980 1981 Register-to-register 1982 Register-to-memory 1983 Memory-to-register 1984 Immediate-to-register 1985 Immediate-to-memory 1986 1987Certain string instructions and stack manipulation instructions, however, 1988transfer data from memory to memory. Both operands of some string 1989instructions are in memory and are implicitly specified. Push and pop stack 1990operations allow transfer between memory operands and the memory-based 1991stack. 1992 1993 19942.5.1 Immediate Operands 1995 1996Certain instructions use data from the instruction itself as one (and 1997sometimes two) of the operands. Such an operand is called an immediate 1998operand. The operand may be 32-, 16-, or 8-bits long. For example: 1999 2000SHR PATTERN, 2 2001 2002One byte of the instruction holds the value 2, the number of bits by which 2003to shift the variable PATTERN. 2004 2005TEST PATTERN, 0FFFF00FFH 2006 2007A doubleword of the instruction holds the mask that is used to test the 2008variable PATTERN. 2009 2010 20112.5.2 Register Operands 2012 2013Operands may be located in one of the 32-bit general registers (EAX, EBX, 2014ECX, EDX, ESI, EDI, ESP, or EBP), in one of the 16-bit general registers 2015(AX, BX, CX, DX, SI, DI, SP, or BP), or in one of the 8-bit general 2016registers (AH, BH, CH, DH, AL, BL, CL,or DL). 2017 2018The 80386 has instructions for referencing the segment registers (CS, DS, 2019ES, SS, FS, GS). These instructions are used by applications programs only 2020if systems designers have chosen a segmented memory model. 2021 2022The 80386 also has instructions for referring to the flag register. The 2023flags may be stored on the stack and restored from the stack. Certain 2024instructions change the commonly modified flags directly in the EFLAGS 2025register. Other flags that are seldom modified can be modified indirectly 2026via the flags image in the stack. 2027 2028 20292.5.3 Memory Operands 2030 2031Data-manipulation instructions that address operands in memory must specify 2032(either directly or indirectly) the segment that contains the operand and 2033the offset of the operand within the segment. However, for speed and compact 2034instruction encoding, segment selectors are stored in the high speed segment 2035registers. Therefore, data-manipulation instructions need to specify only 2036the desired segment register and an offset in order to address a memory 2037operand. 2038 2039An 80386 data-manipulation instruction that accesses memory uses one of the 2040following methods for specifying the offset of a memory operand within its 2041segment: 2042 2043 1. Most data-manipulation instructions that access memory contain a byte 2044 that explicitly specifies the addressing method for the operand. A 2045 byte, known as the modR/M byte, follows the opcode and specifies 2046 whether the operand is in a register or in memory. If the operand is 2047 in memory, the address is computed from a segment register and any of 2048 the following values: a base register, an index register, a scaling 2049 factor, a displacement. When an index register is used, the modR/M 2050 byte is also followed by another byte that identifies the index 2051 register and scaling factor. This addressing method is the 2052 mostflexible. 2053 2054 2. A few data-manipulation instructions implicitly use specialized 2055 addressing methods: 2056 2057 For a few short forms of MOV that implicitly use the EAX register, 2058 the offset of the operand is coded as a doubleword in the 2059 instruction. No base register, index register, or scaling factor 2060 are used. 2061 2062 String operations implicitly address memory via DS:ESI, (MOVS, 2063 CMPS, OUTS, LODS, SCAS) or via ES:EDI (MOVS, CMPS, INS, STOS). 2064 2065 Stack operations implicitly address operands via SS:ESP 2066 registers; e.g., PUSH, POP, PUSHA, PUSHAD, POPA, POPAD, PUSHF, 2067 PUSHFD, POPF, POPFD, CALL, RET, IRET, IRETD, exceptions, and 2068 interrupts. 2069 2070 20712.5.3.1 Segment Selection 2072 2073Data-manipulation instructions need not explicitly specify which segment 2074register is used. For all of these instructions, specification of a segment 2075register is optional. For all memory accesses, if a segment is not 2076explicitly specified by the instruction, the processor automatically chooses 2077a segment register according to the rules of Table 2-1. (If systems 2078designers have chosen a flat model of memory organization, the segment 2079registers and the rules that the processor uses in choosing them are not 2080apparent to applications programs.) 2081 2082There is a close connection between the kind of memory reference and the 2083segment in which that operand resides. As a rule, a memory reference implies 2084the current data segment (i.e., the implicit segment selector is in DS). 2085However, ESP and EBP are used to access items on the stack; therefore, when 2086the ESP or EBP register is used as a base register, the current stack 2087segment is implied (i.e., SS contains the selector). 2088 2089Special instruction prefix elements may be used to override the default 2090segment selection. Segment-override prefixes allow an explicit segment 2091selection. The 80386 has a segment-override prefix for each of the segment 2092registers. Only in the following special cases is there an implied segment 2093selection that a segment prefix cannot override: 2094 2095 The use of ES for destination strings in string instructions. 2096 The use of SS in stack instructions. 2097 The use of CS for instruction fetches. 2098 2099 2100Table 2-1. Default Segment Register Selection Rules 2101 2102Memory Reference Needed Segment Implicit Segment Selection Rule 2103 Register 2104 Used 2105 2106Instructions Code (CS) Automatic with instruction prefetch 2107Stack Stack (SS) All stack pushes and pops. Any 2108 memory reference that uses ESP or 2109 EBP as a base register. 2110Local Data Data (DS) All data references except when 2111 relative to stack or string 2112 destination. 2113Destination Strings Extra (ES) Destination of string instructions. 2114 2115 21162.5.3.2 Effective-Address Computation 2117 2118The modR/M byte provides the most flexible of the addressing methods, and 2119instructions that require a modR/M byte as the second byte of the 2120instruction are the most common in the 80386 instruction set. For memory 2121operands defined by modR/M, the offset within the desired segment is 2122calculated by taking the sum of up to three components: 2123 2124 A displacement element in the instruction. 2125 2126 A base register. 2127 2128 An index register. The index register may be automatically multiplied 2129 by a scaling factor of 2, 4, or 8. 2130 2131The offset that results from adding these components is called an effective 2132address. Each of these components of an effective address may have either a 2133positive or negative value. If the sum of all the components exceeds 2^(32), 2134the effective address is truncated to 32 bits.Figure 2-10 illustrates the 2135full set of possibilities for modR/M addressing. 2136 2137The displacement component, because it is encoded in the instruction, is 2138useful for fixed aspects of addressing; for example: 2139 2140 Location of simple scalar operands. 2141 Beginning of a statically allocated array. 2142 Offset of an item within a record. 2143 2144The base and index components have similar functions. Both utilize the same 2145set of general registers. Both can be used for aspects of addressing that 2146are determined dynamically; for example: 2147 2148 Location of procedure parameters and local variables in stack. 2149 2150 The beginning of one record among several occurrences of the same 2151 record type or in an array of records. 2152 2153 The beginning of one dimension of multiple dimension array. 2154 2155 The beginning of a dynamically allocated array. 2156 2157The uses of general registers as base or index components differ in the 2158following respects: 2159 2160 ESP cannot be used as an index register. 2161 2162 When ESP or EBP is used as the base register, the default segment is 2163 the one selected by SS. In all other cases the default segment is DS. 2164 2165The scaling factor permits efficient indexing into an array in the common 2166cases when array elements are 2, 4, or 8 bytes wide. The shifting of the 2167index register is done by the processor at the time the address is evaluated 2168with no performance loss. This eliminates the need for a separate shift or 2169multiply instruction. 2170 2171The base, index, and displacement components may be used in any 2172combination; any of these components may be null. A scale factor can be used 2173only when an index is also used. Each possible combination is useful for 2174data structures commonly used by programmers in high-level languages and 2175assembly languages. Following are possible uses for some of the various 2176combinations of address components. 2177 2178DISPLACEMENT 2179 2180 The displacement alone indicates the offset of the operand. This 2181 combination is used to directly address a statically allocated scalar 2182 operand. An 8-bit, 16-bit, or 32-bit displacement can be used. 2183 2184BASE 2185 2186 The offset of the operand is specified indirectly in one of the general 2187 registers, as for "based" variables. 2188 2189BASE + DISPLACEMENT 2190 2191 A register and a displacement can be used together for two distinct 2192 purposes: 2193 2194 1. Index into static array when element size is not 2, 4, or 8 bytes. 2195 The displacement component encodes the offset of the beginning of 2196 the array. The register holds the results of a calculation to 2197 determine the offset of a specific element within the array. 2198 2199 2. Access item of a record. The displacement component locates an 2200 item within record. The base register selects one of several 2201 occurrences of record, thereby providing a compact encoding for 2202 this common function. 2203 2204 An important special case of this combination, is to access parameters 2205 in the procedure activation record in the stack. In this case, EBP is 2206 the best choice for the base register, because when EBP is used as a 2207 base register, the processor automatically uses the stack segment 2208 register (SS) to locate the operand, thereby providing a compact 2209 encoding for this common function. 2210 2211(INDEX * SCALE) + DISPLACEMENT 2212 2213 This combination provides efficient indexing into a static array when 2214 the element size is 2, 4, or 8 bytes. The displacement addresses the 2215 beginning of the array, the index register holds the subscript of the 2216 desired array element, and the processor automatically converts the 2217 subscript into an index by applying the scaling factor. 2218 2219BASE + INDEX + DISPLACEMENT 2220 2221 Two registers used together support either a two-dimensional array (the 2222 displacement determining the beginning of the array) or one of several 2223 instances of an array of records (the displacement indicating an item 2224 in the record). 2225 2226BASE + (INDEX * SCALE) + DISPLACEMENT 2227 2228 This combination provides efficient indexing of a two-dimensional array 2229 when the elements of the array are 2, 4, or 8 bytes wide. 2230 2231 2232Figure 2-10. Effective Address Computation 2233 2234 SEGMENT + BASE + (INDEX * SCALE) + DISPLACEMENT 2235 2236 2237 --- 2238 EAX EAX 1 2239 CS ECX ECX 2240 SS EDX EDX 2 NO DISPLACEMENT 2241 Ĵ DS + Ĵ EBX + Ĵ EBX * Ĵ + Ĵ 8-BIT DISPLACEMENT 2242 ES ESP --- 4 32-BIT DISPLACEMENT 2243 FS EBP EBP 2244 GS ESI ESI 6 2245 EDI EDI 2246 2247 2248 22492.6 Interrupts and Exceptions 2250 2251The 80386 has two mechanisms for interrupting program execution: 2252 2253 1. Exceptions are synchronous events that are the responses of the CPU 2254 to certain conditions detected during the execution of an instruction. 2255 2256 2. Interrupts are asynchronous events typically triggered by external 2257 devices needing attention. 2258 2259Interrupts and exceptions are alike in that both cause the processor to 2260temporarily suspend its present program execution in order to execute a 2261program of higher priority. The major distinction between these two kinds of 2262interrupts is their origin. An exception is always reproducible by 2263re-executing with the program and data that caused the exception, whereas an 2264interrupt is generally independent of the currently executing program. 2265 2266Application programmers are not normally concerned with servicing 2267interrupts. More information on interrupts for systems programmers may be 2268found in Chapter 9. Certain exceptions, however, are of interest to 2269applications programmers, and many operating systems give applications 2270programs the opportunity to service these exceptions. However, the operating 2271system itself defines the interface between the applications programs and 2272the exception mechanism of the 80386. 2273 2274Table 2-2 highlights the exceptions that may be of interest to applications 2275programmers. 2276 2277 A divide error exception results when the instruction DIV or IDIV is 2278 executed with a zero denominator or when the quotient is too large for 2279 the destination operand. (Refer to Chapter 3 for a discussion of DIV 2280 and IDIV.) 2281 2282 The debug exception may be reflected back to an applications program 2283 if it results from the trap flag (TF). 2284 2285 A breakpoint exception results when the instruction INT 3 is executed. 2286 This instruction is used by some debuggers to stop program execution at 2287 specific points. 2288 2289 An overflow exception results when the INTO instruction is executed 2290 and the OF (overflow) flag is set (after an arithmetic operation that 2291 set the OF flag). (Refer to Chapter 3 for a discussion of INTO). 2292 2293 A bounds check exception results when the BOUND instruction is 2294 executed and the array index it checks falls outside the bounds of the 2295 array. (Refer to Chapter 3 for a discussion of the BOUND instruction.) 2296 2297 Invalid opcodes may be used by some applications to extend the 2298 instruction set. In such a case, the invalid opcode exception presents 2299 an opportunity to emulate the opcode. 2300 2301 The "coprocessor not available" exception occurs if the program 2302 contains instructions for a coprocessor, but no coprocessor is present 2303 in the system. 2304 2305 A coprocessor error is generated when a coprocessor detects an illegal 2306 operation. 2307 2308The instruction INT generates an interrupt whenever it is executed; the 2309processor treats this interrupt as an exception. The effects of this 2310interrupt (and the effects of all other exceptions) are determined by 2311exception handler routines provided by the application program or as part of 2312the systems software (provided by systems programmers). The INT instruction 2313itself is discussed in Chapter 3. Refer to Chapter 9 for a more complete 2314description of exceptions. 2315 2316 2317Table 2-2. 80386 Reserved Exceptions and Interrupts 2318 2319Vector Number Description 2320 23210 Divide Error 23221 Debug Exceptions 23232 NMI Interrupt 23243 Breakpoint 23254 INTO Detected Overflow 23265 BOUND Range Exceeded 23276 Invalid Opcode 23287 Coprocessor Not Available 23298 Double Exception 23309 Coprocessor Segment Overrun 233110 Invalid Task State Segment 233211 Segment Not Present 233312 Stack Fault 233413 General Protection 233514 Page Fault 233615 (reserved) 233716 Coprocessor Error 233817-32 (reserved) 2339 2340 2341Chapter 3 Applications Instruction Set 2342 2343 2344 2345This chapter presents an overview of the instructions which programmers can 2346use to write application software for the 80386 executing in protected 2347virtual-address mode. The instructions are grouped by categories of related 2348functions. 2349 2350The instructions not discussed in this chapter are those that are normally 2351used only by operating-system programmers. Part II describes the operation 2352of these instructions. 2353 2354The descriptions in this chapter assume that the 80386 is operating in 2355protected mode with 32-bit addressing in effect; however, all instructions 2356discussed are also available when 16-bit addressing is in effect in 2357protected mode, real mode, or virtual 8086 mode. For any differences of 2358operation that exist in the various modes, refer to Chapter 13, 2359Chapter 14, or Chapter 15. 2360 2361The instruction dictionary in Chapter 17 contains more detailed 2362descriptions of all instructions, including encoding, operation, timing, 2363effect on flags, and exceptions. 2364 2365 23663.1 Data Movement Instructions 2367 2368These instructions provide convenient methods for moving bytes, words, or 2369doublewords of data between memory and the registers of the base 2370architecture. They fall into the following classes: 2371 2372 1. General-purpose data movement instructions. 2373 2. Stack manipulation instructions. 2374 3. Type-conversion instructions. 2375 2376 23773.1.1 General-Purpose Data Movement Instructions 2378 2379MOV (Move) transfers a byte, word, or doubleword from the source operand to 2380the destination operand. The MOV instruction is useful for transferring data 2381along any of these paths 2382There are also variants of MOV that operate on segment registers. These 2383are covered in a later section of this chapter.: 2384 2385 To a register from memory 2386 To memory from a register 2387 Between general registers 2388 Immediate data to a register 2389 Immediate data to a memory 2390 2391The MOV instruction cannot move from memory to memory or from segment 2392register to segment register are not allowed. Memory-to-memory moves can be 2393performed, however, by the string move instruction MOVS. 2394 2395XCHG (Exchange) swaps the contents of two operands. This instruction takes 2396the place of three MOV instructions. It does not require a temporary 2397location to save the contents of one operand while load the other is being 2398loaded. XCHG is especially useful for implementing semaphores or similar 2399data structures for process synchronization. 2400 2401The XCHG instruction can swap two byte operands, two word operands, or two 2402doubleword operands. The operands for the XCHG instruction may be two 2403register operands, or a register operand with a memory operand. When used 2404with a memory operand, XCHG automatically activates the LOCK signal. (Refer 2405to Chapter 11 for more information on the bus lock.) 2406 2407 24083.1.2 Stack Manipulation Instructions 2409 2410PUSH (Push) decrements the stack pointer (ESP), then transfers the source 2411operand to the top of stack indicated by ESP (see Figure 3-1). PUSH is 2412often used to place parameters on the stack before calling a procedure; it 2413is also the basic means of storing temporary variables on the stack. The 2414PUSH instruction operates on memory operands, immediate operands, and 2415register operands (including segment registers). 2416 2417PUSHA (Push All Registers) saves the contents of the eight general 2418registers on the stack (see Figure 3-2). This instruction simplifies 2419procedure calls by reducing the number of instructions required to retain 2420the contents of the general registers for use in a procedure. The processor 2421pushes the general registers on the stack in the following order: EAX, ECX, 2422EDX, EBX, the initial value of ESP before EAX was pushed, EBP, ESI, and 2423EDI. PUSHA is complemented by the POPA instruction. 2424 2425POP (Pop) transfers the word or doubleword at the current top of stack 2426(indicated by ESP) to the destination operand, and then increments ESP to 2427point to the new top of stack. See Figure 3-3. POP moves information from 2428the stack to a general register, or to memory 2429There are also a variant of POP that operates on segment registers. This 2430is covered in a later section of this chapter.. 2431 2432POPA (Pop All Registers) restores the registers saved on the stack by 2433PUSHA, except that it ignores the saved value of ESP. See Figure 3-4. 2434 2435 2436Figure 3-1. PUSH 2437 2438 D O BEFORE PUSH AFTER PUSH 2439 I F 31 0 31 0 2440 R 2441 E E 2442 C X 2443 T P 2444 I A 2445 O N ESP 2446 N S OPERAND 2447 I ESP 2448 O 2449 N 2450 2451 2452 2453 2454 2455 2456Figure 3-2. PUSHA 2457 2458 BEFORE PUSHA AFTER PUSHA 2459 31 0 31 0 2460 D O 2461 I F 2462 R 2463 E E 2464 C X 2465 T P ESP 2466 I A EAX 2467 O N 2468 N S ECX 2469 I 2470 O EDX 2471 N 2472 EBX 2473 2474 OLD ESP 2475 2476 EBP 2477 2478 ESI 2479 2480 EDI 2481 ESP 2482 2483 2484 2485 2486 2487 24883.1.3 Type Conversion Instructions 2489 2490The type conversion instructions convert bytes into words, words into 2491doublewords, and doublewords into 64-bit items (quad-words). These 2492instructions are especially useful for converting signed integers, because 2493they automatically fill the extra bits of the larger item with the value of 2494the sign bit of the smaller item. This kind of conversion, illustrated by 2495Figure 3-5, is called sign extension. 2496 2497There are two classes of type conversion instructions: 2498 2499 1. The forms CWD, CDQ, CBW, and CWDE which operate only on data in the 2500 EAX register. 2501 2502 2. The forms MOVSX and MOVZX, which permit one operand to be in any 2503 general register while permitting the other operand to be in memory or 2504 in a register. 2505 2506CWD (Convert Word to Doubleword) and CDQ (Convert Doubleword to Quad-Word) 2507double the size of the source operand. CWD extends the sign of the 2508word in register AX throughout register DX. CDQ extends the sign of the 2509doubleword in EAX throughout EDX. CWD can be used to produce a doubleword 2510dividend from a word before a word division, and CDQ can be used to produce 2511a quad-word dividend from a doubleword before doubleword division. 2512 2513CBW (Convert Byte to Word) extends the sign of the byte in register AL 2514throughout AX. 2515 2516CWDE (Convert Word to Doubleword Extended) extends the sign of the word in 2517register AX throughout EAX. 2518 2519MOVSX (Move with Sign Extension) sign-extends an 8-bit value to a 16-bit 2520value and a 8- or 16-bit value to 32-bit value. 2521 2522MOVZX (Move with Zero Extension) extends an 8-bit value to a 16-bit value 2523and an 8- or 16-bit value to 32-bit value by inserting high-order zeros. 2524 2525 2526Figure 3-3. POP 2527 2528 D O BEFORE POP AFTER POP 2529 I F 31 0 31 0 2530 R 2531 E E 2532 C X 2533 T P 2534 I A 2535 O N ESP 2536 N S OPERAND 2537 I ESP 2538 O 2539 N 2540 2541 2542 2543 2544 2545 2546Figure 3-4. POPA 2547 2548 BEFORE POPA AFTER POPA 2549 31 0 31 0 2550 D O 2551 I F 2552 R 2553 E E 2554 C X 2555 T P ESP 2556 I A EAX 2557 O N 2558 N S ECX 2559 I 2560 O EDX 2561 N 2562 EBX 2563 2564 ESP 2565 2566 EPB 2567 2568 ESI 2569 2570 EDI 2571 ESP 2572 2573 2574 2575 2576 2577 2578Figure 3-5. Sign Extension 2579 2580 15 7 0 2581 ͻ 2582 BEFORE SIGN EXTENSIONS N N N N N N N N N N N N N N N 2583 ͼ 2584 AFTER SIGN EXTENSIONĿ 2585 2586 31 23 15 7 0 2587 ͻ 2588 SS S S S S S S S S S S S S S S S N N N N N N N N N N N N N N N 2589 ͼ 2590 2591 25923.2 Binary Arithmetic Instructions 2593 2594The arithmetic instructions of the 80386 processor simplify the 2595manipulation of numeric data that is encoded in binary. Operations include 2596the standard add, subtract, multiply, and divide as well as increment, 2597decrement, compare, and change sign. Both signed and unsigned binary 2598integers are supported. The binary arithmetic instructions may also be used 2599as one step in the process of performing arithmetic on decimal integers. 2600 2601Many of the arithmetic instructions operate on both signed and unsigned 2602integers. These instructions update the flags ZF, CF, SF, and OF in such a 2603manner that subsequent instructions can interpret the results of the 2604arithmetic as either signed or unsigned. CF contains information relevant to 2605unsigned integers; SF and OF contain information relevant to signed 2606integers. ZF is relevant to both signed and unsigned integers; ZF is set 2607when all bits of the result are zero. 2608 2609If the integer is unsigned, CF may be tested after one of these arithmetic 2610operations to determine whether the operation required a carry or borrow of 2611a one-bit in the high-order position of the destination operand. CF is set 2612if a one-bit was carried out of the high-order position (addition 2613instructions ADD, ADC, AAA, and DAA) or if a one-bit was carried (i.e. 2614borrowed) into the high-order bit (subtraction instructions SUB, SBB, AAS, 2615DAS, CMP, and NEG). 2616 2617If the integer is signed, both SF and OF should be tested. SF always has 2618the same value as the sign bit of the result. The most significant bit (MSB) 2619of a signed integer is the bit next to the signbit 6 of a byte, bit 14 of 2620a word, or bit 30 of a doubleword. OF is set in either of these cases: 2621 2622 A one-bit was carried out of the MSB into the sign bit but no one bit 2623 was carried out of the sign bit (addition instructions ADD, ADC, INC, 2624 AAA, and DAA). In other words, the result was greater than the greatest 2625 positive number that could be contained in the destination operand. 2626 2627 A one-bit was carried from the sign bit into the MSB but no one bit 2628 was carried into the sign bit (subtraction instructions SUB, SBB, DEC, 2629 AAS, DAS, CMP, and NEG). In other words, the result was smaller that 2630 the smallest negative number that could be contained in the destination 2631 operand. 2632 2633These status flags are tested by executing one of the two families of 2634conditional instructions: Jcc (jump on condition cc) or SETcc (byte set on 2635condition). 2636 2637 26383.2.1 Addition and Subtraction Instructions 2639 2640ADD (Add Integers) replaces the destination operand with the sum of the 2641source and destination operands. Sets CF if overflow. 2642 2643ADC (Add Integers with Carry) sums the operands, adds one if CF is set, and 2644replaces the destination operand with the result. If CF is cleared, ADC 2645performs the same operation as the ADD instruction. An ADD followed by 2646multiple ADC instructions can be used to add numbers longer than 32 bits. 2647 2648INC (Increment) adds one to the destination operand. INC does not affect 2649CF. Use ADD with an immediate value of 1 if an increment that updates carry 2650(CF) is needed. 2651 2652SUB (Subtract Integers) subtracts the source operand from the destination 2653operand and replaces the destination operand with the result. If a borrow is 2654required, the CF is set. The operands may be signed or unsigned bytes, 2655words, or doublewords. 2656 2657SBB (Subtract Integers with Borrow) subtracts the source operand from the 2658destination operand, subtracts 1 if CF is set, and returns the result to the 2659destination operand. If CF is cleared, SBB performs the same operation as 2660SUB. SUB followed by multiple SBB instructions may be used to subtract 2661numbers longer than 32 bits. If CF is cleared, SBB performs the same 2662operation as SUB. 2663 2664DEC (Decrement) subtracts 1 from the destination operand. DEC does not 2665update CF. Use SUB with an immediate value of 1 to perform a decrement that 2666affects carry. 2667 2668 26693.2.2 Comparison and Sign Change Instruction 2670 2671CMP (Compare) subtracts the source operand from the destination operand. It 2672updates OF, SF, ZF, AF, PF, and CF but does not alter the source and 2673destination operands. A subsequent Jcc or SETcc instruction can test the 2674appropriate flags. 2675 2676NEG (Negate) subtracts a signed integer operand from zero. The effect of 2677NEG is to reverse the sign of the operand from positive to negative or from 2678negative to positive. 2679 2680 26813.2.3 Multiplication Instructions 2682 2683The 80386 has separate multiply instructions for unsigned and signed 2684operands. MUL operates on unsigned numbers, while IMUL operates on signed 2685integers as well as unsigned. 2686 2687MUL (Unsigned Integer Multiply) performs an unsigned multiplication of the 2688source operand and the accumulator. If the source is a byte, the processor 2689multiplies it by the contents of AL and returns the double-length result to 2690AH and AL. If the source operand is a word, the processor multiplies it by 2691the contents of AX and returns the double-length result to DX and AX. If the 2692source operand is a doubleword, the processor multiplies it by the contents 2693of EAX and returns the 64-bit result in EDX and EAX. MUL sets CF and OF 2694when the upper half of the result is nonzero; otherwise, they are cleared. 2695 2696IMUL (Signed Integer Multiply) performs a signed multiplication operation. 2697IMUL has three variations: 2698 2699 1. A one-operand form. The operand may be a byte, word, or doubleword 2700 located in memory or in a general register. This instruction uses EAX 2701 and EDX as implicit operands in the same way as the MUL instruction. 2702 2703 2. A two-operand form. One of the source operands may be in any general 2704 register while the other may be either in memory or in a general 2705 register. The product replaces the general-register operand. 2706 2707 3. A three-operand form; two are source and one is the destination 2708 operand. One of the source operands is an immediate value stored in 2709 the instruction; the second may be in memory or in any general 2710 register. The product may be stored in any general register. The 2711 immediate operand is treated as signed. If the immediate operand is a 2712 byte, the processor automatically sign-extends it to the size of the 2713 second operand before performing the multiplication. 2714 2715The three forms are similar in most respects: 2716 2717 The length of the product is calculated to twice the length of the 2718 operands. 2719 2720 The CF and OF flags are set when significant bits are carried into the 2721 high-order half of the result. CF and OF are cleared when the 2722 high-order half of the result is the sign-extension of the low-order 2723 half. 2724 2725However, forms 2 and 3 differ in that the product is truncated to the 2726length of the operands before it is stored in the destination register. 2727Because of this truncation, OF should be tested to ensure that no 2728significant bits are lost. (For ways to test OF, refer to the INTO and PUSHF 2729instructions.) 2730 2731Forms 2 and 3 of IMUL may also be used with unsigned operands because, 2732whether the operands are signed or unsigned, the low-order half of the 2733product is the same. 2734 2735 27363.2.4 Division Instructions 2737 2738The 80386 has separate division instructions for unsigned and signed 2739operands. DIV operates on unsigned numbers, while IDIV operates on signed 2740integers as well as unsigned. In either case, an exception (interrupt zero) 2741occurs if the divisor is zero or if the quotient is too large for AL, AX, or 2742EAX. 2743 2744DIV (Unsigned Integer Divide) performs an unsigned division of the 2745accumulator by the source operand. The dividend (the accumulator) is twice 2746the size of the divisor (the source operand); the quotient and remainder 2747have the same size as the divisor, as the following table shows. 2748 2749Size of Source Operand 2750 (divisor) Dividend Quotient Remainder 2751 2752Byte AX AL AH 2753Word DX:AX AX DX 2754Doubleword EDX:EAX EAX EDX 2755 2756Non-integral quotients are truncated to integers toward 0. The remainder is 2757always less than the divisor. For unsigned byte division, the largest 2758quotient is 255. For unsigned word division, the largest quotient is 65,535. 2759For unsigned doubleword division the largest quotient is 2^(32) -1. 2760 2761IDIV (Signed Integer Divide) performs a signed division of the accumulator 2762by the source operand. IDIV uses the same registers as the DIV instruction. 2763 2764For signed byte division, the maximum positive quotient is +127, and the 2765minimum negative quotient is -128. For signed word division, the maximum 2766positive quotient is +32,767, and the minimum negative quotient is -32,768. 2767For signed doubleword division the maximum positive quotient is 2^(31) -1, 2768the minimum negative quotient is -2^(31). Non-integral results are truncated 2769towards 0. The remainder always has the same sign as the dividend and is 2770less than the divisor in magnitude. 2771 2772 27733.3 Decimal Arithmetic Instructions 2774 2775Decimal arithmetic is performed by combining the binary arithmetic 2776instructions (already discussed in the prior section) with the decimal 2777arithmetic instructions. The decimal arithmetic instructions are used in one 2778of the following ways: 2779 2780 To adjust the results of a previous binary arithmetic operation to 2781 produce a valid packed or unpacked decimal result. 2782 2783 To adjust the inputs to a subsequent binary arithmetic operation so 2784 that the operation will produce a valid packed or unpacked decimal 2785 result. 2786 2787These instructions operate only on the AL or AH registers. Most utilize the 2788AF flag. 2789 2790 27913.3.1 Packed BCD Adjustment Instructions 2792 2793DAA (Decimal Adjust after Addition) adjusts the result of adding two valid 2794packed decimal operands in AL. DAA must always follow the addition of two 2795pairs of packed decimal numbers (one digit in each half-byte) to obtain a 2796pair of valid packed decimal digits as results. The carry flag is set if 2797carry was needed. 2798 2799DAS (Decimal Adjust after Subtraction) adjusts the result of subtracting 2800two valid packed decimal operands in AL. DAS must always follow the 2801subtraction of one pair of packed decimal numbers (one digit in each half- 2802byte) from another to obtain a pair of valid packed decimal digits as 2803results. The carry flag is set if a borrow was needed. 2804 2805 28063.3.2 Unpacked BCD Adjustment Instructions 2807 2808AAA (ASCII Adjust after Addition) changes the contents of register AL to a 2809valid unpacked decimal number, and zeros the top 4 bits. AAA must always 2810follow the addition of two unpacked decimal operands in AL. The carry flag 2811is set and AH is incremented if a carry is necessary. 2812 2813AAS (ASCII Adjust after Subtraction) changes the contents of register AL to 2814a valid unpacked decimal number, and zeros the top 4 bits. AAS must always 2815follow the subtraction of one unpacked decimal operand from another in AL. 2816The carry flag is set and AH decremented if a borrow is necessary. 2817 2818AAM (ASCII Adjust after Multiplication) corrects the result of a 2819multiplication of two valid unpacked decimal numbers. AAM must always follow 2820the multiplication of two decimal numbers to produce a valid decimal result. 2821The high order digit is left in AH, the low order digit in AL. 2822 2823AAD (ASCII Adjust before Division) modifies the numerator in AH and AL to 2824prepare for the division of two valid unpacked decimal operands so that the 2825quotient produced by the division will be a valid unpacked decimal number. 2826AH should contain the high-order digit and AL the low-order digit. This 2827instruction adjusts the value and places the result in AL. AH will contain 2828zero. 2829 2830 28313.4 Logical Instructions 2832 2833The group of logical instructions includes: 2834 2835 The Boolean operation instructions 2836 Bit test and modify instructions 2837 Bit scan instructions 2838 Rotate and shift instructions 2839 Byte set on condition 2840 2841 28423.4.1 Boolean Operation Instructions 2843 2844The logical operations are AND, OR, XOR, and NOT. 2845 2846NOT (Not) inverts the bits in the specified operand to form a one's 2847complement of the operand. The NOT instruction is a unary operation that 2848uses a single operand in a register or memory. NOT has no effect on the 2849flags. 2850 2851The AND, OR, and XOR instructions perform the standard logical operations 2852"and", "(inclusive) or", and "exclusive or". These instructions can use the 2853following combinations of operands: 2854 2855 Two register operands 2856 2857 A general register operand with a memory operand 2858 2859 An immediate operand with either a general register operand or a 2860 memory operand. 2861 2862AND, OR, and XOR clear OF and CF, leave AF undefined, and update SF, ZF, 2863and PF. 2864 2865 28663.4.2 Bit Test and Modify Instructions 2867 2868This group of instructions operates on a single bit which can be in memory 2869or in a general register. The location of the bit is specified as an offset 2870from the low-order end of the operand. The value of the offset either may be 2871given by an immediate byte in the instruction or may be contained in a 2872general register. 2873 2874These instructions first assign the value of the selected bit to CF, the 2875carry flag. Then a new value is assigned to the selected bit, as determined 2876by the operation. OF, SF, ZF, AF, PF are left in an undefined state. Table 28773-1 defines these instructions. 2878 2879 2880Table 3-1. Bit Test and Modify Instructions 2881 2882Instruction Effect on CF Effect on 2883 Selected Bit 2884 2885Bit (Bit Test) CF BIT (none) 2886BTS (Bit Test and Set) CF BIT BIT 1 2887BTR (Bit Test and Reset) CF BIT BIT 0 2888BTC (Bit Test and Complement) CF BIT BIT NOT(BIT) 2889 2890 28913.4.3 Bit Scan Instructions 2892 2893These instructions scan a word or doubleword for a one-bit and store the 2894index of the first set bit into a register. The bit string being scanned 2895may be either in a register or in memory. The ZF flag is set if the entire 2896word is zero (no set bits are found); ZF is cleared if a one-bit is found. 2897If no set bit is found, the value of the destination register is undefined. 2898 2899BSF (Bit Scan Forward) scans from low-order to high-order (starting from 2900bit index zero). 2901 2902BSR (Bit Scan Reverse) scans from high-order to low-order (starting from 2903bit index 15 of a word or index 31 of a doubleword). 2904 2905 29063.4.4 Shift and Rotate Instructions 2907 2908The shift and rotate instructions reposition the bits within the specified 2909operand. 2910 2911These instructions fall into the following classes: 2912 2913 Shift instructions 2914 Double shift instructions 2915 Rotate instructions 2916 2917 29183.4.4.1 Shift Instructions 2919 2920The bits in bytes, words, and doublewords may be shifted arithmetically or 2921logically. Depending on the value of a specified count, bits can be shifted 2922up to 31 places. 2923 2924A shift instruction can specify the count in one of three ways. One form of 2925shift instruction implicitly specifies the count as a single shift. The 2926second form specifies the count as an immediate value. The third form 2927specifies the count as the value contained in CL. This last form allows the 2928shift count to be a variable that the program supplies during execution. 2929Only the low order 5 bits of CL are used. 2930 2931CF always contains the value of the last bit shifted out of the destination 2932operand. In a single-bit shift, OF is set if the value of the high-order 2933(sign) bit was changed by the operation. Otherwise, OF is cleared. Following 2934a multibit shift, however, the content of OF is always undefined. 2935 2936The shift instructions provide a convenient way to accomplish division or 2937multiplication by binary power. Note however that division of signed numbers 2938by shifting right is not the same kind of division performed by the IDIV 2939instruction. 2940 2941SAL (Shift Arithmetic Left) shifts the destination byte, word, or 2942doubleword operand left by one or by the number of bits specified in the 2943count operand (an immediate value or the value contained in CL). The 2944processor shifts zeros in from the right (low-order) side of the operand as 2945bits exit from the left (high-order) side. See Figure 3-6. 2946 2947SHL (Shift Logical Left) is a synonym for SAL (refer to SAL). 2948 2949SHR (Shift Logical Right) shifts the destination byte, word, or doubleword 2950operand right by one or by the number of bits specified in the count operand 2951(an immediate value or the value contained in CL). The processor shifts 2952zeros in from the left side of the operand as bits exit from the right side. 2953See Figure 3-7. 2954 2955SAR (Shift Arithmetic Right) shifts the destination byte, word, or 2956doubleword operand to the right by one or by the number of bits specified in 2957the count operand (an immediate value or the value contained in CL). The 2958processor preserves the sign of the operand by shifting in zeros on the left 2959(high-order) side if the value is positive or by shifting by ones if the 2960value is negative. See Figure 3-8. 2961 2962Even though this instruction can be used to divide integers by a power of 2963two, the type of division is not the same as that produced by the IDIV 2964instruction. The quotient of IDIV is rounded toward zero, whereas the 2965"quotient" of SAR is rounded toward negative infinity. This difference is 2966apparent only for negative numbers. For example, when IDIV is used to divide 2967-9 by 4, the result is -2 with a remainder of -1. If SAR is used to shift 2968-9 right by two bits, the result is -3. The "remainder" of this kind of 2969division is +3; however, the SAR instruction stores only the high-order bit 2970of the remainder (in CF). 2971 2972The code sequence in Figure 3-9 produces the same result as IDIV for any M 2973= 2^(N), where 0 < N < 32. This sequence takes about 12 to 18 clocks, 2974depending on whether the jump is taken; if ECX contains M, the corresponding 2975IDIV ECX instruction will take about 43 clocks. 2976 2977 2978Figure 3-6. SAL and SHL 2979 2980 OF CF OPERAND 2981 2982 BEFORE SHL X X 10001000100010001000100010001111 2983 OR SAL 2984 2985 AFTER SHL 1 1 00010001000100010001000100011110 0 2986 OR SAL BY 1 2987 2988 AFTER SHL X 0 00100010001000100011110000000000 0 2989 OR SAL BY 10 2990 2991SHL (WHICH HAS THE SYNONYM SAL) SHIFTS THE BITS IN THE REGISTER OR MEMORY 2992OPERAND TO THE LEFT BY THE SPECIFIED NUMBER OF BIT POSITIONS. CF RECEIVES 2993THE LAST BIT SHIFTED OUT OF THE LEFT OF THE OPERAND. SHL SHIFTS IN ZEROS 2994TO FILL THE VACATED BIT LOCATIONS. THESE INSTRUCTIONS OPERATE ON BYTE, 2995WORD, AND DOUBLEWORD OPERANDS. 2996 2997 2998Figure 3-7. SHR 2999 3000 OPERAND CF 3001 3002 BEFORE SHR 10001000100010001000100010001111 X 3003 3004 AFTER SHR 0010001000100010001000100010001111 3005 BY 1 3006 3007 AFTER SHR 000000000001000100010001000100010O 3008 BY 10 3009 3010SHR SHIFTS THE BITS OF THE REGISTER OR MEMORY OPERAND TO THE RIGHT BY THE 3011SPECIFIED NUMBER OF BIT POSITIONS. CF RECEIVES THE LAST BIT SHIFTED OUT OF 3012THE RIGHT OF THE OPERAND. SHR SHIFTS IN ZEROS TO FILL THE VACATED BIT 3013LOCATIONS. 3014 3015 3016Figure 3-8. SAR 3017 3018 POSITIVE OPERAND CF 3019 3020 BEFORE SAR 01000100010001000100010001000111 X 3021 3022 AFTER SAR 0001000100010001000100010001000111 3023 BY 1 3024 3025 NEGATIVE OPERAND CF 3026 3027 BEFORE SAR 11000100010001000100010001000111 X 3028 3029 AFTER SAR 0111000100010001000100010001000111 3030 BY 1 3031 3032SAR PRESERVES THE SIGN OF THE REGISTER OR MEMORY OPERAND AS IT SHIFTS THE 3033OPERAND TO THE RIGHT BY THE SPECIFIED NUMBER OF BIT POSITIONS. CF RECIEVES 3034THE LAST BIT SHIFTED OUT OF THE RIGHT OF THE OPERAND. 3035 3036 3037Figure 3-9. Using SAR to Simulate IDIV 3038 3039 ; assuming N is in ECX, and the dividend is in EAX 3040 ; CLOCKS 3041 CMP EAX, 0 ; to set sign flag 2 3042 JGE NoAdjust ; jump if sign is zero 3 or 9 3043 ADD EAX, ECX ; 2 3044 DEC EAX ; EAX := EAX + (N-1) 2 3045NoAdjust: 3046 SAR EAX, CL ; 3 3047 ; TOTAL CLOCKS 12 or 18] 3048 3049 30503.4.4.2 Double-Shift Instructions 3051 3052These instructions provide the basic operations needed to implement 3053operations on long unaligned bit strings. The double shifts operate either 3054on word or doubleword operands, as follows: 3055 3056 1. Taking two word operands as input and producing a one-word output. 3057 3058 2. Taking two doubleword operands as input and producing a doubleword 3059 output. 3060 3061Of the two input operands, one may either be in a general register or in 3062memory, while the other may only be in a general register. The results 3063replace the memory or register operand. The number of bits to be shifted is 3064specified either in the CL register or in an immediate byte of the 3065instruction. 3066 3067Bits are shifted from the register operand into the memory or register 3068operand. CF is set to the value of the last bit shifted out of the 3069destination operand. SF, ZF, and PF are set according to the value of the 3070result. OF and AF are left undefined. 3071 3072SHLD (Shift Left Double) shifts bits of the R/M field to the left, while 3073shifting high-order bits from the Reg field into the R/M field on the right 3074(see Figure 3-10). The result is stored back into the R/M operand. The Reg 3075field is not modified. 3076 3077SHRD (Shift Right Double) shifts bits of the R/M field to the right, while 3078shifting low-order bits from the Reg field into the R/M field on the left 3079(see Figure 3-11). The result is stored back into the R/M operand. The Reg 3080field is not modified. 3081 3082 30833.4.4.3 Rotate Instructions 3084 3085Rotate instructions allow bits in bytes, words, and doublewords to be 3086rotated. Bits rotated out of an operand are not lost as in a shift, but are 3087"circled" back into the other "end" of the operand. 3088 3089Rotates affect only the carry and overflow flags. CF may act as an 3090extension of the operand in two of the rotate instructions, allowing a bit 3091to be isolated and then tested by a conditional jump instruction (JC or 3092JNC). CF always contains the value of the last bit rotated out, even if the 3093instruction does not use this bit as an extension of the rotated operand. 3094 3095In single-bit rotates, OF is set if the operation changes the high-order 3096(sign) bit of the destination operand. If the sign bit retains its original 3097value, OF is cleared. On multibit rotates, the value of OF is always 3098undefined. 3099 3100ROL (Rotate Left) rotates the byte, word, or doubleword destination operand 3101left by one or by the number of bits specified in the count operand (an 3102immediate value or the value contained in CL). For each rotation specified, 3103the high-order bit that exits from the left of the operand returns at the 3104right to become the new low-order bit of the operand. See Figure 3-12. 3105 3106ROR (Rotate Right) rotates the byte, word, or doubleword destination 3107operand right by one or by the number of bits specified in the count operand 3108(an immediate value or the value contained in CL). For each rotation 3109specified, the low-order bit that exits from the right of the operand 3110returns at the left to become the new high-order bit of the operand. 3111See Figure 3-13. 3112 3113RCL (Rotate Through Carry Left) rotates bits in the byte, word, or 3114doubleword destination operand left by one or by the number of bits 3115specified in the count operand (an immediate value or the value contained in 3116CL). 3117 3118This instruction differs from ROL in that it treats CF as a high-order 3119one-bit extension of the destination operand. Each high-order bit that exits 3120from the left side of the operand moves to CF before it returns to the 3121operand as the low-order bit on the next rotation cycle. See Figure 3-14. 3122 3123RCR (Rotate Through Carry Right) rotates bits in the byte, word, or 3124doubleword destination operand right by one or by the number of bits 3125specified in the count operand (an immediate value or the value contained in 3126CL). 3127 3128This instruction differs from ROR in that it treats CF as a low-order 3129one-bit extension of the destination operand. Each low-order bit that exits 3130from the right side of the operand moves to CF before it returns to the 3131operand as the high-order bit on the next rotation cycle. See Figure 3-15. 3132 3133 3134Figure 3-10. Shift Left Double 3135 3136 31 DESTINATION 0 3137 ͻ ͻ 3138 CF Ķ MEMORY OF REGISTER Ŀ 3139 ͼ ͼ 3140 3141 31 SOURCE 0 3142 ͻ 3143 Ķ REGISTER 3144 ͼ 3145 3146 3147Figure 3-11. Shift Right Double 3148 3149 31 SOURCE 0 3150 ͻ 3151 REGISTER Ŀ 3152 ͼ 3153 3154 31 DESTINATION 0 3155 ͻ ͻ 3156 MEMORY OF REGISTER CF 3157 ͼ ͼ 3158 3159 3160Figure 3-12. ROL 3161 3162 31 DESTINATION 0 3163 ͻ ͻ 3164 CF Ķ MEMORY OF REGISTER Ŀ 3165 ͼ ͼ 3166 3167 3168 3169Figure 3-13. ROR 3170 3171 Ŀ 3172 31 DESTINATION 0 3173 ͻ ͻ 3174 MEMORY OF REGISTER CF 3175 ͼ ͼ 3176 3177 3178Figure 3-14. RCL 3179 3180 31 DESTINATION 0 3181 ͻ ͻ 3182 Ķ CF Ķ MEMORY OF REGISTER Ŀ 3183 ͼ ͼ 3184 3185 3186 3187Figure 3-15. RCR 3188 3189 Ŀ 3190 31 DESTINATION 0 3191 ͻ ͻ 3192 MEMORY OF REGISTER CF 3193 ͼ ͼ 3194 3195 31963.4.4.4 Fast "BIT BLT" Using Double Shift Instructions 3197 3198One purpose of the double shifts is to implement a bit string move, with 3199arbitrary misalignment of the bit strings. This is called a "bit blt" (BIT 3200BLock Transfer.) A simple example is to move a bit string from an arbitrary 3201offset into a doubleword-aligned byte string. A left-to-right string is 3202moved 32 bits at a time if a double shift is used inside the move loop. 3203 3204 MOV ESI,ScrAddr 3205 MOV EDI,DestAddr 3206 MOV EBX,WordCnt 3207 MOV CL,RelOffset ; relative offset Dest-Src 3208 MOV EDX,[ESI] ; load first word of source 3209 ADD ESI,4 ; bump source address 3210BltLoop: 3211 LODS ; new low order part 3212 SHLD EDX,EAX,CL ; EDX overwritten with aligned stuff 3213 XCHG EDX,EAS ; Swap high/low order parts 3214 STOS ; Write out next aligned chunk 3215 DEC EBX 3216 JA BltLoop 3217 3218This loop is simple yet allows the data to be moved in 32-bit pieces for 3219the highest possible performance. Without a double shift, the best that can 3220be achieved is 16 bits per loop iteration by using a 32-bit shift and 3221replacing the XCHG with a ROR by 16 to swap high and low order parts of 3222registers. A more general loop than shown above would require some extra 3223masking on the first doubleword moved (before the main loop), and on the 3224last doubleword moved (after the main loop), but would have the same basic 322532-bits per loop iteration as the code above. 3226 3227 32283.4.4.5 Fast Bit-String Insert and Extract 3229 3230The double shift instructions also enable: 3231 3232 Fast insertion of a bit string from a register into an arbitrary bit 3233 location in a larger bit string in memory without disturbing the bits 3234 on either side of the inserted bits. 3235 3236 Fast extraction of a bits string into a register from an arbitrary bit 3237 location in a larger bit string in memory without disturbing the bits 3238 on either side of the extracted bits. 3239 3240The following coded examples illustrate bit insertion and extraction under 3241variousconditions: 3242 3243 1. Bit String Insert into Memory (when bit string is 1-25 bits long, 3244 i.e., spans four bytes or less): 3245 3246 ; Insert a right-justified bit string from register into 3247 ; memory bit string. 3248 ; 3249 ; Assumptions: 3250 ; 1) The base of the string array is dword aligned, and 3251 ; 2) the length of the bit string is an immediate value 3252 ; but the bit offset is held in a register. 3253 ; 3254 ; Register ESI holds the right-justified bit string 3255 ; to be inserted. 3256 ; Register EDI holds the bit offset of the start of the 3257 ; substring. 3258 ; Registers EAX and ECX are also used by this 3259 ; "insert" operation. 3260 ; 3261 MOV ECX,EDI ; preserve original offset for later use 3262 SHR EDI,3 ; signed divide offset by 8 (byte address) 3263 AND CL,7H ; isolate low three bits of offset in CL 3264 MOV EAX,[EDI]strg_base ; move string dword into EAX 3265 ROR EAX,CL ; right justify old bit field 3266 SHRD EAX,ESI,length ; bring in new bits 3267 ROL EAX,length ; right justify new bit field 3268 ROL EAX,CL ; bring to final position 3269 MOV [EDI]strg_base,EAX ; replace dword in memory 3270 3271 2. Bit String Insert into Memory (when bit string is 1-31 bits long, i.e. 3272 spans five bytes or less): 3273 3274 ; Insert a right-justified bit string from register into 3275 ; memory bit string. 3276 ; 3277 ; Assumptions: 3278 ; 1) The base of the string array is dword aligned, and 3279 ; 2) the length of the bit string is an immediate value 3280 ; but the bit offset is held in a register. 3281 ; 3282 ; Register ESI holds the right-justified bit string 3283 ; to be inserted. 3284 ; Register EDI holds the bit offset of the start of the 3285 ; substring. 3286 ; Registers EAX, EBX, ECX, and EDI are also used by 3287 ; this "insert" operation. 3288 ; 3289 MOV ECX,EDI ; temp storage for offset 3290 SHR EDI,5 ; signed divide offset by 32 (dword address) 3291 SHL EDI,2 ; multiply by 4 (in byte address format) 3292 AND CL,1FH ; isolate low five bits of offset in CL 3293 MOV EAX,[EDI]strg_base ; move low string dword into EAX 3294 MOV EDX,[EDI]strg_base+4 ; other string dword into EDX 3295 MOV EBX,EAX ; temp storage for part of string rotate 3296 SHRD EAX,EDX,CL ; double shift by offset within dword EDX:EAX 3297 SHRD EAX,EBX,CL ; double shift by offset within dword right 3298 SHRD EAX,ESI,length ; bring in new bits 3299 ROL EAX,length ; right justify new bit field 3300 MOV EBX,EAX ; temp storage for part of string rotate 3301 SHLD EAX,EDX,CL ; double shift back by offset within word EDX:EAX 3302 SHLD EDX,EBX,CL ; double shift back by offset within word left 3303 MOV [EDI]strg_base,EAX ; replace dword in memory 3304 MOV [EDI]strg_base+4,EDX ; replace dword in memory 3305 3306 3. Bit String Insert into Memory (when bit string is exactly 32 bits 3307 long, i.e., spans five or four types of memory): 3308 3309 ; Insert right-justified bit string from register into 3310 ; memory bit string. 3311 ; 3312 ; Assumptions: 3313 ; 1) The base of the string array is dword aligned, and 3314 ; 2) the length of the bit string is 32 3315 ; but the bit offset is held in a register. 3316 ; 3317 ; Register ESI holds the 32-bit string to be inserted. 3318 ; Register EDI holds the bit offset of the start of the 3319 ; substring. 3320 ; Registers EAX, EBX, ECX, and EDI are also used by 3321 ; this "insert" operation. 3322 ; 3323 MOV EDX,EDI ; preserve original offset for later use 3324 SHR EDI,5 ; signed divide offset by 32 (dword address) 3325 SHL EDI,2 ; multiply by 4 (in byte address format) 3326 AND CL,1FH ; isolate low five bits of offset in CL 3327 MOV EAX,[EDI]strg_base ; move low string dword into EAX 3328 MOV EDX,[EDI]strg_base+4 ; other string dword into EDX 3329 MOV EBX,EAX ; temp storage for part of string rotate 3330 SHRD EAX,EDX ; double shift by offset within dword EDX:EAX 3331 SHRD EDX,EBX ; double shift by offset within dword right 3332 MOV EAX,ESI ; move 32-bit bit field into position 3333 MOV EBX,EAX ; temp storage for part of string rotate 3334 SHLD EAX,EDX ; double shift back by offset within word EDX:EAX 3335 SHLD EDX,EBX ; double shift back by offset within word left 3336 MOV [EDI]strg_base,EAX ; replace dword in memory 3337 MOV [EDI]strg_base,+4,EDX ; replace dword in memory 3338 3339 4. Bit String Extract from Memory (when bit string is 1-25 bits long, 3340 i.e., spans four bytes or less): 3341 3342 ; Extract a right-justified bit string from memory bit 3343 ; string into register 3344 ; 3345 ; Assumptions: 3346 ; 1) The base of the string array is dword aligned, and 3347 ; 2) the length of the bit string is an immediate value 3348 ; but the bit offset is held in a register. 3349 ; 3350 ; Register EAX holds the right-justified, zero-padded 3351 ; bit string that was extracted. 3352 ; Register EDI holds the bit offset of the start of the 3353 ; substring. 3354 ; Registers EDI, and ECX are also used by this "extract." 3355 ; 3356 MOV ECX,EDI ; temp storage for offset 3357 SHR EDI,3 ; signed divide offset by 8 (byte address) 3358 AND CL,7H ; isolate low three bits of offset 3359 MOV EAX,[EDI]strg_base ; move string dword into EAX 3360 SHR EAX,CL ; shift by offset within dword 3361 AND EAX,mask ; extracted bit field in EAX 3362 3363 5. Bit String Extract from Memory (when bit string is 1-32 bits long, 3364 i.e., spans five bytes or less): 3365 3366 ; Extract a right-justified bit string from memory bit 3367 ; string into register. 3368 ; 3369 ; Assumptions: 3370 ; 1) The base of the string array is dword aligned, and 3371 ; 2) the length of the bit string is an immediate 3372 ; value but the bit offset is held in a register. 3373 ; 3374 ; Register EAX holds the right-justified, zero-padded 3375 ; bit string that was extracted. 3376 ; Register EDI holds the bit offset of the start of the 3377 ; substring. 3378 ; Registers EAX, EBX, and ECX are also used by this "extract." 3379 MOV ECX,EDI ; temp storage for offset 3380 SHR EDI,5 ; signed divide offset by 32 (dword address) 3381 SHL EDI,2 ; multiply by 4 (in byte address format) 3382 AND CL,1FH ; isolate low five bits of offset in CL 3383 MOV EAX,[EDI]strg_base ; move low string dword into EAX 3384 MOV EDX,[EDI]strg_base+4 ; other string dword into EDX 3385 SHRD EAX,EDX,CL ; double shift right by offset within dword 3386 AND EAX,mask ; extracted bit field in EAX 3387 3388 33893.4.5 Byte-Set-On-Condition Instructions 3390 3391This group of instructions sets a byte to zero or one depending on any of 3392the 16 conditions defined by the status flags. The byte may be in memory or 3393may be a one-byte general register. These instructions are especially useful 3394for implementing Boolean expressions in high-level languages such as Pascal. 3395 3396SETcc (Set Byte on Condition cc) set a byte to one if condition cc is true; 3397sets the byte to zero otherwise. Refer to Appendix D for a definition of 3398the possible conditions. 3399 3400 34013.4.6 Test Instruction 3402 3403TEST (Test) performs the logical "and" of the two operands, clears OF and 3404CF, leaves AF undefined, and updates SF, ZF, and PF. The flags can be tested 3405by conditional control transfer instructions or by the byte-set-on-condition 3406instructions. The operands may be doublewords, words, or bytes. 3407 3408The difference between TEST and AND is that TEST does not alter the 3409destination operand. TEST differs from BT in that TEST is useful for testing 3410the value of multiple bits in one operations, whereas BT tests a single bit. 3411 3412 34133.5 Control Transfer Instructions 3414 3415The 80386 provides both conditional and unconditional control transfer 3416instructions to direct the flow of execution. Conditional control transfers 3417depend on the results of operations that affect the flag register. 3418Unconditional control transfers are always executed. 3419 3420 34213.5.1 Unconditional Transfer Instructions 3422 3423JMP, CALL, RET, INT and IRET instructions transfer control from one code 3424segment location to another. These locations can be within the same code 3425segment (near control transfers) or in different code segments (far control 3426transfers). The variants of these instructions that transfer control to 3427other segments are discussed in a later section of this chapter. If the 3428model of memory organization used in a particular 80386 application does 3429not make segments visible to applications programmers, intersegment control 3430transfers will not be used. 3431 3432 34333.5.1.1 Jump Instruction 3434 3435JMP (Jump) unconditionally transfers control to the target location. JMP is 3436a one-way transfer of execution; it does not save a return address on the 3437stack. 3438 3439The JMP instruction always performs the same basic function of transferring 3440control from the current location to a new location. Its implementation 3441varies depending on whether the address is specified directly within the 3442instruction or indirectly through a register or memory. 3443 3444A direct JMP instruction includes the destination address as part of the 3445instruction. An indirect JMP instruction obtains the destination address 3446indirectly through a register or a pointer variable. 3447 3448Direct near JMP. A direct JMP uses a relative displacement value contained 3449in the instruction. The displacement is signed and the size of the 3450displacement may be a byte, word, or doubleword. The processor forms an 3451effective address by adding this relative displacement to the address 3452contained in EIP. When the additions have been performed, EIP refers to the 3453next instruction to be executed. 3454 3455Indirect near JMP. Indirect JMP instructions specify an absolute address in 3456one of several ways: 3457 3458 1. The program can JMP to a location specified by a general register 3459 (any of EAX, EDX, ECX, EBX, EBP, ESI, or EDI). The processor moves 3460 this 32-bit value into EIP and resumes execution. 3461 3462 2. The processor can obtain the destination address from a memory 3463 operand specified in the instruction. 3464 3465 3. A register can modify the address of the memory pointer to select a 3466 destination address. 3467 3468 34693.5.1.2 Call Instruction 3470 3471CALL (Call Procedure) activates an out-of-line procedure, saving on the 3472stack the address of the instruction following the CALL for later use by a 3473RET (Return) instruction. CALL places the current value of EIP on the stack. 3474The RET instruction in the called procedure uses this address to transfer 3475control back to the calling program. 3476 3477CALL instructions, like JMP instructions have relative, direct, and 3478indirect versions. 3479 3480Indirect CALL instructions specify an absolute address in one of these 3481ways: 3482 3483 1. The program can CALL a location specified by a general register (any 3484 of EAX, EDX, ECX, EBX, EBP, ESI, or EDI). The processor moves this 3485 32-bit value into EIP. 3486 3487 2. The processor can obtain the destination address from a memory 3488 operand specified in the instruction. 3489 3490 34913.5.1.3 Return and Return-From-Interrupt Instruction 3492 3493RET (Return From Procedure) terminates the execution of a procedure and 3494transfers control through a back-link on the stack to the program that 3495originally invoked the procedure. RET restores the value of EIP that was 3496saved on the stack by the previous CALL instruction. 3497 3498RET instructions may optionally specify an immediate operand. By adding 3499this constant to the new top-of-stack pointer, RET effectively removes any 3500arguments that the calling program pushed on the stack before the execution 3501of the CALL instruction. 3502 3503IRET (Return From Interrupt) returns control to an interrupted procedure. 3504IRET differs from RET in that it also pops the flags from the stack into the 3505flags register. The flags are stored on the stack by the interrupt 3506mechanism. 3507 3508 35093.5.2 Conditional Transfer Instructions 3510 3511The conditional transfer instructions are jumps that may or may not 3512transfer control, depending on the state of the CPU flags when the 3513instruction executes. 3514 3515 35163.5.2.1 Conditional Jump Instructions 3517 3518Table 3-2 shows the conditional transfer mnemonics and their 3519interpretations. The conditional jumps that are listed as pairs are actually 3520the same instruction. The assembler provides the alternate mnemonics for 3521greater clarity within a program listing. 3522 3523Conditional jump instructions contain a displacement which is added to the 3524EIP register if the condition is true. The displacement may be a byte, a 3525word, or a doubleword. The displacement is signed; therefore, it can be used 3526to jump forward or backward. 3527 3528 3529Table 3-2. Interpretation of Conditional Transfers 3530 3531Unsigned Conditional Transfers 3532 3533Mnemonic Condition Tested "Jump If..." 3534 3535JA/JNBE (CF or ZF) = 0 above/not below nor equal 3536JAE/JNB CF = 0 above or equal/not below 3537JB/JNAE CF = 1 below/not above nor equal 3538JBE/JNA (CF or ZF) = 1 below or equal/not above 3539JC CF = 1 carry 3540JE/JZ ZF = 1 equal/zero 3541JNC CF = 0 not carry 3542JNE/JNZ ZF = 0 not equal/not zero 3543JNP/JPO PF = 0 not parity/parity odd 3544JP/JPE PF = 1 parity/parity even 3545 3546Signed Conditional Transfers 3547 3548Mnemonic Condition Tested "Jump If..." 3549JG/JNLE ((SF xor OF) or ZF) = 0 greater/not less nor equal 3550JGE/JNL (SF xor OF) = 0 greater or equal/not less 3551JL/JNGE (SF xor OF) = 1 less/not greater nor equal 3552JLE/JNG ((SF xor OF) or ZF) = 1 less or equal/not greater 3553JNO OF = 0 not overflow 3554JNS SF = 0 not sign (positive, including 0) 3555JO OF = 1 overflow 3556JS SF = 1 sign (negative) 3557 3558 35593.5.2.2 Loop Instructions 3560 3561The loop instructions are conditional jumps that use a value placed in ECX 3562to specify the number of repetitions of a software loop. All loop 3563instructions automatically decrement ECX and terminate the loop when ECX=0. 3564Four of the five loop instructions specify a condition involving ZF that 3565terminates the loop before ECX reaches zero. 3566 3567LOOP (Loop While ECX Not Zero) is a conditional transfer that automatically 3568decrements the ECX register before testing ECX for the branch condition. If 3569ECX is non-zero, the program branches to the target label specified in the 3570instruction. The LOOP instruction causes the repetition of a code section 3571until the operation of the LOOP instruction decrements ECX to a value of 3572zero. If LOOP finds ECX=0, control transfers to the instruction immediately 3573following the LOOP instruction. If the value of ECX is initially zero, then 3574the LOOP executes 2^(32) times. 3575 3576LOOPE (Loop While Equal) and LOOPZ (Loop While Zero) are synonyms for the 3577same instruction. These instructions automatically decrement the ECX 3578register before testing ECX and ZF for the branch conditions. If ECX is 3579non-zero and ZF=1, the program branches to the target label specified in the 3580instruction. If LOOPE or LOOPZ finds that ECX=0 or ZF=0, control transfers 3581to the instruction immediately following the LOOPE or LOOPZ instruction. 3582 3583LOOPNE (Loop While Not Equal) and LOOPNZ (Loop While Not Zero) are synonyms 3584for the same instruction. These instructions automatically decrement the ECX 3585register before testing ECX and ZF for the branch conditions. If ECX is 3586non-zero and ZF=0, the program branches to the target label specified in the 3587instruction. If LOOPNE or LOOPNZ finds that ECX=0 or ZF=1, control transfers 3588to the instruction immediately following the LOOPNE or LOOPNZ instruction. 3589 3590 35913.5.2.3 Executing a Loop or Repeat Zero Times 3592 3593JCXZ (Jump if ECX Zero) branches to the label specified in the instruction 3594if it finds a value of zero in ECX. JCXZ is useful in combination with the 3595LOOP instruction and with the string scan and compare instructions, all of 3596which decrement ECX. Sometimes, it is desirable to design a loop that 3597executes zero times if the count variable in ECX is initialized to zero. 3598Because the LOOP instructions (and repeat prefixes) decrement ECX before 3599they test it, a loop will execute 2^(32) times if the program enters the 3600loop with a zero value in ECX. A programmer may conveniently overcome this 3601problem with JCXZ, which enables the program to branch around the code 3602within the loop if ECX is zero when JCXZ executes. When used with repeated 3603string scan and compare instructions, JCXZ can determine whether the 3604repetitions terminated due to zero in ECX or due to satisfaction of the 3605scan or compare conditions. 3606 3607 36083.5.3 Software-Generated Interrupts 3609 3610The INT n, INTO, and BOUND instructions allow the programmer to specify a 3611transfer to an interrupt service routine from within a program. 3612 3613INT n (Software Interrupt) activates the interrupt service routine that 3614corresponds to the number coded within the instruction. The INT instruction 3615may specify any interrupt type. Programmers may use this flexibility to 3616implement multiple types of internal interrupts or to test the operation of 3617interrupt service routines. (Interrupts 0-31 are reserved by Intel.) The 3618interrupt service routine terminates with an IRET instruction that returns 3619control to the instruction that follows INT. 3620 3621INTO (Interrupt on Overflow) invokes interrupt 4 if OF is set. Interrupt 4 3622is reserved for this purpose. OF is set by several arithmetic, logical, and 3623string instructions. 3624 3625BOUND (Detect Value Out of Range) verifies that the signed value contained 3626in the specified register lies within specified limits. An interrupt (INT 5) 3627occurs if the value contained in the register is less than the lower bound 3628or greater than the upper bound. 3629 3630The BOUND instruction includes two operands. The first operand specifies 3631the register being tested. The second operand contains the effective 3632relative address of the two signed BOUND limit values. The BOUND instruction 3633assumes that the upper limit and lower limit are in adjacent memory 3634locations. These limit values cannot be register operands; if they are, an 3635invalid opcode exception occurs. 3636 3637BOUND is useful for checking array bounds before using a new index value to 3638access an element within the array. BOUND provides a simple way to check the 3639value of an index register before the program overwrites information in a 3640location beyond the limit of the array. 3641 3642The block of memory that specifies the lower and upper limits of an array 3643might typically reside just before the array itself. This makes the array 3644bounds accessible at a constant offset from the beginning of the array. 3645Because the address of the array will already be present in a register, this 3646practice avoids extra calculations to obtain the effective address of the 3647array bounds. 3648 3649The upper and lower limit values may each be a word or a doubleword. 3650 3651 36523.6 String and Character Translation Instructions 3653 3654The instructions in this category operate on strings rather than on logical 3655or numeric values. Refer also to the section on I/O for information about 3656the string I/O instructions (also known as block I/O). 3657 3658The power of 80386 string operations derives from the following features of 3659the architecture: 3660 36611. A set of primitive string operations 3662 3663 MOVS Move String 3664 CMPS Compare string 3665 SCAS Scan string 3666 LODS Load string 3667 STOS Store string 3668 36692. Indirect, indexed addressing, with automatic incrementing or 3670 decrementing of the indexes. 3671 3672 Indexes: 3673 3674 ESI Source index register 3675 EDI Destination index register 3676 3677 Control flag: 3678 3679 DF Direction flag 3680 3681 Control flag instructions: 3682 3683 CLD Clear direction flag instruction 3684 STD Set direction flag instruction 3685 36863. Repeat prefixes 3687 3688 REP Repeat while ECX not xero 3689 REPE/REPZ Repeat while equal or zero 3690 REPNE/REPNZ Repeat while not equal or not zero 3691 3692The primitive string operations operate on one element of a string. A 3693string element may be a byte, a word, or a doubleword. The string elements 3694are addressed by the registers ESI and EDI. After every primitive operation 3695ESI and/or EDI are automatically updated to point to the next element of the 3696string. If the direction flag is zero, the index registers are incremented; 3697if one, they are decremented. The amount of the increment or decrement is 36981, 2, or 4 depending on the size of the string element. 3699 3700 37013.6.1 Repeat Prefixes 3702 3703The repeat prefixes REP (Repeat While ECX Not Zero), REPE/REPZ (Repeat 3704While Equal/Zero), and REPNE/REPNZ (Repeat While Not Equal/Not Zero) specify 3705repeated operation of a string primitive. This form of iteration allows the 3706CPU to process strings much faster than would be possible with a regular 3707software loop. 3708 3709When a primitive string operation has a repeat prefix, the operation is 3710executed repeatedly, each time using a different element of the string. The 3711repetition terminates when one of the conditions specified by the prefix is 3712satisfied. 3713 3714At each repetition of the primitive instruction, the string operation may 3715be suspended temporarily in order to handle an exception or external 3716interrupt. After the interruption, the string operation can be restarted 3717again where it left off. This method of handling strings allows operations 3718on strings of arbitrary length, without affecting interrupt response. 3719 3720All three prefixes causes the hardware to automatically repeat the 3721associated string primitive until ECX=0. The differences among the repeat 3722prefixes have to do with the second termination condition. REPE/REPZ and 3723REPNE/REPNZ are used exclusively with the SCAS (Scan String) and CMPS 3724(Compare String) primitives. When these prefixes are used, repetition of the 3725next instruction depends on the zero flag (ZF) as well as the ECX register. 3726ZF does not require initialization before execution of a repeated string 3727instruction, because both SCAS and CMPS set ZF according to the results of 3728the comparisons they make. The differences are summarized in the 3729accompanying table. 3730 3731Prefix Termination Termination 3732 Condition 1 Condition 2 3733 3734REP ECX = 0 (none) 3735REPE/REPZ ECX = 0 ZF = 0 3736REPNE/REPNZ ECX = 0 ZF = 1 3737 3738 37393.6.2 Indexing and Direction Flag Control 3740 3741The addresses of the operands of string primitives are determined by the 3742ESI and EDI registers. ESI points to source operands. By default, ESI refers 3743to a location in the segment indicated by the DS segment register. A 3744segment-override prefix may be used, however, to cause ESI to refer to CS, 3745SS, ES, FS, or GS. EDI points to destination operands in the segment 3746indicated by ES; no segment override is possible. The use of two different 3747segment registers in one instruction allows movement of strings between 3748different segments. 3749 3750This use of ESI and DSI has led to the descriptive names source index and 3751destination index for the ESI and EDI registers, respectively. In all 3752cases other than string instructions, however, the ESI and EDI registers may 3753be used as general-purpose registers. 3754 3755When ESI and EDI are used in string primitives, they are automatically 3756incremented or decremented after to operation. The direction flag determines 3757whether they are incremented or decremented. The instruction CLD puts zero 3758in DF, causing the index registers to be incremented; the instruction STD 3759puts one in DF, causing the index registers to be decremented. Programmers 3760should always put a known value in DF before using string instructions in a 3761procedure. 3762 3763 37643.6.3 String Instructions 3765 3766MOVS (Move String) moves the string element pointed to by ESI to the 3767location pointed to by EDI. MOVSB operates on byte elements, MOVSW operates 3768on word elements, and MOVSD operates on doublewords. The destination segment 3769register cannot be overridden by a segment override prefix, but the source 3770segment register can be overridden. 3771 3772The MOVS instruction, when accompanied by the REP prefix, operates as a 3773memory-to-memory block transfer. To set up for this operation, the program 3774must initialize ECX and the register pairs ESI and EDI. ECX specifies the 3775number of bytes, words, or doublewords in the block. 3776 3777If DF=0, the program must point ESI to the first element of the source 3778string and point EDI to the destination address for the first element. If 3779DF=1, the program must point these two registers to the last element of the 3780source string and to the destination address for the last element, 3781respectively. 3782 3783CMPS (Compare Strings) subtracts the destination string element (at ES:EDI) 3784from the source string element (at ESI) and updates the flags AF, SF, PF, CF 3785and OF. If the string elements are equal, ZF=1; otherwise, ZF=0. If DF=0, 3786the processor increments the memory pointers (ESI and EDI) for the two 3787strings. CMPSB compares bytes, CMPSW compares words, and CMPSD compares 3788doublewords. The segment register used for the source address can be changed 3789with a segment override prefix while the destination segment register 3790cannot be overridden. 3791 3792SCAS (Scan String) subtracts the destination string element at ES:EDI from 3793EAX, AX, or AL and updates the flags AF, SF, ZF, PF, CF and OF. If the 3794values are equal, ZF=1; otherwise, ZF=0. If DF=0, the processor increments 3795the memory pointer (EDI) for the string. SCASB scans bytes; SCASW scans 3796words; SCASD scans doublewords. The destination segment register (ES) cannot 3797be overridden. 3798 3799When either the REPE or REPNE prefix modifies either the SCAS or CMPS 3800primitives, the processor compares the value of the current string element 3801with the value in EAX for doubleword elements, in AX for word elements, or 3802in AL for byte elements. Termination of the repeated operation depends on 3803the resulting state of ZF as well as on the value in ECX. 3804 3805LODS (Load String) places the source string element at ESI into EAX for 3806doubleword strings, into AX for word strings, or into AL for byte strings. 3807LODS increments or decrements ESI according to DF. 3808 3809STOS (Store String) places the source string element from EAX, AX, or AL 3810into the string at ES:DSI. STOS increments or decrements EDI according to 3811DF. 3812 3813 38143.7 Instructions for Block-Structured Languages 3815 3816The instructions in this section provide machine-language support for 3817functions normally found in high-level languages. These instructions include 3818ENTER and LEAVE, which simplify the programming of procedures. 3819 3820ENTER (Enter Procedure) creates a stack frame that may be used to implement 3821the scope rules of block-structured high-level languages. A LEAVE 3822instruction at the end of a procedure complements an ENTER at the beginning 3823of the procedure to simplify stack management and to control access to 3824variables for nested procedures. 3825 3826The ENTER instruction includes two parameters. The first parameter 3827specifies the number of bytes of dynamic storage to be allocated on the 3828stack for the routine being entered. The second parameter corresponds to the 3829lexical nesting level (0-31) of the routine. (Note that the lexical level 3830has no relationship to either the protection privilege levels or to the I/O 3831privilege level.) 3832 3833The specified lexical level determines how many sets of stack frame 3834pointers the CPU copies into the new stack frame from the preceding frame. 3835This list of stack frame pointers is sometimes called the display. The first 3836word of the display is a pointer to the last stack frame. This pointer 3837enables a LEAVE instruction to reverse the action of the previous ENTER 3838instruction by effectively discarding the last stack frame. 3839 3840 Example: ENTER 2048,3 3841 3842 Allocates 2048 bytes of dynamic storage on the stack and sets up pointers 3843 to two previous stack frames in the stack frame that ENTER creates for 3844 this procedure. 3845 3846After ENTER creates the new display for a procedure, it allocates the 3847dynamic storage space for that procedure by decrementing ESP by the number 3848of bytes specified in the first parameter. This new value of ESP serves as a 3849starting point for all PUSH and POP operations within that procedure. 3850 3851To enable a procedure to address its display, ENTER leaves EBP pointing to 3852the beginning of the new stack frame. Data manipulation instructions that 3853specify EBP as a base register implicitly address locations within the stack 3854segment instead of the data segment. 3855 3856The ENTER instruction can be used in two ways: nested and non-nested. If 3857the lexical level is 0, the non-nested form is used. Since the second 3858operand is 0, ENTER pushes EBP, copies ESP to EBP and then subtracts the 3859first operand from ESP. The nested form of ENTER occurs when the second 3860parameter (lexical level) is not 0. 3861 3862Figure 3-16 gives the formal definition of ENTER. 3863 3864The main procedure (with other procedures nested within) operates at the 3865highest lexical level, level 1. The first procedure it calls operates at the 3866next deeper lexical level, level 2. A level 2 procedure can access the 3867variables of the main program which are at fixed locations specified by the 3868compiler. In the case of level 1, ENTER allocates only the requested 3869dynamic storage on the stack because there is no previous display to copy. 3870 3871A program operating at a higher lexical level calling a program at a lower 3872lexical level requires that the called procedure should have access to the 3873variables of the calling program. ENTER provides this access through a 3874display that provides addressability to the calling program's stack frame. 3875 3876A procedure calling another procedure at the same lexical level implies 3877that they are parallel procedures and that the called procedure should not 3878have access to the variables of the calling procedure. In this case, ENTER 3879copies only that portion of the display from the calling procedure which 3880refers to previously nested procedures operating at higher lexical levels. 3881The new stack frame does not include the pointer for addressing the calling 3882procedure's stack frame. 3883 3884ENTER treats a reentrant procedure as a procedure calling another procedure 3885at the same lexical level. In this case, each succeeding iteration of the 3886reentrant procedure can address only its own variables and the variables of 3887the calling procedures at higher lexical levels. A reentrant procedure can 3888always address its own variables; it does not require pointers to the stack 3889frames of previous iterations. 3890 3891By copying only the stack frame pointers of procedures at higher lexical 3892levels, ENTER makes sure that procedures access only those variables of 3893higher lexical levels, not those at parallel lexical levels (see Figure 38943-17). Figures 3-18 through 3-21 demonstrate the actions of the ENTER 3895instruction if the modules shown in Figure 3-17 were to call one another in 3896alphabetic order. 3897 3898Block-structured high-level languages can use the lexical levels defined by 3899ENTER to control access to the variables of previously nested procedures. 3900Referring to Figure 3-17 for example, if PROCEDURE A calls PROCEDURE B 3901which, in turn, calls PROCEDURE C, then PROCEDURE C will have access to the 3902variables of MAIN and PROCEDURE A, but not PROCEDURE B because they operate 3903at the same lexical level. Following is the complete definition of access to 3904variables for Figure 3-17. 3905 3906 1. MAIN PROGRAM has variables at fixed locations. 3907 3908 2. PROCEDURE A can access only the fixed variables of MAIN. 3909 3910 3. PROCEDURE B can access only the variables of PROCEDURE A and MAIN. 3911 PROCEDURE B cannot access the variables of PROCEDURE C or PROCEDURE D. 3912 3913 4. PROCEDURE C can access only the variables of PROCEDURE A and MAIN. 3914 PROCEDURE C cannot access the variables of PROCEDURE B or PROCEDURE D. 3915 3916 5. PROCEDURE D can access the variables of PROCEDURE C, PROCEDURE A, and 3917 MAIN. PROCEDURE D cannot access the variables of PROCEDURE B. 3918 3919ENTER at the beginning of the MAIN PROGRAM creates dynamic storage space 3920for MAIN but copies no pointers. The first and only word in the display 3921points to itself because there is no previous value for LEAVE to return to 3922EBP. See Figure 3-18. 3923 3924After MAIN calls PROCEDURE A, ENTER creates a new display for PROCEDURE A 3925with the first word pointing to the previous value of EBP (BPM for LEAVE to 3926return to the MAIN stack frame) and the second word pointing to the current 3927value of EBP. Procedure A can access variables in MAIN since MAIN is at 3928level 1. Therefore the base for the dynamic storage for MAIN is at [EBP-2]. 3929All dynamic variables for MAIN are at a fixed offset from this value. See 3930Figure 3-19. 3931 3932After PROCEDURE A calls PROCEDURE B, ENTER creates a new display for 3933PROCEDURE B with the first word pointing to the previous value of EBP, the 3934second word pointing to the value of EBP for MAIN, and the third word 3935pointing to the value of EBP for A and the last word pointing to the current 3936EBP. B can access variables in A and MAIN by fetching from the display the 3937base addresses of the respective dynamic storage areas. See Figure 3-20. 3938 3939After PROCEDURE B calls PROCEDURE C, ENTER creates a new display for 3940PROCEDURE C with the first word pointing to the previous value of EBP, the 3941second word pointing to the value of EBP for MAIN, and the third word 3942pointing to the EBP value for A and the third word pointing to the current 3943value of EBP. Because PROCEDURE B and PROCEDURE C have the same lexical 3944level, PROCEDURE C is not allowed access to variables in B and therefore 3945does not receive a pointer to the beginning of PROCEDURE B's stack frame. 3946See Figure 3-21. 3947 3948LEAVE (Leave Procedure) reverses the action of the previous ENTER 3949instruction. The LEAVE instruction does not include any operands. LEAVE 3950copies EBP to ESP to release all stack space allocated to the procedure by 3951the most recent ENTER instruction. Then LEAVE pops the old value of EBP from 3952the stack. A subsequent RET instruction can then remove any arguments that 3953were pushed on the stack by the calling program for use by the called 3954procedure. 3955 3956 3957Figure 3-16. Formal Definition of the ENTER Instruction 3958 3959The formal definition of the ENTER instruction for all cases is given by the 3960following listing. LEVEL denotes the value of the second operand. 3961 3962Push EBP 3963Set a temporary value FRAME_PTR := ESP 3964If LEVEL > 0 then 3965 Repeat (LEVEL-1) times: 3966 EBP :=EBP - 4 3967 Push the doubleword pointed to by EBP 3968 End repeat 3969 Push FRAME_PTR 3970End if 3971EBP := FRAME_PTR 3972ESP := ESP - first operand. 3973 3974 3975Figure 3-17. Variable Access in Nested Procedures 3976 3977 ͻ 3978 MAIN PROCEDURE (LEXICAL LEVEL 1) 3979 ͻ 3980 PROCEDURE A (LEXICAL LEVEL 2) 3981 ͻ 3982 PROCEDURE B (LEXICAL LEVEL 3) 3983 ͼ 3984 3985 ͻ 3986 PROCEDURE C (LEXICAL LEVEL 3) 3987 ͻ 3988 PROCEDURE D (LEXICAL LEVEL 4) 3989 ͼ 3990 3991 ͼ 3992 3993 ͼ 3994 3995 ͼ 3996 3997 3998Figure 3-18. Stack Frame for MAIN at Level 1 3999 4000 31 0 4001 D O 4002 I F 4003 R OLD ESP 4004 E E DISPLAY Ĵ EBP FOR 4005 C X EBPM 4006EBPM = EBP VALUE FOR MAIN MAIN 4007 T P 4008 I A 4009 O N 4010 N S DYNAMIC Ĵ 4011 I STORAGE 4012 O 4013 N ESP 4014 4015 4016 4017 4018Figure 3-19. Stack Frame for Procedure A 4019 4020 31 0 4021 D O 4022 I F 4023 R OLD ESP 4024 E E 4025 C X EBPM 4026EBPM = EBP VALUE FOR MAIN 4027 T P 4028 I A 4029 O N 4030 N S 4031 I 4032 O 4033 N 4034 EBPM 4035 EBP FOR A 4036 DISPLAY Ĵ EBPM 4037 4038 EBPA 4039EBPA = EBP VALUE FOR PROCEDURE A 4040 4041 4042 4043 DYNAMIC Ĵ 4044 STORAGE 4045 4046 ESP 4047 4048 4049 4050 4051Figure 3-20. Stack Frame for Procedure B at Level 3 Called from A 4052 4053 31 0 4054 D O 4055 I F 4056 R OLD ESP 4057 E E 4058 C X EBPM 4059EBPM = EBP VALUE FOR MAIN 4060 T P 4061 I A 4062 O N 4063 N S 4064 I 4065 O 4066 N 4067 EBPM 4068 4069 EBPM 4070 4071 EBPA 4072 4073 4074 4075 4076 4077 4078 4079 EBPA 4080 EBP 4081 EBPM 4082 DISPLAY Ĵ 4083 EBPA 4084 4085 EBPB 4086EBPB = EBP VALUE FOR PROCEDURE B 4087 4088 4089 4090 DYNAMIC Ĵ 4091 STORAGE 4092 4093 ESP 4094 4095 4096 4097 4098Figure 3-21. Stack Frame for Procedure C at Level 3 Called from B 4099 4100 31 0 4101 D O 4102 I F 4103 R OLD ESP 4104 E E 4105 C X EBPM 4106EBPM = EBP VALUE FOR MAIN 4107 T P 4108 I A 4109 O N 4110 N S 4111 I 4112 O 4113 N 4114 EBPM 4115 4116 EBPM 4117 4118 EBPA 4119EBPA = EBP VALUE FOR PROCEDURE A 4120 4121 4122 4123 4124 4125 4126 4127 EBPA 4128 EBP 4129 EBPM 4130 DISPLAY Ĵ 4131 EBPA 4132 4133 EBPB 4134EBPB = EBP VALUE FOR PROCEDURE B 4135 4136 4137 4138 DYNAMIC Ĵ 4139 STORAGE 4140 4141 ESP 4142 4143 4144 4145 41463.8 Flag Control Instructions 4147 4148The flag control instructions provide a method for directly changing the 4149state of bits in the flag register. 4150 4151 41523.8.1 Carry and Direction Flag Control Instructions 4153 4154The carry flag instructions are useful in conjunction with 4155rotate-with-carry instructions RCL and RCR. They can initialize the carry 4156flag, CF, to a known state before execution of a rotate that moves the carry 4157bit into one end of the rotated operand. 4158 4159The direction flag control instructions are specifically included to set or 4160clear the direction flag, DF, which controls the left-to-right or 4161right-to-left direction of string processing. If DF=0, the processor 4162automatically increments the string index registers, ESI and EDI, after each 4163execution of a string primitive. If DF=1, the processor decrements these 4164index registers. Programmers should use one of these instructions before any 4165procedure that uses string instructions to insure that DF is set properly. 4166 4167Flag Control Instruction Effect 4168 4169STC (Set Carry Flag) CF 1 4170CLC (Clear Carry Flag) CF 0 4171CMC (Complement Carry Flag) CF NOT (CF) 4172CLD (Clear Direction Flag) DF 0 4173STD (Set Direction Flag) DF 1 4174 4175 41763.8.2 Flag Transfer Instructions 4177 4178Though specific instructions exist to alter CF and DF, there is no direct 4179method of altering the other applications-oriented flags. The flag transfer 4180instructions allow a program to alter the other flag bits with the bit 4181manipulation instructions after transferring these flags to the stack or the 4182AH register. 4183 4184The instructions LAHF and SAHF deal with five of the status flags, which 4185are used primarily by the arithmetic and logical instructions. 4186 4187LAHF (Load AH from Flags) copies SF, ZF, AF, PF, and CF to AH bits 7, 6, 4, 41882, and 0, respectively (see Figure 3-22). The contents of the remaining bits 4189(5, 3, and 1) are undefined. The flags remain unaffected. 4190 4191SAHF (Store AH into Flags) transfers bits 7, 6, 4, 2, and 0 from AH into 4192SF, ZF, AF, PF, and CF, respectively (see Figure 3-22). 4193 4194The PUSHF and POPF instructions are not only useful for storing the flags 4195in memory where they can be examined and modified but are also useful for 4196preserving the state of the flags register while executing a procedure. 4197 4198PUSHF (Push Flags) decrements ESP by two and then transfers the low-order 4199word of the flags register to the word at the top of stack pointed to by ESP 4200(see Figure 3-23). The variant PUSHFD decrements ESP by four, then 4201transfers both words of the extended flags register to the top of the stack 4202pointed to by ESP (the VM and RF flags are not moved, however). 4203 4204POPF (Pop Flags) transfers specific bits from the word at the top of stack 4205into the low-order byte of the flag register (see Figure 3-23), then 4206increments ESP by two. The variant POPFD transfers specific bits from the 4207doubleword at the top of the stack into the extended flags register (the RF 4208and VM flags are not changed, however), then increments ESP by four. 4209 4210 4211Figure 3-22. LAHF and SAHF 4212 4213 7 6 5 4 3 2 1 0 4214 ͻ 4215 SF ZF UU AF UU PF UU CF 4216 ͼ 4217 4218 LAHF LOADS FIVE FLAGS FROM THE FLAG REGISTER INTO REGISTER AH. SAHF 4219 STORES THESE SAME FIVE FLAGS FROM AH INTO THE FLAG REGISTER. THE BIT 4220 POSITION OF EACH FLAG IS THE SAME IN AH AS IT IS IN THE FLAG REGISTER. 4221 THE REMAINING BITS (MARKED UU) ARE RESERVED; DO NOT DEFINE. 4222 4223 42243.9 Coprocessor Interface Instructions 4225 4226A numerics coprocessor (e.g., the 80387 or 80287) provides an extension to 4227the instruction set of the base architecture. The coprocessor extends the 4228instruction set of the base architecture to support high-precision integer 4229and floating-point calculations. This extended instruction set includes 4230arithmetic, comparison, transcendental, and data transfer instructions. The 4231coprocessor also contains a set of useful constants to enhance the speed of 4232numeric calculations. 4233 4234A program contains instructions for the coprocessor in line with the 4235instructions for the CPU. The system executes these instructions in the same 4236order as they appear in the instruction stream. The coprocessor operates 4237concurrently with the CPU to provide maximum throughput for numeric 4238calculations. 4239 4240The 80386 also has features to support emulation of the numerics 4241coprocessor when the coprocessor is absent. The software emulation of the 4242coprocessor is transparent to application software but requires more time 4243for execution. Refer to Chapter 11 for more information on coprocessor 4244emulation. 4245 4246ESC (Escape) is a 5-bit sequence that begins the opcodes that identify 4247floating point numeric instructions. The ESC pattern tells the 80386 to send 4248the opcode and addresses of operands to the numerics coprocessor. The 4249numerics coprocessor uses the escape instructions to perform 4250high-performance, high-precision floating point arithmetic that conforms to 4251the IEEE floating point standard 754. 4252 4253WAIT (Wait) is an 80386 instruction that suspends program execution until 4254the 80386 CPU detects that the BUSY pin is inactive. This condition 4255indicates that the coprocessor has completed its processing task and that 4256the CPU may obtain the results. 4257 4258 4259Figure 3-23. Flag Format for PUSHF and POPF 4260 4261 PUSHFD/POPFD 4262 Ŀ 4263 PUSHF/POPF 4264 Ŀ 4265 31 23 15 7 0 4266 ͻ 4267 VR NID ODITSZ A P C 4268 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 4269 MF T PLFFFFFF F F F 4270 ͼ 4271 4272 BITS MARKED 0 AND 1 ARE RESERVED BY INTEL. DO NOT DEFINE. 4273 4274 SYSTEMS FLAGS (INCLUDING THE IOPL FIELD, AND THE VM, RF, AND IF FLAGS) 4275 ARE PUSHED AND ARE VISIBLE TO APPLICATIONS PROGRAMS. HOWEVER, WHEN AN 4276 APPLICATIONS PROGRAM POPS THE FLAGS, THESE ITEMS ARE NOT CHANGED, 4277 REGARDLESS OF THE VALUES POPPED INTO THEM. 4278 4279 42803.10 Segment Register Instructions 4281 4282This category actually includes several distinct types of instructions. 4283These various types are grouped together here because, if systems designers 4284choose an unsegmented model of memory organization, none of these 4285instructions is used by applications programmers. The instructions that deal 4286with segment registers are: 4287 42881. Segment-register transfer instructions. 4289 4290 MOV SegReg, ... 4291 MOV ..., SegReg 4292 PUSH SegReg 4293 POP SegReg 4294 42952. Control transfers to another executable segment. 4296 4297 JMP far ; direct and indirect 4298 CALL far 4299 RET far 4300 43013. Data pointer instructions. 4302 4303 LDS 4304 LES 4305 LFS 4306 LGS 4307 LSS 4308 4309Note that the following interrupt-related instructions are different; all 4310are capable of transferring control to another segment, but the use of 4311segmentation is not apparent to the applications programmer. 4312 4313INT n 4314INTO 4315BOUND 4316IRET 4317 4318 43193.10.1 Segment-Register Transfer Instructions 4320 4321The MOV, POP, and PUSH instructions also serve to load and store segment 4322registers. These variants operate similarly to their general-register 4323counterparts except that one operand can be a segment register. MOV cannot 4324move segment register to a segment register. Neither POP nor MOV can place a 4325value in the code-segment register CS; only the far control-transfer 4326instructions can change CS. 4327 4328 43293.10.2 Far Control Transfer Instructions 4330 4331The far control-transfer instructions transfer control to a location in 4332another segment by changing the content of the CS register. 4333 4334Direct far JMP. Direct JMP instructions that specify a target location 4335outside the current code segment contain a far pointer. This pointer 4336consists of a selector for the new code segment and an offset within the new 4337segment. 4338 4339Indirect far JMP. Indirect JMP instructions that specify a target location 4340outside the current code segment use a 48-bit variable to specify the far 4341pointer. 4342 4343Far CALL. An intersegment CALL places both the value of EIP and CS on the 4344stack. 4345 4346Far RET. An intersegment RET restores the values of both CS and EIP which 4347were saved on the stack by the previous intersegment CALL instruction. 4348 4349 43503.10.3 Data Pointer Instructions 4351 4352The data pointer instructions load a pointer (consisting of a segment 4353selector and an offset) to a segment register and a general register. 4354 4355LDS (Load Pointer Using DS) transfers a pointer variable from the source 4356operand to DS and the destination register. The source operand must be a 4357memory operand, and the destination operand must be a general register. DS 4358receives the segment-selector of the pointer. The destination register 4359receives the offset part of the pointer, which points to a specific location 4360within the segment. 4361 4362Example: LDS ESI, STRING_X 4363 4364Loads DS with the selector identifying the segment pointed to by a 4365STRING_X, and loads the offset of STRING_X into ESI. Specifying ESI as the 4366destination operand is a convenient way to prepare for a string operation on 4367a source string that is not in the current data segment. 4368 4369LES (Load Pointer Using ES) operates identically to LDS except that ES 4370receives the segment selector rather than DS. 4371 4372Example: LES EDI, DESTINATION_X 4373 4374Loads ES with the selector identifying the segment pointed to by 4375DESTINATION_X, and loads the offset of DESTINATION_X into EDI. This 4376instruction provides a convenient way to select a destination for a string 4377operation if the desired location is not in the current extra segment. 4378 4379LFS (Load Pointer Using FS) operates identically to LDS except that FS 4380receives the segment selector rather than DS. 4381 4382LGS (Load Pointer Using GS) operates identically to LDS except that GS 4383receives the segment selector rather than DS. 4384 4385LSS (Load Pointer Using SS) operates identically to LDS except that SS 4386receives the segment selector rather than DS. This instruction is 4387especially important, because it allows the two registers that identify the 4388stack (SS:ESP) to be changed in one uninterruptible operation. Unlike the 4389other instructions which load SS, interrupts are not inhibited at the end 4390of the LSS instruction. The other instructions (e.g., POP SS) inhibit 4391interrupts to permit the following instruction to load ESP, thereby forming 4392an indivisible load of SS:ESP. Since both SS and ESP can be loaded by LSS, 4393there is no need to inhibit interrupts. 4394 4395 43963.11 Miscellaneous Instructions 4397 4398The following instructions do not fit in any of the previous categories, 4399but are nonetheless useful. 4400 4401 44023.11.1 Address Calculation Instruction 4403 4404LEA (Load Effective Address) transfers the offset of the source operand 4405(rather than its value) to the destination operand. The source operand must 4406be a memory operand, and the destination operand must be a general register. 4407This instruction is especially useful for initializing registers before the 4408execution of the string primitives (ESI, EDI) or the XLAT instruction (EBX). 4409The LEA can perform any indexing or scaling that may be needed. 4410 4411Example: LEA EBX, EBCDIC_TABLE 4412 4413Causes the processor to place the address of the starting location of the 4414table labeled EBCDIC_TABLE into EBX. 4415 4416 44173.11.2 No-Operation Instruction 4418 4419NOP (No Operation) occupies a byte of storage but affects nothing but the 4420instruction pointer, EIP. 4421 4422 44233.11.3 Translate Instruction 4424 4425XLAT (Translate) replaced a byte in the AL register with a byte from a 4426user-coded translation table. When XLAT is executed, AL should have the 4427unsigned index to the table addressed by EBX. XLAT changes the contents of 4428AL from table index to table entry. EBX is unchanged. The XLAT instruction 4429is useful for translating from one coding system to another such as from 4430ASCII to EBCDIC. The translate table may be up to 256 bytes long. The 4431value placed in the AL register serves as an index to the location of the 4432corresponding translation value. 4433 4434 4435 PART II SYSTEMS PROGRAMMING 4436 4437 4438Chapter 4 Systems Architecture 4439 4440 4441 4442Many of the architectural features of the 80386 are used only by systems 4443programmers. This chapter presents an overview of these aspects of the 4444architecture. 4445 4446The systems-level features of the 80386 architecture include: 4447 4448 Memory Management 4449 Protection 4450 Multitasking 4451 Input/Output 4452 Exceptions and Interrupts 4453 Initialization 4454 Coprocessing and Multiprocessing 4455 Debugging 4456 4457These features are implemented by registers and instructions, all of which 4458are introduced in the following sections. The purpose of this chapter is not 4459to explain each feature in detail, but rather to place the remaining 4460chapters of Part II in perspective. Each mention in this chapter of a 4461register or instruction is either accompanied by an explanation or a 4462reference to a following chapter where detailed information can be obtained. 4463 4464 44654.1 Systems Registers 4466 4467The registers designed for use by systems programmers fall into these 4468classes: 4469 4470 EFLAGS 4471 Memory-Management Registers 4472 Control Registers 4473 Debug Registers 4474 Test Registers 4475 4476 44774.1.1 Systems Flags 4478 4479The systems flags of the EFLAGS register control I/O, maskable interrupts, 4480debugging, task switching, and enabling of virtual 8086 execution in a 4481protected, multitasking environment. These flags are highlighted in Figure 44824-1. 4483 4484IF (Interrupt-Enable Flag, bit 9) 4485 4486 Setting IF allows the CPU to recognize external (maskable) interrupt 4487 requests. Clearing IF disables these interrupts. IF has no effect on 4488 either exceptions or nonmaskable external interrupts. Refer to Chapter 4489 9 for more details about interrupts. 4490 4491NT (Nested Task, bit 14) 4492 4493 The processor uses the nested task flag to control chaining of 4494 interrupted and called tasks. NT influences the operation of the IRET 4495 instruction. Refer to Chapter 7 and Chapter 9 for more information on 4496 nested tasks. 4497 4498RF (Resume Flag, bit 16) 4499 4500 The RF flag temporarily disables debug exceptions so that an instruction 4501 can be restarted after a debug exception without immediately causing 4502 another debug exception. Refer to Chapter 12 for details. 4503 4504TF (Trap Flag, bit 8) 4505 4506 Setting TF puts the processor into single-step mode for debugging. In 4507 this mode, the CPU automatically generates an exception after each 4508 instruction, allowing a program to be inspected as it executes each 4509 instruction. Single-stepping is just one of several debugging features of 4510 the 80386. Refer to Chapter 12 for additional information. 4511 4512VM (Virtual 8086 Mode, bit 17) 4513 4514 When set, the VM flag indicates that the task is executing an 8086 4515 program. Refer to Chapter 14 for a detailed discussion of how the 80386 4516 executes 8086 tasks in a protected, multitasking environment. 4517 4518 4519Figure 4-1. System Flags of EFLAGS Register 4520 4521 31 23 15 7 0 4522 ͻ 4523 VRNID ODITSZAPC 4524 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001 4525 MFT PLFFFFFFFFF 4526 ͼ 4527 4528 VIRTUAL 8086 MODE 4529 RESUME FLAG 4530 NESTED TASK FLAG 4531 I/O PRIVILEGE LEVEL 4532 INTERRUPT ENABLE 4533 4534 4535NOTE 4536 0 OR 1 INDICATES INTEL RESERVED. DO NOT DEFINE. 4537 4538 4539 45404.1.2 Memory-Management Registers 4541 4542Four registers of the 80386 locate the data structures that control 4543segmented memory management: 4544 4545GDTR Global Descriptor Table Register 4546LDTR Local Descriptor Table Register 4547 4548 These registers point to the segment descriptor tables GDT and LDT. 4549 Refer to Chapter 5 for an explanation of addressing via descriptor 4550 tables. 4551 4552IDTR Interrupt Descriptor Table Register 4553 4554 This register points to a table of entry points for interrupt handlers 4555 (the IDT). Refer to Chapter 9 for details of the interrupt mechanism. 4556 4557TR Task Register 4558 4559 This register points to the information needed by the processor to define 4560 the current task. Refer to Chapter 7 for a description of the 4561 multitasking features of the 80386. 4562 4563 45644.1.3 Control Registers 4565 4566Figure 4-2 shows the format of the 80386 control registers CR0, CR2, and 4567CR3. These registers are accessible to systems programmers only via variants 4568of the MOV instruction, which allow them to be loaded from or stored in 4569general registers; for example: 4570 4571MOV EAX, CR0 4572MOV CR3, EBX 4573 4574CR0 contains system control flags, which control or indicate conditions 4575that apply to the system as a whole, not to an individual task. 4576 4577EM (Emulation, bit 2) 4578 4579 EM indicates whether coprocessor functions are to be emulated. Refer to 4580 Chapter 11 for details. 4581 4582ET (Extension Type, bit 4) 4583 4584 ET indicates the type of coprocessor present in the system (80287 or 4585 80387). Refer to Chapter 11 and Chapter 10 for details. 4586 4587MP (Math Present, bit 1) 4588 4589 MP controls the function of the WAIT instruction, which is used to 4590 coordinate a coprocessor. Refer to Chapter 11 for details. 4591 4592PE (Protection Enable, bit 0) 4593 4594 Setting PE causes the processor to begin executing in protected mode. 4595 Resetting PE returns to real-address mode. Refer to Chapter 14 and 4596 Chapter 10 for more information on changing processor modes. 4597 4598PG (Paging, bit 31) 4599 4600 PG indicates whether the processor uses page tables to translate linear 4601 addresses into physical addresses. Refer to Chapter 5 for a description 4602 of page translation; refer to Chapter 10 for a discussion of how to set 4603 PG. 4604 4605TS (Task Switched, bit 3) 4606 4607 The processor sets TS with every task switch and tests TS when 4608 interpreting coprocessor instructions. Refer to Chapter 11 for details. 4609 4610CR2 is used for handling page faults when PG is set. The processor stores 4611in CR2 the linear address that triggers the fault. Refer to Chapter 9 for a 4612description of page-fault handling. 4613 4614CR3 is used when PG is set. CR3 enables the processor to locate the page 4615table directory for the current task. Refer to Chapter 5 for a description 4616of page tables and page translation. 4617 4618 4619Figure 4-2. Control Registers 4620 4621 31 23 15 7 0 4622ͻ 4623 4624 PAGE DIRECTORY BASE REGISTER (PDBR) RESERVED CR3 4625Ķ 4626 4627 PAGE FAULT LINEAR ADDRESS CR2 4628Ķ 4629 4630 RESERVED CR1 4631Ķ 4632P ETEMP 4633G RESERVED TSMPECR0 4634ͼ 4635 4636 46374.1.4 Debug Register 4638 4639The debug registers bring advanced debugging abilities to the 80386, 4640including data breakpoints and the ability to set instruction breakpoints 4641without modifying code segments. Refer to Chapter 12 for a complete 4642description of formats and usage. 4643 4644 46454.1.5 Test Registers 4646 4647The test registers are not a standard part of the 80386 architecture. They 4648are provided solely to enable confidence testing of the translation 4649lookaside buffer (TLB), the cache used for storing information from page 4650tables. Chapter 12 explains how to use these registers. 4651 4652 46534.2 Systems Instructions 4654 4655Systems instructions deal with such functions as: 4656 4657 1. Verification of pointer parameters (refer to Chapter 6): 4658 4659 ARPL Adjust RPL 4660 LAR Load Access Rights 4661 LSL Load Segment Limit 4662 VERR Verify for Reading 4663 VERW Verify for Writing 4664 4665 2. Addressing descriptor tables (refer to Chaper 5): 4666 4667 LLDT Load LDT Register 4668 SLDT Store LDT Register 4669 LGDT Load GDT Register 4670 SGDT Store GDT Register 4671 4672 3. Multitasking (refer to Chapter 7): 4673 4674 LTR Load Task Register 4675 STR Store Task Register 4676 4677 4. Coprocessing and Multiprocessing (refer to Chapter 11): 4678 4679 CLTS Clear Task-Switched Flag 4680 ESC Escape instructions 4681 WAIT Wait until Coprocessor not Busy 4682 LOCK Assert Bus-Lock Signal 4683 4684 5. Input and Output (refer to Chapter 8): 4685 4686 IN Input 4687 OUT Output 4688 INS Input String 4689 OUTS Output String 4690 4691 6. Interrupt control (refer to Chapter 9): 4692 4693 CLI Clear Interrupt-Enable Flag 4694 STI Set Interrupt-Enable Flag 4695 LIDT Load IDT Register 4696 SIDT Store IDT Register 4697 4698 7. Debugging (refer to Chapter 12): 4699 4700 MOV Move to and from debug registers 4701 4702 8. TLB testing (refer to Chapter 10): 4703 4704 MOV Move to and from test registers 4705 4706 9. System Control: 4707 4708 SMSW Set MSW 4709 LMSW Load MSW 4710 HLT Halt Processor 4711 MOV Move to and from control registers 4712 4713The instructions SMSW and LMSW are provided for compatibility with the 471480286 processor. 80386 programs access the MSW in CR0 via variants of the 4715MOV instruction. HLT stops the processor until receipt of an INTR or RESET 4716signal. 4717 4718In addition to the chapters cited above, detailed information about each of 4719these instructions can be found in the instruction reference chapter, 4720Chapter 17. 4721 4722 4723Chapter 5 Memory Management 4724 4725 4726 4727The 80386 transforms logical addresses (i.e., addresses as viewed by 4728programmers) into physical address (i.e., actual addresses in physical 4729memory) in two steps: 4730 4731 Segment translation, in which a logical address (consisting of a 4732 segment selector and segment offset) are converted to a linear address. 4733 4734 Page translation, in which a linear address is converted to a physical 4735 address. This step is optional, at the discretion of systems-software 4736 designers. 4737 4738These translations are performed in a way that is not visible to 4739applications programmers. Figure 5-1 illustrates the two translations at a 4740high level of abstraction. 4741 4742Figure 5-1 and the remainder of this chapter present a simplified view of 4743the 80386 addressing mechanism. In reality, the addressing mechanism also 4744includes memory protection features. For the sake of simplicity, however, 4745the subject of protection is taken up in another chapter, Chapter 6. 4746 4747 4748Figure 5-1. Address Translation Overview 4749 4750 15 0 31 0 4751 LOGICAL ͻ ͻ 4752 ADDRESS SELECTOR OFFSET 4753 ͼ ͼ 4754 4755 ͻ 4756 SEGMENT TRANSLATION 4757 ͼ 4758 ͻ PAGING ENABLED 4759 PG ?Ŀ 4760 ͼ 4761 31 PAGING DISABLED 0 4762 LINEAR ͻ 4763 ADDRESS DIR PAGE OFFSET 4764 ͼ 4765 4766 ͻ 4767 PAGE TRANSLATION 4768 ͼ 4769 4770 31 0 4771 PHYSICAL ͻ 4772 ADDRESS 4773 ͼ 4774 4775 47765.1 Segment Translation 4777 4778Figure 5-2 shows in more detail how the processor converts a logical 4779address into a linear address. 4780 4781To perform this translation, the processor uses the following data 4782structures: 4783 4784 Descriptors 4785 Descriptor tables 4786 Selectors 4787 Segment Registers 4788 4789 47905.1.1 Descriptors 4791 4792The segment descriptor provides the processor with the data it needs to map 4793a logical address into a linear address. Descriptors are created by 4794compilers, linkers, loaders, or the operating system, not by applications 4795programmers. Figure 5-3 illustrates the two general descriptor formats. All 4796types of segment descriptors take one of these formats. Segment-descriptor 4797fields are: 4798 4799BASE: Defines the location of the segment within the 4 gigabyte linear 4800address space. The processor concatenates the three fragments of the base 4801address to form a single 32-bit value. 4802 4803LIMIT: Defines the size of the segment. When the processor concatenates the 4804two parts of the limit field, a 20-bit value results. The processor 4805interprets the limit field in one of two ways, depending on the setting of 4806the granularity bit: 4807 4808 1. In units of one byte, to define a limit of up to 1 megabyte. 4809 4810 2. In units of 4 Kilobytes, to define a limit of up to 4 gigabytes. The 4811 limit is shifted left by 12 bits when loaded, and low-order one-bits 4812 are inserted. 4813 4814Granularity bit: Specifies the units with which the LIMIT field is 4815interpreted. When thebit is clear, the limit is interpreted in units of one 4816byte; when set, the limit is interpreted in units of 4 Kilobytes. 4817 4818TYPE: Distinguishes between various kinds of descriptors. 4819 4820DPL (Descriptor Privilege Level): Used by the protection mechanism (refer 4821to Chapter 6). 4822 4823Segment-Present bit: If this bit is zero, the descriptor is not valid for 4824use in address transformation; the processor will signal an exception when a 4825selector for the descriptor is loaded into a segment register. Figure 5-4 4826shows the format of a descriptor when the present-bit is zero. The operating 4827system is free to use the locations marked AVAILABLE. Operating systems that 4828implement segment-based virtual memory clear the present bit in either of 4829these cases: 4830 4831 When the linear space spanned by the segment is not mapped by the 4832 paging mechanism. 4833 4834 When the segment is not present in memory. 4835 4836Accessed bit: The processor sets this bit when the segment is accessed; 4837i.e., a selector for the descriptor is loaded into a segment register or 4838used by a selector test instruction. Operating systems that implement 4839virtual memory at the segment level may, by periodically testing and 4840clearing this bit, monitor frequency of segment usage. 4841 4842Creation and maintenance of descriptors is the responsibility of systems 4843software, usually requiring the cooperation of compilers, program loaders or 4844system builders, and therating system. 4845 4846 4847Figure 5-2. Segment Translation 4848 4849 15 0 31 0 4850 LOGICAL ͻ ͻ 4851 ADDRESS SELECTOR OFFSET 4852 ͼ ͼ 4853 4854 DESCRIPTOR TABLE 4855 ͻ 4856 4857 4858 4859 4860 4861 SEGMENT BASE ͻ 4862 DESCRIPTOR + 4863 ADDRESS ͼ 4864 4865 ͼ 4866 4867 LINEAR ͻ 4868 ADDRESS DIR PAGE OFFSET 4869 ͼ 4870 4871 4872Figure 5-3. General Segment-Descriptor Format 4873 4874 DESCRIPTORS USED FOR APPLICATIONS CODE AND DATA SEGMENTS 4875 4876 31 23 15 7 0 4877 ͻ 4878 A 4879 BASE 31..24 GXOV LIMIT P DPL 1 TYPEA BASE 23..16 4 4880 L 19..16 4881 Ķ 4882 4883 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 4884 4885 ͼ 4886 4887 DESCRIPTORS USED FOR SPECIAL SYSTEM SEGMENTS 4888 4889 31 23 15 7 0 4890 ͻ 4891 A 4892 BASE 31..24 GXOV LIMIT P DPL 0 TYPE BASE 23..16 4 4893 L 19..16 4894 Ķ 4895 4896 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 4897 4898 ͼ 4899 4900 A - ACCESSED 4901 AVL - AVAILABLE FOR USE BY SYSTEMS PROGRAMMERS 4902 DPL - DESCRIPTOR PRIVILEGE LEVEL 4903 G - GRANULARITY 4904 P - SEGMENT PRESENT 4905 4906 49075.1.2 Descriptor Tables 4908 4909Segment descriptors are stored in either of two kinds of descriptor table: 4910 4911 The global descriptor table (GDT) 4912 A local descriptor table (LDT) 4913 4914A descriptor table is simply a memory array of 8-byte entries that contain 4915descriptors, as Figure 5-5 shows. A descriptor table is variable in length 4916and may contain up to 8192 (2^(13)) descriptors. The first entry of the GDT 4917(INDEX=0) is not used by the processor, however. 4918 4919The processor locates the GDT and the current LDT in memory by means of the 4920GDTR and LDTR registers. These registers store the base addresses of the 4921tables in the linear address space and store the segment limits. The 4922instructions LGDT and SGDT give access to the GDTR; the instructions LLDT 4923and SLDT give access to the LDTR. 4924 4925 4926Figure 5-4. Format of Not-Present Descriptor 4927 4928 31 23 15 7 0 4929 ͻ 4930 4931 AVAILABLE O DPL S TYPE AVAILABLE 4 4932 4933 Ķ 4934 4935 AVAILABLE 0 4936 4937 ͼ 4938 4939 4940Figure 5-5. Descriptor Tables 4941 4942 GLOBAL DESCRIPTOR TABLE LOCAL DESCRIPTOR TABLE 4943 ͻ ͻ 4944 4945 Ķ Ķ 4946 M M 4947 ͼ ͼ 4948 | | | | 4949 | | | | 4950 ͻ ͻ 4951 4952 Ķ Ķ 4953 N + 3 N + 3 4954 4955 4956 Ķ Ķ 4957 N + 2 N + 2 4958 4959 4960 Ķ Ķ 4961 N + 1 N + 1 4962 4963 4964 Ķ Ķ 4965 N N 4966 ͼ ͼ 4967 | | | | 4968 | | | | 4969 ͻ ͻ 4970 4971 (UNUSED)Ķ Ķ 4972 4973 ͼ ͼ 4974 4975 ͻ ͻ 4976 GDTR LDTR 4977 ͼ ͼ 4978 4979 49805.1.3 Selectors 4981 4982The selector portion of a logical address identifies a descriptor by 4983specifying a descriptor table and indexing a descriptor within that table. 4984Selectors may be visible to applications programs as a field within a 4985pointer variable, but the values of selectors are usually assigned (fixed 4986up) by linkers or linking loaders. Figure 5-6 shows the format of a 4987selector. 4988 4989Index: Selects one of 8192 descriptors in a descriptor table. The processor 4990simply multiplies this index value by 8 (the length of a descriptor), and 4991adds the result to the base address of the descriptor table in order to 4992access the appropriate segment descriptor in the table. 4993 4994Table Indicator: Specifies to which descriptor table the selector refers. A 4995zero indicates the GDT; a one indicates the current LDT. 4996 4997Requested Privilege Level: Used by the protection mechanism. (Refer to 4998Chapter 6.) 4999 5000Because the first entry of the GDT is not used by the processor, a selector 5001that has an index of zero and a table indicator of zero (i.e., a selector 5002that points to the first entry of the GDT), can be used as a null selector. 5003The processor does not cause an exception when a segment register (other 5004than CS or SS) is loaded with a null selector. It will, however, cause an 5005exception when the segment register is used to access memory. This feature 5006is useful for initializing unused segment registers so as to trap accidental 5007references. 5008 5009 5010Figure 5-6. Format of a Selector 5011 5012 15 4 3 0 5013 ͻ 5014 T 5015 INDEX RPL 5016 I 5017 ͼ 5018 5019 TI - TABLE INDICATOR 5020 RPL - REQUESTOR'S PRIVILEGE LEVEL 5021 5022 5023Figure 5-7. Segment Registers 5024 5025 16-BIT VISIBLE 5026 SELECTOR HIDDEN DESCRIPTOR 5027 ͻ 5028 CS 5029 Ķ 5030 SS 5031 Ķ 5032 DS 5033 Ķ 5034 ES 5035 Ķ 5036 FS 5037 Ķ 5038 GS 5039 ͼ 5040 5041 50425.1.4 Segment Registers 5043 5044The 80386 stores information from descriptors in segment registers, thereby 5045avoiding the need to consult a descriptor table every time it accesses 5046memory. 5047 5048Every segment register has a "visible" portion and an "invisible" portion, 5049as Figure 5-7 illustrates. The visible portions of these segment address 5050registers are manipulated by programs as if they were simply 16-bit 5051registers. The invisible portions are manipulated by the processor. 5052 5053The operations that load these registers are normal program instructions 5054(previously described in Chapter 3). These instructions are of two classes: 5055 5056 1. Direct load instructions; for example, MOV, POP, LDS, LSS, LGS, LFS. 5057 These instructions explicitly reference the segment registers. 5058 5059 2. Implied load instructions; for example, far CALL and JMP. These 5060 instructions implicitly reference the CS register, and load it with a 5061 new value. 5062 5063Using these instructions, a program loads the visible part of the segment 5064register with a 16-bit selector. The processor automatically fetches the 5065base address, limit, type, and other information from a descriptor table and 5066loads them into the invisible part of the segment register. 5067 5068Because most instructions refer to data in segments whose selectors have 5069already been loaded into segment registers, the processor can add the 5070segment-relative offset supplied by the instruction to the segment base 5071address with no additional overhead. 5072 5073 50745.2 Page Translation 5075 5076In the second phase of address transformation, the 80386 transforms a 5077linear address into a physical address. This phase of address transformation 5078implements the basic features needed for page-oriented virtual-memory 5079systems and page-level protection. 5080 5081The page-translation step is optional. Page translation is in effect only 5082when the PG bit of CR0 is set. This bit is typically set by the operating 5083system during software initialization. The PG bit must be set if the 5084operating system is to implement multiple virtual 8086 tasks, page-oriented 5085protection, or page-oriented virtual memory. 5086 5087 50885.2.1 Page Frame 5089 5090A page frame is a 4K-byte unit of contiguous addresses of physical memory. 5091Pages begin onbyte boundaries and are fixed in size. 5092 5093 50945.2.2 Linear Address 5095 5096A linear address refers indirectly to a physical address by specifying a 5097page table, a page within that table, and an offset within that page. Figure 50985-8 shows the format of a linear address. 5099 5100Figure 5-9 shows how the processor converts the DIR, PAGE, and OFFSET 5101fields of a linear address into the physical address by consulting two 5102levels of page tables. The addressing mechanism uses the DIR field as an 5103index into a page directory, uses the PAGE field as an index into the page 5104table determined by the page directory, and uses the OFFSET field to address 5105a byte within the page determined by the page table. 5106 5107 5108Figure 5-8. Format of a Linear Address 5109 5110 31 22 21 12 11 0 5111 ͻ 5112 5113 DIR PAGE OFFSET 5114 5115 ͼ 5116 5117 5118Figure 5-9. Page Translation 5119 5120 PAGE FRAME 5121 ͻ ͻ 5122 DIR PAGE OFFSET 5123 ͼ 5124 5125 PHYSICAL 5126 ADDRESS 5127 PAGE DIRECTORY PAGE TABLE 5128 ͻ ͻ 5129 ͼ 5130 5131 PG TBL ENTRY 5132 5133 DIR ENTRY Ŀ 5134 5135 5136 ͼ ͼ 5137 5138ͻ 5139 CR3 5140ͼ 5141 5142 51435.2.3 Page Tables 5144 5145A page table is simply an array of 32-bit page specifiers. A page table is 5146itself a page, and therefore contains 4 Kilobytes of memory or at most 1K 514732-bit entries. 5148 5149Two levels of tables are used to address a page of memory. At the higher 5150level is a page directory. The page directory addresses up to 1K page tables 5151of the second level. A page table of the second level addresses up to 1K 5152pages. All the tables addressed by one page directory, therefore, can 5153address 1M pages (2^(20)). Because each page contains 4K bytes 2^(12) 5154bytes), the tables of one page directory can span the entire physical 5155address space of the 80386 (2^(20) times 2^(12) = 2^(32)). 5156 5157The physical address of the current page directory is stored in the CPU 5158register CR3, also called the page directory base register (PDBR). Memory 5159management software has the option of using one page directory for all 5160tasks, one page directory for each task, or some combination of the two. 5161Refer to Chapter 10 for information on initialization of CR3. Refer to 5162Chapter 7 to see how CR3 can change for each task. 5163 5164 51655.2.4 Page-Table Entries 5166 5167Entries in either level of page tables have the same format. Figure 5-10 5168illustrates this format. 5169 5170 51715.2.4.1 Page Frame Address 5172 5173The page frame address specifies the physical starting address of a page. 5174Because pages are located on 4K boundaries, the low-order 12 bits are always 5175zero. In a page directory, the page frame address is the address of a page 5176table. In a second-level page table, the page frame address is the address 5177of the page frame that contains the desired memory operand. 5178 5179 51805.2.4.2 Present Bit 5181 5182The Present bit indicates whether a page table entry can be used in address 5183translation. P=1 indicates that the entry can be used. 5184 5185When P=0 in either level of page tables, the entry is not valid for address 5186translation, and the rest of the entry is available for software use; none 5187of the other bits in the entry is tested by the hardware. Figure 5-11 5188illustrates the format of a page-table entry when P=0. 5189 5190If P=0 in either level of page tables when an attempt is made to use a 5191page-table entry for address translation, the processor signals a page 5192exception. In software systems that support paged virtual memory, the 5193page-not-present exception handler can bring the required page into physical 5194memory. The instruction that caused the exception can then be reexecuted. 5195Refer to Chapter 9 for more information on exception handlers. 5196 5197Note that there is no present bit for the page directory itself. The page 5198directory may be not-present while the associated task is suspended, but the 5199operating system must ensure that the page directory indicated by the CR3 5200image in the TSS is present in physical memory before the task is 5201dispatched. Refer to Chapter 7 for an explanation of the TSS and task 5202dispatching. 5203 5204 5205Figure 5-10. Format of a Page Table Entry 5206 5207 31 12 11 0 5208 ͻ 5209 UR 5210 PAGE FRAME ADDRESS 31..12 AVAIL 0 0DA0 0//P 5211 SW 5212 ͼ 5213 5214 P - PRESENT 5215 R/W - READ/WRITE 5216 U/S - USER/SUPERVISOR 5217 D - DIRTY 5218 AVAIL - AVAILABLE FOR SYSTEMS PROGRAMMER USE 5219 5220 NOTE: 0 INDICATES INTEL RESERVED. DO NOT DEFINE. 5221 5222 5223Figure 5-11. Invalid Page Table Entry 5224 5225 31 1 0 5226 ͻ 5227 5228 AVAILABLE 0 5229 5230 ͼ 5231 5232 52335.2.4.3 Accessed and Dirty Bits 5234 5235These bits provide data about page usage in both levels of the page tables. 5236With the exception of the dirty bit in a page directory entry, these bits 5237are set by the hardware; however, the processor does not clear any of these 5238bits. 5239 5240The processor sets the corresponding accessed bits in both levels of page 5241tables to one before a read or write operation to a page. 5242 5243The processor sets the dirty bit in the second-level page table to one 5244before a write to an address covered by that page table entry. The dirty bit 5245in directory entries is undefined. 5246 5247An operating system that supports paged virtual memory can use these bits 5248to determine what pages to eliminate from physical memory when the demand 5249for memory exceeds the physical memory available. The operating system is 5250responsible for testing and clearing these bits. 5251 5252Refer to Chapter 11 for how the 80386 coordinates updates to the accessed 5253and dirty bits in multiprocessor systems. 5254 5255 52565.2.4.4 Read/Write and User/Supervisor Bits 5257 5258These bits are not used for address translation, but are used for 5259page-level protection, which the processor performs at the same time as 5260address translation. Refer to Chapter 6 where protection is discussed in 5261detail. 5262 5263 52645.2.5 Page Translation Cache 5265 5266For greatest efficiency in address translation, the processor stores the 5267most recently used page-table data in an on-chip cache. Only if the 5268necessary paging information is not in the cache must both levels of page 5269tables be referenced. 5270 5271The existence of the page-translation cache is invisible to applications 5272programmers but not to systems programmers; operating-system programmers 5273must flush the cache whenever the page tables are changed. The 5274page-translation cache can be flushed by either of two methods: 5275 5276 1. By reloading CR3 with a MOV instruction; for example: 5277 5278 MOV CR3, EAX 5279 5280 2. By performing a task switch to a TSS that has a different CR3 image 5281 than the current TSS. (Refer to Chapter 7 for more information on 5282 task switching.) 5283 5284 52855.3 Combining Segment and Page Translation 5286 5287Figure 5-12 combines Figure 5-2 and Figure 5-9 to summarize both phases 5288of the transformation from a logical address to a physical address when 5289paging is enabled. By appropriate choice of options and parameters to both 5290phases, memory-management software can implement several different styles of 5291memory management. 5292 5293 52945.3.1 "Flat" Architecture 5295 5296When the 80386 is used to execute software designed for architectures that 5297don't have segments, it may be expedient to effectively "turn off" the 5298segmentation features of the 80386. The 80386 does not have a mode that 5299disables segmentation, but the same effect can be achieved by initially 5300loading the segment registers with selectors for descriptors that encompass 5301the entire 32-bit linear address space. Once loaded, the segment registers 5302don't need to be changed. The 32-bit offsets used by 80386 instructions are 5303adequate to address the entire linear-address space. 5304 5305 53065.3.2 Segments Spanning Several Pages 5307 5308The architecture of the 80386 permits segments to be larger or smaller than 5309the size of a page (4 Kilobytes). For example, suppose a segment is used to 5310address and protect a large data structure that spans 132 Kilobytes. In a 5311software system that supports paged virtual memory, it is not necessary for 5312the entire structure to be in physical memory at once. The structure is 5313divided into 33 pages, any number of which may not be present. The 5314applications programmer does not need to be aware that the virtual memory 5315subsystem is paging the structure in this manner. 5316 5317 5318Figure 5-12. 80306 Addressing Machanism 5319 5320 16 0 32 0 5321 ͻ LOGICAL 5322 SELECTOR OFFSET ADDRESS 5323 ͼ 5324 5325 DESCRIPTOR TABLE 5326 ͻ 5327 5328 5329 5330 5331 5332 SEGMENT ͻ 5333 DESCRIPTOR + 5334 ͼ 5335 5336 ͼ 5337 PAGE FRAME 5338 LINEAR ͻ ͻ 5339 ADDRESS DIR PAGE OFFSET 5340 ͼ 5341 5342 PHYSICAL 5343 ADDRESS 5344 PAGE DIRECTORY PAGE TABLE 5345 ͻ ͻ 5346 5347 ͼ 5348 5349 PG TBL ENTRY 5350 5351 DIR ENTRY Ŀ 5352 5353 5354 ͼ ͼ 5355 5356ͻ 5357 CR3 5358ͼ 5359 5360 53615.3.3 Pages Spanning Several Segments 5362 5363On the other hand, segments may be smaller than the size of a page. For 5364example, consider a small data structure such as a semaphore. Because of the 5365protection and sharing provided by segments (refer to Chapter 6), it may be 5366useful to create a separate segment for each semaphore. But, because a 5367system may need many semaphores, it is not efficient to allocate a page for 5368each. Therefore, it may be useful to cluster many related segments within a 5369page. 5370 5371 53725.3.4 Non-Aligned Page and Segment Boundaries 5373 5374The architecture of the 80386 does not enforce any correspondence between 5375the boundaries of pages and segments. It is perfectly permissible for a page 5376to contain the end of one segment and the beginning of another. Likewise, a 5377segment may contain the end of one page and the beginning of another. 5378 5379 53805.3.5 Aligned Page and Segment Boundaries 5381 5382Memory-management software may be simpler, however, if it enforces some 5383correspondence between page and segment boundaries. For example, if segments 5384are allocated only in units of one page, the logic for segment and page 5385allocation can be combined. There is no need for logic to account for 5386partially used pages. 5387 5388 53895.3.6 Page-Table per Segment 5390 5391An approach to space management that provides even further simplification 5392of space-management software is to maintain a one-to-one correspondence 5393between segment descriptors and page-directory entries, as Figure 5-13 5394illustrates. Each descriptor has a base address in which the low-order 22 5395bits are zero; in other words, the base address is mapped by the first entry 5396of a page table. A segment may have any limit from 1 to 4 megabytes. 5397Depending on the limit, the segment is contained in from 1 to 1K page 5398frames. A task is thus limited to 1K segments (a sufficient number for many 5399applications), each containing up to 4 Mbytes. The descriptor, the 5400corresponding page-directory entry, and the corresponding page table can be 5401allocated and deallocated simultaneously. 5402 5403 5404Figure 5-13. Descriptor per Page Table 5405 5406 PAGE FRAMES 5407 ͻ 5408 LDT PAGE DIRECTORY PAGE TABLES 5409 ͻ ͻ ͻ 5410 ͼ 5411 5412 PTE ͻ 5413 5414 PTE Ŀ 5415 ͼ 5416 PTE Ŀ 5417 ͼ ͻ 5418 DESCRIPTOR PDE 5419 5420 DESCRIPTOR PDE Ŀ ͼ 5421 ͻ 5422 ͻ 5423 5424 5425 ͼ 5426 PTE 5427 ͻ 5428 PTE Ŀ 5429 ͼ ͼ ͼ 5430 LDT PAGE DIRECTORY PAGE TABLES ͼ 5431 PAGE FRAMES 5432 5433 5434Chapter 6 Protection 5435 5436 5437 54386.1 Why Protection? 5439 5440The purpose of the protection features of the 80386 is to help detect and 5441identify bugs. The 80386 supports sophisticated applications that may 5442consist of hundreds or thousands of program modules. In such applications, 5443the question is how bugs can be found and eliminated as quickly as possible 5444and how their damage can be tightly confined. To help debug applications 5445faster and make them more robust in production, the 80386 contains 5446mechanisms to verify memory accesses and instruction execution for 5447conformance to protection criteria. These mechanisms may be used or ignored, 5448according to system design objectives. 5449 5450 54516.2 Overview of 80386 Protection Mechanisms 5452 5453Protection in the 80386 has five aspects: 5454 5455 1. Type checking 5456 2. Limit checking 5457 3. Restriction of addressable domain 5458 4. Restriction of procedure entry points 5459 5. Restriction of instruction set 5460 5461The protection hardware of the 80386 is an integral part of the memory 5462management hardware. Protection applies both to segment translation and to 5463page translation. 5464 5465Each reference to memory is checked by the hardware to verify that it 5466satisfies the protection criteria. All these checks are made before the 5467memory cycle is started; any violation prevents that cycle from starting and 5468results in an exception. Since the checks are performed concurrently with 5469address formation, there is no performance penalty. 5470 5471Invalid attempts to access memory result in an exception. Refer to 5472Chapter 9 for an explanation of the exception mechanism. The present 5473chapter defines the protection violations that lead to exceptions. 5474 5475The concept of "privilege" is central to several aspects of protection 5476(numbers 3, 4, and 5 in the preceeding list). Applied to procedures, 5477privilege is the degree to which the procedure can be trusted not to make a 5478mistake that might affect other procedures or data. Applied to data, 5479privilege is the degree of protection that a data structure should have 5480from less trusted procedures. 5481 5482The concept of privilege applies both to segment protection and to page 5483protection. 5484 5485 54866.3 Segment-Level Protection 5487 5488All five aspects of protection apply to segment translation: 5489 5490 1. Type checking 5491 2. Limit checking 5492 3. Restriction of addressable domain 5493 4. Restriction of procedure entry points 5494 5. Restriction of instruction set 5495 5496The segment is the unit of protection, and segment descriptors store 5497protection parameters. Protection checks are performed automatically by the 5498CPU when the selector of a segment descriptor is loaded into a segment 5499register and with every segment access. Segment registers hold the 5500protection parameters of the currently addressable segments. 5501 5502 55036.3.1 Descriptors Store Protection Parameters 5504 5505Figure 6-1 highlights the protection-related fields of segment descriptors. 5506 5507The protection parameters are placed in the descriptor by systems software 5508at the time a descriptor is created. In general, applications programmers do 5509not need to be concerned about protection parameters. 5510 5511When a program loads a selector into a segment register, the processor 5512loads not only the base address of the segment but also protection 5513information. Each segment register has bits in the invisible portion for 5514storing base, limit, type, and privilege level; therefore, subsequent 5515protection checks on the same segment do not consume additional clock 5516cycles. 5517 5518 5519Figure 6-1. Protection Fields of Segment Descriptors 5520 5521 DATA SEGMENT DESCRIPTOR 5522 5523 31 23 15 7 0 5524 ͻ 5525 A LIMIT TYPE 5526 BASE 31..24GB0V 19..16 P DPL BASE 23..16 4 5527 L 10EWA 5528 Ķ 5529 5530 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 5531 5532 ͼ 5533 5534 EXECUTABLE SEGMENT DESCRIPTOR 5535 5536 31 23 15 7 0 5537 ͻ 5538 A LIMIT TYPE 5539 BASE 31..24GD0V 19..16 P DPL BASE 23..16 4 5540 L 10CRA 5541 Ķ 5542 5543 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 5544 5545 ͼ 5546 5547 SYSTEM SEGMENT DESCRIPTOR 5548 5549 31 23 15 7 0 5550 ͻ 5551 A LIMIT 5552 BASE 31..24GX0V 19..16 P DPL 0 TYPE BASE 23..16 4 5553 L 5554 Ķ 5555 5556 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 5557 5558 ͼ 5559 5560 5561 A - ACCESSED E - EXPAND-DOWN 5562 AVL - AVAILABLE FOR PROGRAMMERS USE G - GRANULARITY 5563 B - BIG P - SEGMENT PRESENT 5564 C - CONFORMING R - READABLE 5565 D - DEFAULT W - WRITABLE 5566 DPL - DESCRIPTOR PRIVILEGE LEVEL 5567 5568 55696.3.1.1 Type Checking 5570 5571The TYPE field of a descriptor has two functions: 5572 5573 1. It distinguishes among different descriptor formats. 5574 2. It specifies the intended usage of a segment. 5575 5576Besides the descriptors for data and executable segments commonly used by 5577applications programs, the 80386 has descriptors for special segments used 5578by the operating system and for gates. Table 6-1 lists all the types defined 5579for system segments and gates. Note that not all descriptors define 5580segments; gate descriptors have a different purpose that is discussed later 5581in this chapter. 5582 5583The type fields of data and executable segment descriptors include bits 5584which further define the purpose of the segment (refer to Figure 6-1): 5585 5586 The writable bit in a data-segment descriptor specifies whether 5587 instructions can write into the segment. 5588 5589 The readable bit in an executable-segment descriptor specifies 5590 whether instructions are allowed to read from the segment (for example, 5591 to access constants that are stored with instructions). A readable, 5592 executable segment may be read in two ways: 5593 5594 1. Via the CS register, by using a CS override prefix. 5595 5596 2. By loading a selector of the descriptor into a data-segment register 5597 (DS, ES, FS,or GS). 5598 5599Type checking can be used to detect programming errors that would attempt 5600to use segments in ways not intended by the programmer. The processor 5601examines type information on two kinds of occasions: 5602 5603 1. When a selector of a descriptor is loaded into a segment register. 5604 Certain segment registers can contain only certain descriptor types; 5605 for example: 5606 5607 The CS register can be loaded only with a selector of an executable 5608 segment. 5609 5610 Selectors of executable segments that are not readable cannot be 5611 loaded into data-segment registers. 5612 5613 Only selectors of writable data segments can be loaded into SS. 5614 5615 2. When an instruction refers (implicitly or explicitly) to a segment 5616 register. Certain segments can be used by instructions only in certain 5617 predefined ways; for example: 5618 5619 No instruction may write into an executable segment. 5620 5621 No instruction may write into a data segment if the writable bit is 5622 not set. 5623 5624 No instruction may read an executable segment unless the readable bit 5625 is set. 5626 5627 5628Table 6-1. System and Gate Descriptor Types 5629 5630Code Type of Segment or Gate 5631 5632 0 -reserved 5633 1 Available 286 TSS 5634 2 LDT 5635 3 Busy 286 TSS 5636 4 Call Gate 5637 5 Task Gate 5638 6 286 Interrupt Gate 5639 7 286 Trap Gate 5640 8 -reserved 5641 9 Available 386 TSS 5642 A -reserved 5643 B Busy 386 TSS 5644 C 386 Call Gate 5645 D -reserved 5646 E 386 Interrupt Gate 5647 F 386 Trap Gate 5648 5649 56506.3.1.2 Limit Checking 5651 5652The limit field of a segment descriptor is used by the processor to prevent 5653programs from addressing outside the segment. The processor's interpretation 5654of the limit depends on the setting of the G (granularity) bit. For data 5655segments, the processor's interpretation of the limit depends also on the 5656E-bit (expansion-direction bit) and the B-bit (big bit) (refer to Table 56576-2). 5658 5659When G=0, the actual limit is the value of the 20-bit limit field as it 5660appears in the descriptor. In this case, the limit may range from 0 to 56610FFFFFH (2^(20) - 1 or 1 megabyte). When G=1, the processor appends 12 5662low-order one-bits to the value in the limit field. In this case the actual 5663limit may range from 0FFFH (2^(12) - 1 or 4 kilobytes) to 0FFFFFFFFH(2^(32) 5664- 1 or 4 gigabytes). 5665 5666For all types of segments except expand-down data segments, the value of 5667the limit is one less than the size (expressed in bytes) of the segment. The 5668processor causes a general-protection exception in any of these cases: 5669 5670 Attempt to access a memory byte at an address > limit. 5671 Attempt to access a memory word at an address limit. 5672 Attempt to access a memory doubleword at an address (limit-2). 5673 5674For expand-down data segments, the limit has the same function but is 5675interpreted differently. In these cases the range of valid addresses is from 5676limit + 1 to either 64K or 2^(32) - 1 (4 Gbytes) depending on the B-bit. An 5677expand-down segment has maximum size when the limit is zero. 5678 5679The expand-down feature makes it possible to expand the size of a stack by 5680copying it to a larger segment without needing also to update intrastack 5681pointers. 5682 5683The limit field of descriptors for descriptor tables is used by the 5684processor to prevent programs from selecting a table entry outside the 5685descriptor table. The limit of a descriptor table identifies the last valid 5686byte of the last descriptor in the table. Since each descriptor is eight 5687bytes long, the limit value is N * 8 - 1 for a table that can contain up to 5688N descriptors. 5689 5690Limit checking catches programming errors such as runaway subscripts and 5691invalid pointer calculations. Such errors are detected when they occur, so 5692that identification of the cause is easier. Without limit checking, such 5693errors could corrupt other modules; the existence of such errors would not 5694be discovered until later, when the corrupted module behaves incorrectly, 5695and when identification of the cause is difficult. 5696 5697 5698Table 6-2. Useful Combinations of E, G, and B Bits 5699 5700 5701Case: 1 2 3 4 5702 5703Expansion Direction U U D D 5704G-bit 0 1 0 1 5705B-bit X X 0 1 5706 5707Lower bound is: 5708 0 X X 5709 LIMIT+1 X 5710shl(LIMIT,12,1)+1 X 5711 5712Upper bound is: 5713 LIMIT X 5714 shl(LIMIT,12,1) X 5715 64K-1 X 5716 4G-1 X 5717 5718Max seg size is: 5719 64K X 5720 64K-1 X 5721 4G-4K X 5722 4G X 5723 5724Min seg size is: 5725 0 X X 5726 4K X X 5727 5728shl (X, 12, 1) = shift X left by 12 bits inserting one-bits on the right 5729 5730 57316.3.1.3 Privilege Levels 5732 5733The concept of privilege is implemented by assigning a value from zero to 5734three to key objects recognized by the processor. This value is called the 5735privilege level. The value zero represents the greatest privilege, the 5736value three represents the least privilege. The following 5737processor-recognized objects contain privilege levels: 5738 5739 Descriptors contain a field called the descriptor privilege level 5740 (DPL). 5741 5742 Selectors contain a field called the requestor's privilege level 5743 (RPL). The RPL is intended to represent the privilege level of 5744 the procedure that originates a selector. 5745 5746 An internal processor register records the current privilege level 5747 (CPL). Normally the CPL is equal to the DPL of the segment that 5748 the processor is currently executing. CPL changes as control is 5749 transferred to segments with differing DPLs. 5750 5751The processor automatically evaluates the right of a procedure to access 5752another segment by comparing the CPL to one or more other privilege levels. 5753The evaluation is performed at the time the selector of a descriptor is 5754loaded into a segment register. The criteria used for evaluating access to 5755data differs from that for evaluating transfers of control to executable 5756segments; therefore, the two types of access are considered separately in 5757the following sections. 5758 5759Figure 6-2 shows how these levels of privilege can be interpreted as rings 5760of protection. The center is for the segments containing the most critical 5761software, usually the kernel of the operating system. Outer rings are for 5762the segments of less critical software. 5763 5764It is not necessary to use all four privilege levels. Existing software 5765that was designed to use only one or two levels of privilege can simply 5766ignore the other levels offered by the 80386. A one-level system should use 5767privilege level zero; a two-level system should use privilege levels zero 5768and three. 5769 5770 5771Figure 6-2. Levels of Privilege 5772 5773 TASK C 5774 Ŀ 5775 ͻ 5776 APPLICATIONS 5777 ͻ 5778 CUSTOM EXTENSIONS 5779 ͻ 5780 SYSTEM SERVICES 5781 ͻ 5782 KERNAL 5783 Ķ͵ 5784 LEVELLEVELLEVELLEVEL 5785 0 1 2 3 5786 ͼ 5787 5788 ͼ 5789 5790 ͼ 5791 5792 TASK B ͼ TASK A 5793 5794 5795 57966.3.2 Restricting Access to Data 5797 5798To address operands in memory, an 80386 program must load the selector of a 5799data segment into a data-segment register (DS, ES, FS, GS, SS). The 5800processor automatically evaluates access to a data segment by comparing 5801privilege levels. The evaluation is performed at the time a selector for the 5802descriptor of the target segment is loaded into the data-segment register. 5803As Figure 6-3 shows, three different privilege levels enter into this type 5804of privilege check: 5805 5806 1. The CPL (current privilege level). 5807 5808 2. The RPL (requestor's privilege level) of the selector used to specify 5809 the target segment. 5810 5811 3. The DPL of the descriptor of the target segment. 5812 5813Instructions may load a data-segment register (and subsequently use the 5814target segment) only if the DPL of the target segment is numerically greater 5815than or equal to the maximum of the CPL and the selector's RPL. In other 5816words, a procedure can only access data that is at the same or less 5817privileged level. 5818 5819The addressable domain of a task varies as CPL changes. When CPL is zero, 5820data segments at all privilege levels are accessible; when CPL is one, only 5821data segments at privilege levels one through three are accessible; when CPL 5822is three, only data segments at privilege level three are accessible. This 5823property of the 80386 can be used, for example, to prevent applications 5824procedures from reading or changing tables of the operating system. 5825 5826 5827Figure 6-3. Privilege Check for Data Access 5828 5829 16-BIT VISIBLE 5830 SELECTOR INVISIBLE DESCRIPTOR 5831 ͻ 5832 CS CPL 5833 ͼ 5834 5835 TARGET SEGMENT SELECTOR ͻ 5836 ͻ PRIVILEGE 5837 INDEX RPL CHECK 5838 ͼ BY CPU 5839 ͼ 5840 DATA SEGMENT DESCRIPTOR 5841 5842 31 23 15 7 0 5843 ͻ 5844 A LIMIT TYPE 5845 BASE 31..24 GB0V P DPL BASE 23..16 4 5846 L 19..16 10EWA 5847 Ķ 5848 5849 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 5850 5851 ͼ 5852 5853 5854 CPL - CURRENT PRIVILEGE LEVEL 5855 RPL - REQUESTOR'S PRIVILEGE LEVEL 5856 DPL - DESCRIPTOR PRIVILEGE LEVEL 5857 5858 58596.3.2.1 Accessing Data in Code Segments 5860 5861Less common than the use of data segments is the use of code segments to 5862store data. Code segments may legitimately hold constants; it is not 5863possible to write to a segment described as a code segment. The following 5864methods of accessing data in code segments are possible: 5865 5866 1. Load a data-segment register with a selector of a nonconforming, 5867 readable, executable segment. 5868 5869 2. Load a data-segment register with a selector of a conforming, 5870 readable, executable segment. 5871 5872 3. Use a CS override prefix to read a readable, executable segment whose 5873 selector is already loaded in the CS register. 5874 5875The same rules as for access to data segments apply to case 1. Case 2 is 5876always valid because the privilege level of a segment whose conforming bit 5877is set is effectively the same as CPL regardless of its DPL. Case 3 always 5878valid because the DPL of the code segment in CS is, by definition, equal to 5879CPL. 5880 5881 58826.3.3 Restricting Control Transfers 5883 5884With the 80386, control transfers are accomplished by the instructions JMP, 5885CALL, RET, INT, and IRET, as well as by the exception and interrupt 5886mechanisms. Exceptions and interrupts are special cases that Chapter 9 5887covers. This chapter discusses only JMP, CALL, and RET instructions. 5888 5889The "near" forms of JMP, CALL, and RET transfer within the current code 5890segment, and therefore are subject only to limit checking. The processor 5891ensures that the destination of the JMP, CALL, or RET instruction does not 5892exceed the limit of the current executable segment. This limit is cached in 5893the CS register; therefore, protection checks for near transfers require no 5894extra clock cycles. 5895 5896The operands of the "far" forms of JMP and CALL refer to other segments; 5897therefore, the processor performs privilege checking. There are two ways a 5898JMP or CALL can refer to another segment: 5899 5900 1. The operand selects the descriptor of another executable segment. 5901 5902 2. The operand selects a call gate descriptor. This gated form of 5903 transfer is discussed in a later section on call gates. 5904 5905As Figure 6-4 shows, two different privilege levels enter into a privilege 5906check for a control transfer that does not use a call gate: 5907 5908 1. The CPL (current privilege level). 5909 2. The DPL of the descriptor of the target segment. 5910 5911Normally the CPL is equal to the DPL of the segment that the processor is 5912currently executing. CPL may, however, be greater than DPL if the conforming 5913bit is set in the descriptor of the current executable segment. The 5914processor keeps a record of the CPL cached in the CS register; this value 5915can be different from the DPL in the descriptor of the code segment. 5916 5917The processor permits a JMP or CALL directly to another segment only if one 5918of the following privilege rules is satisfied: 5919 5920 DPL of the target is equal to CPL. 5921 5922 The conforming bit of the target code-segment descriptor is set, and 5923 the DPL of the target is less than or equal to CPL. 5924 5925An executable segment whose descriptor has the conforming bit set is called 5926a conforming segment. The conforming-segment mechanism permits sharing of 5927procedures that may be called from various privilege levels but should 5928execute at the privilege level of the calling procedure. Examples of such 5929procedures include math libraries and some exception handlers. When control 5930is transferred to a conforming segment, the CPL does not change. This is 5931the only case when CPL may be unequal to the DPL of the current executable 5932segment. 5933 5934Most code segments are not conforming. The basic rules of privilege above 5935mean that, for nonconforming segments, control can be transferred without a 5936gate only to executable segments at the same level of privilege. There is a 5937need, however, to transfer control to (numerically) smaller privilege 5938levels; this need is met by the CALL instruction when used with call-gate 5939descriptors, which are explained in the next section. The JMP instruction 5940may never transfer control to a nonconforming segment whose DPL does not 5941equal CPL. 5942 5943 5944Figure 6-4. Privilege Check for Control Transfer without Gate 5945 5946 16-BIT VISIBLE 5947 SELECTOR INVISIBLE PART 5948 ͻ 5949 CPL CS 5950 ͼ 5951 5952 ͻ 5953 PRIVILEGE 5954 CHECK 5955 BY CPU 5956 CODE-SEGMENT DESCRIPTOR ͼ 5957 5958 31 23 15 7 0 5959 ͻ 5960 A LIMIT 5961 BASE 31..24 GD0V P DPL BASE 23..16 4 5962 L 19..16 11CRA 5963 Ķ 5964 5965 SEGMENT BASE 15..0 SEGMENT LIMIT 15..0 0 5966 5967 ͼ 5968 5969 CPL - CURRENT PRIVILEGE LEVEL 5970 DPL - DESCRIPTOR PRIVILEGE LEVEL 5971 C - CONFORMING BIT 5972 5973 59746.3.4 Gate Descriptors Guard Procedure Entry Points 5975 5976To provide protection for control transfers among executable segments 5977at different privilege levels, the 80386 uses gate descriptors. There are 5978four kinds of gate descriptors: 5979 5980 Call gates 5981 Trap gates 5982 Interrupt gates 5983 Task gates 5984 5985This chapter is concerned only with call gates. Task gates are used for 5986task switching, and therefore are discussed in Chapter 7. Chapter 9 5987explains how trap gates and interrupt gates are used by exceptions and 5988interrupts. Figure 6-5 illustrates the format of a call gate. A call gate 5989descriptor may reside in the GDT or in an LDT, but not in the IDT. 5990 5991A call gate has two primary functions: 5992 5993 1. To define an entry point of a procedure. 5994 2. To specify the privilege level of the entry point. 5995 5996Call gate descriptors are used by call and jump instructions in the same 5997manner as code segment descriptors. When the hardware recognizes that the 5998destination selector refers to a gate descriptor, the operation of the 5999instruction is expanded as determined by the contents of the call gate. 6000 6001The selector and offset fields of a gate form a pointer to the entry point 6002of a procedure. A call gate guarantees that all transitions to another 6003segment go to a valid entry point, rather than possibly into the middle of a 6004procedure (or worse, into the middle of an instruction). The far pointer 6005operand of the control transfer instruction does not point to the segment 6006and offset of the target instruction; rather, the selector part of the 6007pointer selects a gate, and the offset is not used. Figure 6-6 illustrates 6008this style of addressing. 6009 6010As Figure 6-7 shows, four different privilege levels are used to check the 6011validity of a control transfer via a call gate: 6012 6013 1. The CPL (current privilege level). 6014 6015 2. The RPL (requestor's privilege level) of the selector used to specify 6016 the call gate. 6017 6018 3. The DPL of the gate descriptor. 6019 6020 4. The DPL of the descriptor of the target executable segment. 6021 6022The DPL field of the gate descriptor determines what privilege levels can 6023use the gate. One code segment can have several procedures that are intended 6024for use by different privilege levels. For example, an operating system may 6025have some services that are intended to be used by applications, whereas 6026others may be intended only for use by other systems software. 6027 6028Gates can be used for control transfers to numerically smaller privilege 6029levels or to the same privilege level (though they are not necessary for 6030transfers to the same level). Only CALL instructions can use gates to 6031transfer to smaller privilege levels. A gate may be used by a JMP 6032instruction only to transfer to an executable segment with the same 6033privilege level or to a conforming segment. 6034 6035For a JMP instruction to a nonconforming segment, both of the following 6036privilege rules must be satisfied; otherwise, a general protection exception 6037results. 6038 6039 MAX (CPL,RPL) gate DPL 6040 target segment DPL = CPL 6041 6042For a CALL instruction (or for a JMP instruction to a conforming segment), 6043both of the following privilege rules must be satisfied; otherwise, a 6044general protection exception results. 6045 6046 MAX (CPL,RPL) gate DPL 6047 target segment DPL CPL 6048 6049 6050Figure 6-5. Format of 80386 Call Gate 6051 6052 31 23 15 7 0 6053 ͻ 6054 TYPE DWORD 6055 OFFSET 31..16 P DPL 0 0 0 4 6056 0 1 1 0 0 COUNT 6057 Ķ 6058 6059 SELECTOR OFFSET 15..0 0 6060 6061 ͼ 6062 6063 6064Figure 6-6. Indirect Transfer via Call Gate 6065 6066 OPCODE OFFSET SELECTOR 6067 ͻ 6068 CALL (NOT USED) INDEX RPL 6069 ͼ 6070 6071 DESCRIPTOR TABLE 6072 ͻ 6073 6074 Ķ 6075 6076 ͼ 6077 6078 6079 6080 ͻ 6081 GATE OFFSET DPL COUNT EXECUTABLE 6082 DESCRIPTOR Ķ SEGMENT 6083 Ķ SELECTOR OFFSET Ŀ ͻ 6084 6085 6086 Ķ 6087 6088 6089 PROCEDURE 6090 Ķ 6091 6092 6093 EXECUTABLE BASE DPL BASE 6094 SEGMENT Ķ ͼ 6095 DESCRIPTOR BASE 6096 ͼ 6097 6098 6099 6100 ͻ 6101 6102 Ķ 6103 6104 ͼ 6105 6106 6107Figure 6-7. Privilege Check via Call Gate 6108 6109 16-BIT VISIBLE 6110 SELECTOR INVISIBLE DESCRIPTOR 6111 ͻ 6112 CS CPL 6113 ͼ 6114 6115 TARGET SELECTOR ͻ 6116 ͻ PRIVILEGE 6117 INDEX RPL CHECK 6118 ͼ BY 6119 CPU 6120 ͼ 6121 6122 GATE DESCRIPTOR 6123 ͻ 6124 OFFSET DPL COUNT 6125 6126 SELECTOR OFFSET 6127 ͼ 6128 6129 6130 ͻ 6131 EXECUTABLE BASE LIMIT DPL BASE 6132 SEGMENT 6133 DESCRIPTOR BASE LIMIT 6134 ͼ 6135 6136 CPL - CURRENT PRIVILEGE LEVEL 6137 RPL - REQUESTOR'S PRIVILEGE LEVEL 6138 DPL - DESCRIPTOR PRIVILEGE LEVEL 6139 6140 61416.3.4.1 Stack Switching 6142 6143If the destination code segment of the call gate is at a different 6144privilege level than the CPL, an interlevel transfer is being requested. 6145 6146To maintain system integrity, each privilege level has a separate stack. 6147These stacks assure sufficient stack space to process calls from less 6148privileged levels. Without them, a trusted procedure would not work 6149correctly if the calling procedure did not provide sufficient space on the 6150caller's stack. 6151 6152The processor locates these stacks via the task state segment (see Figure 61536-8). Each task has a separate TSS, thereby permitting tasks to have 6154separate stacks. Systems software is responsible for creating TSSs and 6155placing correct stack pointers in them. The initial stack pointers in the 6156TSS are strictly read-only values. The processor never changes them during 6157the course of execution. 6158 6159When a call gate is used to change privilege levels, a new stack is 6160selected by loading a pointer value from the Task State Segment (TSS). The 6161processor uses the DPL of the target code segment (the new CPL) to index the 6162initial stack pointer for PL 0, PL 1, or PL 2. 6163 6164The DPL of the new stack data segment must equal the new CPL; if it does 6165not, a stack exception occurs. It is the responsibility of systems software 6166to create stacks and stack-segment descriptors for all privilege levels that 6167are used. Each stack must contain enough space to hold the old SS:ESP, the 6168return address, and all parameters and local variables that may be required 6169to process a call. 6170 6171As with intralevel calls, parameters for the subroutine are placed on the 6172stack. To make privilege transitions transparent to the called procedure, 6173the processor copies the parameters to the new stack. The count field of a 6174call gate tells the processor how many doublewords (up to 31) to copy from 6175the caller's stack to the new stack. If the count is zero, no parameters are 6176copied. 6177 6178The processor performs the following stack-related steps in executing an 6179interlevel CALL. 6180 6181 1. The new stack is checked to assure that it is large enough to hold 6182 the parameters and linkages; if it is not, a stack fault occurs with 6183 an error code of 0. 6184 6185 2. The old value of the stack registers SS:ESP is pushed onto the new 6186 stack as two doublewords. 6187 6188 3. The parameters are copied. 6189 6190 4. A pointer to the instruction after the CALL instruction (the former 6191 value of CS:EIP) is pushed onto the new stack. The final value of 6192 SS:ESP points to this return pointer on the new stack. 6193 6194Figure 6-9 illustrates the stack contents after a successful interlevel 6195call. 6196 6197The TSS does not have a stack pointer for a privilege level 3 stack, 6198because privilege level 3 cannot be called by any procedure at any other 6199privilege level. 6200 6201Procedures that may be called from another privilege level and that require 6202more than the 31 doublewords for parameters must use the saved SS:ESP link 6203to access all parameters beyond the last doubleword copied. 6204 6205A call via a call gate does not check the values of the words copied onto 6206the new stack. The called procedure should check each parameter for 6207validity. A later section discusses how the ARPL, VERR, VERW, LSL, and LAR 6208instructions can be used to check pointer values. 6209 6210 6211Figure 6-8. Initial Stack Pointers of TSS 6212 6213 31 23 15 7 0 6214 ͻ64 6215 6216 6217 6218 6219 6220 EFLAGS 24 6221 6222 INSTRUCTION POINTER (EIP) 20 6223 6224 CR3 (PDBR) 1C 6225 Ŀ 6226 00000000 00000000 SS2 1018 6227 6228 ESP2 14 6229 6230 00000000 00000000 SS1 0110 INITIAL 6231 STACK 6232 ESP1 0C POINTERS 6233 6234 00000000 00000000 SS0 008 6235 6236 ESP0 4 6237 6238 00000000 00000000 TSS BACK LINK 0 6239 ͼ 6240 6241 6242Figure 6-9. Stack Contents after an Interlevel Call 6243 6244 31 0 SS:ESP 6245 ͻFROM TSS 6246 31 0 OLD SS 6247 ͻ 6248 D O OLD ESP 6249 I F 6250 R PARM 3 6251 E E 6252 C X PARM 2 6253 T P 6254 I A PARM 3 PARM 1 6255 O N 6256 N S PARM 2 OLD CS NEW 6257 I OLD SS:ESP 6258 O PARM 1 SS:ESP OLD EIP 6259 N 6260 6261 6262 ͼ ͼ 6263 OLD STACK NEW STACK 6264 6265 62666.3.4.2 Returning from a Procedure 6267 6268The "near" forms of the RET instruction transfer control within the current 6269code segment and therefore are subject only to limit checking. The offset of 6270the instruction following the corresponding CALL, is popped from the stack. 6271The processor ensures that this offset does not exceed the limit of the 6272current executable segment. 6273 6274The "far" form of the RET instruction pops the return pointer that was 6275pushed onto the stack by a prior far CALL instruction. Under normal 6276conditions, the return pointer is valid, because of its relation to the 6277prior CALL or INT. Nevertheless, the processor performs privilege checking 6278because of the possibility that the current procedure altered the pointer or 6279failed to properly maintain the stack. The RPL of the CS selector popped 6280off the stack by the return instruction identifies the privilege level of 6281the calling procedure. 6282 6283An intersegment return instruction can change privilege levels, but only 6284toward procedures of lesser privilege. When the RET instruction encounters a 6285saved CS value whose RPL is numerically greater than the CPL, an interlevel 6286return occurs. Such a return follows these steps: 6287 6288 1. The checks shown in Table 6-3 are made, and CS:EIP and SS:ESP are 6289 loaded with their former values that were saved on the stack. 6290 6291 2. The old SS:ESP (from the top of the current stack) value is adjusted 6292 by the number of bytes indicated in the RET instruction. The resulting 6293 ESP value is not compared to the limit of the stack segment. If ESP is 6294 beyond the limit, that fact is not recognized until the next stack 6295 operation. (The SS:ESP value of the returning procedure is not 6296 preserved; normally, this value is the same as that contained in the 6297 TSS.) 6298 6299 3. The contents of the DS, ES, FS, and GS segment registers are checked. 6300 If any of these registers refer to segments whose DPL is greater than 6301 the new CPL (excluding conforming code segments), the segment register 6302 is loaded with the null selector (INDEX = 0, TI = 0). The RET 6303 instruction itself does not signal exceptions in these cases; 6304 however, any subsequent memory reference that attempts to use a 6305 segment register that contains the null selector will cause a general 6306 protection exception. This prevents less privileged code from 6307 accessing more privileged segments using selectors left in the 6308 segment registers by the more privileged procedure. 6309 6310 63116.3.5 Some Instructions are Reserved for Operating System 6312 6313Instructions that have the power to affect the protection mechanism or to 6314influence general system performance can only be executed by trusted 6315procedures. The 80386 has two classes of such instructions: 6316 6317 1. Privileged instructions those used for system control. 6318 6319 2. Sensitive instructions those used for I/O and I/O related 6320 activities. 6321 6322 6323Table 6-3. Interlevel Return Checks 6324 6325 6326Type of Check Exception 6327SF Stack Fault 6328GP General Protection Exception 6329NP Segment-Not-Present Exception Error Code 6330 6331ESP is within current SS segment SF 0 6332ESP + 7 is within current SS segment SF 0 6333RPL of return CS is greater than CPL GP Return CS 6334Return CS selector is not null GP Return CS 6335Return CS segment is within descriptor 6336table limit GP Return CS 6337Return CS descriptor is a code segment GP Return CS 6338Return CS segment is present NP Return CS 6339DPL of return nonconforming code 6340segment = RPL of return CS, or DPL of 6341return conforming code segment RPL 6342of return CS GP Return CS 6343ESP + N + 15 is within SS segment 6344N Immediate Operand of RET N Instruction SF Return SS 6345SS selector at ESP + N + 12 is not null GP Return SS 6346SS selector at ESP + N + 12 is within 6347descriptor table limit GP Return SS 6348SS descriptor is writable data segment GP Return SS 6349SS segment is present SF Return SS 6350Saved SS segment DPL = RPL of saved 6351CS GP Return SS 6352Saved SS selector RPL = Saved SS 6353segment DPL GP Return SS 6354 6355 63566.3.5.1 Privileged Instructions 6357 6358The instructions that affect system data structures can only be executed 6359when CPL is zero. If the CPU encounters one of these instructions when CPL 6360is greater than zero, it signals a general protection exception. These 6361instructions include: 6362 6363 CLTS Clear TaskSwitched Flag 6364 HLT Halt Processor 6365 LGDT Load GDL Register 6366 LIDT Load IDT Register 6367 LLDT Load LDT Register 6368 LMSW Load Machine Status Word 6369 LTR Load Task Register 6370 MOV to/from CRn Move to Control Register n 6371 MOV to /from DRn Move to Debug Register n 6372 MOV to/from TRn Move to Test Register n 6373 6374 63756.3.5.2 Sensitive Instructions 6376 6377Instructions that deal with I/O need to be restricted but also need to be 6378executed by procedures executing at privilege levels other than zero. The 6379mechanisms for restriction of I/O operations are covered in detail in 6380Chapter 8, "Input/Output". 6381 6382 63836.3.6 Instructions for Pointer Validation 6384 6385Pointer validation is an important part of locating programming errors. 6386Pointer validation is necessary for maintaining isolation between the 6387privilege levels. Pointer validation consists of the following steps: 6388 6389 1. Check if the supplier of the pointer is entitled to access the 6390 segment. 6391 6392 2. Check if the segment type is appropriate to its intended use. 6393 6394 3. Check if the pointer violates the segment limit. 6395 6396Although the 80386 processor automatically performs checks 2 and 3 during 6397instruction execution, software must assist in performing the first check. 6398The unprivileged instruction ARPL is provided for this purpose. Software can 6399also explicitly perform steps 2 and 3 to check for potential violations 6400(rather than waiting for an exception). The unprivileged instructions LAR, 6401LSL, VERR, and VERW are provided for this purpose. 6402 6403LAR (Load Access Rights) is used to verify that a pointer refers to a 6404segment of the proper privilege level and type. LAR has one operanda 6405selector for a descriptor whose access rights are to be examined. The 6406descriptor must be visible at the privilege level which is the maximum of 6407the CPL and the selector's RPL. If the descriptor is visible, LAR obtains a 6408masked form of the second doubleword of the descriptor, masks this value 6409with 00FxFF00H, stores the result into the specified 32-bit destination 6410register, and sets the zero flag. (The x indicates that the corresponding 6411four bits of the stored value are undefined.) Once loaded, the access-rights 6412bits can be tested. All valid descriptor types can be tested by the LAR 6413instruction. If the RPL or CPL is greater than DPL, or if the selector is 6414outside the table limit, no access-rights value is returned, and the zero 6415flag is cleared. Conforming code segments may be accessed from any privilege 6416level. 6417 6418LSL (Load Segment Limit) allows software to test the limit of a descriptor. 6419If the descriptor denoted by the given selector (in memory or a register) is 6420visible at the CPL, LSL loads the specified 32-bit register with a 32-bit, 6421byte granular, unscrambled limit that is calculated from fragmented limit 6422fields and the G-bit of that descriptor. This can only be done for segments 6423(data, code, task state, and local descriptor tables); gate descriptors are 6424inaccessible. (Table 6-4 lists in detail which types are valid and which 6425are not.) Interpreting the limit is a function of the segment type. For 6426example, downward expandable data segments treat the limit differently than 6427code segments do. For both LAR and LSL, the zero flag (ZF) is set if the 6428loading was performed; otherwise, the ZF is cleared. 6429 6430 6431Table 6-4. Valid Descriptor Types for LSL 6432 6433 Type Descriptor Type Valid? 6434 Code 6435 6436 0 (invalid) NO 6437 1 Available 286 TSS YES 6438 2 LDT YES 6439 3 Busy 286 TSS YES 6440 4 286 Call Gate NO 6441 5 Task Gate NO 6442 6 286 Trap Gate NO 6443 7 286 Interrupt Gate NO 6444 8 (invalid) NO 6445 9 Available 386 TSS YES 6446 A (invalid) NO 6447 B Busy 386 TSS YES 6448 C 386 Call Gate NO 6449 D (invalid) NO 6450 E 386 Trap Gate NO 6451 F 386 Interrupt Gate NO 6452 6453 64546.3.6.1 Descriptor Validation 6455 6456The 80386 has two instructions, VERR and VERW, which determine whether a 6457selector points to a segment that can be read or written at the current 6458privilege level. Neither instruction causes a protection fault if the result 6459is negative. 6460 6461VERR (Verify for Reading) verifies a segment for reading and loads ZF with 64621 if that segment is readable from the current privilege level. VERR checks 6463that: 6464 6465 The selector points to a descriptor within the bounds of the GDT or 6466 LDT. 6467 6468 It denotes a code or data segment descriptor. 6469 6470 The segment is readable and of appropriate privilege level. 6471 6472The privilege check for data segments and nonconforming code segments is 6473that the DPL must be numerically greater than or equal to both the CPL and 6474the selector's RPL. Conforming segments are not checked for privilege level. 6475 6476VERW (Verify for Writing) provides the same capability as VERR for 6477verifying writability. Like the VERR instruction, VERW loads ZF if the 6478result of the writability check is positive. The instruction checks that the 6479descriptor is within bounds, is a segment descriptor, is writable, and that 6480its DPL is numerically greater or equal to both the CPL and the selector's 6481RPL. Code segments are never writable, conforming or not. 6482 6483 64846.3.6.2 Pointer Integrity and RPL 6485 6486The Requestor's Privilege Level (RPL) feature can prevent inappropriate use 6487of pointers that could corrupt the operation of more privileged code or data 6488from a less privileged level. 6489 6490A common example is a file system procedure, FREAD (file_id, n_bytes, 6491buffer_ptr). This hypothetical procedure reads data from a file into a 6492buffer, overwriting whatever is there. Normally, FREAD would be available at 6493the user level, supplying only pointers to the file system procedures and 6494data located and operating at a privileged level. Normally, such a procedure 6495prevents user-level procedures from directly changing the file tables. 6496However, in the absence of a standard protocol for checking pointer 6497validity, a user-level procedure could supply a pointer into the file tables 6498in place of its buffer pointer, causing the FREAD procedure to corrupt them 6499unwittingly. 6500 6501Use of RPL can avoid such problems. The RPL field allows a privilege 6502attribute to be assigned to a selector. This privilege attribute would 6503normally indicate the privilege level of the code which generated the 6504selector. The 80386 processor automatically checks the RPL of any selector 6505loaded into a segment register to determine whether the RPL allows access. 6506 6507To take advantage of the processor's checking of RPL, the called procedure 6508need only ensure that all selectors passed to it have an RPL at least as 6509high (numerically) as the original caller's CPL. This action guarantees that 6510selectors are not more trusted than their supplier. If one of the selectors 6511is used to access a segment that the caller would not be able to access 6512directly, i.e., the RPL is numerically greater than the DPL, then a 6513protection fault will result when that selector is loaded into a segment 6514register. 6515 6516ARPL (Adjust Requestor's Privilege Level) adjusts the RPL field of a 6517selector to become the larger of its original value and the value of the RPL 6518field in a specified register. The latter is normally loaded from the image 6519of the caller's CS register which is on the stack. If the adjustment changes 6520the selector's RPL, ZF (the zero flag) is set; otherwise, ZF is cleared. 6521 6522 65236.4 Page-Level Protection 6524 6525Two kinds of protection are related to pages: 6526 6527 1. Restriction of addressable domain. 6528 2. Type checking. 6529 6530 65316.4.1 Page-Table Entries Hold Protection Parameters 6532 6533Figure 6-10 highlights the fields of PDEs and PTEs that control access to 6534pages. 6535 6536 6537Figure 6-10. Protection Fields of Page Table Entries 6538 6539 31 12 11 7 0 6540 ͻ 6541 UR 6542 PAGE FRAME ADDRESS 31..12AVAIL00DA00//P 6543 SW 6544 ͼ 6545 R/W - READ/WRITE 6546 U/S - USER/SUPERVISOR 6547 6548 65496.4.1.1 Restricting Addressable Domain 6550 6551The concept of privilege for pages is implemented by assigning each page to 6552one of two levels: 6553 6554 1. Supervisor level (U/S=0) for the operating system and other systems 6555 software and related data. 6556 6557 2. User level (U/S=1) for applications procedures and data. 6558 6559The current level (U or S) is related to CPL. If CPL is 0, 1, or 2, the 6560processor is executing at supervisor level. If CPL is 3, the processor is 6561executing at user level. 6562 6563When the processor is executing at supervisor level, all pages are 6564addressable, but, when the processor is executing at user level, only pages 6565that belong to the user level are addressable. 6566 6567 65686.4.1.2 Type Checking 6569 6570At the level of page addressing, two types are defined: 6571 6572 1. Read-only access (R/W=0) 6573 2. Read/write access (R/W=1) 6574 6575When the processor is executing at supervisor level, all pages are both 6576readable and writable. When the processor is executing at user level, only 6577pages that belong to user level and are marked for read/write access are 6578writable; pages that belong to supervisor level are neither readable nor 6579writable from user level. 6580 6581 65826.4.2 Combining Protection of Both Levels of Page Tables 6583 6584For any one page, the protection attributes of its page directory entry may 6585differ from those of its page table entry. The 80386 computes the effective 6586protection attributes for a page by examining the protection attributes in 6587both the directory and the page table. Table 6-5 shows the effective 6588protection provided by the possible combinations of protection attributes. 6589 6590 65916.4.3 Overrides to Page Protection 6592 6593Certain accesses are checked as if they are privilege-level 0 references, 6594even if CPL = 3: 6595 6596 LDT, GDT, TSS, IDT references. 6597 Access to inner stack during ring-crossing CALL/INT. 6598 6599 66006.5 Combining Page and Segment Protection 6601 6602When paging is enabled, the 80386 first evaluates segment protection, then 6603evaluates page protection. If the processor detects a protection violation 6604at either the segment or the page level, the requested operation cannot 6605proceed; a protection exception occurs instead. 6606 6607For example, it is possible to define a large data segment which has some 6608subunits that are read-only and other subunits that are read-write. In this 6609case, the page directory (or page table) entries for the read-only subunits 6610would have the U/S and R/W bits set to x0, indicating no write rights for 6611all the pages described by that directory entry (or for individual pages). 6612This technique might be used, for example, in a UNIX-like system to define 6613a large data segment, part of which is read only (for shared data or ROMmed 6614constants). This enables UNIX-like systems to define a "flat" data space as 6615one large segment, use "flat" pointers to address within this "flat" space, 6616yet be able to protect shared data, shared files mapped into the virtual 6617space, and supervisor areas. 6618 6619 6620Table 6-5. Combining Directory and Page Protection 6621 6622Page Directory Entry Page Table Entry Combined Protection 6623 U/S R/W U/S R/W U/S R/W 6624 6625 S-0 R-0 S-0 R-0 S x 6626 S-0 R-0 S-0 W-1 S x 6627 S-0 R-0 U-1 R-0 S x 6628 S-0 R-0 U-1 W-1 S x 6629 S-0 W-1 S-0 R-0 S x 6630 S-0 W-1 S-0 W-1 S x 6631 S-0 W-1 U-1 R-0 S x 6632 S-0 W-1 U-1 W-1 S x 6633 U-1 R-0 S-0 R-0 S x 6634 U-1 R-0 S-0 W-1 S x 6635 U-1 R-0 U-1 R-0 U R 6636 U-1 R-0 U-1 W-1 U R 6637 U-1 W-1 S-0 R-0 S x 6638 U-1 W-1 S-0 W-1 S x 6639 U-1 W-1 U-1 R-0 U R 6640 U-1 W-1 U-1 W-1 U W 6641 6642 6643NOTE 6644 S Supervisor 6645 R Read only 6646 U User 6647 W Read and Write 6648 x indicates that when the combined U/S attribute is S, the R/W attribute 6649 is not checked. 6650 6651 6652 6653Chapter 7 Multitasking 6654 6655 6656 6657To provide efficient, protected multitasking, the 80386 employs several 6658special data structures. It does not, however, use special instructions to 6659control multitasking; instead, it interprets ordinary control-transfer 6660instructions differently when they refer to the special data structures. The 6661registers and data structures that support multitasking are: 6662 6663 Task state segment 6664 Task state segment descriptor 6665 Task register 6666 Task gate descriptor 6667 6668With these structures the 80386 can rapidly switch execution from one task 6669to another, saving the context of the original task so that the task can be 6670restarted later. In addition to the simple task switch, the 80386 offers two 6671other task-management features: 6672 6673 1. Interrupts and exceptions can cause task switches (if needed in the 6674 system design). The processor not only switches automatically to the 6675 task that handles the interrupt or exception, but it automatically 6676 switches back to the interrupted task when the interrupt or exception 6677 has been serviced. Interrupt tasks may interrupt lower-priority 6678 interrupt tasks to any depth. 6679 6680 2. With each switch to another task, the 80386 can also switch to 6681 another LDT and to another page directory. Thus each task can have a 6682 different logical-to-linear mapping and a different linear-to-physical 6683 mapping. This is yet another protection feature, because tasks can be 6684 isolated and prevented from interfering with one another. 6685 6686 66877.1 Task State Segment 6688 6689All the information the processor needs in order to manage a task is stored 6690in a special type of segment, a task state segment (TSS). Figure 7-1 shows 6691the format of a TSS for executing 80386 tasks. (Another format is used for 6692executing 80286 tasks; refer to Chapter 13.) 6693 6694The fields of a TSS belong to two classes: 6695 6696 1. A dynamic set that the processor updates with each switch from the 6697 task. This set includes the fields that store: 6698 6699 The general registers (EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI). 6700 6701 The segment registers (ES, CS, SS, DS, FS, GS). 6702 6703 The flags register (EFLAGS). 6704 6705 The instruction pointer (EIP). 6706 6707 The selector of the TSS of the previously executing task (updated 6708 only when a return is expected). 6709 6710 2. A static set that the processor reads but does not change. This set 6711 includes the fields that store: 6712 6713 The selector of the task's LDT. 6714 6715 The register (PDBR) that contains the base address of the task's 6716 page directory (read only when paging is enabled). 6717 6718 Pointers to the stacks for privilege levels 0-2. 6719 6720 The T-bit (debug trap bit) which causes the processor to raise a 6721 debug exception when a task switch occurs. (Refer to Chapter 12 6722 for more information on debugging.) 6723 6724 The I/O map base (refer to Chapter 8 for more information on the 6725 use of the I/O map). 6726 6727Task state segments may reside anywhere in the linear space. The only case 6728that requires caution is when the TSS spans a page boundary and the 6729higher-addressed page is not present. In this case, the processor raises an 6730exception if it encounters the not-present page while reading the TSS during 6731a task switch. Such an exception can be avoided by either of two strategies: 6732 6733 1. By allocating the TSS so that it does not cross a page boundary. 6734 6735 2. By ensuring that both pages are either both present or both 6736 not-present at the time of a task switch. If both pages are 6737 not-present, then the page-fault handler must make both pages present 6738 before restarting the instruction that caused the task switch. 6739 6740 6741Figure 7-1. 80386 32-Bit Task State Segment 6742 6743 31 23 15 7 0 6744 ͻ 6745 I/O MAP BASE 0 0 0 0 0 0 0 0 0 0 0 0 0 T64 6746 Ķ 6747 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 LDT 60 6748 Ķ 6749 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 GS 5C 6750 Ķ 6751 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FS 58 6752 Ķ 6753 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DS 54 6754 Ķ 6755 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 SS 50 6756 Ķ 6757 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 CS 4C 6758 Ķ 6759 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ES 48 6760 Ķ 6761 EDI 44 6762 Ķ 6763 ESI 40 6764 Ķ 6765 EBP 3C 6766 Ķ 6767 ESP 38 6768 Ķ 6769 EBX 34 6770 Ķ 6771 EDX 30 6772 6773 ECX 2C 6774 Ķ 6775 EAX 28 6776 Ķ 6777 EFLAGS 24 6778 Ķ 6779 INSTRUCTION POINTER (EIP) 20 6780 Ķ 6781 CR3 (PDPR) 1C 6782 Ķ 6783 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 SS2 18 6784 Ķ 6785 ESP2 14 6786 Ķ 6787 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 SS1 10 6788 Ķ 6789 ESP1 0C 6790 Ķ 6791 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 SS0 8 6792 Ķ 6793 ESP0 4 6794 Ķ 6795 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 BACK LINK TO PREVIOUS TSS 0 6796 ͼ 6797 6798 6799NOTE 6800 0 MEANS INTEL RESERVED. DO NOT DEFINE. 6801 6802 6803 68047.2 TSS Descriptor 6805 6806The task state segment, like all other segments, is defined by a 6807descriptor. Figure 7-2 shows the format of a TSS descriptor. 6808 6809The B-bit in the type field indicates whether the task is busy. A type code 6810of 9 indicates a non-busy task; a type code of 11 indicates a busy task. 6811Tasks are not reentrant. The B-bit allows the processor to detect an attempt 6812to switch to a task that is already busy. 6813 6814The BASE, LIMIT, and DPL fields and the G-bit and P-bit have functions 6815similar to their counterparts in data-segment descriptors. The LIMIT field, 6816however, must have a value equal to or greater than 103. An attempt to 6817switch to a task whose TSS descriptor has a limit less that 103 causes an 6818exception. A larger limit is permissible, and a larger limit is required if 6819an I/O permission map is present. A larger limit may also be convenient for 6820systems software if additional data is stored in the same segment as the 6821TSS. 6822 6823A procedure that has access to a TSS descriptor can cause a task switch. In 6824most systems the DPL fields of TSS descriptors should be set to zero, so 6825that only trusted software has the right to perform task switching. 6826 6827Having access to a TSS-descriptor does not give a procedure the right to 6828read or modify a TSS. Reading and modification can be accomplished only with 6829another descriptor that redefines the TSS as a data segment. An attempt to 6830load a TSS descriptor into any of the segment registers (CS, SS, DS, ES, FS, 6831GS) causes an exception. 6832 6833TSS descriptors may reside only in the GDT. An attempt to identify a TSS 6834with a selector that has TI=1 (indicating the current LDT) results in an 6835exception. 6836 6837 6838Figure 7-2. TSS Descriptor for 32-bit TSS 6839 6840 31 23 15 7 0 6841 ͻ 6842 A LIMIT TYPE 6843 BASE 31..24 G00V P DPL BASE 23..16 4 6844 L 19..16 010B1 6845 Ķ 6846 6847 BASE 15..0 LIMIT 15..0 0 6848 6849 ͼ 6850 6851 68527.3 Task Register 6853 6854The task register (TR) identifies the currently executing task by pointing 6855to the TSS. Figure 7-3 shows the path by which the processor accesses the 6856current TSS. 6857 6858The task register has both a "visible" portion (i.e., can be read and 6859changed by instructions) and an "invisible" portion (maintained by the 6860processor to correspond to the visible portion; cannot be read by any 6861instruction). The selector in the visible portion selects a TSS descriptor 6862in the GDT. The processor uses the invisible portion to cache the base and 6863limit values from the TSS descriptor. Holding the base and limit in a 6864register makes execution of the task more efficient, because the processor 6865does not need to repeatedly fetch these values from memory when it 6866references the TSS of the current task. 6867 6868The instructions LTR and STR are used to modify and read the visible 6869portion of the task register. Both instructions take one operand, a 16-bit 6870selector located in memory or in a general register. 6871 6872LTR (Load task register) loads the visible portion of the task register 6873with the selector operand, which must select a TSS descriptor in the GDT. 6874LTR also loads the invisible portion with information from the TSS 6875descriptor selected by the operand. LTR is a privileged instruction; it may 6876be executed only when CPL is zero. LTR is generally used during system 6877initialization to give an initial value to the task register; thereafter, 6878the contents of TR are changed by task switch operations. 6879 6880STR (Store task register) stores the visible portion of the task register 6881in a general register or memory word. STR is not privileged. 6882 6883 6884Figure 7-3. Task Register 6885 6886 ͻ 6887 6888 6889 TASK STATE 6890 SEGMENT Ŀ 6891 6892 6893 ͼ 6894 16-BIT VISIBLE 6895 REGISTER HIDDEN REGISTER 6896 ͻ 6897 TR SELECTOR (BASE) (LIMT) 6898 ͼ 6899 6900 Ŀ 6901 GLOBAL DESCRIPTOR TABLE 6902 6903 | TSS DESCRIPTOR | 6904 ͻ 6905 6906 6907 6908 ͼ 6909 | | 6910 ; 6911 6912 69137.4 Task Gate Descriptor 6914 6915A task gate descriptor provides an indirect, protected reference to a TSS. 6916Figure 7-4 illustrates the format of a task gate. 6917 6918The SELECTOR field of a task gate must refer to a TSS descriptor. The value 6919of the RPL in this selector is not used by the processor. 6920 6921The DPL field of a task gate controls the right to use the descriptor to 6922cause a task switch. A procedure may not select a task gate descriptor 6923unless the maximum of the selector's RPL and the CPL of the procedure is 6924numerically less than or equal to the DPL of the descriptor. This constraint 6925prevents untrusted procedures from causing a task switch. (Note that when a 6926task gate is used, the DPL of the target TSS descriptor is not used for 6927privilege checking.) 6928 6929A procedure that has access to a task gate has the power to cause a task 6930switch, just as a procedure that has access to a TSS descriptor. The 80386 6931has task gates in addition to TSS descriptors to satisfy three needs: 6932 6933 1. The need for a task to have a single busy bit. Because the busy-bit 6934 is stored in the TSS descriptor, each task should have only one such 6935 descriptor. There may, however, be several task gates that select the 6936 single TSS descriptor. 6937 6938 2. The need to provide selective access to tasks. Task gates fulfill 6939 this need, because they can reside in LDTs and can have a DPL that is 6940 different from the TSS descriptor's DPL. A procedure that does not 6941 have sufficient privilege to use the TSS descriptor in the GDT (which 6942 usually has a DPL of 0) can still switch to another task if it has 6943 access to a task gate for that task in its LDT. With task gates, 6944 systems software can limit the right to cause task switches to 6945 specific tasks. 6946 6947 3. The need for an interrupt or exception to cause a task switch. Task 6948 gates may also reside in the IDT, making it possible for interrupts 6949 and exceptions to cause task switching. When interrupt or exception 6950 vectors to an IDT entry that contains a task gate, the 80386 switches 6951 to the indicated task. Thus, all tasks in the system can benefit from 6952 the protection afforded by isolation from interrupt tasks. 6953 6954Figure 7-5 illustrates how both a task gate in an LDT and a task gate in 6955the IDT can identify the same task. 6956 6957 6958Figure 7-4. Task Gate Descriptor 6959 6960 31 23 15 7 0 6961 ͻ 6962 6963 (NOT USED)P DPL 0 0 1 0 1(NOT USED) 4 6964 6965 Ķ 6966 6967 SELECTOR (NOT USED) 0 6968 6969 ͼ 6970 6971 6972Figure 7-5. Task Gate Indirectly Identifies Task 6973 6974 LOCAL DESCRIPTOR TABLE INTERRUPT DESCRIPTOR TABLE 6975 6976 | | | | 6977 | TASK GATE | | TASK GATE | 6978 ͻ ͻ 6979 6980 Ķ Ķ 6981 Ķ Ķ 6982 ͼ ͼ 6983 | | | | 6984 | | | | 6985 ; ; 6986 Ŀ 6987 GLOBAL DESCRIPTOR TABLE 6988 6989 | | 6990 | TASK DESCRIPTOR | 6991 ͻ 6992 6993 Ķ 6994 Ŀ 6995 ͼ 6996 | | 6997 | | 6998 ; 6999 7000 ͻ 7001 7002 7003 7004 TASK STATE 7005 SEGMENT 7006 7007 7008 7009 ͼ 7010 7011 70127.5 Task Switching 7013 7014The 80386 switches execution to another task in any of four cases: 7015 7016 1. The current task executes a JMP or CALL that refers to a TSS 7017 descriptor. 7018 7019 2. The current task executes a JMP or CALL that refers to a task gate. 7020 7021 3. An interrupt or exception vectors to a task gate in the IDT. 7022 7023 4. The current task executes an IRET when the NT flag is set. 7024 7025JMP, CALL, IRET, interrupts, and exceptions are all ordinary mechanisms of 7026the 80386 that can be used in circumstances that do not require a task 7027switch. Either the type of descriptor referenced or the NT (nested task) bit 7028in the flag word distinguishes between the standard mechanism and the 7029variant that causes a task switch. 7030 7031To cause a task switch, a JMP or CALL instruction can refer either to a TSS 7032descriptor or to a task gate. The effect is the same in either case: the 703380386 switches to the indicated task. 7034 7035An exception or interrupt causes a task switch when it vectors to a task 7036gate in the IDT. If it vectors to an interrupt or trap gate in the IDT, a 7037task switch does not occur. Refer to Chapter 9 for more information on the 7038interrupt mechanism. 7039 7040Whether invoked as a task or as a procedure of the interrupted task, an 7041interrupt handler always returns control to the interrupted procedure in the 7042interrupted task. If the NT flag is set, however, the handler is an 7043interrupt task, and the IRET switches back to the interrupted task. 7044 7045A task switching operation involves these steps: 7046 7047 1. Checking that the current task is allowed to switch to the designated 7048 task. Data-access privilege rules apply in the case of JMP or CALL 7049 instructions. The DPL of the TSS descriptor or task gate must be less 7050 than or equal to the maximum of CPL and the RPL of the gate selector. 7051 Exceptions, interrupts, and IRETs are permitted to switch tasks 7052 regardless of the DPL of the target task gate or TSS descriptor. 7053 7054 2. Checking that the TSS descriptor of the new task is marked present 7055 and has a valid limit. Any errors up to this point occur in the 7056 context of the outgoing task. Errors are restartable and can be 7057 handled in a way that is transparent to applications procedures. 7058 7059 3. Saving the state of the current task. The processor finds the base 7060 address of the current TSS cached in the task register. It copies the 7061 registers into the current TSS (EAX, ECX, EDX, EBX, ESP, EBP, ESI, 7062 EDI, ES, CS, SS, DS, FS, GS, and the flag register). The EIP field of 7063 the TSS points to the instruction after the one that caused the task 7064 switch. 7065 7066 4. Loading the task register with the selector of the incoming task's 7067 TSS descriptor, marking the incoming task's TSS descriptor as busy, 7068 and setting the TS (task switched) bit of the MSW. The selector is 7069 either the operand of a control transfer instruction or is taken from 7070 a task gate. 7071 7072 5. Loading the incoming task's state from its TSS and resuming 7073 execution. The registers loaded are the LDT register; the flag 7074 register; the general registers EIP, EAX, ECX, EDX, EBX, ESP, EBP, 7075 ESI, EDI; the segment registers ES, CS, SS, DS, FS, and GS; and PDBR. 7076 Any errors detected in this step occur in the context of the incoming 7077 task. To an exception handler, it appears that the first instruction 7078 of the new task has not yet executed. 7079 7080Note that the state of the outgoing task is always saved when a task switch 7081occurs. If execution of that task is resumed, it starts after the 7082instruction that caused the task switch. The registers are restored to the 7083values they held when the task stopped executing. 7084 7085Every task switch sets the TS (task switched) bit in the MSW (machine 7086status word). The TS flag is useful to systems software when a coprocessor 7087(such as a numerics coprocessor) is present. The TS bit signals that the 7088context of the coprocessor may not correspond to the current 80386 task. 7089Chapter 11 discusses the TS bit and coprocessors in more detail. 7090 7091Exception handlers that field task-switch exceptions in the incoming task 7092(exceptions due to tests 4 thru 16 of Table 7-1) should be cautious about 7093taking any action that might load the selector that caused the exception. 7094Such an action will probably cause another exception, unless the exception 7095handler first examines the selector and fixes any potential problem. 7096 7097The privilege level at which execution resumes in the incoming task is 7098neither restricted nor affected by the privilege level at which the outgoing 7099task was executing. Because the tasks are isolated by their separate address 7100spaces and TSSs and because privilege rules can be used to prevent improper 7101access to a TSS, no privilege rules are needed to constrain the relation 7102between the CPLs of the tasks. The new task begins executing at the 7103privilege level indicated by the RPL of the CS selector value that is loaded 7104from the TSS. 7105 7106 7107Table 7-1. Checks Made during a Task Switch 7108 7109 7110Test Test Description Exception 7111NP = Segment-not-present exception, GP = General protection fault, TS = 7112Invalid TSS, SF = Stack fault Error Code Selects 7113 7114 1 Incoming TSS descriptor is NP Incoming TSS 7115 present 7116 2 Incoming TSS descriptor is GP Incoming TSS 7117 marked not-busy 7118 3 Limit of incoming TSS is TS Incoming TSS 7119 greater than or equal to 103 7120 7121 All register and selector values are loaded 7122 7123 4 LDT selector of incoming TS Incoming TSS 7124 task is valid 7125 5 LDT of incoming task is TS Incoming TSS 7126 present 7127 6 CS selector is valid 7128Validity tests of a selector check that the selector is in the proper 7129table (eg., the LDT selector refers to the GDT), lies within the bounds of 7130the table, and refers to the proper type of descriptor (e.g., the LDT 7131selector refers to an LDT descriptor). TS Code segment 7132 7 Code segment is present NP Code segment 7133 8 Code segment DPL matches TS Code segment 7134 CS RPL 7135 9 Stack segment is valid 7136Validity tests of a selector check that the selector is in the proper 7137table (eg., the LDT selector refers to the GDT), lies within the bounds of 7138the table, and refers to the proper type of descriptor (e.g., the LDT 7139selector refers to an LDT descriptor). GP Stack segment 7140 10 Stack segment is present SF Stack segment 7141 11 Stack segment DPL = CPL SF Stack segment 7142 12 Stack-selector RPL = CPL GP Stack segment 7143 13 DS, ES, FS, GS selectors are GP Segment 7144 valid 7145Validity tests of a selector check that the selector is in the proper 7146table (eg., the LDT selector refers to the GDT), lies within the bounds of 7147the table, and refers to the proper type of descriptor (e.g., the LDT 7148selector refers to an LDT descriptor). 7149 7150 7151 14 DS, ES, FS, GS segments GP Segment 7152 are readable 7153 15 DS, ES, FS, GS segments NP Segment 7154 are present 7155 16 DS, ES, FS, GS segment DPL GP Segment 7156 CPL (unless these are 7157 conforming segments) 7158 7159 71607.6 Task Linking 7161 7162The back-link field of the TSS and the NT (nested task) bit of the flag 7163word together allow the 80386 to automatically return to a task that CALLed 7164another task or was interrupted by another task. When a CALL instruction, an 7165interrupt instruction, an external interrupt, or an exception causes a 7166switch to a new task, the 80386 automatically fills the back-link of the new 7167TSS with the selector of the outgoing task's TSS and, at the same time, 7168sets the NT bit in the new task's flag register. The NT flag indicates 7169whether the back-link field is valid. The new task releases control by 7170executing an IRET instruction. When interpreting an IRET, the 80386 examines 7171the NT flag. If NT is set, the 80386 switches back to the task selected by 7172the back-link field. Table 7-2 summarizes the uses of these fields. 7173 7174 7175Table 7-2. Effect of Task Switch on BUSY, NT, and Back-Link 7176 7177Affected Field Effect of JMP Effect of Effect of 7178 Instruction CALL Instruction IRET Instruction 7179 7180Busy bit of Set, must be Set, must be 0 Unchanged, 7181incoming task 0 before before must be set 7182 7183Busy bit of Cleared Unchanged Cleared 7184outgoing task (already set) 7185 7186NT bit of Cleared Set Unchanged 7187incoming task 7188 7189NT bit of Unchanged Unchanged Cleared 7190outgoing task 7191 7192Back-link of Unchanged Set to outgoing Unchanged 7193incoming task TSS selector 7194 7195Back-link of Unchanged Unchanged Unchanged 7196outgoing task 7197 7198 71997.6.1 Busy Bit Prevents Loops 7200 7201The B-bit (busy bit) of the TSS descriptor ensures the integrity of the 7202back-link. A chain of back-links may grow to any length as interrupt tasks 7203interrupt other interrupt tasks or as called tasks call other tasks. The 7204busy bit ensures that the CPU can detect any attempt to create a loop. A 7205loop would indicate an attempt to reenter a task that is already busy; 7206however, the TSS is not a reentrable resource. 7207 7208The processor uses the busy bit as follows: 7209 7210 1. When switching to a task, the processor automatically sets the busy 7211 bit of the new task. 7212 7213 2. When switching from a task, the processor automatically clears the 7214 busy bit of the old task if that task is not to be placed on the 7215 back-link chain (i.e., the instruction causing the task switch is JMP 7216 or IRET). If the task is placed on the back-link chain, its busy bit 7217 remains set. 7218 7219 3. When switching to a task, the processor signals an exception if the 7220 busy bit of the new task is already set. 7221 7222By these actions, the processor prevents a task from switching to itself or 7223to any task that is on a back-link chain, thereby preventing invalid reentry 7224into a task. 7225 7226The busy bit is effective even in multiprocessor configurations, because 7227the processor automatically asserts a bus lock when it sets or clears the 7228busy bit. This action ensures that two processors do not invoke the same 7229task at the same time. (Refer to Chapter 11 for more on multiprocessing.) 7230 7231 72327.6.2 Modifying Task Linkages 7233 7234Any modification of the linkage order of tasks should be accomplished only 7235by software that can be trusted to correctly update the back-link and the 7236busy-bit. Such changes may be needed to resume an interrupted task before 7237the task that interrupted it. Trusted software that removes a task from the 7238back-link chain must follow one of the following policies: 7239 7240 1. First change the back-link field in the TSS of the interrupting task, 7241 then clear the busy-bit in the TSS descriptor of the task removed from 7242 the list. 7243 7244 2. Ensure that no interrupts occur between updating the back-link chain 7245 and the busy bit. 7246 7247 72487.7 Task Address Space 7249 7250The LDT selector and PDBR fields of the TSS give software systems designers 7251flexibility in utilization of segment and page mapping features of the 725280386. By appropriate choice of the segment and page mappings for each task, 7253tasks may share address spaces, may have address spaces that are largely 7254distinct from one another, or may have any degree of sharing between these 7255two extremes. 7256 7257The ability for tasks to have distinct address spaces is an important 7258aspect of 80386 protection. A module in one task cannot interfere with a 7259module in another task if the modules do not have access to the same address 7260spaces. The flexible memory management features of the 80386 allow systems 7261designers to assign areas of shared address space to those modules of 7262different tasks that are designed to cooperate with each other. 7263 7264 72657.7.1 Task Linear-to-Physical Space Mapping 7266 7267The choices for arranging the linear-to-physical mappings of tasks fall 7268into two general classes: 7269 7270 1. One linear-to-physical mapping shared among all tasks. 7271 7272 When paging is not enabled, this is the only possibility. Without page 7273 tables, all linear addresses map to the same physical addresses. 7274 7275 When paging is enabled, this style of linear-to-physical mapping 7276 results from using one page directory for all tasks. The linear space 7277 utilized may exceed the physical space available if the operating 7278 system also implements page-level virtual memory. 7279 7280 2. Several partially overlapping linear-to-physical mappings. 7281 7282 This style is implemented by using a different page directory for each 7283 task. Because the PDBR (page directory base register) is loaded from 7284 the TSS with each task switch, each task may have a different page 7285 directory. 7286 7287In theory, the linear address spaces of different tasks may map to 7288completely distinct physical addresses. If the entries of different page 7289directories point to different page tables and the page tables point to 7290different pages of physical memory, then the tasks do not share any physical 7291addresses. 7292 7293In practice, some portion of the linear address spaces of all tasks must 7294map to the same physical addresses. The task state segments must lie in a 7295common space so that the mapping of TSS addresses does not change while the 7296processor is reading and updating the TSSs during a task switch. The linear 7297space mapped by the GDT should also be mapped to a common physical space; 7298otherwise, the purpose of the GDT is defeated. Figure 7-6 shows how the 7299linear spaces of two tasks can overlap in the physical space by sharing 7300page tables. 7301 7302 73037.7.2 Task Logical Address Space 7304 7305By itself, a common linear-to-physical space mapping does not enable 7306sharing of data among tasks. To share data, tasks must also have a common 7307logical-to-linear space mapping; i.e., they must also have access to 7308descriptors that point into a shared linear address space. There are three 7309ways to create common logical-to-physical address-space mappings: 7310 7311 1. Via the GDT. All tasks have access to the descriptors in the GDT. If 7312 those descriptors point into a linear-address space that is mapped to 7313 a common physical-address space for all tasks, then the tasks can 7314 share data and instructions. 7315 7316 2. By sharing LDTs. Two or more tasks can use the same LDT if the LDT 7317 selectors in their TSSs select the same LDT segment. Those 7318 LDT-resident descriptors that point into a linear space that is mapped 7319 to a common physical space permit the tasks to share physical memory. 7320 This method of sharing is more selective than sharing by the GDT; the 7321 sharing can be limited to specific tasks. Other tasks in the system 7322 may have different LDTs that do not give them access to the shared 7323 areas. 7324 7325 3. By descriptor aliases in LDTs. It is possible for certain descriptors 7326 of different LDTs to point to the same linear address space. If that 7327 linear address space is mapped to the same physical space by the page 7328 mapping of the tasks involved, these descriptors permit the tasks to 7329 share the common space. Such descriptors are commonly called 7330 "aliases". This method of sharing is even more selective than the 7331 prior two; other descriptors in the LDTs may point to distinct linear 7332 addresses or to linear addresses that are not shared. 7333 7334 7335Figure 7-6. Partially-Overlapping Linear Spaces 7336 7337 TSSs PAGE FRAMES 7338 ͻ 7339 TASK A TSS PAGE DIRECTORIES PAGE TABLES TASK A 7340 ͻ ͻ ͻ PAGE 7341 ͼ 7342 ͻ 7343 PTE TASK A 7344 PAGE 7345 PTE ͼ 7346 ͻ 7347 PDBR PDE PTE Ŀ TASK A 7348 ͼ PAGE 7349 PDE Ŀ SHARED PT ͼ 7350 ͼ ͼ ͻ ͻ 7351 SHARED 7352 PAGE 7353 ͼ 7354 ͻ 7355 PTE SHARED 7356 PAGE 7357 PTE ͼ 7358 TASK B TSS ͼ ͻ 7359 ͻ ͻ TASK B 7360 PAGE 7361 ͻ ͼ 7362 ͻ 7363 TASK B 7364 PAGE 7365 ͼ 7366 PDBR PDE PTE PAGE FRAMES 7367 7368 PDE PTE 7369 ͼ ͼ ͼ 7370 TSSs PAGE DIRECTORIES PAGE TABLES 7371 7372 7373Chapter 8 Input/Output 7374 7375 7376 7377This chapter presents the I/O features of the 80386 from the following 7378perspectives: 7379 7380 Methods of addressing I/O ports 7381 7382 Instructions that cause I/O operations 7383 7384 Protection as it applies to the use of I/O instructions and I/O port 7385 addresses. 7386 7387 73888.1 I/O Addressing 7389 7390The 80386 allows input/output to be performed in either of two ways: 7391 7392 By means of a separate I/O address space (using specific I/O 7393 instructions) 7394 7395 By means of memory-mapped I/O (using general-purpose operand 7396 manipulationinstructions). 7397 7398 73998.1.1 I/O Address Space 7400 7401The 80386 provides a separate I/O address space, distinct from physical 7402memory, that can be used to address the input/output ports that are used for 7403external 16 devices. The I/O address space consists of 2^(16) (64K) 7404individually addressable 8-bit ports; any two consecutive 8-bit ports can be 7405treated as a 16-bit port; and four consecutive 8-bit ports can be treated 7406as a 32-bit port. Thus, the I/O address space can accommodate up to 64K 74078-bit ports, up to 32K 16-bit ports, or up to 16K 32-bit ports. 7408 7409The program can specify the address of the port in two ways. Using an 7410immediate byte constant, the program can specify: 7411 7412 256 8-bit ports numbered 0 through 255. 7413 128 16-bit ports numbered 0, 2, 4, . . . , 252, 254. 7414 64 32-bit ports numbered 0, 4, 8, . . . , 248, 252. 7415 7416Using a value in DX, the program can specify: 7417 7418 8-bit ports numbered 0 through 65535 7419 16-bit ports numbered 0, 2, 4, . . . , 65532, 65534 7420 32-bit ports numbered 0, 4, 8, . . . , 65528, 65532 7421 7422The 80386 can transfer 32, 16, or 8 bits at a time to a device located in 7423the I/O space. Like doublewords in memory, 32-bit ports should be aligned at 7424addresses evenly divisible by four so that the 32 bits can be transferred in 7425a single bus access. Like words in memory, 16-bit ports should be aligned at 7426even-numbered addresses so that the 16 bits can be transferred in a single 7427bus access. An 8-bit port may be located at either an even or odd address. 7428 7429The instructions IN and OUT move data between a register and a port in the 7430I/O address space. The instructions INS and OUTS move strings of data 7431between the memory address space and ports in the I/O address space. 7432 7433 74348.1.2 Memory-Mapped I/O 7435 7436I/O devices also may be placed in the 80386 memory address space. As long 7437as the devices respond like memory components, they are indistinguishable to 7438the processor. 7439 7440Memory-mapped I/O provides additional programming flexibility. Any 7441instruction that references memory may be used to access an I/O port located 7442in the memory space. For example, the MOV instruction can transfer data 7443between any register and a port; and the AND, OR, and TEST instructions may 7444be used to manipulate bits in the internal registers of a device (see Figure 74458-1). Memory-mapped I/O performed via the full instruction set maintains 7446the full complement of addressing modes for selecting the desired I/O 7447device (e.g., direct address, indirect address, base register, index 7448register, scaling). 7449 7450Memory-mapped I/O, like any other memory reference, is subject to access 7451protection and control when executing in protected mode. Refer to Chapter 6 7452for a discussion of memory protection. 7453 7454 74558.2 I/O Instructions 7456 7457The I/O instructions of the 80386 provide access to the processor's I/O 7458ports for the transfer of data to and from peripheral devices. These 7459instructions have as one operand the address of a port in the I/O address 7460space. There are two classes of I/O instruction: 7461 7462 1. Those that transfer a single item (byte, word, or doubleword) located 7463 in a register. 7464 7465 2. Those that transfer strings of items (strings of bytes, words, or 7466 doublewords) located in memory. These are known as "string I/O 7467 instructions" or "block I/O instructions". 7468 7469 74708.2.1 Register I/O Instructions 7471 7472The I/O instructions IN and OUT are provided to move data between I/O ports 7473and the EAX (32-bit I/O), the AX (16-bit I/O), or AL (8-bit I/O) general 7474registers. IN and OUT instructions address I/O ports either directly, with 7475the address of one of up to 256 port addresses coded in the instruction, or 7476indirectly via the DX register to one of up to 64K port addresses. 7477 7478IN (Input from Port) transfers a byte, word, or doubleword from an input 7479port to AL, AX, or EAX. If a program specifies AL with the IN instruction, 7480the processor transfers 8 bits from the selected port to AL. If a program 7481specifies AX with the IN instruction, the processor transfers 16 bits from 7482the port to AX. If a program specifies EAX with the IN instruction, the 7483processor transfers 32 bits from the port to EAX. 7484 7485OUT (Output to Port) transfers a byte, word, or doubleword to an output 7486port from AL, AX, or EAX. The program can specify the number of the port 7487using the same methods as the IN instruction. 7488 7489 7490Figure 8-1. Memory-Mapped I/O 7491 7492 MEMORY 7493 ADDRESS SPACE I/O DEVICE 1 7494 ͻ ͻ 7495 INTERNAL REGISTER 7496 Ķ ĺͻ 7497 7498 Ķ ĺͼ 7499 ͼ 7500 7501 7502 7503 I/O DEVICE 2 7504 ͻ 7505 INTERNAL REGISTER 7506 Ķ ĺͻ 7507 7508 Ķ ĺͼ 7509 ͼ 7510 ͼ 7511 7512 75138.2.2 Block I/O Instructions 7514 7515The block (or string) I/O instructions INS and OUTS move blocks of data 7516between I/O ports and memory space. Block I/O instructions use the DX 7517register to specify the address of a port in the I/O address space. INS and 7518OUTS use DX to specify: 7519 7520 8-bit ports numbered 0 through 65535 7521 16-bit ports numbered 0, 2, 4, . . . , 65532, 65534 7522 32-bit ports numbered 0, 4, 8, . . . , 65528, 65532 7523 7524Block I/O instructions use either SI or DI to designate the source or 7525destination memory address. For each transfer, SI or DI are automatically 7526either incremented or decremented as specified by the direction bit in the 7527flags register. 7528 7529INS and OUTS, when used with repeat prefixes, cause block input or output 7530operations. REP, the repeat prefix, modifies INS and OUTS to provide a means 7531of transferring blocks of data between an I/O port and memory. These block 7532I/O instructions are string primitives (refer also to Chapter 3 for more on 7533string primitives). They simplify programming and increase the speed of data 7534transfer by eliminating the need to use a separate LOOP instruction or an 7535intermediate register to hold the data. 7536 7537The string I/O primitives can operate on byte strings, word strings, or 7538doubleword strings. After each transfer, the memory address in ESI or EDI is 7539updated by 1 for byte operands, by 2 for word operands, or by 4 for 7540doubleword operands. The value in the direction flag (DF) determines whether 7541the processor automatically increments ESI or EDI (DF=0) or whether it 7542automatically decrements these registers (DF=1). 7543 7544INS (Input String from Port) transfers a byte or a word string element from 7545an input port to memory. The mnemonics INSB, INSW, and INSD are variants 7546that explicitly specify the size of the operand. If a program specifies 7547INSB, the processor transfers 8 bits from the selected port to the memory 7548location indicated by ES:EDI. If a program specifies INSW, the processor 7549transfers 16 bits from the port to the memory location indicated by ES:EDI. 7550If a program specifies INSD, the processor transfers 32 bits from the port 7551to the memory location indicated by ES:EDI. The destination segment register 7552choice (ES) cannot be changed for the INS instruction. Combined with the REP 7553prefix, INS moves a block of information from an input port to a series of 7554consecutive memory locations. 7555 7556OUTS (Output String to Port) transfers a byte, word, or doubleword string 7557element to an output port from memory. The mnemonics OUTSB, OUTSW, and OUTSD 7558are variants that explicitly specify the size of the operand. If a program 7559specifies OUTSB, the processor transfers 8 bits from the memory location 7560indicated by ES:EDI to the the selected port. If a program specifies OUTSW, 7561the processor transfers 16 bits from the memory location indicated by ES:EDI 7562to the the selected port. If a program specifies OUTSD, the processor 7563transfers 32 bits from the memory location indicated by ES:EDI to the the 7564selected port. Combined with the REP prefix, OUTS moves a block of 7565information from a series of consecutive memory locations indicated by 7566DS:ESI to an output port. 7567 7568 75698.3 Protection and I/O 7570 7571Two mechanisms provide protection for I/O functions: 7572 7573 1. The IOPL field in the EFLAGS register defines the right to use 7574 I/O-related instructions. 7575 7576 2. The I/O permission bit map of a 80386 TSS segment defines the right 7577 to use ports in the I/O address space. 7578 7579These mechanisms operate only in protected mode, including virtual 8086 7580mode; they do not operate in real mode. In real mode, there is no protection 7581of the I/O space; any procedure can execute I/O instructions, and any I/O 7582port can be addressed by the I/O instructions. 7583 7584 75858.3.1 I/O Privilege Level 7586 7587Instructions that deal with I/O need to be restricted but also need to be 7588executed by procedures executing at privilege levels other than zero. For 7589this reason, the processor uses two bits of the flags register to store the 7590I/O privilege level (IOPL). The IOPL defines the privilege level 7591needed to execute I/O-related instructions. 7592 7593The following instructions can be executed only if CPL IOPL: 7594 7595IN Input 7596INS Input String 7597OUT Output 7598OUTS Output String 7599CLI Clear Interrupt-Enable Flag 7600STI Set Interrupt-Enable 7601 7602These instructions are called "sensitive" instructions, because they are 7603sensitive to IOPL. 7604 7605To use sensitive instructions, a procedure must execute at a privilege 7606level at least as privileged as that specified by the IOPL (CPL IOPL). Any 7607attempt by a less privileged procedure to use a sensitive instruction 7608results in a general protection exception. 7609 7610Because each task has its own unique copy of the flags register, each task 7611can have a different IOPL. A task whose primary function is to perform I/O 7612(a device driver) can benefit from having an IOPL of three, thereby 7613permitting all procedures of the task to performI/O. Other tasks typically 7614have IOPL set to zero or one, reserving the right to perform I/O 7615instructions for the most privileged procedures. 7616 7617A task can change IOPL only with the POPF instruction; however, such 7618changes are privileged. No procedure may alter IOPL (the I/O privilege level 7619in the flag register) unless the procedure is executing at privilege level 76200. An attempt by a less privileged procedure to alter IOPL does not result 7621in an exception; IOPL simply remains unaltered. 7622 7623The POPF instruction may be used in addition to CLI and STI to alter the 7624interrupt-enable flag (IF); however, changes to IF by POPF are 7625IOPL-sensitive. A procedure may alter IF with a POPF instruction only when 7626executing at a level that is at least as privileged as IOPL. An attempt by a 7627less privileged procedure to alter IF in this manner does not result in an 7628exception; IF simply remains unaltered. 7629 7630 76318.3.2 I/O Permission Bit Map 7632 7633The I/O instructions that directly refer to addresses in the processor's 7634I/O space are IN, INS, OUT, OUTS. The 80386 has the ability to selectively 7635trap references to specific I/O addresses. The structure that enables 7636selective trapping is the I/O Permission Bit Map in the TSS segment (see 7637Figure 8-2). The I/O permission map is a bit vector. The size of the map 7638and its location in the TSS segment are variable. The processor locates the 7639I/O permission map by means of the I/O map base field in the fixed portion 7640of the TSS. The I/O map base field is 16 bits wide and contains the offset 7641of the beginning of the I/O permission map. The upper limit of the I/O 7642permission map is the same as the limit of the TSS segment. 7643 7644In protected mode, when it encounters an I/O instruction (IN, INS, OUT, or 7645OUTS), the processor first checks whether CPL IOPL. If this condition is 7646true, the I/O operation may proceed. If not true, the processor checks the 7647I/O permission map. (In virtual 8086 mode, the processor consults the map 7648without regard for IOPL. Refer to Chapter 15.) 7649 7650Each bit in the map corresponds to an I/O port byte address; for example, 7651the bit for port 41 is found at I/O map base + 5, bit offset 1. The 7652processor tests all the bits that correspond to the I/O addresses spanned by 7653an I/O operation; for example, a doubleword operation tests four bits 7654corresponding to four adjacent byte addresses. If any tested bit is set, 7655the processor signals a general protection exception. If all the tested bits 7656are zero, the I/O operation may proceed. 7657 7658It is not necessary for the I/O permission map to represent all the I/O 7659addresses. I/O addresses not spanned by the map are treated as if they had 7660one bits in the map. For example, if TSS limit is equal to I/O map base + 766131, the first 256 I/O ports are mapped; I/O operations on any port greater 7662than 255 cause an exception. 7663 7664If I/O map base is greater than or equal to TSS limit, the TSS segment has 7665no I/O permission map, and all I/O instructions in the 80386 program cause 7666exceptions when CPL > IOPL. 7667 7668Because the I/O permission map is in the TSS segment, different tasks can 7669have different maps. Thus, the operating system can allocate ports to a task 7670by changing the I/O permission map in the task's TSS. 7671 7672 7673Figure 8-2. I/O Address Bit Map 7674 7675 TSS SEGMEMT 7676 7677 31 23 15 7 0 7678 ͻ 7679 LIMIT 7680 7681 7682 I/O PERMISSION BIT MAP 7683 7684 7685 7686 Ķ 7687 7688 7689 7690 Ķ 7691 Ķ I/O MAP BASE uuuuuuuu uuuuuuuT64 7692 Ķ 7693 00000000 00000000 LOT 60 7694 Ķ 7695 00000000 00000000 GS 5C 7696 Ķ 7697 58 7698 7699 7700 7701 4 7702 Ķ 7703 00000000 00000000 TSS BACK LINK 0 7704 ͼ 7705 7706 7707Chapter 9 Exceptions and Interrupts 7708 7709 7710 7711Interrupts and exceptions are special kinds of control transfer; they work 7712somewhat like unprogrammed CALLs. They alter the normal program flow to 7713handle external events or to report errors or exceptional conditions. The 7714difference between interrupts and exceptions is that interrupts are used to 7715handle asynchronous events external to the processor, but exceptions handle 7716conditions detected by the processor itself in the course of executing 7717instructions. 7718 7719There are two sources for external interrupts and two sources for 7720exceptions: 7721 7722 1. Interrupts 7723 7724 Maskable interrupts, which are signalled via the INTR pin. 7725 7726 Nonmaskable interrupts, which are signalled via the NMI 7727 (Non-Maskable Interrupt) pin. 7728 7729 2. Exceptions 7730 7731 Processor detected. These are further classified as faults, traps, 7732 and aborts. 7733 7734 Programmed. The instructions INTO, INT 3, INT n, and BOUND can 7735 trigger exceptions. These instructions are often called "software 7736 interrupts", but the processor handles them as exceptions. 7737 7738This chapter explains the features that the 80386 offers for controlling 7739and responding to interrupts when it is executing in protected mode. 7740 7741 77429.1 Identifying Interrupts 7743 7744The processor associates an identifying number with each different type of 7745interrupt or exception. 7746 7747The NMI and the exceptions recognized by the processor are assigned 7748predetermined identifiers in the range 0 through 31. Not all of these 7749numbers are currently used by the 80386; unassigned identifiers in this 7750range are reserved by Intel for possible future expansion. 7751 7752The identifiers of the maskable interrupts are determined by external 7753interrupt controllers (such as Intel's 8259A Programmable Interrupt 7754Controller) and communicated to the processor during the processor's 7755interrupt-acknowledge sequence. The numbers assigned by an 8259A PIC can be 7756specified by software. Any numbers in the range 32 through 255 can be used. 7757Table 9-1 shows the assignment of interrupt and exception identifiers. 7758 7759Exceptions are classified as faults, traps, or aborts depending on the way 7760they are reported and whether restart of the instruction that caused the 7761exception is supported. 7762 7763Faults Faults are exceptions that are reported "before" the 7764 instruction causingthe exception. Faults are either detected before 7765 the instruction begins to execute, or during execution of the 7766 instruction. If detected during the instruction, the fault is 7767 reported with the machine restored to a state that permits the 7768 instruction to be restarted. 7769 7770Traps A trap is an exception that is reported at the instruction 7771 boundary immediately after the instruction in which the 7772 exception was detected. 7773 7774Aborts An abort is an exception that permits neither precise location 7775 of the instruction causing the exception nor restart of the program 7776 that caused the exception. Aborts are used to report severe errors, 7777 such as hardware errors and inconsistent or illegal values in system 7778 tables. 7779 7780 7781Table 9-1. Interrupt and Exception ID Assignments 7782 7783Identifier Description 7784 77850 Divide error 77861 Debug exceptions 77872 Nonmaskable interrupt 77883 Breakpoint (one-byte INT 3 instruction) 77894 Overflow (INTO instruction) 77905 Bounds check (BOUND instruction) 77916 Invalid opcode 77927 Coprocessor not available 77938 Double fault 77949 (reserved) 779510 Invalid TSS 779611 Segment not present 779712 Stack exception 779813 General protection 779914 Page fault 780015 (reserved) 780116 Coprecessor error 780217-31 (reserved) 780332-255 Available for external interrupts via INTR pin 7804 7805 78069.2 Enabling and Disabling Interrupts 7807 7808The processor services interrupts and exceptions only between the end of 7809one instruction and the beginning of the next. When the repeat prefix is 7810used to repeat a string instruction, interrupts and exceptions may occur 7811between repetitions. Thus, operations on long strings do not delay interrupt 7812response. 7813 7814Certain conditions and flag settings cause the processor to inhibit certain 7815interrupts and exceptions at instruction boundaries. 7816 7817 78189.2.1 NMI Masks Further NMIs 7819 7820While an NMI handler is executing, the processor ignores further interrupt 7821signals at the NMI pin until the next IRET instruction is executed. 7822 7823 78249.2.2 IF Masks INTR 7825 7826The IF (interrupt-enable flag) controls the acceptance of external 7827interrupts signalled via the INTR pin. When IF=0, INTR interrupts are 7828inhibited; when IF=1, INTR interrupts are enabled. As with the other flag 7829bits, the processor clears IF in response to a RESET signal. The 7830instructions CLI and STI alter the setting of IF. 7831 7832CLI (Clear Interrupt-Enable Flag) and STI (Set Interrupt-Enable Flag) 7833explicitly alter IF (bit 9 in the flag register). These instructions may be 7834executed only if CPL IOPL. A protection exception occurs if they are 7835executed when CPL > IOPL. 7836 7837The IF is also affected implicitly by the following operations: 7838 7839 The instruction PUSHF stores all flags, including IF, in the stack 7840 where they can be examined. 7841 7842 Task switches and the instructions POPF and IRET load the flags 7843 register; therefore, they can be used to modify IF. 7844 7845 Interrupts through interrupt gates automatically reset IF, disabling 7846 interrupts. (Interrupt gates are explained later in this chapter.) 7847 7848 78499.2.3 RF Masks Debug Faults 7850 7851The RF bit in EFLAGS controls the recognition of debug faults. This permits 7852debug faults to be raised for a given instruction at most once, no matter 7853how many times the instruction is restarted. (Refer to Chapter 12 for more 7854information on debugging.) 7855 7856 78579.2.4 MOV or POP to SS Masks Some Interrupts and Exceptions 7858 7859Software that needs to change stack segments often uses a pair of 7860instructions; for example: 7861 7862 MOV SS, AX 7863 MOV ESP, StackTop 7864 7865If an interrupt or exception is processed after SS has been changed but 7866before ESP has received the corresponding change, the two parts of the stack 7867pointer SS:ESP are inconsistent for the duration of the interrupt handler or 7868exception handler. 7869 7870To prevent this situation, the 80386, after both a MOV to SS and a POP to 7871SS instruction, inhibits NMI, INTR, debug exceptions, and single-step traps 7872at the instruction boundary following the instruction that changes SS. Some 7873exceptions may still occur; namely, page fault and general protection fault. 7874Always use the 80386 LSS instruction, and the problem will not occur. 7875 7876 78779.3 Priority Among Simultaneous Interrupts and Exceptions 7878 7879If more than one interrupt or exception is pending at an instruction 7880boundary, the processor services one of them at a time. The priority among 7881classes of interrupt and exception sources is shown in Table 9-2. The 7882processor first services a pending interrupt or exception from the class 7883that has the highest priority, transferring control to the first 7884instruction of the interrupt handler. Lower priority exceptions are 7885discarded; lower priority interrupts are held pending. Discarded exceptions 7886will be rediscovered when the interrupt handler returns control to the point 7887of interruption. 7888 7889 78909.4 Interrupt Descriptor Table 7891 7892The interrupt descriptor table (IDT) associates each interrupt or exception 7893identifier with a descriptor for the instructions that service the 7894associated event. Like the GDT and LDTs, the IDT is an array of 8-byte 7895descriptors. Unlike the GDT and LDTs, the first entry of the IDT may contain 7896a descriptor. To form an index into the IDT, the processor multiplies the 7897interrupt or exception identifier by eight. Because there are only 256 7898identifiers, the IDT need not contain more than 256 descriptors. It can 7899contain fewer than 256 entries; entries are required only for interrupt 7900identifiers that are actually used. 7901 7902The IDT may reside anywhere in physical memory. As Figure 9-1 shows, the 7903processor locates the IDT by means of the IDT register (IDTR). The 7904instructions LIDT and SIDT operate on the IDTR. Both instructions have one 7905explicit operand: the address in memory of a 6-byte area. Figure 9-2 shows 7906the format of this area. 7907 7908LIDT (Load IDT register) loads the IDT register with the linear base 7909address and limit values contained in the memory operand. This instruction 7910can be executed only when the CPL is zero. It is normally used by the 7911initialization logic of an operating system when creating an IDT. An 7912operating system may also use it to change from one IDT to another. 7913 7914SIDT (Store IDT register) copies the base and limit value stored in IDTR 7915to a memory location. This instruction can be executed at any privilege 7916level. 7917 7918 7919Table 9-2. Priority Among Simultaneous Interrupts and Exceptions 7920 7921Priority Class of Interrupt or Exception 7922 7923HIGHEST Faults except debug faults 7924 Trap instructions INTO, INT n, INT 3 7925 Debug traps for this instruction 7926 Debug faults for next instruction 7927 NMI interrupt 7928LOWEST INTR interrupt 7929 7930 7931Figure 9-1. IDT Register and Table 7932 7933 INTERRUPT DESCRIPTOR TABLE 7934 ͻ 7935 7936 GATE FOR INTERRUPT #N Ķ 7937 7938 ͼ 7939 7940 7941 7942 ͻ 7943 7944 GATE FOR INTERRUPT #2 Ķ 7945 7946 7947 IDT REGISTER 7948 GATE FOR INTERRUPT #1 Ķ 7949 15 0 7950 ͻ 7951 IDT LIMIT 7952 GATE FOR INTERRUPT #0 Ķ 7953 IDT BASE 7954 ͼ ͼ 7955 31 0 7956 7957 7958Figure 9-2. Pseudo-Descriptor Format for LIDT and SIDT 7959 7960 31 23 15 7 0 7961 ͻ 7962 BASE 2 7963 7964 LIMIT 0 7965 ͼ 7966 7967 79689.5 IDT Descriptors 7969 7970The IDT may contain any of three kinds of descriptor: 7971 7972 Task gates 7973 Interrupt gates 7974 Trap gates 7975 7976Figure 9-3 illustrates the format of task gates and 80386 interrupt gates 7977and trap gates. (The task gate in an IDT is the same as the task gate 7978already discussed in Chapter 7.) 7979 7980 7981Figure 9-3. 80306 IDT Gate Descriptors 7982 7983 80386 TASK GATE 7984 31 23 15 7 0 7985 ͻ 7986 (NOT USED) P DPL0 0 1 0 1(NOT USED)4 7987 Ķ 7988 SELECTOR (NOT USED)0 7989 ͼ 7990 7991 80386 INTERRUPT GATE 7992 31 23 15 7 0 7993 ͻ 7994 OFFSET 31..16 P DPL0 1 1 1 00 0 0(NOT USED) 4 7995 Ķ 7996 SELECTOR OFFSET 15..0 0 7997 ͼ 7998 7999 80386 TRAP GATE 8000 31 23 15 7 0 8001 ͻ 8002 OFFSET 31..16 P DPL0 1 1 1 10 0 0(NOT USED) 4 8003 Ķ 8004 SELECTOR OFFSET 15..0 0 8005 ͼ 8006 8007 80089.6 Interrupt Tasks and Interrupt Procedures 8009 8010Just as a CALL instruction can call either a procedure or a task, so an 8011interrupt or exception can "call" an interrupt handler that is either a 8012procedure or a task. When responding to an interrupt or exception, the 8013processor uses the interrupt or exception identifier to index a descriptor 8014in the IDT. If the processor indexes to an interrupt gate or trap gate, it 8015invokes the handler in a manner similar to a CALL to a call gate. If the 8016processor finds a task gate, it causes a task switch in a manner similar to 8017a CALL to a task gate. 8018 8019 80209.6.1 Interrupt Procedures 8021 8022An interrupt gate or trap gate points indirectly to a procedure which will 8023execute in the context of the currently executing task as illustrated by 8024Figure 9-4. The selector of the gate points to an executable-segment 8025descriptor in either the GDT or the current LDT. The offset field of the 8026gate points to the beginning of the interrupt or exception handling 8027procedure. 8028 8029The 80386 invokes an interrupt or exception handling procedure in much the 8030same manner as it CALLs a procedure; the differences are explained in the 8031following sections. 8032 8033 8034Figure 9-4. Interrupt Vectoring for Procedures 8035 8036 IDT EXECUTABLE SEGMENT 8037 ͻ ͻ 8038 OFFSET 8039 ENTRY POINT 8040 LDT OR GDT 8041 ͻ 8042 8043INTERRUPT 8044 ID TRAP GATE OR 8045 INTERRUPT GATE Ŀ 8046 8047 8048 SEGMENT Ŀ 8049 DESCRIPTOR 8050 8051 8052 8053 BASE 8054 ͼ ͼ 8055 8056 8057 8058 ͼ 8059 8060 80619.6.1.1 Stack of Interrupt Procedure 8062 8063Just as with a control transfer due to a CALL instruction, a control 8064transfer to an interrupt or exception handling procedure uses the stack to 8065store the information needed for returning to the original procedure. As 8066Figure 9-5 shows, an interrupt pushes the EFLAGS register onto the stack 8067before the pointer to the interrupted instruction. 8068 8069Certain types of exceptions also cause an error code to be pushed on the 8070stack. An exception handler can use the error code to help diagnose the 8071exception. 8072 8073 80749.6.1.2 Returning from an Interrupt Procedure 8075 8076An interrupt procedure also differs from a normal procedure in the method 8077of leaving the procedure. The IRET instruction is used to exit from an 8078interrupt procedure. IRET is similar to RET except that IRET increments EIP 8079by an extra four bytes (because of the flags on the stack) and moves the 8080saved flags into the EFLAGS register. The IOPL field of EFLAGS is changed 8081only if the CPL is zero. The IF flag is changed only if CPL IOPL. 8082 8083 8084Figure 9-5. Stack Layout after Exception of Interrupt 8085 8086 WITHOUT PRIVILEGE TRANSITION 8087 8088 D O 31 0 31 0 8089 I F 8090 R OLD OLD 8091 E E SS:ESP SS:ESP 8092 C X 8093 T P 8094 I A OLD EFLAGS OLD EFLAGS 8095 O N 8096 N S OLD CS NEW OLD CS 8097 I SS:ESP 8098 O OLD EIP OLD EIP NEW 8099 N SS:ESP 8100 ERROR CODE 8101 8102 8103 8104 WITHOUT ERROR CODE WITH ERROR CODE 8105 8106 WITH PRIVILEGE TRANSITION 8107 8108 D O 31 0 31 0 8109 I F ͻĿ ͻĿ 8110 R OLD SS OLD SS 8111 E E SS:ESP SS:ESP 8112 C X OLD ESP FROM TSS OLD ESP FROM TSS 8113 T P 8114 I A OLD EFLAGS OLD EFLAGS 8115 O N 8116 N S OLD CS NEW OLD CS 8117 I SS:EIP 8118 O OLD EIP OLD EIP NEW 8119 N SS:ESP 8120 ERROR CODE 8121 8122 8123 8124 WITHOUT ERROR CODE WITH ERROR CODE 8125 8126 81279.6.1.3 Flags Usage by Interrupt Procedure 8128 8129Interrupts that vector through either interrupt gates or trap gates cause 8130TF (the trap flag) to be reset after the current value of TF is saved on the 8131stack as part of EFLAGS. By this action the processor prevents debugging 8132activity that uses single-stepping from affecting interrupt response. A 8133subsequent IRET instruction restores TF to the value in the EFLAGS image on 8134the stack. 8135 8136The difference between an interrupt gate and a trap gate is in the effect 8137on IF (the interrupt-enable flag). An interrupt that vectors through an 8138interrupt gate resets IF, thereby preventing other interrupts from 8139interfering with the current interrupt handler. A subsequent IRET 8140instruction restores IF to the value in the EFLAGS image on the stack. An 8141interrupt through a trap gate does not change IF. 8142 8143 81449.6.1.4 Protection in Interrupt Procedures 8145 8146The privilege rule that governs interrupt procedures is similar to that for 8147procedure calls: the CPU does not permit an interrupt to transfer control to 8148a procedure in a segment of lesser privilege (numerically greater privilege 8149level) than the current privilege level. An attempt to violate this rule 8150results in a general protection exception. 8151 8152Because occurrence of interrupts is not generally predictable, this 8153privilege rule effectively imposes restrictions on the privilege levels at 8154which interrupt and exception handling procedures can execute. Either of the 8155following strategies can be employed to ensure that the privilege rule is 8156never violated. 8157 8158 Place the handler in a conforming segment. This strategy suits the 8159 handlers for certain exceptions (divide error, for example). Such a 8160 handler must use only the data available to it from the stack. If it 8161 needed data from a data segment, the data segment would have to have 8162 privilege level three, thereby making it unprotected. 8163 8164 Place the handler procedure in a privilege level zero segment. 8165 8166 81679.6.2 Interrupt Tasks 8168 8169A task gate in the IDT points indirectly to a task, as Figure 9-6 8170illustrates. The selector of the gate points to a TSS descriptor in the GDT. 8171 8172When an interrupt or exception vectors to a task gate in the IDT, a task 8173switch results. Handling an interrupt with a separate task offers two 8174advantages: 8175 8176 The entire context is saved automatically. 8177 8178 The interrupt handler can be isolated from other tasks by giving it a 8179 separate address space, either via its LDT or via its page directory. 8180 8181The actions that the processor takes to perform a task switch are discussed 8182in Chapter 7. The interrupt task returns to the interrupted task by 8183executing an IRET instruction. 8184 8185If the task switch is caused by an exception that has an error code, the 8186processor automatically pushes the error code onto the stack that 8187corresponds to the privilege level of the first instruction to be executed 8188in the interrupt task. 8189 8190When interrupt tasks are used in an operating system for the 80386, there 8191are actually two schedulers: the software scheduler (part of the operating 8192system) and the hardware scheduler (part of the processor's interrupt 8193mechanism). The design of the software scheduler should account for the fact 8194that the hardware scheduler may dispatch an interrupt task whenever 8195interrupts are enabled. 8196 8197 8198Figure 9-6. Interrupt Vectoring for Tasks 8199 8200 IDT GDT 8201 ͻ ͻ 8202 TSS 8203 Ķ Ķ ͻ 8204 8205 Ķ Ķ 8206 8207 Ķ Ķ 8208 TASK GATE Ŀ 8209 Ķ Ķ 8210 TSS DESCRIPTOR Ŀ 8211 Ķ Ķ 8212 8213 Ķ Ķ ͼ 8214 8215 Ķ Ķ 8216 8217 ͼ ͼ 8218 8219 INTERRUPT ID 8220 8221 82229.7 Error Code 8223 8224With exceptions that relate to a specific segment, the processor pushes an 8225error code onto the stack of the exception handler (whether procedure or 8226task). The error code has the format shown in Figure 9-7. The format of the 8227error code resembles that of a selector; however, instead of an RPL field, 8228the error code contains two one-bit items: 8229 8230 1. The processor sets the EXT bit if an event external to the program 8231 caused the exception. 8232 8233 2. The processor sets the I-bit (IDT-bit) if the index portion of the 8234 error code refers to a gate descriptor in the IDT. 8235 8236If the I-bit is not set, the TI bit indicates whether the error code refers 8237to the GDT (value 0) or to the LDT (value 1). The remaining 14 bits are the 8238upper 14 bits of the segment selector involved. In some cases the error code 8239on the stack is null, i.e., all bits in the low-order word are zero. 8240 8241 8242Figure 9-7. Error Code Format 8243 8244 31 15 2 1 0 8245 ͻ 8246 T E 8247 UNDEFINED SELECTOR INDEX I 8248 I X 8249 ͼ 8250 8251 82529.8 Exception Conditions 8253 8254The following sections describe each of the possible exception conditions 8255in detail. Each description classifies the exception as a fault, trap, or 8256abort. This classification provides information needed by systems 8257programmers for restarting the procedure in which the exception occurred: 8258 8259Faults The CS and EIP values saved when a fault is reported point to the 8260 instruction causing the fault. 8261 8262Traps The CS and EIP values stored when the trap is reported point to the 8263 instruction dynamically after the instruction causing the trap. If 8264 a trap is detected during an instruction that alters program flow, 8265 the reported values of CS and EIP reflect the alteration of program 8266 flow. For example, if a trap is detected in a JMP instruction, the 8267 CS and EIP values pushed onto the stack point to the target of the 8268 JMP, not to the instruction after the JMP. 8269 8270Aborts An abort is an exception that permits neither precise location of 8271 the instruction causing the exception nor restart of the program 8272 that caused the exception. Aborts are used to report severe errors, 8273 such as hardware errors and inconsistent or illegal values in 8274 system tables. 8275 8276 82779.8.1 Interrupt 0 Divide Error 8278 8279The divide-error fault occurs during a DIV or an IDIV instruction when the 8280divisor is zero. 8281 8282 82839.8.2 Interrupt 1 Debug Exceptions 8284 8285The processor triggers this interrupt for any of a number of conditions; 8286whether the exception is a fault or a trap depends on the condition: 8287 8288 Instruction address breakpoint fault. 8289 Data address breakpoint trap. 8290 General detect fault. 8291 Single-step trap. 8292 Task-switch breakpoint trap. 8293 8294The processor does not push an error code for this exception. An exception 8295handler can examine the debug registers to determine which condition caused 8296the exception. Refer to Chapter 12 for more detailed information about 8297debugging and the debug registers. 8298 8299 83009.8.3 Interrupt 3 Breakpoint 8301 8302The INT 3 instruction causes this trap. The INT 3 instruction is one byte 8303long, which makes it easy to replace an opcode in an executable segment with 8304the breakpoint opcode. The operating system or a debugging subsystem can use 8305a data-segment alias for an executable segment to place an INT 3 anywhere it 8306is convenient to arrest normal execution so that some sort of special 8307processing can be performed. Debuggers typically use breakpoints as a way of 8308displaying registers, variables, etc., at crucial points in a task. 8309 8310The saved CS:EIP value points to the byte following the breakpoint. If a 8311debugger replaces a planted breakpoint with a valid opcode, it must subtract 8312one from the saved EIP value before returning. Refer also to Chapter 12 for 8313more information on debugging. 8314 8315 83169.8.4 Interrupt 4 Overflow 8317 8318This trap occurs when the processor encounters an INTO instruction and the 8319OF (overflow) flag is set. Since signed arithmetic and unsigned arithmetic 8320both use the same arithmetic instructions, the processor cannot determine 8321which is intended and therefore does not cause overflow exceptions 8322automatically. Instead it merely sets OF when the results, if interpreted as 8323signed numbers, would be out of range. When doing arithmetic on signed 8324operands, careful programmers and compilers either test OF directly or use 8325the INTO instruction. 8326 8327 83289.8.5 Interrupt 5 Bounds Check 8329 8330This fault occurs when the processor, while executing a BOUND instruction, 8331finds that the operand exceeds the specified limits. A program can use the 8332BOUND instruction to check a signed array index against signed limits 8333defined in a block of memory. 8334 8335 83369.8.6 Interrupt 6 Invalid Opcode 8337 8338This fault occurs when an invalid opcode is detected by the execution unit. 8339(The exception is not detected until an attempt is made to execute the 8340invalid opcode; i.e., prefetching an invalid opcode does not cause this 8341exception.) No error code is pushed on the stack. The exception can be 8342handled within the same task. 8343 8344This exception also occurs when the type of operand is invalid for the 8345given opcode. Examples include an intersegment JMP referencing a register 8346operand, or an LES instruction with a register source operand. 8347 8348 83499.8.7 Interrupt 7 Coprocessor Not Available 8350 8351This exception occurs in either of two conditions: 8352 8353 The processor encounters an ESC (escape) instruction, and the EM 8354 (emulate) bit ofCR0 (control register zero) is set. 8355 8356 The processor encounters either the WAIT instruction or an ESC 8357 instruction, and both the MP (monitor coprocessor) and TS (task 8358 switched) bits of CR0 are set. 8359 8360Refer to Chapter 11 for information about the coprocessor interface. 8361 8362 83639.8.8 Interrupt 8 Double Fault 8364 8365Normally, when the processor detects an exception while trying to invoke 8366the handler for a prior exception, the two exceptions can be handled 8367serially. If, however, the processor cannot handle them serially, it signals 8368the double-fault exception instead. To determine when two faults are to be 8369signalled as a double fault, the 80386 divides the exceptions into three 8370classes: benign exceptions, contributory exceptions, and page faults. Table 83719-3 shows this classification. 8372 8373Table 9-4 shows which combinations of exceptions cause a double fault and 8374which do not. 8375 8376The processor always pushes an error code onto the stack of the 8377double-fault handler; however, the error code is always zero. The faulting 8378instruction may not be restarted. If any other exception occurs while 8379attempting to invoke the double-fault handler, the processor shuts down. 8380 8381 8382Table 9-3. Double-Fault Detection Classes 8383 8384Class ID Description 8385 8386 1 Debug exceptions 8387 2 NMI 8388 3 Breakpoint 8389Benign 4 Overflow 8390Exceptions 5 Bounds check 8391 6 Invalid opcode 8392 7 Coprocessor not available 8393 16 Coprocessor error 8394 8395 0 Divide error 8396 9 Coprocessor Segment Overrun 8397Contributory 10 Invalid TSS 8398Exceptions 11 Segment not present 8399 12 Stack exception 8400 13 General protection 8401 8402Page Faults 14 Page fault 8403 8404 8405Table 9-4. Double-Fault Definition 8406 8407 SECOND EXCEPTION 8408 8409 Benign Contributory Page 8410 Exception Exception Fault 8411 8412 8413 Benign OK OK OK 8414 Exception 8415 8416FIRST Contributory OK DOUBLE OK 8417EXCEPTION Exception 8418 8419 Page 8420 Fault OK DOUBLE DOUBLE 8421 8422 84239.8.9 Interrupt 9 Coprocessor Segment Overrun 8424 8425This exception is raised in protected mode if the 80386 detects a page or 8426segment violation while transferring the middle portion of a coprocessor 8427operand to the NPX. This exception is avoidable. Refer to Chapter 11 for 8428more information about the coprocessor interface. 8429 8430 84319.8.10 Interrupt 10 Invalid TSS 8432 8433Interrupt 10 occurs if during a task switch the new TSS is invalid. A TSS 8434is considered invalid in the cases shown in Table 9-5. An error code is 8435pushed onto the stack to help identify the cause of the fault. The EXT bit 8436indicates whether the exception was caused by a condition outside the 8437control of the program; e.g., an external interrupt via a task gate 8438triggered a switch to an invalid TSS. 8439 8440This fault can occur either in the context of the original task or in the 8441context of the new task. Until the processor has completely verified the 8442presence of the new TSS, the exception occurs in the context of the original 8443task. Once the existence of the new TSS is verified, the task switch is 8444considered complete; i.e., TR is updated and, if the switch is due to a 8445CALL or interrupt, the backlink of the new TSS is set to the old TSS. Any 8446errors discovered by the processor after this point are handled in the 8447context of the new task. 8448 8449To insure a proper TSS to process it, the handler for exception 10 must be 8450a task invoked via a task gate. 8451 8452 8453Table 9-5. Conditions That Invalidate the TSS 8454 8455Error Code Condition 8456 8457TSS id + EXT The limit in the TSS descriptor is less than 103 8458LTD id + EXT Invalid LDT selector or LDT not present 8459SS id + EXT Stack segment selector is outside table limit 8460SS id + EXT Stack segment is not a writable segment 8461SS id + EXT Stack segment DPL does not match new CPL 8462SS id + EXT Stack segment selector RPL < > CPL 8463CS id + EXT Code segment selector is outside table limit 8464CS id + EXT Code segment selector does not refer to code 8465 segment 8466CS id + EXT DPL of non-conforming code segment < > new CPL 8467CS id + EXT DPL of conforming code segment > new CPL 8468DS/ES/FS/GS id + EXT DS, ES, FS, or GS segment selector is outside 8469 table limits 8470DS/ES/FS/GS id + EXT DS, ES, FS, or GS is not readable segment 8471 8472 84739.8.11 Interrupt 11 Segment Not Present 8474 8475Exception 11 occurs when the processor detects that the present bit of a 8476descriptor is zero. The processor can trigger this fault in any of these 8477cases: 8478 8479 While attempting to load the CS, DS, ES, FS, or GS registers; loading 8480 the SS register, however, causes a stack fault. 8481 8482 While attempting loading the LDT register with an LLDT instruction; 8483 loading the LDT register during a task switch operation, however, 8484 causes the "invalid TSS" exception. 8485 8486 While attempting to use a gate descriptor that is marked not-present. 8487 8488This fault is restartable. If the exception handler makes the segment 8489present and returns, the interrupted program will resume execution. 8490 8491If a not-present exception occurs during a task switch, not all the steps 8492of the task switch are complete. During a task switch, the processor first 8493loads all the segment registers, then checks their contents for validity. If 8494a not-present exception is discovered, the remaining segment registers have 8495not been checked and therefore may not be usable for referencing memory. The 8496not-present handler should not rely on being able to use the values found 8497in CS, SS, DS, ES, FS, and GS without causing another exception. The 8498exception handler should check all segment registers before trying to resume 8499the new task; otherwise, general protection faults may result later under 8500conditions that make diagnosis more difficult. There are three ways to 8501handle this case: 8502 8503 1. Handle the not-present fault with a task. The task switch back to the 8504 interrupted task will cause the processor to check the registers as it 8505 loads them from the TSS. 8506 8507 2. PUSH and POP all segment registers. Each POP causes the processor to 8508 check the new contents of the segment register. 8509 8510 3. Scrutinize the contents of each segment-register image in the TSS, 8511 simulating the test that the processor makes when it loads a segment 8512 register. 8513 8514This exception pushes an error code onto the stack. The EXT bit of the 8515error code is set if an event external to the program caused an interrupt 8516that subsequently referenced a not-present segment. The I-bit is set if the 8517error code refers to an IDT entry, e.g., an INT instruction referencing a 8518not-present gate. 8519 8520An operating system typically uses the "segment not present" exception to 8521implement virtual memory at the segment level. A not-present indication in a 8522gate descriptor, however, usually does not indicate that a segment is not 8523present (because gates do not necessarily correspond to segments). 8524Not-present gates may be used by an operating system to trigger exceptions 8525of special significance to the operating system. 8526 8527 85289.8.12 Interrupt 12 Stack Exception 8529 8530A stack fault occurs in either of two general conditions: 8531 8532 As a result of a limit violation in any operation that refers to the 8533 SS register. This includes stack-oriented instructions such as POP, 8534 PUSH, ENTER, and LEAVE, as well as other memory references that 8535 implicitly use SS (for example, MOV AX, [BP+6]). ENTER causes this 8536 exception when the stack is too small for the indicated local-variable 8537 space. 8538 8539 When attempting to load the SS register with a descriptor that is 8540 marked not-present but is otherwise valid. This can occur in a task 8541 switch, an interlevel CALL, an interlevel return, an LSS instruction, 8542 or a MOV or POP instruction to SS. 8543 8544When the processor detects a stack exception, it pushes an error code onto 8545the stack of the exception handler. If the exception is due to a not-present 8546stack segment or to overflow of the new stack during an interlevel CALL, the 8547error code contains a selector to the segment in question (the exception 8548handler can test the present bit in the descriptor to determine which 8549exception occurred); otherwise the error code is zero. 8550 8551An instruction that causes this fault is restartable in all cases. The 8552return pointer pushed onto the exception handler's stack points to the 8553instruction that needs to be restarted. This instruction is usually the one 8554that caused the exception; however, in the case of a stack exception due to 8555loading of a not-present stack-segment descriptor during a task switch, the 8556indicated instruction is the first instruction of the new task. 8557 8558When a stack fault occurs during a task switch, the segment registers may 8559not be usable for referencing memory. During a task switch, the selector 8560values are loaded before the descriptors are checked. If a stack fault is 8561discovered, the remaining segment registers have not been checked and 8562therefore may not be usable for referencing memory. The stack fault handler 8563should not rely on being able to use the values found in CS, SS, DS, ES, 8564FS, and GS without causing another exception. The exception handler should 8565check all segment registers before trying to resume the new task; otherwise, 8566general protection faults may result later under conditions that make 8567diagnosis more difficult. 8568 8569 85709.8.13 Interrupt 13 General Protection Exception 8571 8572All protection violations that do not cause another exception cause a 8573general protection exception. This includes (but is not limited to): 8574 8575 1. Exceeding segment limit when using CS, DS, ES, FS, or GS 8576 8577 2. Exceeding segment limit when referencing a descriptor table 8578 8579 3. Transferring control to a segment that is not executable 8580 8581 4. Writing into a read-only data segment or into a code segment 8582 8583 5. Reading from an execute-only segment 8584 8585 6. Loading the SS register with a read-only descriptor (unless the 8586 selector comes from the TSS during a task switch, in which case a TSS 8587 exception occurs 8588 8589 7. Loading SS, DS, ES, FS, or GS with the descriptor of a system segment 8590 8591 8. Loading DS, ES, FS, or GS with the descriptor of an executable 8592 segment that is not also readable 8593 8594 9. Loading SS with the descriptor of an executable segment 8595 8596 10. Accessing memory via DS, ES, FS, or GS when the segment register 8597 contains a null selector 8598 8599 11. Switching to a busy task 8600 8601 12. Violating privilege rules 8602 8603 13. Loading CR0 with PG=1 and PE=0. 8604 8605 14. Interrupt or exception via trap or interrupt gate from V86 mode to 8606 privilege level other than zero. 8607 8608 15. Exceeding the instruction length limit of 15 bytes (this can occur 8609 only if redundant prefixes are placed before an instruction) 8610 8611The general protection exception is a fault. In response to a general 8612protection exception, the processor pushes an error code onto the exception 8613handler's stack. If loading a descriptor causes the exception, the error 8614code contains a selector to the descriptor; otherwise, the error code is 8615null. The source of the selector in an error code may be any of the 8616following: 8617 8618 1. An operand of the instruction. 8619 2. A selector from a gate that is the operand of the instruction. 8620 3. A selector from a TSS involved in a task switch. 8621 8622 86239.8.14 Interrupt 14 Page Fault 8624 8625This exception occurs when paging is enabled (PG=1) and the processor 8626detects one of the following conditions while translating a linear address 8627to a physical address: 8628 8629 The page-directory or page-table entry needed for the address 8630 translation has zero in its present bit. 8631 8632 The current procedure does not have sufficient privilege to access the 8633 indicated page. 8634 8635The processor makes available to the page fault handler two items of 8636information that aid in diagnosing the exception and recovering from it: 8637 8638 An error code on the stack. The error code for a page fault has a 8639 format different from that for other exceptions (see Figure 9-8). The 8640 error code tells the exception handler three things: 8641 8642 1. Whether the exception was due to a not present page or to an access 8643 rights violation. 8644 8645 2. Whether the processor was executing at user or supervisor level at 8646 the time of the exception. 8647 8648 3. Whether the memory access that caused the exception was a read or 8649 write. 8650 8651 CR2 (control register two). The processor stores in CR2 the linear 8652 address used in the access that caused the exception (see Figure 9-9). 8653 The exception handler can use this address to locate the corresponding 8654 page directory and page table entries. If another page fault can occur 8655 during execution of the page fault handler, the handler should push CR2 8656 onto the stack. 8657 8658 8659Figure 9-8. Page-Fault Error Code Format 8660 8661 ͻ 8662 FieldValue Description 8663 Ķ 8664 U/S 0 The access causing the fault originated when the processor 8665 was executing in supervisor mode. 8666 8667 1 The access causing the fault originated when the processor 8668 was executing in user mode. 8669 8670 W/R 0 The access causing the fault was a read. 8671 8672 1 The access causing the fault was a write. 8673 8674 P 0 The fault was caused by a not-present page. 8675 8676 1 The fault was caused by a page-level protection violation. 8677 ͼ 8678 8679 31 15 7 3 2 1 0 8680 ͻ 8681 UW 8682 UNDEFINED//P 8683 SR 8684 ͼ 8685 8686 86879.8.14.1 Page Fault During Task Switch 8688 8689The processor may access any of four segments during a task switch: 8690 8691 1. Writes the state of the original task in the TSS of that task. 8692 8693 2. Reads the GDT to locate the TSS descriptor of the new task. 8694 8695 3. Reads the TSS of the new task to check the types of segment 8696 descriptors from the TSS. 8697 8698 4. May read the LDT of the new task in order to verify the segment 8699 registers stored in the new TSS. 8700 8701A page fault can result from accessing any of these segments. In the latter 8702two cases the exception occurs in the context of the new task. The 8703instruction pointer refers to the next instruction of the new task, not to 8704the instruction that caused the task switch. If the design of the operating 8705system permits page faults to occur during task-switches, the page-fault 8706handler should be invoked via a task gate. 8707 8708 8709Figure 9-9. CR2 Format 8710 8711 31 23 15 7 0 8712 ͻ 8713 8714 PAGE FAULT LINEAR ADDRESS 8715 8716 ͼ 8717 8718 87199.8.14.2 Page Fault with Inconsistent Stack Pointer 8720 8721Special care should be taken to ensure that a page fault does not cause the 8722processor to use an invalid stack pointer (SS:ESP). Software written for 8723earlier processors in the 8086 family often uses a pair of instructions to 8724change to a new stack; for example: 8725 8726MOV SS, AX 8727MOV SP, StackTop 8728 8729With the 80386, because the second instruction accesses memory, it is 8730possible to get a page fault after SS has been changed but before SP has 8731received the corresponding change. At this point, the two parts of the stack 8732pointer SS:SP (or, for 32-bit programs, SS:ESP) are inconsistent. 8733 8734The processor does not use the inconsistent stack pointer if the handling 8735of the page fault causes a stack switch to a well defined stack (i.e., the 8736handler is a task or a more privileged procedure). However, if the page 8737fault handler is invoked by a trap or interrupt gate and the page fault 8738occurs at the same privilege level as the page fault handler, the processor 8739will attempt to use the stack indicated by the current (invalid) stack 8740pointer. 8741 8742In systems that implement paging and that handle page faults within the 8743faulting task (with trap or interrupt gates), software that executes at the 8744same privilege level as the page fault handler should initialize a new stack 8745by using the new LSS instruction rather than an instruction pair shown 8746above. When the page fault handler executes at privilege level zero (the 8747normal case), the scope of the problem is limited to privilege-level zero 8748code, typically the kernel of the operating system. 8749 8750 87519.8.15 Interrupt 16 Coprocessor Error 8752 8753The 80386 reports this exception when it detects a signal from the 80287 or 875480387 on the 80386's ERROR# input pin. The 80386 tests this pin only at the 8755beginning of certain ESC instructions and when it encounters a WAIT 8756instruction while the EM bit of the MSW is zero (no emulation). Refer to 8757Chapter 11 for more information on the coprocessor interface. 8758 8759 87609.9 Exception Summary 8761 8762 8763Table 9-6 summarizes the exceptions recognized by the 386. 8764 8765Table 9-6. Exception Summary 8766 8767 8768Description Interrupt Return Address Exception Function That Can Generate 8769 Number Points to Type the Exception 8770 Faulting 8771 Instruction 8772 8773Divide error 0 YES FAULT DIV, IDIV 8774Debug exceptions 1 8775Some debug exceptions are traps and some are faults. The exception 8776handler can determine which has occurred by examining DR6. (Refer to 8777Chapter 12.) 8778Some debug exceptions are traps and some are faults. The exception 8779handler can determine which has occurred by examining DR6. (Refer to 8780Chapter 12.) Any instruction 8781Breakpoint 3 NO TRAP One-byte INT 3 8782Overflow 4 NO TRAP INTO 8783Bounds check 5 YES FAULT BOUND 8784Invalid opcode 6 YES FAULT Any illegal instruction 8785Coprocessor not available 7 YES FAULT ESC, WAIT 8786Double fault 8 YES ABORT Any instruction that can 8787 generate an exception 8788Coprocessor Segment 8789Overrun 9 NO ABORT Any operand of an ESC 8790 instruction that wraps around 8791 the end of a segment. 8792Invalid TSS 10 YES FAULT 8793An invalid-TSS fault is not restartable if it occurs during the 8794processing of an external interrupt. JMP, CALL, IRET, any interrupt 8795Segment not present 11 YES FAULT Any segment-register modifier 8796Stack exception 12 YES FAULT Any memory reference thru SS 8797General Protection 13 YES FAULT/ABORT 8798All GP faults are restartable. If the fault occurs while attempting to 8799vector to the handler for an external interrupt, the interrupted program is 8800restartable, but the interrupt may be lost. Any memory reference or code 8801 fetch 8802Page fault 14 YES FAULT Any memory reference or code 8803 fetch 8804Coprocessor error 16 YES FAULT 8805Coprocessor errors are reported as a fault on the first ESC or WAIT 8806instruction executed after the ESC instruction that caused the error. ESC, WAIT 8807Two-byte SW Interrupt 0-255 NO TRAP INT n 8808 8809 88109.10 Error Code Summary 8811 8812Table 9-7 summarizes the error information that is available with each 8813exception. 8814 8815 8816Table 9-7. Error-Code Summary 8817 8818Description Interrupt Error Code 8819 Number 8820 8821Divide error 0 No 8822Debug exceptions 1 No 8823Breakpoint 3 No 8824Overflow 4 No 8825Bounds check 5 No 8826Invalid opcode 6 No 8827Coprocessor not available 7 No 8828System error 8 Yes (always 0) 8829Coprocessor Segment Overrun 9 No 8830Invalid TSS 10 Yes 8831Segment not present 11 Yes 8832Stack exception 12 Yes 8833General protection fault 13 Yes 8834Page fault 14 Yes 8835Coprocessor error 16 No 8836Two-byte SW interrupt 0-255 No 8837 8838 8839Chapter 10 Initialization 8840 8841 8842 8843After a signal on the RESET pin, certain registers of the 80386 are set to 8844predefined values. These values are adequate to enable execution of a 8845bootstrap program, but additional initialization must be performed by 8846software before all the features of the processor can be utilized. 8847 8848 884910.1 Processor State After Reset 8850 8851The contents of EAX depend upon the results of the power-up self test. The 8852self-test may be requested externally by assertion of BUSY# at the end of 8853RESET. The EAX register holds zero if the 80386 passed the test. A nonzero 8854value in EAX after self-test indicates that the particular 80386 unit is 8855faulty. If the self-test is not requested, the contents of EAX after RESET 8856is undefined. 8857 8858DX holds a component identifier and revision number after RESET as Figure 885910-1 illustrates. DH contains 3, which indicates an 80386 component. DL 8860contains a unique identifier of the revision level. 8861 8862Control register zero (CR0) contains the values shown in Figure 10-2. The 8863ET bit of CR0 is set if an 80387 is present in the configuration (according 8864to the state of the ERROR# pin after RESET). If ET is reset, the 8865configuration either contains an 80287 or does not contain a coprocessor. A 8866software test is required to distinguish between these latter two 8867possibilities. 8868 8869The remaining registers and flags are set as follows: 8870 8871 EFLAGS =00000002H 8872 IP =0000FFF0H 8873 CS selector =000H 8874 DS selector =0000H 8875 ES selector =0000H 8876 SS selector =0000H 8877 FS selector =0000H 8878 GS selector =0000H 8879 IDTR: 8880 base =0 8881 limit =03FFH 8882 8883All registers not mentioned above are undefined. 8884 8885These settings imply that the processor begins in real-address mode with 8886interrupts disabled. 8887 8888 8889Figure 10-1. Contents of EDX after RESET 8890 8891 EDX REGISTER 8892 8893 31 23 15 7 0 8894 ͻ 8895 DH DL 8896 UNDEFINED DEVICE ID STEPPING ID 8897 3 (UNIQUE) 8898 ͼ 8899 8900 8901Figure 10-2. Initial Contents of CR0 8902 8903 CONTROL REGISTER ZERO 8904 8905 31 23 15 7 4 3 1 0 8906 ͻ 8907 P ETEMP 8908 UNDEFINED 8909 G TSMPE 8910 Ѽ 8911 8912 0 - PAGING DISABLED 8913 * - INDICATES PRESENCE OF 80387 8914 0 - NO TASK SWITCH 8915 0 - DO NOT MONITOR COPROCESSOR 8916 0 - COPROCESSOR NOT PRESENT 8917 0 - PROTECTION NOT ENABLED (REAL ADDRESS MODE) 8918 8919 892010.2 Software Initialization for Real-Address Mode 8921 8922In real-address mode a few structures must be initialized before a program 8923can take advantage of all the features available in this mode. 8924 8925 892610.2.1 Stack 8927 8928No instructions that use the stack can be used until the stack-segment 8929register (SS) has been loaded. SS must point to an area in RAM. 8930 8931 893210.2.2 Interrupt Table 8933 8934The initial state of the 80386 leaves interrupts disabled; however, the 8935processor will still attempt to access the interrupt table if an exception 8936or nonmaskable interrupt (NMI) occurs. Initialization software should take 8937one of the following actions: 8938 8939 Change the limit value in the IDTR to zero. This will cause a shutdown 8940 if an exception or nonmaskable interrupt occurs. (Refer to the 80386 8941 Hardware Reference Manual to see how shutdown is signalled externally.) 8942 8943 Put pointers to valid interrupt handlers in all positions of the 8944 interrupt table that might be used by exceptions or interrupts. 8945 8946 Change the IDTR to point to a valid interrupt table. 8947 8948 894910.2.3 First Instructions 8950 8951After RESET, address lines A{31-20} are automatically asserted for 8952instruction fetches. This fact, together with the initial values of CS:IP, 8953causes instruction execution to begin at physical address FFFFFFF0H. Near 8954(intrasegment) forms of control transfer instructions may be used to pass 8955control to other addresses in the upper 64K bytes of the address space. The 8956first far (intersegment) JMP or CALL instruction causes A{31-20} to drop 8957low, and the 80386 continues executing instructions in the lower one 8958megabyte of physical memory. This automatic assertion of address lines 8959A{31-20} allows systems designers to use a ROM at the high end of 8960the address space to initialize the system. 8961 8962 896310.3 Switching to Protected Mode 8964 8965Setting the PE bit of the MSW in CR0 causes the 80386 to begin executing in 8966protected mode. The current privilege level (CPL) starts at zero. The 8967segment registers continue to point to the same linear addresses as in real 8968address mode (in real address mode, linear addresses are the same physical 8969addresses). 8970 8971Immediately after setting the PE flag, the initialization code must flush 8972the processor's instruction prefetch queue by executing a JMP instruction. 8973The 80386 fetches and decodes instructions and addresses before they are 8974used; however, after a change into protected mode, the prefetched 8975instruction information (which pertains to real-address mode) is no longer 8976valid. A JMP forces the processor to discard the invalid information. 8977 8978 897910.4 Software Initialization for Protected Mode 8980 8981Most of the initialization needed for protected mode can be done either 8982before or after switching to protected mode. If done in protected mode, 8983however, the initialization procedures must not use protected-mode features 8984that are not yet initialized. 8985 8986 898710.4.1 Interrupt Descriptor Table 8988 8989The IDTR may be loaded in either real-address or protected mode. However, 8990the format of the interrupt table for protected mode is different than that 8991for real-address mode. It is not possible to change to protected mode and 8992change interrupt table formats at the same time; therefore, it is inevitable 8993that, if IDTR selects an interrupt table, it will have the wrong format at 8994some time. An interrupt or exception that occurs at this time will have 8995unpredictable results. To avoid this unpredictability, interrupts should 8996remain disabled until interrupt handlers are in place and a valid IDT has 8997been created in protected mode. 8998 8999 900010.4.2 Stack 9001 9002The SS register may be loaded in either real-address mode or protected 9003mode. If loaded in real-address mode, SS continues to point to the same 9004linear base-address after the switch to protected mode. 9005 9006 900710.4.3 Global Descriptor Table 9008 9009Before any segment register is changed in protected mode, the GDT register 9010must point to a valid GDT. Initialization of the GDT and GDTR may be done in 9011real-address mode. The GDT (as well as LDTs) should reside in RAM, because 9012the processor modifies the accessed bit of descriptors. 9013 9014 901510.4.4 Page Tables 9016 9017Page tables and the PDBR in CR3 can be initialized in either real-address 9018mode or in protected mode; however, the paging enabled (PG) bit of CR0 9019cannot be set until the processor is in protected mode. PG may be set 9020simultaneously with PE, or later. When PG is set, the PDBR in CR3 should 9021already be initialized with a physical address that points to a valid page 9022directory. The initialization procedure should adopt one of the following 9023strategies to ensure consistent addressing before and after paging is 9024enabled: 9025 9026 The page that is currently being executed should map to the same 9027 physical addresses both before and after PG is set. 9028 9029 A JMP instruction should immediately follow the setting of PG. 9030 9031 903210.4.5 First Task 9033 9034The initialization procedure can run awhile in protected mode without 9035initializing the task register; however, before the first task switch, the 9036following conditions must prevail: 9037 9038 There must be a valid task state segment (TSS) for the new task. The 9039 stack pointers in the TSS for privilege levels numerically less than or 9040 equal to the initial CPL must point to valid stack segments. 9041 9042 The task register must point to an area in which to save the current 9043 task state. After the first task switch, the information dumped in this 9044 area is not needed, and the area can be used for other purposes. 9045 9046 904710.5 Initialization Example 9048 9049$TITLE ('Initial Task') 9050 9051 NAME INIT 9052 9053init_stack SEGMENT RW 9054 DW 20 DUP(?) 9055tos LABEL WORD 9056init_stack ENDS 9057 9058init_data SEGMENT RW PUBLIC 9059 DW 20 DUP(?) 9060init_data ENDS 9061 9062init_code SEGMENT ER PUBLIC 9063 9064ASSUME DS:init_data 9065 9066 nop 9067 nop 9068 nop 9069init_start: 9070 ; set up stack 9071 mov ax, init_stack 9072 mov ss, ax 9073 mov esp, offset tos 9074 9075 mov a1,1 9076blink: 9077 xor a1,1 9078 out 0e4h,a1 9079 mov cx,3FFFh 9080here: 9081 dec cx 9082 jnz here 9083 9084 jmp SHORT blink 9085 9086 hlt 9087init_code ends 9088 9089 END init_start, SS:init_stack, DS:init_data 9090 9091$TITLE('Protected Mode Transition -- 386 initialization') 9092NAME RESET 9093 9094;***************************************************************** 9095; Upon reset the 386 starts executing at address 0FFFFFFF0H. The 9096; upper 12 address bits remain high until a FAR call or jump is 9097; executed. 9098; 9099; Assume the following: 9100; 9101; 9102; - a short jump at address 0FFFFFFF0H (placed there by the 9103; system builder) causes execution to begin at START in segment 9104; RESET_CODE. 9105; 9106; 9107; - segment RESET_CODE is based at physical address 0FFFF0000H, 9108; i.e. at the start of the last 64K in the 4G address space. 9109; Note that this is the base of the CS register at reset. If 9110; you locate ROMcode above this address, you will need to 9111; figure out an adjustment factor to address things within this 9112; segment. 9113; 9114;***************************************************************** 9115$EJECT ; 9116 9117; Define addresses to locate GDT and IDT in RAM. 9118; These addresses are also used in the BLD386 file that defines 9119; the GDT and IDT. If you change these addresses, make sure you 9120; change the base addresses specified in the build file. 9121 9122GDTbase EQU 00001000H ; physical address for GDT base 9123IDTbase EQU 00000400H ; physical address for IDT base 9124 9125PUBLIC GDT_EPROM 9126PUBLIC IDT_EPROM 9127PUBLIC START 9128 9129DUMMY segment rw ; ONLY for ASM386 main module stack init 9130 DW 0 9131DUMMY ends 9132 9133;***************************************************************** 9134; 9135; Note: RESET CODE must be USEl6 because the 386 initally executes 9136; in real mode. 9137; 9138 9139RESET_CODE segment er PUBLIC USE16 9140 9141ASSUME DS:nothing, ES:nothing 9142 9143; 9144; 386 Descriptor template 9145 9146DESC STRUC 9147 lim_0_15 DW 0 ; limit bits (0..15) 9148 bas_0_15 DW 0 ; base bits (0..15) 9149 bas_16_23 DB 0 ; base bits (16..23) 9150 access DB 0 ; access byte 9151 gran DB 0 ; granularity byte 9152 bas_24_31 DB 0 ; base bits (24..31) 9153DESC ENDS 9154 9155; The following is the layout of the real GDT created by BLD386. 9156; It is located in EPROM and will be copied to RAM. 9157; 9158; GDT[O] ... NULL 9159; GDT[1] ... Alias for RAM GDT 9160; GDT[2] ... Alias for RAM IDT 9161; GDT[2] ... initial task TSS 9162; GDT[3] ... initial task TSS alias 9163; GDT[4] ... initial task LDT 9164; GDT[5] ... initial task LDT alias 9165 9166; 9167; define entries in GDT and IDT. 9168 9169GDT_ENTRIES EQU 8 9170IDT_ENTRIES EQU 32 9171 9172; define some constants to index into the real GDT 9173 9174GDT_ALIAS EQU 1*SIZE DESC 9175IDT_ALIAS EQU 2*SIZE DESC 9176INIT_TSS EQU 3*SIZE DESC 9177INIT_TSS_A EQU 4*SIZE DESC 9178INIT_LDT EQU 5*SIZE DESC 9179INIT_LDT_A EQU 6*SIZE DESC 9180 9181; 9182; location of alias in INIT_LDT 9183 9184INIT_LDT_ALIAS EQU 1*SIZE DESC 9185 9186; 9187; access rights byte for DATA and TSS descriptors 9188 9189DS_ACCESS EQU 010010010B 9190TSS_ACCESS EQU 010001001B 9191 9192 9193; 9194; This temporary GDT will be used to set up the real GDT in RAM. 9195 9196Temp_GDT LABEL BYTE ; tag for begin of scratch GDT 9197 9198NULL_DES DESC <> ; NULL descriptor 9199 9200 ; 32-Gigabyte data segment based at 0 9201FLAT_DES DESC <0FFFFH,0,0,92h,0CFh,0> 9202 9203GDT_eprom DP ? ; Builder places GDT address and limit 9204 ; in this 6 byte area. 9205 9206IDT_eprom DP ? ; Builder places IDT address and limit 9207 ; in this 6 byte area. 9208 9209; 9210; Prepare operand for loadings GDTR and LDTR. 9211 9212 9213TGDT_pword LABEL PWORD ; for temp GDT 9214 DW end_Temp_GDT_Temp_GDT -1 9215 DD 0 9216 9217GDT_pword LABEL PWORD ; for GDT in RAM 9218 DW GDT_ENTRIES * SIZE DESC -1 9219 DD GDTbase 9220 9221IDT_pword LABEL PWORD ; for IDT in RAM 9222 DW IDT_ENTRIES * SIZE DESC -1 9223 DD IDTbase 9224 9225 9226end_Temp_GDT LABEL BYTE 9227 9228; 9229; Define equates for addressing convenience. 9230 9231GDT_DES_FLAT EQU DS:GDT_ALIAS +GDTbase 9232IDT_DES_FLAT EQU DS:IDT_ALIAS +GDTbase 9233 9234INIT_TSS_A_OFFSET EQU DS:INIT_TSS_A 9235INIT_TSS_OFFSET EQU DS:INIT_TSS 9236 9237INIT_LDT_A_OFFSET EQU DS:INIT_LDT_A 9238INIT_LDT_OFFSET EQU DS:INIT_LDT 9239 9240 9241; define pointer for first task switch 9242 9243ENTRY POINTER LABEL DWORD 9244 DW 0, INIT_TSS 9245 9246;****************************************************************** 9247; 9248; Jump from reset vector to here. 9249 9250START: 9251 9252 CLI ;disable interrupts 9253 CLD ;clear direction flag 9254 9255 LIDT NULL_des ;force shutdown on errors 9256 9257; 9258; move scratch GDT to RAM at physical 0 9259 9260 XOR DI,DI 9261 MOV ES,DI ;point ES:DI to physical location 0 9262 9263 9264 MOV SI,OFFSET Temp_GDT 9265 MOV CX,end_Temp_GDT-Temp_GDT ;set byte count 9266 INC CX 9267; 9268; move table 9269 9270 REP MOVS BYTE PTR ES:[DI],BYTE PTR CS:[SI] 9271 9272 LGDT tGDT_pword ;load GDTR for Temp. GDT 9273 ;(located at 0) 9274 9275; switch to protected mode 9276 9277 MOV EAX,CR0 ;get current CRO 9278 MOV EAX,1 ;set PE bit 9279 MOV CRO,EAX ;begin protected mode 9280; 9281; clear prefetch queue 9282 9283 JMP SHORT flush 9284flush: 9285 9286; set DS,ES,SS to address flat linear space (0 ... 4GB) 9287 9288 MOV BX,FLAT_DES-Temp_GDT 9289 MOV US,BX 9290 MOV ES,BX 9291 MOV SS,BX 9292; 9293; initialize stack pointer to some (arbitrary) RAM location 9294 9295 MOV ESP, OFFSET end_Temp_GDT 9296 9297; 9298; copy eprom GDT to RAM 9299 9300 MOV ESI,DWORD PTR GDT_eprom +2 ; get base of eprom GDT 9301 ; (put here by builder). 9302 9303 MOV EDI,GDTbase ; point ES:EDI to GDT base in RAM. 9304 9305 MOV CX,WORD PTR gdt_eprom +0 ; limit of eprom GDT 9306 INC CX 9307 SHR CX,1 ; easier to move words 9308 CLD 9309 REP MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 9310 9311; 9312; copy eprom IDT to RAM 9313; 9314 MOV ESI,DWORD PTR IDT_eprom +2 ; get base of eprom IDT 9315 ; (put here by builder) 9316 9317 MOV EDI,IDTbase ; point ES:EDI to IDT base in RAM. 9318 9319 MOV CX,WORD PTR idt_eprom +0 ; limit of eprom IDT 9320 INC CX 9321 SHR CX,1 9322 CLD 9323 REP MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] 9324 9325; switch to RAM GDT and IDT 9326; 9327 LIDT IDT_pword 9328 LGDT GDT_pword 9329 9330; 9331 MOV BX,GDT_ALIAS ; point DS to GDT alias 9332 MOV DS,BX 9333; 9334; copy eprom TSS to RAM 9335; 9336 MOV BX,INIT_TSS_A ; INIT TSS A descriptor base 9337 ; has RAM location of INIT TSS. 9338 9339 MOV ES,BX ; ES points to TSS in RAM 9340 9341 MOV BX,INIT_TSS ; get inital task selector 9342 LAR DX,BX ; save access byte 9343 MOV [BX].access,DS_ACCESS ; set access as data segment 9344 MOV FS,BX ; FS points to eprom TSS 9345 9346 XOR si,si ; FS:si points to eprom TSS 9347 XOR di,di ; ES:di points to RAM TSS 9348 9349 MOV CX,[BX].lim_0_15 ; get count to move 9350 INC CX 9351 9352; 9353; move INIT_TSS to RAM. 9354 9355 REP MOVS BYTE PTR ES:[di],BYTE PTR FS:[si] 9356 9357 MOV [BX].access,DH ; restore access byte 9358 9359; 9360; change base of INIT TSS descriptor to point to RAM. 9361 9362 MOV AX,INIT_TSS_A_OFFSET.bas_0_15 9363 MOV INIT_TSS_OFFSET.bas_0_15,AX 9364 MOV AL,INIT_TSS_A_OFFSET.bas_16_23 9365 MOV INIT_TSS_OFFSET.bas_16_23,AL 9366 MOV AL,INIT_TSS_A_OFFSET.bas_24_31 9367 MOV INIT_TSS_OFFSET.bas_24_31,AL 9368 9369; 9370; change INIT TSS A to form a save area for TSS on first task 9371; switch. Use RAM at location 0. 9372 9373 MOV BX,INIT_TSS_A 9374 MOV WORD PTR [BX].bas_0_15,0 9375 MOV [BX].bas_16_23,0 9376 MOV [BX].bas_24_31,0 9377 MOV [BX].access,TSS_ACCESS 9378 MOV [BX].gran,O 9379 LTR BX ; defines save area for TSS 9380 9381; 9382; copy eprom LDT to RAM 9383 9384 MOV BX,INIT_LDT_A ; INIT_LDT_A descriptor has 9385 ; base address in RAM for INIT_LDT. 9386 9387 MOV ES,BX ; ES points LDT location in RAM. 9388 9389 MOV AH,[BX].bas_24_31 9390 MOV AL,[BX].bas_16_23 9391 SHL EAX,16 9392 MOV AX,[BX].bas_0_15 ; save INIT_LDT base (ram) in EAX 9393 9394 MOV BX,INIT_LDT ; get inital LDT selector 9395 LAR DX,BX ; save access rights 9396 MOV [BX].access,DS_ACCESS ; set access as data segment 9397 MOV FS,BX ; FS points to eprom LDT 9398 9399 XOR si,si ; FS:SI points to eprom LDT 9400 XOR di,di ; ES:DI points to RAM LDT 9401 9402 MOV CX,[BX].lim_0_15 ; get count to move 9403 INC CX 9404; 9405; move initial LDT to RAM 9406 9407 REP MOVS BYTE PTR ES:[di],BYTE PTR FS:[si] 9408 9409 MOV [BX].access,DH ; restore access rights in 9410 ; INIT_LDT descriptor 9411 9412; 9413; change base of alias (of INIT_LDT) to point to location in RAM. 9414 9415 MOV ES:[INIT_LDT_ALIAS].bas_0_15,AX 9416 SHR EAX,16 9417 MOV ES:[INIT_LDT_ALIAS].bas_16_23,AL 9418 MOV ES:[INIT_LDT_ALIAS].bas_24_31,AH 9419 9420; 9421; now set the base value in INIT_LDT descriptor 9422 9423 MOV AX,INIT_LDT_A_OFFSET.bas_0_15 9424 MOV INIT_LDT_OFFSET.bas_0_15,AX 9425 MOV AL,INIT_LDT_A_OFFSET.bas_16_23 9426 MOV INIT_LDT_OFFSET.bas_16_23,AL 9427 MOV AL,INIT_LDT_A_OFFSET.bas_24_31 9428 MOV INIT_LDT_OFFSET.bas_24_31,AL 9429 9430; 9431; Now GDT, IDT, initial TSS and initial LDT are all set up. 9432; 9433; Start the first task! 9434' 9435 JMP ENTRY_POINTER 9436 9437RESET_CODE ends 9438 END START, SS:DUMMY,DS:DUMMY 9439 9440 944110.6 TLB Testing 9442 9443The 80386 provides a mechanism for testing the Translation Lookaside Buffer 9444(TLB), the cache used for translating linear addresses to physical 9445addresses. Although failure of the TLB hardware is extremely unlikely, users 9446may wish to include TLB confidence tests among other power-up confidence 9447tests for the 80386. 9448 9449 9450NOTE 9451 This TLB testing mechanism is unique to the 80386 and may not be 9452 continued in the same way in future processors. Sortware that uses 9453 this mechanism may be incompatible with future processors. 9454 9455 9456When testing the TLB it is recommended that paging be turned off (PG=0 in 9457CR0) to avoid interference with the test data being written to the TLB. 9458 9459 946010.6.1 Structure of the TLB 9461 9462The TLB is a four-way set-associative memory. Figure 10-3 illustrates the 9463structure of the TLB. There are four sets of eight entries each. Each entry 9464consists of a tag and data. Tags are 24-bits wide. They contain the 9465high-order 20 bits of the linear address, the valid bit, and three attribute 9466bits. The data portion of each entry contains the high-order 20 bits of the 9467physical address. 9468 9469 947010.6.2 Test Registers 9471 9472Two test registers, shown in Figure 10-4, are provided for the purpose of 9473testing. TR6 is the test command register, and TR7 is the test data 9474register. These registers are accessed by variants of the MOV 9475instruction. A test register may be either the source operand or destination 9476operand. The MOV instructions are defined in both real-address mode and 9477protected mode. The test registers are privileged resources; in protected 9478mode, the MOV instructions that access them can only be executed at 9479privilege level 0. An attempt to read or write the test registers when 9480executing at any other privilege level causes a general 9481protection exception. 9482 9483The test command register (TR6) contains a command and an address tag to 9484use in performing the command: 9485 9486C This is the command bit. There are two TLB testing commands: 9487 write entries into the TLB, and perform TLB lookups. To cause an 9488 immediate write into the TLB entry, move a doubleword into TR6 9489 that contains a 0 in this bit. To cause an immediate TLB lookup, 9490 move a doubleword into TR6 that contains a 1 in this bit. 9491 9492Linear On a TLB write, a TLB entry is allocated to this linear address; 9493Address the rest of that TLB entry is set per the value of TR7 and the 9494 value just written into TR6. On a TLB lookup, the TLB is 9495 interrogated per this value; if one and only one TLB entry 9496 matches, the rest of the fields of TR6 and TR7 are set from the 9497 matching TLB entry. 9498 9499V The valid bit for this TLB entry. The TLB uses the valid bit to 9500 identify entries that contain valid data. Entries of the TLB 9501 that have not been assigned values have zero in the valid bit. 9502 All valid bits can be cleared by writing to CR3. 9503 9504D, D# The dirty bit (and its complement) for/from the TLB entry. 9505 9506U, U# The U/S bit (and its complement) for/from the TLB entry. 9507 9508W, W# The R/W bit (and its complement) for/from the TLB entry. 9509 9510 The meaning of these pairs of bits is given by Table 10-1, 9511 where X represents D, U, or W. 9512 9513The test data register (TR7) holds data read from or data to be written to 9514the TLB. 9515 9516Physical This is the data field of the TLB. On a write to the TLB, the 9517Address TLB entry allocated to the linear address in TR6 is set to this 9518 value. On a TLB lookup, if HT is set, the data field (physical 9519 address) from the TLB is read out to this field. If HT is not 9520 set, this field is undefined. 9521 9522HT For a TLB lookup, the HT bit indicates whether the lookup was a 9523 hit (HT 1) or a miss (HT 0). For a TLB write, HT must be set 9524 to 1. 9525 9526REP For a TLB write, selects which of four associative blocks of the 9527 TLB is to be written. For a TLB read, if HT is set, REP reports 9528 in which of the four associative blocks the tag was found; if HT 9529 is not set, REP is undefined. 9530 9531 9532Table 10-1. Meaning of D, U, and W Bit Pairs 9533 9534X X# Effect during Value of bit X 9535 TLB Lookup after TLB Write 9536 95370 0 (undefined) (undefined) 95380 1 Match if X=0 Bit X becomes 0 95391 0 Match if X=1 Bit X becomes 1 95401 1 (undefined) (undefined) 9541 9542 9543Figure 10-3. TLB Structure 9544 9545 ͻ 9546 7 TAG DATA 9547 9548 9549 9550 SET 11 9551 9552 1 TAG DATA 9553 9554 0 TAG DATA 9555 ͼ 9556 9557 ͻ 9558 7 TAG DATA 9559 9560 9561 9562 SET 10 9563 9564 1 TAG DATA 9565 D 9566 A 0 TAG DATA 9567 T ͼ 9568 A 9569 Ŀ ͻ 9570 B 7 TAG DATA 9571 U 9572 S 9573 9574 SET 01 9575 9576 1 TAG DATA 9577 9578 0 TAG DATA 9579 ͼ 9580 9581 ͻ 9582 7 TAG DATA 9583 9584 9585 9586 SET 00 9587 9588 1 TAG DATA 9589 9590 0 TAG DATA 9591 ͼ 9592 9593 9594Figure 10-4. Test Registers 9595 9596 31 23 15 11 7 0 9597 ͻ 9598 H 9599 PHYSICAL ADDRESS 0 0 0 0 0 0 0 REP0 0 TR7 9600 T 9601 Ķ 9602 D U W 9603 LINEAR ADDRESS VD U 0 0 0 0C TR8 9604 # # # 9605 ͼ 9606 9607 NOTE: 0 INDICATES INTEL RESERVED. NO NOT DEFINE 9608 9609 961010.6.3 Test Operations 9611 9612To write a TLB entry: 9613 9614 1. Move a doubleword to TR7 that contains the desired physical address, 9615 HT, and REP values. HT must contain 1. REP must point to the 9616 associative block in which to place the entry. 9617 9618 2. Move a doubleword to TR6 that contains the appropriate linear 9619 address, and values for V, D, U, and W. Be sure C=0 for "write" 9620 command. 9621 9622Be careful not to write duplicate tags; the results of doing so are 9623undefined. 9624 9625To look up (read) a TLB entry: 9626 9627 1. Move a doubleword to TR6 that contains the appropriate linear address 9628 and attributes. Be sure C=1 for "lookup" command. 9629 9630 2. Store TR7. If the HT bit in TR7 indicates a hit, then the other 9631 values reveal the TLB contents. If HT indicates a miss, then the other 9632 values in TR7 are indeterminate. 9633 9634For the purposes of testing, the V bit functions as another bit of 9635addresss. The V bit for a lookup request should usually be set, so that 9636uninitialized tags do not match. Lookups with V=0 are unpredictable if any 9637tags are uninitialized. 9638 9639 9640Chapter 11 Coprocessing and Multiprocessing 9641 9642 9643 9644The 80386 has two levels of support for multiple parallel processing units: 9645 9646 A highly specialized interface for very closely coupled processors of 9647 a type known as coprocessors. 9648 9649 A more general interface for more loosely coupled processors of 9650 unspecified type. 9651 9652 965311.1 Coprocessing 9654 9655The components of the coprocessor interface include: 9656 9657 ET bit of control register zero (CR0) 9658 The EM, and MP bits of CR0 9659 The ESC instructions 9660 The WAIT instruction 9661 The TS bit of CR0 9662 Exceptions 9663 9664 966511.1.1 Coprocessor Identification 9666 9667The 80386 is designed to operate with either an 80287 or 80387 math 9668coprocessor. The ET bit of CR0 indicates which type of coprocessor is 9669present. ET is set automatically by the 80386 after RESET according to the 9670level detected on the ERROR# input. If desired, ET may also be set or reset 9671by loading CR0 with a MOV instruction. If ET is set, the 80386 uses the 967232-bit protocol of the 80387; if reset, the 80386 uses the 16-bit protocol 9673of the 80287. 9674 9675 967611.1.2 ESC and WAIT Instructions 9677 9678The 80386 interprets the pattern 11011B in the first five bits of an 9679instruction as an opcode intended for a coprocessor. Instructions thus 9680marked are called ESCAPE or ESC instructions. The CPU performs the following 9681functions upon encountering an ESC instruction before sending the 9682instruction to the coprocessor: 9683 9684 Tests the emulation mode (EM) flag to determine whether coprocessor 9685 functions are being emulated by software. 9686 9687 Tests the TS flag to determine whether there has been a context change 9688 since the last ESC instruction. 9689 9690 For some ESC instructions, tests the ERROR# pin to determine whether 9691 the coprocessor detected an error in the previous ESC instruction. 9692 9693The WAIT instruction is not an ESC instruction, but WAIT causes the CPU to 9694perform some of the same tests that it performs upon encountering an ESC 9695instruction. The processor performs the following actions for a WAIT 9696instruction: 9697 9698 Waits until the coprocessor no longer asserts the BUSY# pin. 9699 9700 Tests the ERROR# pin (after BUSY# goes inactive). If ERROR# is active, 9701 the 80386 signals exception 16, which indicates that the coprocessor 9702 encountered an error in the previous ESC instruction. 9703 9704 WAIT can therefore be used to cause exception 16 if an error is 9705 pending from a previous ESC instruction. Note that, if no coprocessor 9706 is present, the ERROR# and BUSY# pins should be tied inactive to 9707 prevent WAIT from waiting forever or causing spurious exceptions. 9708 9709 971011.1.3 EM and MP Flags 9711 9712The EM and MP flags of CR0 control how the processor reacts to coprocessor 9713instructions. 9714 9715The EM bit indicates whether coprocessor functions are to be emulated. If 9716the processor finds EM set when executing an ESC instruction, it signals 9717exception 7, giving the exception handler an opportunity to emulate the ESC 9718instruction. 9719 9720The MP (monitor coprocessor) bit indicates whether a coprocessor is 9721actually attached. The MP flag controls the function of the WAIT 9722instruction. If, when executing a WAIT instruction, the CPU finds MP set, 9723then it tests the TS flag; it does not otherwise test TS during a WAIT 9724instruction. If it finds TS set under these conditions, the CPU signals 9725exception 7. 9726 9727The EM and MP flags can be changed with the aid of a MOV instruction using 9728CR0 as the destination operand and read with the aid of a MOV instruction 9729with CR0 as the source operand. These forms of the MOV instruction can be 9730executed only at privilege level zero. 9731 9732 973311.1.4 The Task-Switched Flag 9734 9735The TS bit of CR0 helps to determine when the context of the coprocessor 9736does not match that of the task being executed by the 80386 CPU. The 80386 9737sets TS each time it performs a task switch (whether triggered by software 9738or by hardware interrupt). If, when interpreting one of the ESC 9739instructions, the CPU finds TS already set, it causes exception 7. The WAIT 9740instruction also causes exception 7 if both TS and MP are set. Operating 9741systems can use this exception to switch the context of the coprocessor to 9742correspond to the current task. Refer to the 80386 System Software Writer's 9743Guide for an example. 9744 9745The CLTS instruction (legal only at privilege level zero) resets the TS 9746flag. 9747 9748 974911.1.5 Coprocessor Exceptions 9750 9751Three exceptions aid in interfacing to a coprocessor: interrupt 7 9752(coprocessor not available), interrupt 9 (coprocessor segment overrun), and 9753interrupt 16 (coprocessor error). 9754 9755 975611.1.5.1 Interrupt 7 Coprocessor Not Available 9757 9758This exception occurs in either of two conditions: 9759 9760 1. The CPU encounters an ESC instruction and EM is set. In this case, 9761 the exception handler should emulate the instruction that caused the 9762 exception. TS may also be set. 9763 9764 2. The CPU encounters either the WAIT instruction or an ESC instruction 9765 when both MP and TS are set. In this case, the exception handler 9766 should update the state of the coprocessor, if necessary. 9767 9768 976911.1.5.2 Interrupt 9 Coprocessor Segment Overrun 9770 9771This exception occurs in protected mode under the following conditions: 9772 9773 An operand of a coprocessor instruction wraps around an addressing 9774 limit (0FFFFH for small segments, 0FFFFFFFFH for big segments, zero for 9775 expand-down segments). An operand may wrap around an addressing limit 9776 when the segment limit is near an addressing limit and the operand is 9777 near the largest valid address in the segment. Because of the 9778 wrap-around, the beginning and ending addresses of such an operand 9779 will be near opposite ends of the segment. 9780 9781 Both the first byte and the last byte of the operand (considering 9782 wrap-around) are at addresses located in the segment and in present and 9783 accessible pages. 9784 9785 The operand spans inaccessible addresses. There are two ways that such 9786 an operand may also span inaccessible addresses: 9787 9788 1. The segment limit is not equal to the addressing limit (e.g., 9789 addressing limit is FFFFH and segment limit is FFFDH); therefore, 9790 the operand will span addresses that are not within the segment 9791 (e.g., an 8-byte operand that starts at valid offset FFFC will span 9792 addresses FFFC-FFFF and 0000-0003; however, addresses FFFE and FFFF 9793 are not valid, because they exceed the limit); 9794 9795 2. The operand begins and ends in present and accessible pages but 9796 intermediate bytes of the operand fall either in a not-present page 9797 or in a page to which the current procedure does not have access 9798 rights. 9799 9800The address of the failing numerics instruction and data operand may be 9801lost; an FSTENV does not return reliable addresses. As with the 80286/80287, 9802the segment overrun exception should be handled by executing an FNINIT 9803instruction (i.e., an FINIT without a preceding WAIT). The return address on 9804the stack does not necessarily point to the failing instruction nor to the 9805following instruction. The failing numerics instruction is not restartable. 9806 9807Case 2 can be avoided by either aligning all segments on page boundaries or 9808by not starting them within 108 bytes of the start or end of a page. (The 9809maximum size of a coprocessor operand is 108 bytes.) Case 1 can be avoided 9810by making sure that the gap between the last valid offset and the first 9811valid offset of a segment is either no less than 108 bytes or is zero (i.e., 9812the segment is of full size). If neither software system design constraint 9813is acceptable, the exception handler should execute FNINIT and should 9814probably terminate the task. 9815 9816 981711.1.5.3 Interrupt 16 Coprocessor Error 9818 9819The numerics coprocessors can detect six different exception conditions 9820during instruction execution. If the detected exception is not masked by a 9821bit in the control word, the coprocessor communicates the fact that an error 9822occurred to the CPU by a signal at the ERROR# pin. The CPU causes interrupt 982316 the next time it checks the ERROR# pin, which is only at the beginning of 9824a subsequent WAIT or certain ESC instructions. If the exception is masked, 9825the numerics coprocessor handles the exception according to on-board logic; 9826it does not assert the ERROR# pin in this case. 9827 9828 982911.2 General Multiprocessing 9830 9831The components of the general multiprocessing interface include: 9832 9833 The LOCK# signal 9834 9835 The LOCK instruction prefix, which gives programmed control of the 9836 LOCK# signal. 9837 9838 Automatic assertion of the LOCK# signal with implicit memory updates 9839 by the processor 9840 9841 984211.2.1 LOCK and the LOCK# Signal 9843 9844The LOCK instruction prefix and its corresponding output signal LOCK# can 9845be used to prevent other bus masters from interrupting a data movement 9846operation. LOCK may only be used with the following 80386 instructions when 9847they modify memory. An undefined-opcode exception results from using LOCK 9848before any instruction other than: 9849 9850 Bit test and change: BTS, BTR, BTC. 9851 Exchange: XCHG. 9852 Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. 9853 One-operand arithmetic and logical: INC, DEC, NOT, and NEG. 9854 9855A locked instruction is only guaranteed to lock the area of memory defined 9856by the destination operand, but it may lock a larger memory area. For 9857example, typical 8086 and 80286 configurations lock the entire physical 9858memory space. The area of memory defined by the destination operand is 9859guaranteed to be locked against access by a processor executing a locked 9860instruction on exactly the same memory area, i.e., an operand with 9861identical starting address and identical length. 9862 9863The integrity of the lock is not affected by the alignment of the memory 9864field. The LOCK signal is asserted for as many bus cycles as necessary to 9865update the entire operand. 9866 9867 986811.2.2 Automatic Locking 9869 9870In several instances, the processor itself initiates activity on the data 9871bus. To help ensure that such activities function correctly in 9872multiprocessor configurations, the processor automatically asserts the LOCK# 9873signal. These instances include: 9874 9875 Acknowledging interrupts. 9876 9877 After an interrupt request, the interrupt controller uses the data bus 9878 to send the interrupt ID of the interrupt source to the CPU. The CPU 9879 asserts LOCK# to ensure that no other data appears on the data bus 9880 during this time. 9881 9882 Setting busy bit of TSS descriptor. 9883 9884 The processor tests and sets the busy-bit in the type field of the TSS 9885 descriptor when switching to a task. To ensure that two different 9886 processors cannot simultaneously switch to the same task, the processor 9887 asserts LOCK# while testing and setting this bit. 9888 9889 Loading of descriptors. 9890 9891 While copying the contents of a descriptor from a descriptor table into 9892 a segment register, the processor asserts LOCK# so that the descriptor 9893 cannot be modified by another processor while it is being loaded. For 9894 this action to be effective, operating-system procedures that update 9895 descriptors should adhere to the following steps: 9896 9897 Use a locked update to the access-rights byte to mark the 9898 descriptor not-present. 9899 9900 Update the fields of the descriptor. (This may require several 9901 memory accesses; therefore, LOCK cannot be used.) 9902 9903 Use a locked update to the access-rights byte to mark the 9904 descriptor present again. 9905 9906 Updating page-table A and D bits. 9907 9908 The processor exerts LOCK# while updating the A (accessed) and D 9909 (dirty) bits of page-table entries. Also the processor bypasses the 9910 page-table cache and directly updates these bits in memory. 9911 9912 Executing XCHG instruction. 9913 9914 The 80386 always asserts LOCK during an XCHG instruction that 9915 references memory (even if the LOCK prefix is not used). 9916 9917 991811.2.3 Cache Considerations 9919 9920Systems programmers must take care when updating shared data that may also 9921be stored in on-chip registers and caches. With the 80386, such shared 9922data includes: 9923 9924 Descriptors, which may be held in segment registers. 9925 9926 A change to a descriptor that is shared among processors should be 9927 broadcast to all processors. Segment registers are effectively 9928 "descriptor caches". A change to a descriptor will not be utilized by 9929 another processor if that processor already has a copy of the old 9930 version of the descriptor in a segment register. 9931 9932 Page tables, which may be held in the page-table cache. 9933 9934 A change to a page table that is shared among processors should be 9935 broadcast to all processors, so that others can flush their page-table 9936 caches and reload them with up-to-date page tables from memory. 9937 9938Systems designers can employ an interprocessor interrupt to handle the 9939above cases. When one processor changes data that may be cached by other 9940processors, it can send an interrupt signal to all other processors that may 9941be affected by the change. If the interrupt is serviced by an interrupt 9942task, the task switch automatically flushes the segment registers. The task 9943switch also flushes the page-table cache if the PDBR (the contents of CR3) 9944of the interrupt task is different from the PDBR of every other task. 9945 9946In multiprocessor systems that need a cacheability signal from the CPU, it 9947is recommended that physical address pin A31 be used to indicate 9948cacheability. Such a system can then possess up to 2 Gbytes of physical 9949memory. The virtual address range available to the programmer is not 9950affected by this convention. 9951 9952 9953Chapter 12 Debugging 9954 9955 9956 9957The 80386 brings to Intel's line of microprocessors significant advances in 9958debugging power. The single-step exception and breakpoint exception of 9959previous processors are still available in the 80386, but the principal 9960debugging support takes the form of debug registers. The debug registers 9961support both instruction breakpoints and data breakpoints. Data breakpoints 9962are an important innovation that can save hours of debugging time by 9963pinpointing, for example, exactly when a data structure is being 9964overwritten. The breakpoint registers also eliminate the complexities 9965associated with writing a breakpoint instruction into a code segment 9966(requires a data-segment alias for the code segment) or a code segment 9967shared by multiple tasks (the breakpoint exception can occur in the context 9968of any of the tasks). Breakpoints can even be set in code contained in ROM. 9969 9970 997112.1 Debugging Features of the Architecture 9972 9973The features of the 80386 architecture that support debugging include: 9974 9975Reserved debug interrupt vector 9976 9977Permits processor to automatically invoke a debugger task or procedure when 9978an event occurs that is of interest to the debugger. 9979 9980Four debug address registers 9981 9982Permit programmers to specify up to four addresses that the CPU will 9983automatically monitor. 9984 9985Debug control register 9986 9987Allows programmers to selectively enable various debug conditions 9988associated with the four debug addresses. 9989 9990Debug status register 9991 9992Helps debugger identify condition that caused debug exception. 9993 9994Trap bit of TSS (T-bit) 9995 9996Permits monitoring of task switches. 9997 9998Resume flag (RF) of flags register 9999 10000Allows an instruction to be restarted after a debug exception without 10001immediately causing another debug exception due to the same condition. 10002 10003Single-step flag (TF) 10004 10005Allows complete monitoring of program flow by specifying whether the CPU 10006should cause a debug exception with the execution of every instruction. 10007 10008Breakpoint instruction 10009 10010Permits debugger intervention at any point in program execution and aids 10011debugging of debugger programs. 10012 10013Reserved interrupt vector for breakpoint exception 10014 10015Permits processor to automatically invoke a handler task or procedure upon 10016encountering a breakpoint instruction. 10017 10018These features make it possible to invoke a debugger that is either a 10019separate task or a procedure in the context of the current task. The 10020debugger can be invoked under any of the following kinds of conditions: 10021 10022 Task switch to a specific task. 10023 Execution of the breakpoint instruction. 10024 Execution of every instruction. 10025 Execution of any instruction at a given address. 10026 Read or write of a byte, word, or doubleword at any specified address. 10027 Write to a byte, word, or doubleword at any specified address. 10028 Attempt to change a debug register. 10029 10030 1003112.2 Debug Registers 10032 10033Six 80386 registers are used to control debug features. These registers are 10034accessed by variants of the MOV instruction. A debug register may be either 10035the source operand or destination operand. The debug registers are 10036privileged resources; the MOV instructions that access them can only be 10037executed at privilege level zero. An attempt to read or write the debug 10038registers when executing at any other privilege level causes a general 10039protection exception. Figure 12-1 shows the format of the debug registers. 10040 10041 10042Figure 12-1. Debug Registers 10043 10044 31 23 15 7 0 10045 ͻ 10046 LENR/WLENR/WLENR/WLENR/W GLGLGLGLGL 10047 0 000 0 0 DR7 10048 3 3 2 2 1 1 0 0 EE33221100 10049 Ķ 10050 BBB BBBB 10051 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DR6 10052 TSD 3210 10053 Ķ 10054 10055 RESERVED DR5 10056 10057 Ķ 10058 10059 RESERVED DR4 10060 10061 Ķ 10062 10063 BREAKPOINT 3 LINEAR ADDRESS DR3 10064 10065 Ķ 10066 10067 BREAKPOINT 2 LINEAR ADDRESS DR2 10068 10069 Ķ 10070 10071 BREAKPOINT 1 LINEAR ADDRESS DR1 10072 10073 Ķ 10074 10075 BREAKPOINT 0 LINEAR ADDRESS DR0 10076 10077 ͼ 10078 10079 10080NOTE 10081 0 MEANS INTEL RESERVED. DO NOT DEFINE. 10082 10083 10084 1008512.2.1 Debug Address Registers (DR0-DR3) 10086 10087Each of these registers contains the linear address associated with one of 10088four breakpoint conditions. Each breakpoint condition is further defined by 10089bits in DR7. 10090 10091The debug address registers are effective whether or not paging is enabled. 10092The addresses in these registers are linear addresses. If paging is enabled, 10093the linear addresses are translated into physical addresses by the 10094processor's paging mechanism (as explained in Chapter 5). If paging is not 10095enabled, these linear addresses are the same as physical addresses. 10096 10097Note that when paging is enabled, different tasks may have different 10098linear-to-physical address mappings. When this is the case, an address in a 10099debug address register may be relevant to one task but not to another. For 10100this reason the 80386 has both global and local enable bits in DR7. These 10101bits indicate whether a given debug address has a global (all tasks) or 10102local (current task only) relevance. 10103 10104 1010512.2.2 Debug Control Register (DR7) 10106 10107The debug control register shown in Figure 12-1 both helps to define the 10108debug conditions and selectively enables and disables those conditions. 10109 10110For each address in registers DR0-DR3, the corresponding fields R/W0 10111through R/W3 specify the type of action that should cause a breakpoint. The 10112processor interprets these bits as follows: 10113 10114 00 Break on instruction execution only 10115 01 Break on data writes only 10116 10 undefined 10117 11 Break on data reads or writes but not instruction fetches 10118 10119Fields LEN0 through LEN3 specify the length of data item to be monitored. A 10120length of 1, 2, or 4 bytes may be specified. The values of the length fields 10121are interpreted as follows: 10122 10123 00 one-byte length 10124 01 two-byte length 10125 10 undefined 10126 11 four-byte length 10127 10128If RWn is 00 (instruction execution), then LENn should also be 00. Any other 10129length is undefined. 10130 10131The low-order eight bits of DR7 (L0 through L3 and G0 through G3) 10132selectively enable the four address breakpoint conditions. There are two 10133levels of enabling: the local (L0 through L3) and global (G0 through G3) 10134levels. The local enable bits are automatically reset by the processor at 10135every task switch to avoid unwanted breakpoint conditions in the new task. 10136The global enable bits are not reset by a task switch; therefore, they can 10137be used for conditions that are global to all tasks. 10138 10139The LE and GE bits control the "exact data breakpoint match" feature of the 10140processor. If either LE or GE is set, the processor slows execution so that 10141data breakpoints are reported on the instruction that causes them. It is 10142recommended that one of these bits be set whenever data breakpoints are 10143armed. The processor clears LE at a task switch but does not clear GE. 10144 10145 1014612.2.3 Debug Status Register (DR6) 10147 10148The debug status register shown in Figure 12-1 permits the debugger to 10149determine which debug conditions have occurred. 10150 10151When the processor detects an enabled debug exception, it sets the 10152low-order bits of this register (B0 thru B3) before entering the debug 10153exception handler. Bn is set if the condition described by DRn, LENn, and 10154R/Wn occurs. (Note that the processor sets Bn regardless of whether Gn or 10155Ln is set. If more than one breakpoint condition occurs at one time and if 10156the breakpoint trap occurs due to an enabled condition other than n, Bn may 10157be set, even though neither Gn nor Ln is set.) 10158 10159The BT bit is associated with the T-bit (debug trap bit) of the TSS (refer 10160to 7 for the location of the T-bit). The processor sets the BT bit before 10161entering the debug handler if a task switch has occurred and the T-bit of 10162the new TSS is set. There is no corresponding bit in DR7 that enables and 10163disables this trap; the T-bit of the TSS is the sole enabling bit. 10164 10165The BS bit is associated with the TF (trap flag) bit of the EFLAGS 10166register. The BS bit is set if the debug handler is entered due to the 10167occurrence of a single-step exception. The single-step trap is the 10168highest-priority debug exception; therefore, when BS is set, any of the 10169other debug status bits may also be set. 10170 10171The BD bit is set if the next instruction will read or write one of the 10172eight debug registers and ICE-386 is also using the debug registers at the 10173same time. 10174 10175Note that the bits of DR6 are never cleared by the processor. To avoid any 10176confusion in identifying the next debug exception, the debug handler should 10177move zeros to DR6 immediately before returning. 10178 10179 1018012.2.4 Breakpoint Field Recognition 10181 10182The linear address and LEN field for each of the four breakpoint conditions 10183define a range of sequential byte addresses for a data breakpoint. The LEN 10184field permits specification of a one-, two-, or four-byte field. Two-byte 10185fields must be aligned on word boundaries (addresses that are multiples of 10186two) and four-byte fields must be aligned on doubleword boundaries 10187(addresses that are multiples of four). These requirements are enforced by 10188the processor; it uses the LEN bits to mask the low-order bits of the 10189addresses in the debug address registers. Improperly aligned code or data 10190breakpoint addresses will not yield the expected results. 10191 10192A data read or write breakpoint is triggered if any of the bytes 10193participating in a memory access is within the field defined by a breakpoint 10194address register and the corresponding LEN field. Table 12-1 gives some 10195examples of breakpoint fields with memory references that both do and do not 10196cause traps. 10197 10198To set a data breakpoint for a misaligned field longer than one byte, it 10199may be desirable to put two sets of entries in the breakpoint register such 10200that each entry is properly aligned and the two entries together span the 10201length of the field. 10202 10203Instruction breakpoint addresses must have a length specification of one 10204byte (LEN = 00); other values are undefined. The processor recognizes an 10205instruction breakpoint address only when it points to the first byte of an 10206instruction. If the instruction has any prefixes, the breakpoint address 10207must point to the first prefix. 10208 10209 10210Table 12-1. Breakpoint Field Recognition Examples 10211 10212 Address (hex) Length 10213 10214 DR0 0A0001 1 (LEN0 = 00) 10215Register Contents DR1 0A0002 1 (LEN1 = 00) 10216 DR2 0B0002 2 (LEN2 = 01) 10217 DR3 0C0000 4 (LEN3 = 11) 10218 10219Some Examples of Memory 0A0001 1 10220References That Cause Traps 0A0002 1 10221 0A0001 2 10222 0A0002 2 10223 0B0002 2 10224 0B0001 4 10225 0C0000 4 10226 0C0001 2 10227 0C0003 1 10228 10229Some Examples of Memory 0A0000 1 10230References That Don't Cause Traps 0A0003 4 10231 0B0000 2 10232 0C0004 4 10233 10234 1023512.3 Debug Exceptions 10236 10237Two of the interrupt vectors of the 80386 are reserved for exceptions that 10238relate to debugging. Interrupt 1 is the primary means of invoking debuggers 10239designed expressly for the 80386; interrupt 3 is intended for debugging 10240debuggers and for compatibility with prior processors in Intel's 8086 10241processor family. 10242 10243 1024412.3.1 Interrupt 1 Debug Exceptions 10245 10246The handler for this exception is usually a debugger or part of a debugging 10247system. The processor causes interrupt 1 for any of several conditions. The 10248debugger can check flags in DR6 and DR7 to determine what condition caused 10249the exception and what other conditions might be in effect at the same time. 10250Table 12-2 associates with each breakpoint condition the combination of 10251bits that indicate when that condition has caused the debug exception. 10252 10253Instruction address breakpoint conditions are faults, while other debug 10254conditions are traps. The debug exception may report either or both at one 10255time. The following paragraphs present details for each class of debug 10256exception. 10257 10258 10259Table 12-2. Debug Exception Conditions 10260 10261Flags to Test Condition 10262 10263BS=1 Single-step trap 10264B0=1 AND (GE0=1 OR LE0=1) Breakpoint DR0, LEN0, R/W0 10265B1=1 AND (GE1=1 OR LE1=1) Breakpoint DR1, LEN1, R/W1 10266B2=1 AND (GE2=1 OR LE2=1) Breakpoint DR2, LEN2, R/W2 10267B3=1 AND (GE3=1 OR LE3=1) Breakpoint DR3, LEN3, R/W3 10268BD=1 Debug registers not available; in use by ICE-386. 10269BT=1 Task switch 10270 10271 1027212.3.1.1 Instruction Addrees Breakpoint 10273 10274The processor reports an instruction-address breakpoint before it executes 10275the instruction that begins at the given address; i.e., an instruction- 10276address breakpoint exception is a fault. 10277 10278The RF (restart flag) permits the debug handler to retry instructions that 10279cause other kinds of faults in addition to debug faults. When it detects a 10280fault, the processor automatically sets RF in the flags image that it pushes 10281onto the stack. (It does not, however, set RF for traps and aborts.) 10282 10283When RF is set, it causes any debug fault to be ignored during the next 10284instruction. (Note, however, that RF does not cause breakpoint traps to be 10285ignored, nor other kinds of faults.) 10286 10287The processor automatically clears RF at the successful completion of every 10288instruction except after the IRET instruction, after the POPF instruction, 10289and after a JMP, CALL, or INT instruction that causes a task switch. These 10290instructions set RF to the value specified by the memory image of the EFLAGS 10291register. 10292 10293The processor automatically sets RF in the EFLAGS image on the stack before 10294entry into any fault handler. Upon entry into the fault handler for 10295instruction address breakpoints, for example, RF is set in the EFLAGS image 10296on the stack; therefore, the IRET instruction at the end of the handler will 10297set RF in the EFLAGS register, and execution will resume at the breakpoint 10298address without generating another breakpoint fault at the same address. 10299 10300If, after a debug fault, RF is set and the debug handler retries the 10301faulting instruction, it is possible that retrying the instruction will 10302raise other faults. The retry of the instruction after these faults will 10303also be done with RF=1, with the result that debug faults continue to be 10304ignored. The processor clears RF only after successful completion of the 10305instruction. 10306 10307Real-mode debuggers can control the RF flag by using a 32-bit IRET. A 1030816-bit IRET instruction does not affect the RF bit (which is in the 10309high-order 16 bits of EFLAGS). To use a 32-bit IRET, the debugger must 10310rearrange the stack so that it holds appropriate values for the 32-bit EIP, 10311CS, and EFLAGS (with RF set in the EFLAGS image). Then executing an IRET 10312with an operand size prefix causes a 32-bit return, popping the RF flag 10313into EFLAGS. 10314 10315 1031612.3.1.2 Data Address Breakpoint 10317 10318A data-address breakpoint exception is a trap; i.e., the processor reports 10319a data-address breakpoint after executing the instruction that accesses the 10320given memory item. 10321 10322When using data breakpoints it is recommended that either the LE or GE bit 10323of DR7 be set also. If either LE or GE is set, any data breakpoint trap is 10324reported exactly after completion of the instruction that accessed the 10325specified memory item. This exact reporting is accomplished by forcing the 1032680386 execution unit to wait for completion of data operand transfers before 10327beginning execution of the next instruction. If neither GE nor LE is set, 10328data breakpoints may not be reported until one instruction after the data is 10329accessed or may not be reported at all. This is due to the fact that, 10330normally, instruction execution is overlapped with memory transfers to such 10331a degree that execution of the next instruction may begin before memory 10332transfers for the prior instruction are completed. 10333 10334If a debugger needs to preserve the contents of a write breakpoint 10335location, it should save the original contents before setting a write 10336breakpoint. Because data breakpoints are traps, a write into a breakpoint 10337location will complete before the trap condition is reported. The handler 10338can report the saved value after the breakpoint is triggered. The data in 10339the debug registers can be used to address the new value stored by the 10340instruction that triggered the breakpoint. 10341 10342 1034312.3.1.3 General Detect Fault 10344 10345This exception occurs when an attempt is made to use the debug registers at 10346the same time that ICE-386 is using them. This additional protection feature 10347is provided to guarantee that ICE-386 can have full control over the 10348debug-register resources when required. ICE-386 uses the debug-registers; 10349therefore, a software debugger that also uses these registers cannot run 10350while ICE-386 is in use. The exception handler can detect this condition by 10351examining the BD bit of DR6. 10352 10353 1035412.3.1.4 Single-Step Trap 10355 10356This debug condition occurs at the end of an instruction if the trap flag 10357(TF) of the flags register held the value one at the beginning of that 10358instruction. Note that the exception does not occur at the end of an 10359instruction that sets TF. For example, if POPF is used to set TF, a 10360single-step trap does not occur until after the instruction that follows 10361POPF. 10362 10363The processor clears the TF bit before invoking the handler. If TF=1 in 10364the flags image of a TSS at the time of a task switch, the exception occurs 10365after the first instruction is executed in the new task. 10366 10367The single-step flag is normally not cleared by privilege changes inside a 10368task. INT instructions, however, do clear TF. Therefore, software 10369debuggers that single-step code must recognize and emulate INT n or INTO 10370rather than executing them directly. 10371 10372To maintain protection, system software should check the current execution 10373privilege level after any single step interrupt to see whether single 10374stepping should continue at the current privilege level. 10375 10376The interrupt priorities in hardware guarantee that if an external 10377interrupt occurs, single stepping stops. When both an external interrupt and 10378a single step interrupt occur together, the single step interrupt is 10379processed first. This clears the TF bit. After saving the return address or 10380switching tasks, the external interrupt input is examined before the first 10381instruction of the single step handler executes. If the external interrupt 10382is still pending, it is then serviced. The external interrupt handler is not 10383single-stepped. To single step an interrupt handler, just single step an INT 10384n instruction that refers to the interrupt handler. 10385 10386 1038712.3.1.5 Task Switch Breakpoint 10388 10389The debug exception also occurs after a switch to an 80386 task if the 10390T-bit of the new TSS is set. The exception occurs after control has passed 10391to the new task, but before the first instruction of that task is executed. 10392The exception handler can detect this condition by examining the BT bit of 10393the debug status register DR6. 10394 10395Note that if the debug exception handler is a task, the T-bit of its TSS 10396should not be set. Failure to observe this rule will cause the processor to 10397enter an infinite loop. 10398 10399 1040012.3.2 Interrupt 3 Breakpoint Exception 10401 10402This exception is caused by execution of the breakpoint instruction INT 3. 10403Typically, a debugger prepares a breakpoint by substituting the opcode of 10404the one-byte breakpoint instruction in place of the first opcode byte of the 10405instruction to be trapped. When execution of the INT 3 instruction causes 10406the exception handler to be invoked, the saved value of ES:EIP points to the 10407byte following the INT 3 instruction. 10408 10409With prior generations of processors, this feature is used extensively for 10410trapping execution of specific instructions. With the 80386, the needs 10411formerly filled by this feature are more conveniently solved via the debug 10412registers and interrupt 1. However, the breakpoint exception is still 10413useful for debugging debuggers, because the breakpoint exception can vector 10414to a different exception handler than that used by the debugger. The 10415breakpoint exception can also be useful when it is necessary to set a 10416greater number of breakpoints than permitted by the debug registers. 10417 10418 10419 PART III COMPATIBILITY 10420 10421 10422Chapter 13 Executing 80286 Protected-Mode Code 10423 10424 10425 1042613.1 80286 Code Executes as a Subset of the 80386 10427 10428In general, programs designed for execution in protected mode on an 80286 10429execute without modification on the 80386, because the features of the 80286 10430are a subset of those of the 80386. 10431 10432All the descriptors used by the 80286 are supported by the 80386 as long as 10433the Intel-reserved word (last word) of the 80286 descriptor is zero. 10434 10435The descriptors for data segments, executable segments, local descriptor 10436tables, and task gates are common to both the 80286 and the 80386. Other 1043780286 descriptorsTSS segment, call gate, interrupt gate, and trap 10438gateare supported by the 80386. The 80386 also has new versions of 10439descriptors for TSS segment, call gate, interrupt gate, and trap gate that 10440support the 32-bit nature of the 80386. Both sets of descriptors can be 10441used simultaneously in the same system. 10442 10443For those descriptors that are common to both the 80286 and the 80386, the 10444presence of zeros in the final word causes the 80386 to interpret these 10445descriptors exactly as 80286 does; for example: 10446 10447Base Address The high-order eight bits of the 32-bit base address are 10448 zero, limiting base addresses to 24 bits. 10449 10450Limit The high-order four bits of the limit field are zero, 10451 restricting the value of the limit field to 64K. 10452 10453Granularity bit The granularity bit is zero, which implies that the value 10454 of the 16-bit limit is interpreted in units of one byte. 10455 10456B-bit In a data-segment descriptor, the B-bit is zero, implying 10457 that the segment is no larger than 64 Kbytes. 10458 10459D-bit In an executable-segment descriptor, the D-bit is zero, 10460 implying that 16-bit addressing and operands are the 10461 default. 10462 10463For formats of these descriptors and documentation of their use refer to 10464the iAPX 286 Programmer's Reference Manual. 10465 10466 1046713.2 Two ways to Execute 80286 Tasks 10468 10469When porting 80286 programs to the 80386, there are two cases to consider: 10470 10471 1. Porting an entire 80286 system to the 80386, complete with 80286 10472 operating system, loader, and system builder. 10473 10474 In this case, all tasks will have 80286 TSSs. The 80386 is being used 10475 as a faster 286. 10476 10477 2. Porting selected 80286 applications to run in an 80386 environment 10478 with an 80386 operating system, loader, and system builder. 10479 10480 In this case, the TSSs used to represent 80286 tasks should be 10481 changed to 80386 TSSs. It is theoretically possible to mix 80286 and 10482 80386 TSSs, but the benefits are slight and the problems are great. It 10483 is recommended that all tasks in a 80386 software system have 80386 10484 TSSs. It is not necessary to change the 80286 object modules 10485 themselves; TSSs are usually constructed by the operating system, by 10486 the loader, or by the system builder. Refer to Chapter 16 for further 10487 discussion of the interface between 16-bit and 32-bit code. 10488 10489 1049013.3 Differences From 80286 10491 10492The few differences that do exist primarily affect operating system code. 10493 10494 1049513.3.1 Wraparound of 80286 24-Bit Physical Address Space 10496 10497With the 80286, any base and offset combination that addresses beyond 16M 10498bytes wraps around to the first megabyte of the 80286 address space. With 10499the 80386, since it has a greater physical address space, any such address 10500falls into the 17th megabyte. In the unlikely event that any software 10501depends on this anomaly, the same effect can be simulated on the 80386 by 10502using paging to map the first 64K bytes of the 17th megabyte of logical 10503addresses to physical addresses in the first megabyte. 10504 10505 1050613.3.2 Reserved Word of Descriptor 10507 10508Because the 80386 uses the contents of the reserved word (last word) of 10509every descriptor, 80286 programs that place values in this word may not 10510execute correctly on the 80386. 10511 10512 1051313.3.3 New Descriptor Type Codes 10514 10515Operating-system code that manages space in descriptor tables often uses an 10516invalid value in the access-rights field of descriptor-table entries to 10517identify unused entries. Access rights values of 80H and 00H remain invalid 10518for both the 80286 and 80386. Other values that were invalid on for the 1051980286 may be valid for the 80386 because of the additional descriptor types 10520defined by the 80386. 10521 10522 1052313.3.4 Restricted Semantics of LOCK 10524 10525The 80286 processor implements the bus lock function differently than the 1052680386. Programs that use forms of memory locking specific to the 80286 may 10527not execute properly when transported to a specific application of the 1052880386. 10529 10530The LOCK prefix and its corresponding output signal should only be used to 10531prevent other bus masters from interrupting a data movement operation. LOCK 10532may only be used with the following 80386 instructions when they modify 10533memory. An undefined-opcode exception results from using LOCK before any 10534other instruction. 10535 10536 Bit test and change: BTS, BTR, BTC. 10537 Exchange: XCHG. 10538 One-operand arithmetic and logical: INC, DEC, NOT, and NEG. 10539 Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. 10540 10541A locked instruction is guaranteed to lock only the area of memory defined 10542by the destination operand, but may lock a larger memory area. For example, 10543typical 8086 and 80286 configurations lock the entire physical memory space. 10544With the 80386, the defined area of memory is guaranteed to be locked 10545against access by a processor executing a locked instruction on exactly the 10546same memory area, i.e., an operand with identical starting address and 10547identical length. 10548 10549 1055013.3.5 Additional Exceptions 10551 10552The 80386 defines new exceptions that can occur even in systems designed 10553for the 80286. 10554 10555 Exception #6 invalid opcode 10556 10557 This exception can result from improper use of the LOCK instruction. 10558 10559 Exception #14 page fault 10560 10561 This exception may occur in an 80286 program if the operating system 10562 enables paging. Paging can be used in a system with 80286 tasks as long 10563 as all tasks use the same page directory. Because there is no place in 10564 an 80286 TSS to store the PDBR, switching to an 80286 task does not 10565 change the value of PDBR. Tasks ported from the 80286 should be given 10566 80386 TSSs so they can take full advantage of paging. 10567 10568 10569Chapter 14 80386 Real-Address Mode 10570 10571 10572 10573The real-address mode of the 80386 executes object code designed for 10574execution on 8086, 8088, 80186, or 80188 processors, or for execution in the 10575real-address mode of an 80286: 10576 10577In effect, the architecture of the 80386 in this mode is almost identical 10578to that of the 8086, 8088, 80186, and 80188. To a programmer, an 80386 in 10579real-address mode appears as a high-speed 8086 with extensions to the 10580instruction set and registers. The principal features of this architecture 10581are defined in Chapters 2 and 3. 10582 10583This chapter discusses certain additional topics that complete the system 10584programmer's view of the 80386 in real-address mode: 10585 10586 Address formation. 10587 Extensions to registers and instructions. 10588 Interrupt and exception handling. 10589 Entering and leaving real-address mode. 10590 Real-address-mode exceptions. 10591 Differences from 8086. 10592 Differences from 80286 real-address mode. 10593 10594 1059514.1 Physical Address Formation 10596 10597The 80386 provides a one Mbyte + 64 Kbyte memory space for an 8086 program. 10598Segment relocation is performed as in the 8086: the 16-bit value in a 10599segment selector is shifted left by four bits to form the base address of a 10600segment. The effective address is extended with four high order zeros and 10601added to the base to form a linear address as Figure 14-1 illustrates. (The 10602linear address is equivalent to the physical address, because paging is not 10603used in real-address mode.) Unlike the 8086, the resulting linear address 10604may have up to 21 significant bits. There is a possibility of a carry when 10605the base address is added to the effective address. On the 8086, the carried 10606bit is truncated, whereas on the 80386 the carried bit is stored in bit 10607position 20 of the linear address. 10608 10609Unlike the 8086 and 80286, 32-bit effective addresses can be generated (via 10610the address-size prefix); however, the value of a 32-bit address may not 10611exceed 65535 without causing an exception. For full compatibility with 80286 10612real-address mode, pseudo-protection faults (interrupt 12 or 13 with no 10613error code) occur if an effective address is generated outside the range 0 10614through 65535. 10615 10616 10617Figure 14-1. Real-Address Mode Address Formation 10618 10619 19 3 0 10620 ͻ 10621 BASE 16-BIT SEGMENT SELECTOR 0 0 0 0 10622 ͼ 10623 10624 + 10625 19 15 0 10626 ͻ 10627 OFFSET 0 0 0 0 16-BIT EFFECTIVE ADDRESS 10628 ͼ 10629 10630 = 10631 20 0 10632 LINEAR ͻ 10633 ADDRESS X X X X X X X X X X X X X X X X X X X X X X 10634 ͼ 10635 10636 1063714.2 Registers and Instructions 10638 10639The register set available in real-address mode includes all the registers 10640defined for the 8086 plus the new registers introduced by the 80386: FS, GS, 10641debug registers, control registers, and test registers. New instructions 10642that explicitly operate on the segment registers FS and GS are available, 10643and the new segment-override prefixes can be used to cause instructions to 10644utilize FS and GS for address calculations. Instructions can utilize 32-bit 10645operands through the use of the operand size prefix. 10646 10647The instruction codes that cause undefined opcode traps (interrupt 6) 10648include instructions of the protected mode that manipulate or interrogate 1064980386 selectors and descriptors; namely, VERR, VERW, LAR, LSL, LTR, STR, 10650LLDT, and SLDT. Programs executing in real-address mode are able to take 10651advantage of the new applications-oriented instructions added to the 10652architecture by the introduction of the 80186/80188, 80286 and 80386: 10653 10654 New instructions introduced by 80186/80188 and 80286. 10655 10656 PUSH immediate data 10657 Push all and pop all (PUSHA and POPA) 10658 Multiply immediate data 10659 Shift and rotate by immediate count 10660 String I/O 10661 ENTER and LEAVE 10662 BOUND 10663 10664 New instructions introduced by 80386. 10665 10666 LSS, LFS, LGS instructions 10667 Long-displacement conditional jumps 10668 Single-bit instructions 10669 Bit scan 10670 Double-shift instructions 10671 Byte set on condition 10672 Move with sign/zero extension 10673 Generalized multiply 10674 MOV to and from control registers 10675 MOV to and from test registers 10676 MOV to and from debug registers 10677 10678 1067914.3 Interrupt and Exception Handling 10680 10681Interrupts and exceptions in 80386 real-address mode work as much as they 10682do on an 8086. Interrupts and exceptions vector to interrupt procedures via 10683an interrupt table. The processor multiplies the interrupt or exception 10684identifier by four to obtain an index into the interrupt table. The entries 10685of the interrupt table are far pointers to the entry points of interrupt or 10686exception handler procedures. When an interrupt occurs, the processor 10687pushes the current values of CS:IP onto the stack, disables interrupts, 10688clears TF (the single-step flag), then transfers control to the location 10689specified in the interrupt table. An IRET instruction at the end of the 10690handler procedure reverses these steps before returning control to the 10691interrupted procedure. 10692 10693The primary difference in the interrupt handling of the 80386 compared to 10694the 8086 is that the location and size of the interrupt table depend on the 10695contents of the IDTR (IDT register). Ordinarily, this fact is not apparent 10696to programmers, because, after RESET, the IDTR contains a base address of 0 10697and a limit of 3FFH, which is compatible with the 8086. However, the LIDT 10698instruction can be used in real-address mode to change the base and limit 10699values in the IDTR. Refer to Chapter 9 for details on the IDTR, and the 10700LIDT and SIDT instructions. If an interrupt occurs and the corresponding 10701entry of the interrupt table is beyond the limit stored in the IDTR, the 10702processor raises exception 8. 10703 10704 1070514.4 Entering and Leaving Real-Address Mode 10706 10707Real-address mode is in effect after a signal on the RESET pin. Even if the 10708system is going to be used in protected mode, the start-up program will 10709execute in real-address mode temporarily while initializing for protected 10710mode. 10711 10712 1071314.4.1 Switching to Protected Mode 10714 10715The only way to leave real-address mode is to switch to protected mode. The 10716processor enters protected mode when a MOV to CR0 instruction sets the PE 10717(protection enable) bit in CR0. (For compatibility with the 80286, the LMSW 10718instruction may also be used to set the PE bit.) 10719 10720Refer to Chapter 10 "Initialization" for other aspects of switching to 10721protected mode. 10722 10723 1072414.5 Switching Back to Real-Address Mode 10725 10726The processor reenters real-address mode if software clears the PE bit in 10727CR0 with a MOV to CR0 instruction. A procedure that attempts to do this, 10728however, should proceed as follows: 10729 10730 1. If paging is enabled, perform the following sequence: 10731 10732 Transfer control to linear addresses that have an identity mapping; 10733 i.e., linear addresses equal physical addresses. 10734 10735 Clear the PG bit in CR0. 10736 10737 Move zeros to CR3 to clear out the paging cache. 10738 10739 2. Transfer control to a segment that has a limit of 64K (FFFFH). This 10740 loads the CS register with the limit it needs to have in real mode. 10741 10742 3. Load segment registers SS, DS, ES, FS, and GS with a selector that 10743 points to a descriptor containing the following values, which are 10744 appropriate to real mode: 10745 10746 Limit = 64K (FFFFH) 10747 Byte granular (G = 0) 10748 Expand up (E = 0) 10749 Writable (W = 1) 10750 Present (P = 1) 10751 Base = any value 10752 10753 4. Disable interrupts. A CLI instruction disables INTR interrupts. NMIs 10754 can be disabled with external circuitry. 10755 10756 5. Clear the PE bit. 10757 10758 6. Jump to the real mode code to be executed using a far JMP. This 10759 action flushes the instruction queue and puts appropriate values in 10760 the access rights of the CS register. 10761 10762 7. Use the LIDT instruction to load the base and limit of the real-mode 10763 interrupt vector table. 10764 10765 8. Enable interrupts. 10766 10767 9. Load the segment registers as needed by the real-mode code. 10768 10769 1077014.6 Real-Address Mode Exceptions 10771 10772The 80386 reports some exceptions differently when executing in 10773real-address mode than when executing in protected mode. Table 14-1 details 10774the real-address-mode exceptions. 10775 10776 1077714.7 Differences From 8086 10778 10779In general, the 80386 in real-address mode will correctly execute ROM-based 10780software designed for the 8086, 8088, 80186, and 80188. Following is a list 10781of the minor differences between 8086 execution on the 80386 and on an 8086. 10782 10783 1. Instruction clock counts. 10784 10785 The 80386 takes fewer clocks for most instructions than the 8086/8088. 10786 The areas most likely to be affected are: 10787 10788 Delays required by I/O devices between I/O operations. 10789 10790 Assumed delays with 8086/8088 operating in parallel with an 8087. 10791 10792 2. Divide Exceptions Point to the DIV instruction. 10793 10794 Divide exceptions on the 80386 always leave the saved CS:IP value 10795 pointing to the instruction that failed. On the 8086/8088, the CS:IP 10796 value points to the next instruction. 10797 10798 3. Undefined 8086/8088 opcodes. 10799 10800 Opcodes that were not defined for the 8086/8088 will cause exception 10801 6 or will execute one of the new instructions defined for the 80386. 10802 10803 4. Value written by PUSH SP. 10804 10805 The 80386 pushes a different value on the stack for PUSH SP than the 10806 8086/8088. The 80386 pushes the value of SP before SP is incremented 10807 as part of the push operation; the 8086/8088 pushes the value of SP 10808 after it is incremented. If the value pushed is important, replace 10809 PUSH SP instructions with the following three instructions: 10810 10811 PUSH BP 10812 MOV BP, SP 10813 XCHG BP, [BP] 10814 10815 This code functions as the 8086/8088 PUSH SP instruction on the 80386. 10816 10817 5. Shift or rotate by more than 31 bits. 10818 10819 The 80386 masks all shift and rotate counts to the low-order five 10820 bits. This MOD 32 operation limits the count to a maximum of 31 bits, 10821 thereby limiting the time that interrupt response is delayed while 10822 the instruction is executing. 10823 10824 6. Redundant prefixes. 10825 10826 The 80386 sets a limit of 15 bytes on instruction length. The only 10827 way to violate this limit is by putting redundant prefixes before an 10828 instruction. Exception 13 occurs if the limit on instruction length 10829 is violated. The 8086/8088 has no instruction length limit. 10830 10831 7. Operand crossing offset 0 or 65,535. 10832 10833 On the 8086, an attempt to access a memory operand that crosses 10834 offset 65,535 (e.g., MOV a word to offset 65,535) or offset 0 (e.g., 10835 PUSH a word when SP = 1) causes the offset to wrap around modulo 10836 65,536. The 80386 raises an exception in these casesexception 13 if 10837 the segment is a data segment (i.e., if CS, DS, ES, FS, or GS is being 10838 used to address the segment), exception 12 if the segment is a stack 10839 segment (i.e., if SS is being used). 10840 10841 8. Sequential execution across offset 65,535. 10842 10843 On the 8086, if sequential execution of instructions proceeds past 10844 offset 65,535, the processor fetches the next instruction byte from 10845 offset 0 of the same segment. On the 80386, the processor raises 10846 exception 13 in such a case. 10847 10848 9. LOCK is restricted to certain instructions. 10849 10850 The LOCK prefix and its corresponding output signal should only be 10851 used to prevent other bus masters from interrupting a data movement 10852 operation. The 80386 always asserts the LOCK signal during an XCHG 10853 instruction with memory (even if the LOCK prefix is not used). LOCK 10854 may only be used with the following 80386 instructions when they 10855 update memory: BTS, BTR, BTC, XCHG, ADD, ADC, SUB, SBB, INC, DEC, 10856 AND, OR, XOR, NOT, and NEG. An undefined-opcode exception 10857 (interrupt 6) results from using LOCK before any other instruction. 10858 10859 10. Single-stepping external interrupt handlers. 10860 10861 The priority of the 80386 single-step exception is different from that 10862 of the 8086/8088. The change prevents an external interrupt handler 10863 from being single-stepped if the interrupt occurs while a program is 10864 being single-stepped. The 80386 single-step exception has higher 10865 priority that any external interrupt. The 80386 will still single-step 10866 through an interrupt handler invoked by the INT instructions or by an 10867 exception. 10868 10869 11. IDIV exceptions for quotients of 80H or 8000H. 10870 10871 The 80386 can generate the largest negative number as a quotient for 10872 the IDIV instruction. The 8086/8088 causes exception zero instead. 10873 10874 12. Flags in stack. 10875 10876 The setting of the flags stored by PUSHF, by interrupts, and by 10877 exceptions is different from that stored by the 8086 in bit positions 10878 12 through 15. On the 8086 these bits are stored as ones, but in 10879 80386 real-address mode bit 15 is always zero, and bits 14 through 12 10880 reflect the last value loaded into them. 10881 10882 13. NMI interrupting NMI handlers. 10883 10884 After an NMI is recognized on the 80386, the NMI interrupt is masked 10885 until an IRET instruction is executed. 10886 10887 14. Coprocessor errors vector to interrupt 16. 10888 10889 Any 80386 system with a coprocessor must use interrupt vector 16 for 10890 the coprocessor error exception. If an 8086/8088 system uses another 10891 vector for the 8087 interrupt, both vectors should point to the 10892 coprocessor-error exception handler. 10893 10894 15. Numeric exception handlers should allow prefixes. 10895 10896 On the 80386, the value of CS:IP saved for coprocessor exceptions 10897 points at any prefixes before an ESC instruction. On 8086/8088 10898 systems, the saved CS:IP points to the ESC instruction. 10899 10900 16. Coprocessor does not use interrupt controller. 10901 10902 The coprocessor error signal to the 80386 does not pass through an 10903 interrupt controller (an 8087 INT signal does). Some instructions in 10904 a coprocessor error handler may need to be deleted if they deal with 10905 the interrupt controller. 10906 10907 17. Six new interrupt vectors. 10908 10909 The 80386 adds six exceptions that arise only if the 8086 program has 10910 a hidden bug. It is recommended that exception handlers be added that 10911 treat these exceptions as invalid operations. This additional 10912 software does not significantly affect the existing 8086 software 10913 because the interrupts do not normally occur. These interrupt 10914 identifiers should not already have been used by the 8086 software, 10915 because they are in the range reserved by Intel. Table 14-2 describes 10916 the new 80386 exceptions. 10917 10918 18. One megabyte wraparound. 10919 10920 The 80386 does not wrap addresses at 1 megabyte in real-address mode. 10921 On members of the 8086 family, it possible to specify addresses 10922 greater than one megabyte. For example, with a selector value 0FFFFH 10923 and an offset of 0FFFFH, the effective address would be 10FFEFH (1 10924 Mbyte + 65519). The 8086, which can form adresses only up to 20 bits 10925 long, truncates the high-order bit, thereby "wrapping" this address 10926 to 0FFEFH. However, the 80386, which can form addresses up to 32 10927 bits long does not truncate such an address. 10928 10929 10930Table 14-1. 80386 Real-Address Mode Exceptions 10931 10932 10933Description Interrupt Function that Can Return Address 10934 Number Generate the Exception Points to Faulting 10935 Instruction 10936Divide error 0 DIV, IDIV YES 10937Debug exceptions 1 All 10938Some debug exceptions point to the faulting instruction, others to the 10939next instruction. The exception handler can determine which has occurred by 10940examining DR6. 10941 10942 10943 10944 10945 10946Breakpoint 3 INT NO 10947Overflow 4 INTO NO 10948Bounds check 5 BOUND YES 10949Invalid opcode 6 Any undefined opcode or LOCK YES 10950 used with wrong instruction 10951Coprocessor not available 7 ESC or WAIT YES 10952Interrupt table limit too small 8 INT vector is not within IDTR YES 10953 limit 10954Reserved 9-12 10955Stack fault 12 Memory operand crosses offset YES 10956 0 or 0FFFFH 10957Pseudo-protection exception 13 Memory operand crosses offset YES 10958 0FFFFH or attempt to execute 10959 past offset 0FFFFH or 10960 instruction longer than 15 10961 bytes 10962Reserved 14,15 10963Coprocessor error 16 ESC or WAIT YES 10964Coprocessor errors are reported on the first ESC or WAIT instruction 10965after the ESC instruction that caused the error. 10966 10967 10968 10969 10970 10971Two-byte SW interrupt 0-255 INT n NO 10972 10973 10974Table 14-2. New 80386 Exceptions 10975 10976Interrupt Function 10977Identifier 10978 10979 5 A BOUND instruction was executed with a register value outside 10980 the limit values. 10981 10982 6 An undefined opcode was encountered or LOCK was used improperly 10983 before an instruction to which it does not apply. 10984 10985 7 The EM bit in the MSW is set when an ESC instruction was 10986 encountered. This exception also occurs on a WAIT instruction 10987 if TS is set. 10988 10989 8 An exception or interrupt has vectored to an interrupt table 10990 entry beyond the interrupt table limit in IDTR. This can occur 10991 only if the LIDT instruction has changed the limit from the 10992 default value of 3FFH, which is enough for all 256 interrupt 10993 IDs. 10994 10995 12 Operand crosses extremes of stack segment, e.g., MOV operation 10996 at offset 0FFFFH or push with SP=1 during PUSH, CALL, or INT. 10997 10998 13 Operand crosses extremes of a segment other than a stack 10999 segment; or sequential instruction execution attempts to 11000 proceed beyond offset 0FFFFH; or an instruction is longer than 11001 15 bytes (including prefixes). 11002 11003 1100414.8 Differences From 80286 Real-Address Mode 11005 11006The few differences that exist between 80386 real-address mode and 80286 11007real-address mode are not likely to affect any existing 80286 programs 11008except possibly the system initialization procedures. 11009 11010 1101114.8.1 Bus Lock 11012 11013The 80286 processor implements the bus lock function differently than the 1101480386. Programs that use forms of memory locking specific to the 80286 may 11015not execute properly if transported to a specific application of the 80386. 11016 11017The LOCK prefix and its corresponding output signal should only be used to 11018prevent other bus masters from interrupting a data movement operation. LOCK 11019may only be used with the following 80386 instructions when they modify 11020memory. An undefined-opcode exception results from using LOCK before any 11021other instruction. 11022 11023 Bit test and change: BTS, BTR, BTC. 11024 Exchange: XCHG. 11025 One-operand arithmetic and logical: INC, DEC, NOT, and NEG. 11026 Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. 11027 11028A locked instruction is guaranteed to lock only the area of memory defined 11029by the destination operand, but may lock a larger memory area. For example, 11030typical 8086 and 80286 configurations lock the entire physical memory space. 11031With the 80386, the defined area of memory is guranteed to be locked against 11032access by a processor executing a locked instruction on exactly the same 11033memory area, i.e., an operand with identical starting address and identical 11034length. 11035 11036 1103714.8.2 Location of First Instruction 11038 11039The starting location is 0FFFFFFF0H (sixteen bytes from end of 32-bit 11040address space) on the 80386 rather than 0FFFFF0H (sixteen bytes from end of 1104124-bit address space) as on the 80286. Many 80286 ROM initialization 11042programs will work correctly in this new environment. Others can be made to 11043work correctly with external hardware that redefines the signals on 11044A{31-20}. 11045 11046 1104714.8.3 Initial Values of General Registers 11048 11049On the 80386, certain general registers may contain different values after 11050RESET than on the 80286. This should not cause compatibility problems, 11051because the content of 8086 registers after RESET is undefined. If 11052self-test is requested during the reset sequence and errors are detected in 11053the 80386 unit, EAX will contain a nonzero value. EDX contains the component 11054and revision identifier. Refer to Chapter 10 for more information. 11055 11056 1105714.8.4 MSW Initialization 11058 11059The 80286 initializes the MSW register to FFF0H, but the 80386 initializes 11060this register to 0000H. This difference should have no effect, because the 11061bits that are different are undefined on the 80286. Programs that read the 11062value of the MSW will behave differently on the 80386 only if they depend on 11063the setting of the undefined, high-order bits. 11064 11065 11066Chapter 15 Virtual 8086 Mode 11067 11068 11069 11070The 80386 supports execution of one or more 8086, 8088, 80186, or 80188 11071programs in an 80386 protected-mode environment. An 8086 program runs in 11072this environment as part of a V86 (virtual 8086) task. V86 tasks take 11073advantage of the hardware support of multitasking offered by the protected 11074mode. Not only can there be multiple V86 tasks, each one executing an 8086 11075program, but V86 tasks can be multiprogrammed with other 80386 tasks. 11076 11077The purpose of a V86 task is to form a "virtual machine" with which to 11078execute an 8086 program. A complete virtual machine consists not only of 1107980386 hardware but also of systems software. Thus, the emulation of an 8086 11080is the result of cooperation between hardware and software: 11081 11082 The hardware provides a virtual set of registers (via the TSS), a 11083 virtual memory space (the first megabyte of the linear address space of 11084 the task), and directly executes all instructions that deal with these 11085 registers and with this address space. 11086 11087 The software controls the external interfaces of the virtual machine 11088 (I/O, interrupts, and exceptions) in a manner consistent with the 11089 larger environment in which it executes. In the case of I/O, software 11090 can choose either to emulate I/O instructions or to let the hardware 11091 execute them directly without software intervention. 11092 11093Software that helps implement virtual 8086 machines is called a V86 11094monitor. 11095 11096 1109715.1 Executing 8086 Code 11098 11099The processor executes in V86 mode when the VM (virtual machine) bit in the 11100EFLAGS register is set. The processor tests this flag under two general 11101conditions: 11102 11103 1. When loading segment registers to know whether to use 8086-style 11104 address formation. 11105 11106 2. When decoding instructions to determine which instructions are 11107 sensitive to IOPL. 11108 11109Except for these two modifications to its normal operations, the 80386 in 11110V86 mode operated much as in protected mode. 11111 11112 1111315.1.1 Registers and Instructions 11114 11115The register set available in V86 mode includes all the registers defined 11116for the 8086 plus the new registers introduced by the 80386: FS, GS, debug 11117registers, control registers, and test registers. New instructions that 11118explicitly operate on the segment registers FS and GS are available, and the 11119new segment-override prefixes can be used to cause instructions to utilize 11120FS and GS for address calculations. Instructions can utilize 32-bit 11121operands through the use of the operand size prefix. 11122 111238086 programs running as V86 tasks are able to take advantage of the new 11124applications-oriented instructions added to the architecture by the 11125introduction of the 80186/80188, 80286 and 80386: 11126 11127 New instructions introduced by 80186/80188 and 80286. 11128 PUSH immediate data 11129 Push all and pop all (PUSHA and POPA) 11130 Multiply immediate data 11131 Shift and rotate by immediate count 11132 String I/O 11133 ENTER and LEAVE 11134 BOUND 11135 11136 New instructions introduced by 80386. 11137 LSS, LFS, LGS instructions 11138 Long-displacement conditional jumps 11139 Single-bit instructions 11140 Bit scan 11141 Double-shift instructions 11142 Byte set on condition 11143 Move with sign/zero extension 11144 Generalized multiply 11145 11146 1114715.1.2 Linear Address Formation 11148 11149In V86 mode, the 80386 processor does not interpret 8086 selectors by 11150referring to descriptors; instead, it forms linear addresses as an 8086 11151would. It shifts the selector left by four bits to form a 20-bit base 11152address. The effective address is extended with four high-order zeros and 11153added to the base address to create a linear address as Figure 15-1 11154illustrates. 11155 11156Because of the possibility of a carry, the resulting linear address may 11157contain up to 21 significant bits. An 8086 program may generate linear 11158addresses anywhere in the range 0 to 10FFEFH (one megabyte plus 11159approximately 64 Kbytes) of the task's linear address space. 11160 11161V86 tasks generate 32-bit linear addresses. While an 8086 program can only 11162utilize the low-order 21 bits of a linear address, the linear address can be 11163mapped via page tables to any 32-bit physical address. 11164 11165Unlike the 8086 and 80286, 32-bit effective addresses can be generated (via 11166the address-size prefix); however, the value of a 32-bit address may not 11167exceed 65,535 without causing an exception. For full compatibility with 1116880286 real-address mode, pseudo-protection faults (interrupt 12 or 13 with 11169no error code) occur if an address is generated outside the range 0 through 1117065,535. 11171 11172 11173Figure 15-1. V86 Mode Address Formation 11174 11175 19 3 0 11176 ͻ 11177 BASE 16-BIT SEGMENT SELECTOR 0 0 0 0 11178 ͼ 11179 11180 + 11181 19 15 0 11182 ͻ 11183 OFFSET 0 0 0 0 16-BIT EFFECTIVE ADDRESS 11184 ͼ 11185 11186 = 11187 20 0 11188 LINEAR ͻ 11189 ADDRESS X X X X X X X X X X X X X X X X X X X X X X 11190 ͼ 11191 11192 1119315.2 Structure of a V86 Task 11194 11195A V86 task consists partly of the 8086 program to be executed and partly of 1119680386 "native mode" code that serves as the virtual-machine monitor. The 11197task must be represented by an 80386 TSS (not an 80286 TSS). The processor 11198enters V86 mode to execute the 8086 program and returns to protected mode to 11199execute the monitor or other 80386 tasks. 11200 11201To run successfully in V86 mode, an existing 8086 program needs the 11202following: 11203 11204 A V86 monitor. 11205 Operating-system services. 11206 11207The V86 monitor is 80386 protected-mode code that executes at 11208privilege-level zero. The monitor consists primarily of initialization and 11209exception-handling procedures. As for any other 80386 program, 11210executable-segment descriptors for the monitor must exist in the GDT or in 11211the task's LDT. The linear addresses above 10FFEFH are available for the 11212V86 monitor, the operating system, and other systems software. The monitor 11213may also need data-segment descriptors so that it can examine the interrupt 11214vector table or other parts of the 8086 program in the first megabyte of the 11215address space. 11216 11217In general, there are two options for implementing the 8086 operating 11218system: 11219 11220 1. The 8086 operating system may run as part of the 8086 code. This 11221 approach is desirable for any of the following reasons: 11222 11223 The 8086 applications code modifies the operating system. 11224 11225 There is not sufficient development time to reimplement the 8086 11226 operating system as 80386 code. 11227 11228 2. The 8086 operating system may be implemented or emulated in the V86 11229 monitor. This approach is desirable for any of the following reasons: 11230 11231 Operating system functions can be more easily coordinated among 11232 several V86 tasks. 11233 11234 The functions of the 8086 operating system can be easily emulated 11235 by calls to the 80386 operating system. 11236 11237Note that, regardless of the approach chosen for implementing the 8086 11238operating system, different V86 tasks may use different 8086 operating 11239systems. 11240 11241 1124215.2.1 Using Paging for V86 Tasks 11243 11244Paging is not necessary for a single V86 task, but paging is useful or 11245necessary for any of the following reasons: 11246 11247 To create multiple V86 tasks. Each task must map the lower megabyte of 11248 linear addresses to different physical locations. 11249 11250 To emulate the megabyte wrap. On members of the 8086 family, it is 11251 possible to specify addresses larger than one megabyte. For example, 11252 with a selector value of 0FFFFH and an offset of 0FFFFH, the effective 11253 address would be 10FFEFH (one megabyte + 65519). The 8086, which can 11254 form addresses only up to 20 bits long, truncates the high-order bit, 11255 thereby "wrapping" this address to 0FFEFH. The 80386, however, which 11256 can form addresses up to 32 bits long does not truncate such an 11257 address. If any 8086 programs depend on this addressing anomaly, the 11258 same effect can be achieved in a V86 task by mapping linear addresses 11259 between 100000H and 110000H and linear addresses between 0 and 10000H 11260 to the same physical addresses. 11261 11262 To create a virtual address space larger than the physical address 11263 space. 11264 11265 To share 8086 OS code or ROM code that is common to several 8086 11266 programs that are executing simultaneously. 11267 11268 To redirect or trap references to memory-mapped I/O devices. 11269 11270 1127115.2.2 Protection within a V86 Task 11272 11273Because it does not refer to descriptors while executing 8086 programs, the 11274processor also does not utilize the protection mechanisms offered by 11275descriptors. To protect the systems software that runs in a V86 task from 11276the 8086 program, software designers may follow either of these approaches: 11277 11278 Reserve the first megabyte (plus 64 kilobytes) of each task's linear 11279 address space for the 8086 program. An 8086 task cannot generate 11280 addresses outside this range. 11281 11282 Use the U/S bit of page-table entries to protect the virtual-machine 11283 monitor and other systems software in each virtual 8086 task's space. 11284 When the processor is in V86 mode, CPL is 3. Therefore, an 8086 program 11285 has only user privileges. If the pages of the virtual-machine monitor 11286 have supervisor privilege, they cannot be accessed by the 8086 program. 11287 11288 1128915.3 Entering and Leaving V86 Mode 11290 11291Figure 15-2 summarizes the ways that the processor can enter and leave an 112928086 program. The processor can enter V86 by either of two means: 11293 11294 1. A task switch to an 80386 task loads the image of EFLAGS from the new 11295 TSS. The TSS of the new task must be an 80386 TSS, not an 80286 TSS, 11296 because the 80286 TSS does not store the high-order word of EFLAGS, 11297 which contains the VM flag. A value of one in the VM bit of the new 11298 EFLAGS indicates that the new task is executing 8086 instructions; 11299 therefore, while loading the segment registers from the TSS, the 11300 processor forms base addresses as the 8086 would. 11301 11302 2. An IRET from a procedure of an 80386 task loads the image of EFLAGS 11303 from the stack. A value of one in VM in this case indicates that the 11304 procedure to which control is being returned is an 8086 procedure. The 11305 CPL at the time the IRET is executed must be zero, else the processor 11306 does not change VM. 11307 11308The processor leaves V86 mode when an interrupt or exception occurs. There 11309are two cases: 11310 11311 1. The interrupt or exception causes a task switch. A task switch from a 11312 V86 task to any other task loads EFLAGS from the TSS of the new task. 11313 If the new TSS is an 80386 TSS and the VM bit in the EFLAGS image is 11314 zero or if the new TSS is an 80286 TSS, then the processor clears the 11315 VM bit of EFLAGS, loads the segment registers from the new TSS using 11316 80386-style address formation, and begins executing the instructions 11317 of the new task according to 80386 protected-mode semantics. 11318 11319 2. The interrupt or exception vectors to a privilege-level zero 11320 procedure. The processor stores the current setting of EFLAGS on the 11321 stack, then clears the VM bit. The interrupt or exception handler, 11322 therefore, executes as "native" 80386 protected-mode code. If an 11323 interrupt or exception vectors to a conforming segment or to a 11324 privilege level other than three, the processor causes a 11325 general-protection exception; the error code is the selector of the 11326 executable segment to which transfer was attempted. 11327 11328Systems software does not manipulate the VM flag directly, but rather 11329manipulates the image of the EFLAGS register that is stored on the stack or 11330in the TSS. The V86 monitor sets the VM flag in the EFLAGS image on the 11331stack or in the TSS when first creating a V86 task. Exception and interrupt 11332handlers can examine the VM flag on the stack. If the interrupted procedure 11333was executing in V86 mode, the handler may need to invoke the V86 monitor. 11334 11335 11336Figure 15-2. Entering and Leaving the 8086 Program 11337 11338 MODE TRANSITION DIAGRAM 11339 11340 ͻ 11341 TASK SWITCH INITIAL 11342 Ķ ENTRY 11343 OR IRET ͼ 11344 11345 11346 ͻ INTERRUPT, EXCEPTION ͻ 11347 8086 PROGRAM V86 MONITOR 11348 (V86 MODE) Ķ (PROTECTED 11349 ͼ IRET MODE) 11350 ͼ 11351 11352 11353 11354 TASK SWITCH ͻ TASK SWITCH 11355 OTHER 80386 TASKS 11356 Ķ (PROTECTED MODE) 11357 TASK SWITCH ͼ TASK SWITCH 11358 11359 1136015.3.1 Transitions Through Task Switches 11361 11362A task switch to or from a V86 task may be due to any of three causes: 11363 11364 1. An interrupt that vectors to a task gate. 11365 2. An action of the scheduler of the 80386 operating system. 11366 3. An IRET when the NT flag is set. 11367 11368In any of these cases, the processor changes the VM bit in EFLAGS according 11369to the image of EFLAGS in the new TSS. If the new TSS is an 80286 TSS, the 11370high-order word of EFLAGS is not in the TSS; the processor clears VM in this 11371case. The processor updates VM prior to loading the segment registers from 11372the images in the new TSS. The new setting of VM determines whether the 11373processor interprets the new segment-register images as 8086 selectors or 1137480386/80286 selectors. 11375 11376 1137715.3.2 Transitions Through Trap Gates and Interrupt Gates 11378 11379The processor leaves V86 mode as the result of an exception or interrupt 11380that vectors via a trap or interrupt gate to a privilege-level zero 11381procedure. The exception or interrupt handler returns to the 8086 code by 11382executing an IRET. 11383 11384Because it was designed for execution by an 8086 processor, an 8086 program 11385in a V86 task will have an 8086-style interrupt table starting at linear 11386address zero. However, the 80386 does not use this table directly. For all 11387exceptions and interrupts that occur in V86 mode, the processor vectors 11388through the IDT. The IDT entry for an interrupt or exception that occurs in 11389a V86 task must contain either: 11390 11391 A task gate. 11392 11393 An 80386 trap gate (type 14) or an 80386 interrupt gate (type 15), 11394 which must point to a nonconforming, privilege-level zero, code 11395 segment. 11396 11397Interrupts and exceptions that have 80386 trap or interrupt gates in the 11398IDT vector to the appropriate handler procedure at privilege-level zero. The 11399contents of all the 8086 segment registers are stored on the PL 0 stack. 11400Figure 15-3 shows the format of the PL 0 stack after an exception or 11401interrupt that occurs while a V86 task is executing an 8086 program. 11402 11403After the processor stores all the 8086 segment registers on the PL 0 11404stack, it loads all the segment registers with zeros before starting to 11405execute the handler procedure. This permits the interrupt handler to safely 11406save and restore the DS, ES, FS, and GS registers as 80386 selectors. 11407Interrupt handlers that may be invoked in the context of either a regular 11408task or a V86 task, can use the same prolog and epilog code for register 11409saving regardless of the kind of task. Restoring zeros to these registers 11410before execution of the IRET does not cause a trap in the interrupt handler. 11411Interrupt procedures that expect values in the segment registers or that 11412return values via segment registers have to use the register images stored 11413on the PL 0 stack. Interrupt handlers that need to know whether the 11414interrupt occurred in V86 mode can examine the VM bit in the stored EFLAGS 11415image. 11416 11417An interrupt handler passes control to the V86 monitor if the VM bit is set 11418in the EFLAGS image stored on the stack and the interrupt or exception is 11419one that the monitor needs to handle. The V86 monitor may either: 11420 11421 Handle the interrupt completely within the V86 monitor. 11422 Invoke the 8086 program's interrupt handler. 11423 11424Reflecting an interrupt or exception back to the 8086 code involves the 11425following steps: 11426 11427 1. Refer to the 8086 interrupt vector to locate the appropriate handler 11428 procedure. 11429 11430 2. Store the state of the 8086 program on the privilege-level three 11431 stack. 11432 11433 3. Change the return link on the privilege-level zero stack to point to 11434 the privilege-level three handler procedure. 11435 11436 4. Execute an IRET so as to pass control to the handler. 11437 11438 5. When the IRET by the privilege-level three handler again traps to the 11439 V86 monitor, restore the return link on the privilege-level zero stack 11440 to point to the originally interrupted, privilege-level three 11441 procedure. 11442 11443 6. Execute an IRET so as to pass control back to the interrupted 11444 procedure. 11445 11446 11447Figure 15-3. PL 0 Stack after Interrupt in V86 Task 11448 11449 11450 WITHOUT ERROR CODE WITH ERROR CODE 11451 31 0 31 0 11452 ͻĿ ͻĿ 11453 OLD GS OLD GS 11454 SS:ESP SS:ESP 11455 D O OLD FS FROM TSS OLD FS FROM TSS 11456 I F 11457 R OLD DS OLD DS 11458 E E 11459 C X OLD ES OLD ES 11460 T P 11461 I A OLD SS OLD SS 11462 O N 11463 N S OLD ESP OLD ESP 11464 I 11465 O OLD EFLAGS OLD EFLAGS 11466 N 11467 OLD CS NEW OLD CS 11468 SS:EIP 11469 OLD EIP OLD EIP NEW 11470 SS:EIP 11471 ERROR CODE 11472 11473 11474 11475 11476 1147715.4 Additional Sensitive Instructions 11478 11479When the 80386 is executing in V86 mode, the instructions PUSHF, POPF, 11480INT n, and IRET are sensitive to IOPL. The instructions IN, INS, OUT, and 11481OUTS, which are ordinarily sensitive in protected mode, are not sensitive 11482in V86 mode. Following is a complete list of instructions that are sensitive 11483in V86 mode: 11484 11485 CLI Clear Interrupt-Enable Flag 11486 STI Set Interrupt-Enable Flag 11487 LOCK Assert Bus-Lock Signal 11488 PUSHF Push Flags 11489 POPF Pop Flags 11490 INT n Software Interrupt 11491 RET Interrupt Return 11492 11493CPL is always three in V86 mode; therefore, if IOPL < 3, these instructions 11494will trigger a general-protection exceptions. These instructions are made 11495sensitive so that their functions can be simulated by the V86 monitor. 11496 11497 1149815.4.1 Emulating 8086 Operating System Calls 11499 11500INT n is sensitive so that the V86 monitor can intercept calls to the 115018086 OS. Many 8086 operating systems are called by pushing parameters onto 11502the stack, then executing an INT n instruction. If IOPL < 3, INT n 11503instructions will be intercepted by the V86 monitor. The V86 monitor can 11504then emulate the function of the 8086 operating system or reflect the 11505interrupt back to the 8086 operating system in V86 mode. 11506 11507 1150815.4.2 Virtualizing the Interrupt-Enable Flag 11509 11510When the processor is executing 8086 code in a V86 task, the instructions 11511PUSHF, POPF, and IRET are sensitive to IOPL so that the V86 monitor can 11512control changes to the interrupt-enable flag (IF). Other instructions that 11513affect IF (STI and CLI) are IOPL sensitive both in 8086 code and in 1151480386/80386 code. 11515 11516Many 8086 programs that were designed to execute on single-task systems set 11517and clear IF to control interrupts. However, when these same programs are 11518executed in a multitasking environment, such control of IF can be 11519disruptive. If IOPL is less than three, all instructions that change or 11520interrogate IF will trap to the V86 monitor. The V86 monitor can then 11521control IF in a manner that both suits the needs of the larger environment 11522and is transparent to the 8086 program. 11523 11524 1152515.5 Virtual I/O 11526 11527Many 8086 programs that were designed to execute on single-task systems use 11528I/O devices directly. However, when these same programs are executed in a 11529multitasking environment, such use of devices can be disruptive. The 80386 11530provides sufficient flexibility to control I/O in a manner that both suits 11531the needs of the new environment and is transparent to the 8086 program. 11532Designers may take any of several possible approaches to controlling I/O: 11533 11534 Implement or emulate the 8086 operating system as an 80386 program and 11535 require the 8086 application to do I/O via software interrupts to the 11536 operating system, trapping all attempts to do I/O directly. 11537 11538 Let the 8086 program take complete control of all I/O. 11539 11540 Selectively trap and emulate references that a task makes to specific 11541 I/O ports. 11542 11543 Trap or redirect references to memory-mapped I/O addresses. 11544 11545The method of controlling I/O depends upon whether I/O ports are I/O mapped 11546or memory mapped. 11547 11548 1154915.5.1 I/O-Mapped I/O 11550 11551I/O-mapped I/O in V86 mode differs from protected mode only in that the 11552protection mechanism does not consult IOPL when executing the I/O 11553instructions IN, INS, OUT, OUTS. Only the I/O permission bit map controls 11554the right for V86 tasks to execute these I/O instructions. 11555 11556The I/O permission map traps I/O instructions selectively depending on the 11557I/O addresses to which they refer. The I/O permission bit map of each V86 11558task determines which I/O addresses are trapped for that task. Because each 11559task may have a different I/O permission bit map, the addresses trapped for 11560one task may be different from those trapped for others. Refer to Chapter 8 11561for more information about the I/O permission map. 11562 11563 1156415.5.2 Memory-Mapped I/O 11565 11566In hardware designs that utilize memory-mapped I/O, the paging facilities 11567of the 80386 can be used to trap or redirect I/O operations. Each task that 11568executes memory-mapped I/O must have a page (or pages) for the memory-mapped 11569address space. The V86 monitor may control memory-mapped I/O by any of 11570these means: 11571 11572 Assign the memory-mapped page to appropriate physical addresses. 11573 Different tasks may have different physical addresses, thereby 11574 preventing the tasks from interfering with each other. 11575 11576 Cause a trap to the monitor by forcing a page fault on the 11577 memory-mapped page. Read-only pages trap writes. Not-present pages trap 11578 both reads and writes. 11579 11580Intervention for every I/O might be excessive for some kinds of I/O 11581devices. A page fault can still be used in this case to cause intervention 11582on the first I/O operation. The monitor can then at least make sure that the 11583task has exclusive access to the device. Then the monitor can change the 11584page status to present and read/write, allowing subsequent I/O to proceed at 11585full speed. 11586 11587 1158815.5.3 Special I/O Buffers 11589 11590Buffers of intelligent controllers (for example, a bit-mapped graphics 11591buffer) can also be virtualized via page mapping. The linear space for the 11592buffer can be mapped to a different physical space for each virtual 8086 11593task. The V86 monitor can then assume responsibility for spooling the data 11594or assigning the virtual buffer to the real buffer at appropriate times. 11595 11596 1159715.6 Differences From 8086 11598 11599In general, V86 mode will correctly execute software designed for the 8086, 116008088, 80186, and 80188. Following is a list of the minor differences between 116018086 execution on the 80386 and on an 8086. 11602 11603 1. Instruction clock counts. 11604 11605 The 80386 takes fewer clocks for most instructions than the 11606 8086/8088. The areas most likely to be affected are: 11607 11608 Delays required by I/O devices between I/O operations. 11609 11610 Assumed delays with 8086/8088 operating in parallel with an 8087. 11611 11612 2. Divide exceptions point to the DIV instruction. 11613 11614 Divide exceptions on the 80386 always leave the saved CS:IP value 11615 pointing to the instruction that failed. On the 8086/8088, the CS:IP 11616 value points to the next instruction. 11617 11618 3. Undefined 8086/8088 opcodes. 11619 11620 Opcodes that were not defined for the 8086/8088 will cause exception 11621 6 or will execute one of the new instructions defined for the 80386. 11622 11623 4. Value written by PUSH SP. 11624 11625 The 80386 pushes a different value on the stack for PUSH SP than the 11626 8086/8088. The 80386 pushes the value of SP before SP is incremented 11627 as part of the push operation; the 8086/8088 pushes the value of SP 11628 after it is incremented. If the value pushed is important, replace 11629 PUSH SP instructions with the following three instructions: 11630 11631 PUSH BP 11632 MOV BP, SP 11633 XCHG BP, [BP] 11634 11635 This code functions as the 8086/8088 PUSH SP instruction on the 11636 80386. 11637 11638 5. Shift or rotate by more than 31 bits. 11639 11640 The 80386 masks all shift and rotate counts to the low-order five 11641 bits. This MOD 32 operation limits the count to a maximum of 31 bits, 11642 thereby limiting the time that interrupt response is delayed while 11643 the instruction is executing. 11644 11645 6. Redundant prefixes. 11646 11647 The 80386 sets a limit of 15 bytes on instruction length. The only 11648 way to violate this limit is by putting redundant prefixes before an 11649 instruction. Exception 13 occurs if the limit on instruction length 11650 is violated. The 8086/8088 has no instruction length limit. 11651 11652 7. Operand crossing offset 0 or 65,535. 11653 11654 On the 8086, an attempt to access a memory operand that crosses 11655 offset 65,535 (e.g., MOV a word to offset 65,535) or offset 0 (e.g., 11656 PUSH a word when SP = 1) causes the offset to wrap around modulo 11657 65,536. The 80386 raises an exception in these casesexception 13 if 11658 the segment is a data segment (i.e., if CS, DS, ES, FS, or GS is 11659 being used to address the segment), exception 12 if the segment is a 11660 stack segment (i.e., if SS is being used). 11661 11662 8. Sequential execution across offset 65,535. 11663 11664 On the 8086, if sequential execution of instructions proceeds past 11665 offset 65,535, the processor fetches the next instruction byte from 11666 offset 0 of the same segment. On the 80386, the processor raises 11667 exception 13 in such a case. 11668 11669 9. LOCK is restricted to certain instructions. 11670 11671 The LOCK prefix and its corresponding output signal should only be 11672 used to prevent other bus masters from interrupting a data movement 11673 operation. The 80386 always asserts the LOCK signal during an XCHG 11674 instruction with memory (even if the LOCK prefix is not used). LOCK 11675 may only be used with the following 80386 instructions when they 11676 update memory: BTS, BTR, BTC, XCHG, ADD, ADC, SUB, SBB, INC, DEC, 11677 AND, OR, XOR, NOT, and NEG. An undefined-opcode exception (interrupt 11678 6) results from using LOCK before any other instruction. 11679 11680 10. Single-stepping external interrupt handlers. 11681 11682 The priority of the 80386 single-step exception is different from 11683 that of the 8086/8088. The change prevents an external interrupt 11684 handler from being single-stepped if the interrupt occurs while a 11685 program is being single-stepped. The 80386 single-step exception has 11686 higher priority that any external interrupt. The 80386 will still 11687 single-step through an interrupt handler invoked by the INT 11688 instructions or by an exception. 11689 11690 11. IDIV exceptions for quotients of 80H or 8000H. 11691 11692 The 80386 can generate the largest negative number as a quotient for 11693 the IDIV instruction. The 8086/8088 causes exception zero instead. 11694 11695 12. Flags in stack. 11696 11697 The setting of the flags stored by PUSHF, by interrupts, and by 11698 exceptions is different from that stored by the 8086 in bit positions 11699 12 through 15. On the 8086 these bits are stored as ones, but in V86 11700 mode bit 15 is always zero, and bits 14 through 12 reflect the last 11701 value loaded into them. 11702 11703 13. NMI interrupting NMI handlers. 11704 11705 After an NMI is recognized on the 80386, the NMI interrupt is masked 11706 until an IRET instruction is executed. 11707 11708 14. Coprocessor errors vector to interrupt 16. 11709 11710 Any 80386 system with a coprocessor must use interrupt vector 16 for 11711 the coprocessor error exception. If an 8086/8088 system uses another 11712 vector for the 8087 interrupt, both vectors should point to the 11713 coprocessor-error exception handler. 11714 11715 15. Numeric exception handlers should allow prefixes. 11716 11717 On the 80386, the value of CS:IP saved for coprocessor exceptions 11718 points at any prefixes before an ESC instruction. On 8086/8088 11719 systems, the saved CS:IP points to the ESC instruction itself. 11720 11721 16. Coprocessor does not use interrupt controller. 11722 11723 The coprocessor error signal to the 80386 does not pass through an 11724 interrupt controller (an 8087 INT signal does). Some instructions in 11725 a coprocessor error handler may need to be deleted if they deal with 11726 the interrupt controller. 11727 11728 1172915.7 Differences From 80286 Real-Address Mode 11730 11731The 80286 processor implements the bus lock function differently than the 1173280386. This fact may or may not be apparent to 8086 programs, depending on 11733how the V86 monitor handles the LOCK prefix. LOCKed instructions are 11734sensitive to IOPL; therefore, software designers can choose to emulate its 11735function. If, however, 8086 programs are allowed to execute LOCK directly, 11736programs that use forms of memory locking specific to the 8086 may not 11737execute properly when transported to a specific application of the 80386. 11738 11739The LOCK prefix and its corresponding output signal should only be used to 11740prevent other bus masters from interrupting a data movement operation. LOCK 11741may only be used with the following 80386 instructions when they modify 11742memory. An undefined-opcode exception results from using LOCK before any 11743other instruction. 11744 11745 Bit test and change: BTS, BTR, BTC. 11746 Exchange: XCHG. 11747 One-operand arithmetic and logical: INC, DEC, NOT, and NEG. 11748 Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. 11749 11750A locked instruction is guaranteed to lock only the area of memory defined 11751by the destination operand, but may lock a larger memory area. For example, 11752typical 8086 and 80286 configurations lock the entire physical memory space. 11753With the 80386, the defined area of memory is guaranteed to be locked 11754against access by a processor executing a locked instruction on exactly the 11755same memory area, i.e., an operand with identical starting address and 11756identical length. 11757 11758 11759Chapter 16 Mixing 16-Bit and 32 Bit Code 11760 11761 11762 11763The 80386 running in protected mode is a 32-bit microprocessor, but it is 11764designed to support 16-bit processing at three levels: 11765 11766 1. Executing 8086/80286 16-bit programs efficiently with complete 11767 compatibility. 11768 11769 2. Mixing 16-bit modules with 32-bit modules. 11770 11771 3. Mixing 16-bit and 32-bit addresses and operands within one module. 11772 11773The first level of support for 16-bit programs has already been discussed 11774in Chapter 13, Chapter 14, and Chapter 15. This chapter shows how 16-bit 11775and 32-bit modules can cooperate with one another, and how one module can 11776utilize both 16-bit and 32-bit operands and addressing. 11777 11778The 80386 functions most efficiently when it is possible to distinguish 11779between pure 16-bit modules and pure 32-bit modules. A pure 16-bit module 11780has these characteristics: 11781 11782 All segments occupy 64 Kilobytes or less. 11783 Data items are either 8 bits or 16 bits wide. 11784 Pointers to code and data have 16-bit offsets. 11785 Control is transferred only among 16-bit segments. 11786 11787A pure 32-bit module has these characteristics: 11788 11789 Segments may occupy more than 64 Kilobytes (zero bytes to 4 11790 gigabytes). 11791 11792 Data items are either 8 bits or 32 bits wide. 11793 11794 Pointers to code and data have 32-bit offsets. 11795 11796 Control is transferred only among 32-bit segments. 11797 11798Pure 16-bit modules do exist; they are the modules designed for 16-bit 11799microprocessors. Pure 32-bit modules may exist in new programs designed 11800explicitly for the 80386. However, as systems designers move applications 11801from 16-bit processors to the 32-bit 80386, it will not always be possible 11802to maintain these ideals of pure 16-bit or 32-bit modules. It may be 11803expedient to execute old 16-bit modules in a new 32-bit environment without 11804making source-code changes to the old modules if any of the following 11805conditions is true: 11806 11807 Modules will be converted one-by-one from 16-bit environments to 11808 32-bit environments. 11809 11810 Older, 16-bit compilers and software-development tools will be 11811 utilized in the new32-bit operating environment until new 32-bit 11812 versions can be created. 11813 11814 The source code of 16-bit modules is not available for modification. 11815 11816 The specific data structures used by a given module inherently utilize 11817 16-bit words. 11818 11819 The native word size of the source language is 16 bits. 11820 11821On the 80386, 16-bit modules can be mixed with 32-bit modules. To design a 11822system that mixes 16- and 32-bit code requires an understanding of the 11823mechanisms that the 80386 uses to invoke and control its 32-bit and 16-bit 11824features. 11825 11826 1182716.1 How the 80386 Implements 16-Bit and 32-Bit Features 11828 11829The features of the architecture that permit the 80386 to work equally well 11830with 32-bit and 16-bit address and operand sizes include: 11831 11832 The D-bit (default bit) of code-segment descriptors, which determines 11833 the default choice of operand-size and address-size for the 11834 instructions of a code segment. (In real-address mode and V86 mode, 11835 which do not use descriptors, the default is 16 bits.) A code segment 11836 whose D-bit is set is known as a USE32 segment; a code segment whose 11837 D-bit is zero is a USE16 segment. The D-bit eliminates the need to 11838 encode the operand size and address size in instructions when all 11839 instructions use operands and effective addresses of the same size. 11840 11841 Instruction prefixes that explicitly override the default choice of 11842 operand size and address size (available in protected mode as well as 11843 in real-address mode and V86 mode). 11844 11845 Separate 32-bit and 16-bit gates for intersegment control transfers 11846 (including call gates, interrupt gates, and trap gates). The operand 11847 size for the control transfer is determined by the type of gate, not by 11848 the D-bit or prefix of the transfer instruction. 11849 11850 Registers that can be used both for 32-bit and 16-bit operands and 11851 effective-address calculations. 11852 11853 The B-bit (big bit) of data-segment descriptors, which determines the 11854 size of stack pointer (32-bit ESP or 16-bit SP) used by the CPU for 11855 implicit stack references. 11856 11857 1185816.2 Mixing 32-Bit and 16-Bit Operations 11859 11860The 80386 has two instruction prefixes that allow mixing of 32-bit and 1186116-bit operations within one segment: 11862 11863 The operand-size prefix (66H) 11864 The address-size prefix (67H) 11865 11866These prefixes reverse the default size selected by the D-bit. For example, 11867the processor can interpret the word-move instruction MOV mem, reg in any of 11868four ways: 11869 11870 In a USE32 segment: 11871 11872 1. Normally moves 32 bits from a 32-bit register to a 32-bit 11873 effective address in memory. 11874 11875 2. If preceded by an operand-size prefix, moves 16 bits from a 16-bit 11876 register to 32-bit effective address in memory. 11877 11878 3. If preceded by an address-size prefix, moves 32 bits from a 32-bit 11879 register to a16-bit effective address in memory. 11880 11881 4. If preceded by both an address-size prefix and an operand-size 11882 prefix, moves 16 bits from a 16-bit register to a 16-bit effective 11883 address in memory. 11884 11885 In a USE16 segment: 11886 11887 1. Normally moves 16 bits from a 16-bit register to a 16-bit 11888 effective address in memory. 11889 11890 2. If preceded by an operand-size prefix, moves 32 bits from a 32-bit 11891 register to 16-bit effective address in memory. 11892 11893 3. If preceded by an address-size prefix, moves 16 bits from a 16-bit 11894 register to a32-bit effective address in memory. 11895 11896 4. If preceded by both an address-size prefix and an operand-size 11897 prefix, moves 32 bits from a 32-bit register to a 32-bit effective 11898 address in memory. 11899 11900These examples illustrate that any instruction can generate any combination 11901of operand size and address size regardless of whether the instruction is in 11902a USE16 or USE32 segment. The choice of the USE16 or USE32 attribute for a 11903code segment is based upon these criteria: 11904 11905 1. The need to address instructions or data in segments that are larger 11906 than 64 Kilobytes. 11907 11908 2. The predominant size of operands. 11909 11910 3. The addressing modes desired. (Refer to Chapter 17 for an explanation 11911 of the additional addressing modes that are available when 32-bit 11912 addressing is used.) 11913 11914Choosing a setting of the D-bit that is contrary to the predominant size of 11915operands requires the generation of an excessive number of operand-size 11916prefixes. 11917 11918 1191916.3 Sharing Data Segments Among Mixed Code Segments 11920 11921Because the choice of operand size and address size is defined in code 11922segments and their descriptors, data segments can be shared freely among 11923both USE16 and USE32 code segments. The only limitation is the one imposed 11924by pointers with 16-bit offsets, which can only point to the first 64 11925Kilobytes of a segment. When a data segment that contains more than 64 11926Kilobytes is to be shared among USE32 and USE16 segments, the data that is 11927to be accessed by the USE16 segments must be located within the first 64 11928Kilobytes. 11929 11930A stack that spans addresses less than 64K can be shared by both USE16 and 11931USE32 code segments. This class of stacks includes: 11932 11933 Stacks in expand-up segments with G=0 and B=0. 11934 11935 Stacks in expand-down segments with G=0 and B=0. 11936 11937 Stacks in expand-up segments with G=1 and B=0, in which the stack is 11938 contained completely within the lower 64 Kilobytes. (Offsets greater 11939 than 64K can be used for data, other than the stack, that is not 11940 shared.) 11941 11942The B-bit of a stack segment cannot, in general, be used to change the size 11943of stack used by a USE16 code segment. The size of stack pointer used by the 11944processor for implicit stack references is controlled by the B-bit of the 11945data-segment descriptor for the stack. Implicit references are those caused 11946by interrupts, exceptions, and instructions such as PUSH, POP, CALL, and 11947RET. One might be tempted, therefore, to try to increase beyond 64K the 11948size of the stack used by 16-bit code simply by supplying a larger stack 11949segment with the B-bit set. However, the B-bit does not control explicit 11950stack references, such as accesses to parameters or local variables. A USE16 11951code segment can utilize a "big" stack only if the code is modified so that 11952all explicit references to the stack are preceded by the address-size 11953prefix, causing those references to use 32-bit addressing. 11954 11955In big, expand-down segments (B=1, G=1, and E=1), all offsets are greater 11956than 64K, therefore USE16 code cannot utilize such a stack segment unless 11957the code segment is modified to employ 32-bit addressing. (Refer to Chapter 119586 for a review of the B, G, and E bits.) 11959 11960 1196116.4 Transferring Control Among Mixed Code Segments 11962 11963When transferring control among procedures in USE16 and USE32 code 11964segments, programmers must be aware of three points: 11965 11966 Addressing limitations imposed by pointers with 16-bit offsets. 11967 11968 Matching of operand-size attribute in effect for the CALL/RET pair and 11969 theInterrupt/IRET pair so as to manage the stack correctly. 11970 11971 Translation of parameters, especially pointer parameters. 11972 11973Clearly, 16-bit effective addresses cannot be used to address data or code 11974located beyond 64K in a 32-bit segment, nor can large 32-bit parameters be 11975squeezed into a 16-bit word; however, except for these obvious limits, most 11976interfacing problems between 16-bit and 32-bit modules can be solved. Some 11977solutions involve inserting interface procedures between the procedures in 11978question. 11979 11980 1198116.4.1 Size of Code-Segment Pointer 11982 11983For control-transfer instructions that use a pointer to identify the next 11984instruction (i.e., those that do not use gates), the size of the offset 11985portion of the pointer is determined by the operand-size attribute. The 11986implications of the use of two different sizes of code-segment pointer are: 11987 11988 JMP, CALL, or RET from 32-bit segment to 16-bit segment is always 11989 possible using a 32-bit operand size. 11990 11991 JMP, CALL, or RET from 16-bit segment using a 16-bit operand size 11992 cannot address the target in a 32-bit segment if the address of the 11993 target is greater than 64K. 11994 11995An interface procedure can enable transfers from USE16 segments to 32-bit 11996addresses beyond 64K without requiring modifications any more extensive than 11997relinking or rebinding the old programs. The requirements for such an 11998interface procedure are discussed later in this chapter. 11999 12000 1200116.4.2 Stack Management for Control Transfers 12002 12003Because stack management is different for 16-bit CALL/RET than for 32-bit 12004CALL/RET, the operand size of RET must match that of CALL. (Refer to Figure 1200516-1.) A 16-bit CALL pushes the 16-bit IP and (for calls between privilege 12006levels) the 16-bit SP register. The corresponding RET must also use a 16-bit 12007operand size to POP these 16-bit values from the stack into the 16-bit 12008registers. A 32-bit CALL pushes the 32-bit EIP and (for interlevel calls) 12009the 32-bit ESP register. The corresponding RET must also use a 32-bit 12010operand size to POP these 32-bit values from the stack into the 32-bit 12011registers. If the two halves of a CALL/RET pair do not have matching operand 12012sizes, the stack will not be managed correctly and the values of the 12013instruction pointer and stack pointer will not be restored to correct 12014values. 12015 12016When the CALL and its corresponding RET are in segments that have D-bits 12017with the same values (i.e., both have 32-bit defaults or both have 16-bit 12018defaults), there is no problem. When the CALL and its corresponding RET are 12019in segments that have different D-bit values, however, programmers (or 12020program development software) must ensure that the CALL and RET match. 12021 12022There are three ways to cause a 16-bit procedure to execute a 32-bit call: 12023 12024 1. Use a 16-bit call to a 32-bit interface procedure that then uses a 12025 32-bit call to invoke the intended target. 12026 12027 2. Bind the 16-bit call to a 32-bit call gate. 12028 12029 3. Modify the 16-bit procedure, inserting an operand-size prefix before 12030 the call, thereby changing it to a 32-bit call. 12031 12032Likewise, there are three ways to cause a 32-bit procedure to execute a 1203316-bit call: 12034 12035 1. Use a 32-bit call to a 32-bit interface procedure that then uses a 12036 16-bit call to invoke the intended target. 12037 12038 2. Bind the 32-bit call to a 16-bit call gate. 12039 12040 3. Modify the 32-bit procedure, inserting an operand-size prefix before 12041 the call, thereby changing it to a 16-bit call. (Be certain that the 12042 return offset does not exceed 64K.) 12043 12044Programmers can utilize any of the preceding methods to make a CALL in a 12045USE16 segment match the corresponding RET in a USE32 segment, or to make a 12046CALL in a USE32 segment match the corresponding RET in a USE16 segment. 12047 12048 12049Figure 16-1. Stack after Far 16-Bit and 32-Bit Calls 12050 12051 WITHOUT PRIVILEGE TRANSITION 12052 12053 AFTER 16-BIT CALL AFTER 32-BIT CALL 12054 12055 31 0 31 0 12056 D O 12057 I F 12058 R 12059 E E 12060 C X PARM2 PARM1 PARM2 12061 T P 12062 I A CS IP SP PARM1 12063 O N 12064 N S CS 12065 I 12066 O EIP ESP 12067 N 12068 12069 12070 12071 WITH PRIVILEGE TRANSITION 12072 12073 AFTER 16-BIT CALL AFTER 32-BIT CALL 12074 12075 D O 31 0 31 0 12076 I F ͻ ͻ 12077 R SS SP SS 12078 E E 12079 C X PARM2 PARM1 ESP 12080 T P 12081 I A CS IP SP PARM2 12082 O N 12083 N S PARM1 12084 I 12085 O CS 12086 N 12087 EIP ESP 12088 12089 12090 12091 12092 1209316.4.2.1 Controlling the Operand-Size for a Call 12094 12095When the selector of the pointer referenced by a CALL instruction selects a 12096segment descriptor, the operand-size attribute in effect for the CALL 12097instruction is determined by the D-bit in the segment descriptor and by any 12098operand-size instruction prefix. 12099 12100When the selector of the pointer referenced by a CALL instruction selects a 12101gate descriptor, the type of call is determined by the type of call gate. A 12102call via an 80286 call gate (descriptor type 4) always has a 16-bit 12103operand-size attribute; a call via an 80386 call gate (descriptor type 12) 12104always has a 32-bit operand-size attribute. The offset of the target 12105procedure is taken from the gate descriptor; therefore, even a 16-bit 12106procedure can call a procedure that is located more than 64 kilobytes from 12107the base of a 32-bit segment, because a 32-bit call gate contains a 32-bit 12108target offset. 12109 12110An unmodified 16-bit code segment that has run successfully on an 8086 or 12111real-mode 80286 will always have a D-bit of zero and will not use 12112operand-size override prefixes; therefore, it will always execute 16-bit 12113versions of CALL. The only modification needed to make a16-bit procedure 12114effect a 32-bit call is to relink the call to an 80386 call gate. 12115 12116 1211716.4.2.2 Changing Size of Call 12118 12119When adding 32-bit gates to 16-bit procedures, it is important to consider 12120the number of parameters. The count field of the gate descriptor specifies 12121the size of the parameter string to copy from the current stack to the stack 12122of the more privileged procedure. The count field of a 16-bit gate specifies 12123the number of words to be copied, whereas the count field of a 32-bit gate 12124specifies the number of doublewords to be copied; therefore, the 16-bit 12125procedure must use an even number of words as parameters. 12126 12127 1212816.4.3 Interrupt Control Transfers 12129 12130With a control transfer due to an interrupt or exception, a gate is always 12131involved. The operand-size attribute for the interrupt is determined by the 12132type of IDT gate. 12133 12134A 386 interrupt or trap gate (descriptor type 14 or 15) to a 32-bit 12135interrupt procedure can be used to interrupt either 32-bit or 16-bit 12136procedures. However, it is not generally feasible to permit an interrupt or 12137exception to invoke a 16-bit handler procedure when 32-bit code is 12138executing, because a 16-bit interrupt procedure has a return offset of only 1213916-bits on its stack. If the 32-bit procedure is executing at an address 12140greater than 64K, the 16-bit interrupt procedure cannot return correctly. 12141 12142 1214316.4.4 Parameter Translation 12144 12145When segment offsets or pointers (which contain segment offsets) are passed 12146as parameters between 16-bit and 32-bit procedures, some translation is 12147required. Clearly, if a 32-bit procedure passes a pointer to data located 12148beyond 64K to a 16-bit procedure, the 16-bit procedure cannot utilize it. 12149Beyond this natural limitation, an interface procedure can perform any 12150format conversion between 32-bit and 16-bit pointers that may be needed. 12151 12152Parameters passed by value between 32-bit and 16-bit code may also require 12153translation between 32-bit and 16-bit formats. Such translation requirements 12154are application dependent. Systems designers should take care to limit the 12155range of values passed so that such translations are possible. 12156 12157 1215816.4.5 The Interface Procedure 12159 12160Interposing an interface procedure between 32-bit and 16-bit procedures can 12161be the solution to any of several interface requirements: 12162 12163 Allowing procedures in 16-bit segments to transfer control to 12164 instructions located beyond 64K in 32-bit segments. 12165 12166 Matching of operand size for CALL/RET. 12167 12168 Parameter translation. 12169 12170Interface procedures between USE32 and USE16 segments can be constructed 12171with these properties: 12172 12173 The procedures reside in a code segment whose D-bit is set, indicating 12174 a default operand size of 32-bits. 12175 12176 All entry points that may be called by 16-bit procedures have offsets 12177 that are actually less than 64K. 12178 12179 All points to which called 16-bit procedures may return also lie 12180 within 64K. 12181 12182The interface procedures do little more than call corresponding procedures 12183in other segments. There may be two kinds of procedures: 12184 12185 Those that are called by 16-bit procedures and call 32-bit procedures. 12186 These interface procedures are called by 16-bit CALLs and use the 12187 operand-size prefix before RET instructions to cause a 16-bit RET. 12188 CALLs to 32-bit segments are 32-bit calls (by default, because the 12189 D-bit is set), and the 32-bit code returns with 32-bit RET 12190 instructions. 12191 12192 Those that are called by 32-bit procedures and call 16-bit procedures. 12193 These interface procedures are called by 32-bit CALL instructions, and 12194 return with 32-bit RET instructions (by default, because the D-bit is 12195 set). CALLs to 16-bit procedures use the operand-size prefix; 12196 procedures in the 16-bit code return with 16-bit RET instructions. 12197 12198 12199 PART IV INSTRUCTION SET 12200 12201 12202Chapter 17 80386 Instruction Set 12203 12204 12205 12206This chapter presents instructions for the 80386 in alphabetical order. For 12207each instruction, the forms are given for each operand combination, 12208including object code produced, operands required, execution time, and a 12209description. For each instruction, there is an operational description and a 12210summary of exceptions generated. 12211 12212 1221317.1 Operand-Size and Address-Size Attributes 12214 12215When executing an instruction, the 80386 can address memory using either 16 12216or 32-bit addresses. Consequently, each instruction that uses memory 12217addresses has associated with it an address-size attribute of either 16 or 1221832 bits. 16-bit addresses imply both the use of a 16-bit displacement in 12219the instruction and the generation of a 16-bit address offset (segment 12220relative address) as the result of the effective address calculation. 1222132-bit addresses imply the use of a 32-bit displacement and the generation 12222of a 32-bit address offset. Similarly, an instruction that accesses words 12223(16 bits) or doublewords (32 bits) has an operand-size attribute of either 1222416 or 32 bits. 12225 12226The attributes are determined by a combination of defaults, instruction 12227prefixes, and (for programs executing in protected mode) size-specification 12228bits in segment descriptors. 12229 12230 1223117.1.1 Default Segment Attribute 12232 12233For programs executed in protected mode, the D-bit in executable-segment 12234descriptors determines the default attribute for both address size and 12235operand size. These default attributes apply to the execution of all 12236instructions in the segment. A value of zero in the D-bit sets the default 12237address size and operand size to 16 bits; a value of one, to 32 bits. 12238 12239Programs that execute in real mode or virtual-8086 mode have 16-bit 12240addresses and operands by default. 12241 12242 1224317.1.2 Operand-Size and Address-Size Instruction Prefixes 12244 12245The internal encoding of an instruction can include two byte-long prefixes: 12246the address-size prefix, 67H, and the operand-size prefix, 66H. (A later 12247section, "Instruction Format," shows the position of the prefixes in an 12248instruction's encoding.) These prefixes override the default segment 12249attributes for the instruction that follows. Table 17-1 shows the effect of 12250each possible combination of defaults and overrides. 12251 12252 1225317.1.3 Address-Size Attribute for Stack 12254 12255Instructions that use the stack implicitly (for example: POP EAX also have 12256a stack address-size attribute of either 16 or 32 bits. Instructions with a 12257stack address-size attribute of 16 use the 16-bit SP stack pointer register; 12258instructions with a stack address-size attribute of 32 bits use the 32-bit 12259ESP register to form the address of the top of the stack. 12260 12261The stack address-size attribute is controlled by the B-bit of the 12262data-segment descriptor in the SS register. A value of zero in the B-bit 12263selects a stack address-size attribute of 16; a value of one selects a stack 12264address-size attribute of 32. 12265 12266 12267Table 17-1. Effective Size Attributes 12268 12269Segment Default D = ... 0 0 0 0 1 1 1 1 12270Operand-Size Prefix 66H N N Y Y N N Y Y 12271Address-Size Prefix 67H N Y N Y N Y N Y 12272 12273Effective Operand Size 16 16 32 32 32 32 16 16 12274Effective Address Size 16 32 16 32 32 16 32 16 12275 12276Y = Yes, this instruction prefix is present 12277N = No, this instruction prefix is not present 12278 12279 1228017.2 Instruction Format 12281 12282All instruction encodings are subsets of the general instruction format 12283shown in Figure 17-1. Instructions consist of optional instruction 12284prefixes, one or two primary opcode bytes, possibly an address specifier 12285consisting of the ModR/M byte and the SIB (Scale Index Base) byte, a 12286displacement, if required, and an immediate data field, if required. 12287 12288Smaller encoding fields can be defined within the primary opcode or 12289opcodes. These fields define the direction of the operation, the size of the 12290displacements, the register encoding, or sign extension; encoding fields 12291vary depending on the class of operation. 12292 12293Most instructions that can refer to an operand in memory have an addressing 12294form byte following the primary opcode byte(s). This byte, called the ModR/M 12295byte, specifies the address form to be used. Certain encodings of the ModR/M 12296byte indicate a second addressing byte, the SIB (Scale Index Base) byte, 12297which follows the ModR/M byte and is required to fully specify the 12298addressing form. 12299 12300Addressing forms can include a displacement immediately following either 12301the ModR/M or SIB byte. If a displacement is present, it can be 8-, 16- or 1230232-bits. 12303 12304If the instruction specifies an immediate operand, the immediate operand 12305always follows any displacement bytes. The immediate operand, if specified, 12306is always the last field of the instruction. 12307 12308The following are the allowable instruction prefix codes: 12309 12310 F3H REP prefix (used only with string instructions) 12311 F3H REPE/REPZ prefix (used only with string instructions 12312 F2H REPNE/REPNZ prefix (used only with string instructions) 12313 F0H LOCK prefix 12314 12315The following are the segment override prefixes: 12316 12317 2EH CS segment override prefix 12318 36H SS segment override prefix 12319 3EH DS segment override prefix 12320 26H ES segment override prefix 12321 64H FS segment override prefix 12322 65H GS segment override prefix 12323 66H Operand-size override 12324 67H Address-size override 12325 12326 12327Figure 17-1. 80386 Instruction Format 12328 12329 ͻ 12330 INSTRUCTION ADDRESS- OPERAND- SEGMENT 12331 PREFIX SIZE PREFIX SIZE PREFIX OVERRIDE 12332 12333 0 OR 1 0 OR 1 0 OR 1 0 OR 1 12334 Ķ 12335 NUMBER OF BYTES 12336 ͼ 12337 12338 ͻ 12339 OPCODE MODR/M SIB DISPLACEMENT IMMEDIATE 12340 12341 12342 1 OR 2 0 OR 1 0 OR 1 0,1,2 OR 4 0,1,2 OR 4 12343 Ķ 12344 NUMBER OF BYTES 12345 ͼ 12346 12347 1234817.2.1 ModR/M and SIB Bytes 12349 12350The ModR/M and SIB bytes follow the opcode byte(s) in many of the 80386 12351instructions. They contain the following information: 12352 12353 The indexing type or register number to be used in the instruction 12354 The register to be used, or more information to select the instruction 12355 The base, index, and scale information 12356 12357The ModR/M byte contains three fields of information: 12358 12359 The mod field, which occupies the two most significant bits of the 12360 byte, combines with the r/m field to form 32 possible values: eight 12361 registers and 24 indexing modes 12362 12363 The reg field, which occupies the next three bits following the mod 12364 field, specifies either a register number or three more bits of opcode 12365 information. The meaning of the reg field is determined by the first 12366 (opcode) byte of the instruction. 12367 12368 The r/m field, which occupies the three least significant bits of the 12369 byte, can specify a register as the location of an operand, or can form 12370 part of the addressing-mode encoding in combination with the field as 12371 described above 12372 12373The based indexed and scaled indexed forms of 32-bit addressing require the 12374SIB byte. The presence of the SIB byte is indicated by certain encodings of 12375the ModR/M byte. The SIB byte then includes the following fields: 12376 12377 The ss field, which occupies the two most significant bits of the 12378 byte, specifies the scale factor 12379 12380 The index field, which occupies the next three bits following the ss 12381 field and specifies the register number of the index register 12382 12383 The base field, which occupies the three least significant bits of the 12384 byte, specifies the register number of the base register 12385 12386Figure 17-2 shows the formats of the ModR/M and SIB bytes. 12387 12388The values and the corresponding addressing forms of the ModR/M and SIB 12389bytes are shown in Tables 17-2, 17-3, and 17-4. The 16-bit addressing 12390forms specified by the ModR/M byte are in Table 17-2. The 32-bit addressing 12391forms specified by ModR/M are in Table 17-3. Table 17-4 shows the 32-bit 12392addressing forms specified by the SIB byte 12393 12394 12395Figure 17-2. ModR/M and SIB Byte Formats 12396 12397 MODR/M BYTE 12398 12399 7 6 5 4 3 2 1 0 12400 ͻ 12401 MOD REG/OPCODE R/M 12402 ͼ 12403 12404 SIB (SCALE INDEX BASE) BYTE 12405 12406 7 6 5 4 3 2 1 0 12407 ͻ 12408 SS INDEX BASE 12409 ͼ 12410 12411 12412Table 17-2. 16-Bit Addressing Forms with the ModR/M Byte 12413 12414 12415r8(/r) AL CL DL BL AH CH DH BH 12416r16(/r) AX CX DX BX SP BP SI DI 12417r32(/r) EAX ECX EDX EBX ESP EBP ESI EDI 12418/digit (Opcode) 0 1 2 3 4 5 6 7 12419REG = 000 001 010 011 100 101 110 111 12420 12421 Effective 12422Address 12423disp8 denotes an 8-bit displacement following the ModR/M byte, to be 12424sign-extended and added to the index. disp16 denotes a 16-bit displacement 12425following the ModR/M byte, to be added to the index. Default segment 12426register is SS for the effective addresses containing a BP index, DS for 12427other effective addresses.Ŀ Mod R/M ModR/M Values in HexadecimalĿ 12428 12429[BX + SI] 000 00 08 10 18 20 28 30 38 12430[BX + DI] 001 01 09 11 19 21 29 31 39 12431[BP + SI] 010 02 0A 12 1A 22 2A 32 3A 12432[BP + DI] 011 03 0B 13 1B 23 2B 33 3B 12433[SI] 00 100 04 0C 14 1C 24 2C 34 3C 12434[DI] 101 05 0D 15 1D 25 2D 35 3D 12435disp16 110 06 0E 16 1E 26 2E 36 3E 12436[BX] 111 07 0F 17 1F 27 2F 37 3F 12437 12438[BX+SI]+disp8 000 40 48 50 58 60 68 70 78 12439[BX+DI]+disp8 001 41 49 51 59 61 69 71 79 12440[BP+SI]+disp8 010 42 4A 52 5A 62 6A 72 7A 12441[BP+DI]+disp8 011 43 4B 53 5B 63 6B 73 7B 12442[SI]+disp8 01 100 44 4C 54 5C 64 6C 74 7C 12443[DI]+disp8 101 45 4D 55 5D 65 6D 75 7D 12444[BP]+disp8 110 46 4E 56 5E 66 6E 76 7E 12445[BX]+disp8 111 47 4F 57 5F 67 6F 77 7F 12446 12447[BX+SI]+disp16 000 80 88 90 98 A0 A8 B0 B8 12448[BX+DI]+disp16 001 81 89 91 99 A1 A9 B1 B9 12449[BX+SI]+disp16 010 82 8A 92 9A A2 AA B2 BA 12450[BX+DI]+disp16 011 83 8B 93 9B A3 AB B3 BB 12451[SI]+disp16 10 100 84 8C 94 9C A4 AC B4 BC 12452[DI]+disp16 101 85 8D 95 9D A5 AD B5 BD 12453[BP]+disp16 110 86 8E 96 9E A6 AE B6 BE 12454[BX]+disp16 111 87 8F 97 9F A7 AF B7 BF 12455 12456EAX/AX/AL 000 C0 C8 D0 D8 E0 E8 F0 F8 12457ECX/CX/CL 001 C1 C9 D1 D9 E1 E9 F1 F9 12458EDX/DX/DL 010 C2 CA D2 DA E2 EA F2 FA 12459EBX/BX/BL 011 C3 CB D3 DB E3 EB F3 FB 12460ESP/SP/AH 11 100 C4 CC D4 DC E4 EC F4 FC 12461EBP/BP/CH 101 C5 CD D5 DD E5 ED F5 FD 12462ESI/SI/DH 110 C6 CE D6 DE E6 EE F6 FE 12463EDI/DI/BH 111 C7 CF D7 DF E7 EF F7 FF 12464 12465 12466 12467NOTES: 12468 disp8 denotes an 8-bit displacement following the ModR/M byte, to be 12469 sign-extended and added to the index. disp16 denotes a 16-bit displacement 12470 following the ModR/M byte, to be added to the index. Default segment 12471 register is SS for the effective addresses containing a BP index, DS for 12472 other effective addresses. 12473 12474 12475 12476Table 17-3. 32-Bit Addressing Forms with the ModR/M Byte 12477 12478 12479r8(/r) AL CL DL BL AH CH DH BH 12480r16(/r) AX CX DX BX SP BP SI DI 12481r32(/r) EAX ECX EDX EBX ESP EBP ESI EDI 12482/digit (Opcode) 0 1 2 3 4 5 6 7 12483REG = 000 001 010 011 100 101 110 111 12484 12485 Effective 12486Address 12487[--] [--] means a SIB follows the ModR/M byte. disp8 denotes an 8-bit 12488displacement following the SIB byte, to be sign-extended and added to the 12489index. disp32 denotes a 32-bit displacement following the ModR/M byte, to 12490be added to the index.Ŀ Mod R/M ModR/M Values in HexadecimalĿ 12491 12492[EAX] 000 00 08 10 18 20 28 30 38 12493[ECX] 001 01 09 11 19 21 29 31 39 12494[EDX] 010 02 0A 12 1A 22 2A 32 3A 12495[EBX] 011 03 0B 13 1B 23 2B 33 3B 12496[--] [--] 00 100 04 0C 14 1C 24 2C 34 3C 12497disp32 101 05 0D 15 1D 25 2D 35 3D 12498[ESI] 110 06 0E 16 1E 26 2E 36 3E 12499[EDI] 111 07 0F 17 1F 27 2F 37 3F 12500 12501disp8[EAX] 000 40 48 50 58 60 68 70 78 12502disp8[ECX] 001 41 49 51 59 61 69 71 79 12503disp8[EDX] 010 42 4A 52 5A 62 6A 72 7A 12504disp8[EPX]; 011 43 4B 53 5B 63 6B 73 7B 12505disp8[--] [--] 01 100 44 4C 54 5C 64 6C 74 7C 12506disp8[ebp] 101 45 4D 55 5D 65 6D 75 7D 12507disp8[ESI] 110 46 4E 56 5E 66 6E 76 7E 12508disp8[EDI] 111 47 4F 57 5F 67 6F 77 7F 12509 12510disp32[EAX] 000 80 88 90 98 A0 A8 B0 B8 12511disp32[ECX] 001 81 89 91 99 A1 A9 B1 B9 12512disp32[EDX] 010 82 8A 92 9A A2 AA B2 BA 12513disp32[EBX] 011 83 8B 93 9B A3 AB B3 BB 12514disp32[--] [--] 10 100 84 8C 94 9C A4 AC B4 BC 12515disp32[EBP] 101 85 8D 95 9D A5 AD B5 BD 12516disp32[ESI] 110 86 8E 96 9E A6 AE B6 BE 12517disp32[EDI] 111 87 8F 97 9F A7 AF B7 BF 12518 12519EAX/AX/AL 000 C0 C8 D0 D8 E0 E8 F0 F8 12520ECX/CX/CL 001 C1 C9 D1 D9 E1 E9 F1 F9 12521EDX/DX/DL 010 C2 CA D2 DA E2 EA F2 FA 12522EBX/BX/BL 011 C3 CB D3 DB E3 EB F3 FB 12523ESP/SP/AH 11 100 C4 CC D4 DC E4 EC F4 FC 12524EBP/BP/CH 101 C5 CD D5 DD E5 ED F5 FD 12525ESI/SI/DH 110 C6 CE D6 DE E6 EE F6 FE 12526EDI/DI/BH 111 C7 CF D7 DF E7 EF F7 FF 12527 12528 12529 12530NOTES: 12531 [--] [--] means a SIB follows the ModR/M byte. disp8 denotes an 8-bit 12532 displacement following the SIB byte, to be sign-extended and added to the 12533 index. disp32 denotes a 32-bit displacement following the ModR/M byte, to 12534 be added to the index. 12535 12536 12537 12538Table 17-4. 32-Bit Addressing Forms with the SIB Byte 12539 12540 12541 r32 EAX ECX EDX EBX ESP [*] 12542[*] means a disp32 with no base if MOD is 00, [ESP] otherwise. This provides 12543the following addressing modes: 12544 disp32[index] (MOD=00) 12545 disp8[EBP][index] (MOD=01) 12546 disp32[EBP][index] (MOD=10) ESI EDI 12547 Base = 0 1 2 3 4 5 6 7 12548 Base = 000 001 010 011 100 101 110 111 12549 12550Scaled Index 12551[*] means a disp32 with no base if MOD is 00, [ESP] otherwise. This provides 12552the following addressing modes: 12553 disp32[index] (MOD=00) 12554 disp8[EBP][index] (MOD=01) 12555 disp32[EBP][index] (MOD=10)SS Index ModR/M Values in HexadecimalĿ 12556 12557[EAX] 000 00 01 02 03 04 05 06 07 12558[ECX] 001 08 09 0A 0B 0C 0D 0E 0F 12559[EDX] 010 10 11 12 13 14 15 16 17 12560[EBX] 011 18 19 1A 1B 1C 1D 1E 1F 12561none 00 100 20 21 22 23 24 25 26 27 12562[EBP] 101 28 29 2A 2B 2C 2D 2E 2F 12563[ESI] 110 30 31 32 33 34 35 36 37 12564[EDI] 111 38 39 3A 3B 3C 3D 3E 3F 12565 12566[EAX*2] 000 40 41 42 43 44 45 46 47 12567[ECX*2] 001 48 49 4A 4B 4C 4D 4E 4F 12568[ECX*2] 010 50 51 52 53 54 55 56 57 12569[EBX*2] 011 58 59 5A 5B 5C 5D 5E 5F 12570none 01 100 60 61 62 63 64 65 66 67 12571[EBP*2] 101 68 69 6A 6B 6C 6D 6E 6F 12572[ESI*2] 110 70 71 72 73 74 75 76 77 12573[EDI*2] 111 78 79 7A 7B 7C 7D 7E 7F 12574 12575[EAX*4] 000 80 81 82 83 84 85 86 87 12576[ECX*4] 001 88 89 8A 8B 8C 8D 8E 8F 12577[EDX*4] 010 90 91 92 93 94 95 96 97 12578[EBX*4] 011 98 89 9A 9B 9C 9D 9E 9F 12579none 10 100 A0 A1 A2 A3 A4 A5 A6 A7 12580[EBP*4] 101 A8 A9 AA AB AC AD AE AF 12581[ESI*4] 110 B0 B1 B2 B3 B4 B5 B6 B7 12582[EDI*4] 111 B8 B9 BA BB BC BD BE BF 12583 12584[EAX*8] 000 C0 C1 C2 C3 C4 C5 C6 C7 12585[ECX*8] 001 C8 C9 CA CB CC CD CE CF 12586[EDX*8] 010 D0 D1 D2 D3 D4 D5 D6 D7 12587[EBX*8] 011 D8 D9 DA DB DC DD DE DF 12588none 11 100 E0 E1 E2 E3 E4 E5 E6 E7 12589[EBP*8] 101 E8 E9 EA EB EC ED EE EF 12590[ESI*8] 110 F0 F1 F2 F3 F4 F5 F6 F7 12591[EDI*8] 111 F8 F9 FA FB FC FD FE FF 12592 12593 12594 12595NOTES: 12596 [*] means a disp32 with no base if MOD is 00, [ESP] otherwise. This 12597 provides the following addressing modes: 12598 disp32[index] (MOD=00) 12599 disp8[EBP][index] (MOD=01) 12600 disp32[EBP][index] (MOD=10) 12601 12602 12603 1260417.2.2 How to Read the Instruction Set Pages 12605 12606The following is an example of the format used for each 80386 instruction 12607description in this chapter: 12608 12609CMC Complement Carry Flag 12610 12611Opcode Instruction Clocks Description 12612 12613F5 CMC 2 Complement carry flag 12614 12615The above table is followed by paragraphs labelled "Operation," 12616"Description," "Flags Affected," "Protected Mode Exceptions," "Real 12617Address Mode Exceptions," and, optionally, "Notes." The following sections 12618explain the notational conventions and abbreviations used in these 12619paragraphs of the instruction descriptions. 12620 12621 1262217.2.2.1 Opcode 12623 12624The "Opcode" column gives the complete object code produced for each form 12625of the instruction. When possible, the codes are given as hexadecimal bytes, 12626in the same order in which they appear in memory. Definitions of entries 12627other than hexadecimal bytes are as follows: 12628 12629/digit: (digit is between 0 and 7) indicates that the ModR/M byte of the 12630instruction uses only the r/m (register or memory) operand. The reg field 12631contains the digit that provides an extension to the instruction's opcode. 12632 12633/r: indicates that the ModR/M byte of the instruction contains both a 12634register operand and an r/m operand. 12635 12636cb, cw, cd, cp: a 1-byte (cb), 2-byte (cw), 4-byte (cd) or 6-byte (cp) 12637value following the opcode that is used to specify a code offset and 12638possibly a new value for the code segment register. 12639 12640ib, iw, id: a 1-byte (ib), 2-byte (iw), or 4-byte (id) immediate operand to 12641the instruction that follows the opcode, ModR/M bytes or scale-indexing 12642bytes. The opcode determines if the operand is a signed value. All words and 12643doublewords are given with the low-order byte first. 12644 12645+rb, +rw, +rd: a register code, from 0 through 7, added to the hexadecimal 12646byte given at the left of the plus sign to form a single opcode byte. The 12647codes are 12648 12649 rb rw rd 12650 AL = 0 AX = 0 EAX = 0 12651 CL = 1 CX = 1 ECX = 1 12652 DL = 2 DX = 2 EDX = 2 12653 BL = 3 BX = 3 EBX = 3 12654 AH = 4 SP = 4 ESP = 4 12655 CH = 5 BP = 5 EBP = 5 12656 DH = 6 SI = 6 ESI = 6 12657 BH = 7 DI = 7 EDI = 7 12658 12659 1266017.2.2.2 Instruction 12661 12662The "Instruction" column gives the syntax of the instruction statement as 12663it would appear in an ASM386 program. The following is a list of the symbols 12664used to represent operands in the instruction statements: 12665 12666rel8: a relative address in the range from 128 bytes before the end of the 12667instruction to 127 bytes after the end of the instruction. 12668 12669rel16, rel32: a relative address within the same code segment as the 12670instruction assembled. rel16 applies to instructions with an operand-size 12671attribute of 16 bits; rel32 applies to instructions with an operand-size 12672attribute of 32 bits. 12673 12674ptr16:16, ptr16:32: a FAR pointer, typically in a code segment different 12675from that of the instruction. The notation 16:16 indicates that the value of 12676the pointer has two parts. The value to the right of the colon is a 16-bit 12677selector or value destined for the code segment register. The value to the 12678left corresponds to the offset within the destination segment. ptr16:16 is 12679used when the instruction's operand-size attribute is 16 bits; ptr16:32 is 12680used with the 32-bit attribute. 12681 12682r8: one of the byte registers AL, CL, DL, BL, AH, CH, DH, or BH. 12683 12684r16: one of the word registers AX, CX, DX, BX, SP, BP, SI, or DI. 12685 12686r32: one of the doubleword registers EAX, ECX, EDX, EBX, ESP, EBP, ESI, or 12687EDI. 12688 12689imm8: an immediate byte value. imm8 is a signed number between -128 and 12690+127 inclusive. For instructions in which imm8 is combined with a word or 12691doubleword operand, the immediate value is sign-extended to form a word or 12692doubleword. The upper byte of the word is filled with the topmost bit of the 12693immediate value. 12694 12695imm16: an immediate word value used for instructions whose operand-size 12696attribute is 16 bits. This is a number between -32768 and +32767 inclusive. 12697 12698imm32: an immediate doubleword value used for instructions whose 12699operand-size attribute is 32-bits. It allows the use of a number between 12700+2147483647 and -2147483648. 12701 12702r/m8: a one-byte operand that is either the contents of a byte register 12703(AL, BL, CL, DL, AH, BH, CH, DH), or a byte from memory. 12704 12705r/m16: a word register or memory operand used for instructions whose 12706operand-size attribute is 16 bits. The word registers are: AX, BX, CX, DX, 12707SP, BP, SI, DI. The contents of memory are found at the address provided by 12708the effective address computation. 12709 12710r/m32: a doubleword register or memory operand used for instructions whose 12711operand-size attribute is 32-bits. The doubleword registers are: EAX, EBX, 12712ECX, EDX, ESP, EBP, ESI, EDI. The contents of memory are found at the 12713address provided by the effective address computation. 12714 12715m8: a memory byte addressed by DS:SI or ES:DI (used only by string 12716instructions). 12717 12718m16: a memory word addressed by DS:SI or ES:DI (used only by string 12719instructions). 12720 12721m32: a memory doubleword addressed by DS:SI or ES:DI (used only by string 12722instructions). 12723 12724m16:16, M16:32: a memory operand containing a far pointer composed of two 12725numbers. The number to the left of the colon corresponds to the pointer's 12726segment selector. The number to the right corresponds to its offset. 12727 12728m16 & 32, m16 & 16, m32 & 32: a memory operand consisting of data item pairs 12729whose sizes are indicated on the left and the right side of the ampersand. 12730All memory addressing modes are allowed. m16 & 16 and m32 & 32 operands are 12731used by the BOUND instruction to provide an operand containing an upper and 12732lower bounds for array indices. m16 & 32 is used by LIDT and LGDT to 12733provide a word with which to load the limit field, and a doubleword with 12734which to load the base field of the corresponding Global and Interrupt 12735Descriptor Table Registers. 12736 12737moffs8, moffs16, moffs32: (memory offset) a simple memory variable of type 12738BYTE, WORD, or DWORD used by some variants of the MOV instruction. The 12739actual address is given by a simple offset relative to the segment base. No 12740ModR/M byte is used in the instruction. The number shown with moffs 12741indicates its size, which is determined by the address-size attribute of the 12742instruction. 12743 12744Sreg: a segment register. The segment register bit assignments are ES=0, 12745CS=1, SS=2, DS=3, FS=4, and GS=5. 12746 12747 1274817.2.2.3 Clocks 12749 12750The "Clocks" column gives the number of clock cycles the instruction takes 12751to execute. The clock count calculations makes the following assumptions: 12752 12753 The instruction has been prefetched and decoded and is ready for 12754 execution. 12755 12756 Bus cycles do not require wait states. 12757 12758 There are no local bus HOLD requests delaying processor access to the 12759 bus. 12760 12761 No exceptions are detected during instruction execution. 12762 12763 Memory operands are aligned. 12764 12765Clock counts for instructions that have an r/m (register or memory) operand 12766are separated by a slash. The count to the left is used for a register 12767operand; the count to the right is used for a memory operand. 12768 12769The following symbols are used in the clock count specifications: 12770 12771 n, which represents a number of repetitions. 12772 12773 m, which represents the number of components in the next instruction 12774 executed, where the entire displacement (if any) counts as one 12775 component, the entire immediate data (if any) counts as one component, 12776 and every other byte of the instruction and prefix(es) each counts as 12777 one component. 12778 12779 pm=, a clock count that applies when the instruction executes in 12780 Protected Mode. pm= is not given when the clock counts are the same for 12781 Protected and Real Address Modes. 12782 12783When an exception occurs during the execution of an instruction and the 12784exception handler is in another task, the instruction execution time is 12785increased by the number of clocks to effect a task switch. This parameter 12786depends on several factors: 12787 12788 The type of TSS used to represent the current task (386 TSS or 286 12789 TSS). 12790 12791 The type of TSS used to represent the new task. 12792 12793 Whether the current task is in V86 mode. 12794 12795 Whether the new task is in V86 mode. 12796 12797Table 17-5 summarizes the task switch times for exceptions. 12798 12799 12800Table 17-5. Task Switch Times for Exceptions 12801 12802 New Task 12803 12804Old 386 TSS 286 TSS 12805Task VM = 0 12806 12807386 VM = 0 309 282 12808TSS 12809 12810386 VM = 1 314 231 12811TSS 12812 12813286 307 282 12814TSS 12815 12816 1281717.2.2.4 Description 12818 12819The "Description" column following the "Clocks" column briefly explains the 12820various forms of the instruction. The "Operation" and "Description" sections 12821contain more details of the instruction's operation. 12822 12823 1282417.2.2.5 Operation 12825 12826The "Operation" section contains an algorithmic description of the 12827instruction which uses a notation similar to the Algol or Pascal language. 12828The algorithms are composed of the following elements: 12829 12830Comments are enclosed within the symbol pairs "(*" and "*)". 12831 12832Compound statements are enclosed between the keywords of the "if" statement 12833(IF, THEN, ELSE, FI) or of the "do" statement (DO, OD), or of the "case" 12834statement (CASE ... OF, ESAC). 12835 12836A register name implies the contents of the register. A register name 12837enclosed in brackets implies the contents of the location whose address is 12838contained in that register. For example, ES:[DI] indicates the contents of 12839the location whose ES segment relative address is in register DI. [SI] 12840indicates the contents of the address contained in register SI relative to 12841SI's default segment (DS) or overridden segment. 12842 12843Brackets also used for memory operands, where they mean that the contents 12844of the memory location is a segment-relative offset. For example, [SRC] 12845indicates that the contents of the source operand is a segment-relative 12846offset. 12847 12848A B; indicates that the value of B is assigned to A. 12849 12850The symbols =, <>, , and are relational operators used to compare two 12851values, meaning equal, not equal, greater or equal, less or equal, 12852respectively. A relational expression such as A = B is TRUE if the value of 12853A is equal to B; otherwise it is FALSE. 12854 12855The following identifiers are used in the algorithmic descriptions: 12856 12857 OperandSize represents the operand-size attribute of the instruction, 12858 which is either 16 or 32 bits. AddressSize represents the address-size 12859 attribute, which is either 16 or 32 bits. For example, 12860 12861 IF instruction = CMPSW 12862 THEN OperandSize 16; 12863 ELSE 12864 IF instruction = CMPSD 12865 THEN OperandSize 32; 12866 FI; 12867 FI; 12868 12869indicates that the operand-size attribute depends on the form of the CMPS 12870instruction used. Refer to the explanation of address-size and operand-size 12871attributes at the beginning of this chapter for general guidelines on how 12872these attributes are determined. 12873 12874 StackAddrSize represents the stack address-size attribute associated 12875 with the instruction, which has a value of 16 or 32 bits, as explained 12876 earlier in the chapter. 12877 12878 SRC represents the source operand. When there are two operands, SRC is 12879 the one on the right. 12880 12881 DEST represents the destination operand. When there are two operands, 12882 DEST is the one on the left. 12883 12884 LeftSRC, RightSRC distinguishes between two operands when both are 12885 source operands. 12886 12887 eSP represents either the SP register or the ESP register depending on 12888 the setting of the B-bit for the current stack segment. 12889 12890The following functions are used in the algorithmic descriptions: 12891 12892 Truncate to 16 bits(value) reduces the size of the value to fit in 16 12893 bits by discarding the uppermost bits as needed. 12894 12895 Addr(operand) returns the effective address of the operand (the result 12896 of the effective address calculation prior to adding the segment base). 12897 12898 ZeroExtend(value) returns a value zero-extended to the operand-size 12899 attribute of the instruction. For example, if OperandSize = 32, 12900 ZeroExtend of a byte value of -10 converts the byte from F6H to 12901 doubleword with hexadecimal value 000000F6H. If the value passed to 12902 ZeroExtend and the operand-size attribute are the same size, 12903 ZeroExtend returns the value unaltered. 12904 12905 SignExtend(value) returns a value sign-extended to the operand-size 12906 attribute of the instruction. For example, if OperandSize = 32, 12907 SignExtend of a byte containing the value -10 converts the byte from 12908 F6H to a doubleword with hexadecimal value FFFFFFF6H. If the value 12909 passed to SignExtend and the operand-size attribute are the same size, 12910 SignExtend returns the value unaltered. 12911 12912 Push(value) pushes a value onto the stack. The number of bytes pushed 12913 is determined by the operand-size attribute of the instruction. The 12914 action of Push is as follows: 12915 12916 IF StackAddrSize = 16 12917 THEN 12918 IF OperandSize = 16 12919 THEN 12920 SP SP - 2; 12921 SS:[SP] value; (* 2 bytes assigned starting at 12922 byte address in SP *) 12923 ELSE (* OperandSize = 32 *) 12924 SP SP - 4; 12925 SS:[SP] value; (* 4 bytes assigned starting at 12926 byte address in SP *) 12927 FI; 12928 ELSE (* StackAddrSize = 32 *) 12929 IF OperandSize = 16 12930 THEN 12931 ESP ESP - 2; 12932 SS:[ESP] value; (* 2 bytes assigned starting at 12933 byte address in ESP*) 12934 ELSE (* OperandSize = 32 *) 12935 ESP ESP - 4; 12936 SS:[ESP] value; (* 4 bytes assigned starting at 12937 byte address in ESP*) 12938 FI; 12939 FI; 12940 12941 Pop(value) removes the value from the top of the stack and returns it. 12942 The statement EAX Pop( ); assigns to EAX the 32-bit value that Pop 12943 took from the top of the stack. Pop will return either a word or a 12944 doubleword depending on the operand-size attribute. The action of Pop 12945 is as follows: 12946 12947 IF StackAddrSize = 16 12948 THEN 12949 IF OperandSize = 16 12950 THEN 12951 ret val SS:[SP]; (* 2-byte value *) 12952 SP SP + 2; 12953 ELSE (* OperandSize = 32 *) 12954 ret val SS:[SP]; (* 4-byte value *) 12955 SP SP + 4; 12956 FI; 12957 ELSE (* StackAddrSize = 32 *) 12958 IF OperandSize = 16 12959 THEN 12960 ret val SS:[ESP]; (* 2 bytes value *) 12961 ESP ESP + 2; 12962 ELSE (* OperandSize = 32 *) 12963 ret val SS:[ESP]; (* 4 bytes value *) 12964 ESP ESP + 4; 12965 FI; 12966 FI; 12967 RETURN(ret val); (*returns a word or doubleword*) 12968 12969 Bit[BitBase, BitOffset] returns the address of a bit within a bit 12970 string, which is a sequence of bits in memory or a register. Bits are 12971 numbered from low-order to high-order within registers and within 12972 memory bytes. In memory, the two bytes of a word are stored with the 12973 low-order byte at the lower address. 12974 12975 If the base operand is a register, the offset can be in the range 0..31. 12976 This offset addresses a bit within the indicated register. An example, 12977 "BIT[EAX, 21]," is illustrated in Figure 17-3. 12978 12979 If BitBase is a memory address, BitOffset can range from -2 gigabits to 2 12980 gigabits. The addressed bit is numbered (Offset MOD 8) within the byte at 12981 address (BitBase + (BitOffset DIV 8)), where DIV is signed division with 12982 rounding towards negative infinity, and MOD returns a positive number. 12983 This is illustrated in Figure 17-4. 12984 12985 I-O-Permission(I-O-Address, width) returns TRUE or FALSE depending on 12986 the I/O permission bitmap and other factors. This function is defined as 12987 follows: 12988 12989 IF TSS type is 286 THEN RETURN FALSE; FI; 12990 Ptr [TSS + 66]; (* fetch bitmap pointer *) 12991 BitStringAddr SHR (I-O-Address, 3) + Ptr; 12992 MaskShift I-O-Address AND 7; 12993 CASE width OF: 12994 BYTE: nBitMask 1; 12995 WORD: nBitMask 3; 12996 DWORD: nBitMask 15; 12997 ESAC; 12998 mask SHL (nBitMask, MaskShift); 12999 CheckString [BitStringAddr] AND mask; 13000 IF CheckString = 0 13001 THEN RETURN (TRUE); 13002 ELSE RETURN (FALSE); 13003 FI; 13004 13005 Switch-Tasks is the task switching function described in Chapter 7. 13006 13007 1300817.2.2.6 Description 13009 13010The "Description" section contains further explanation of the instruction's 13011operation. 13012 13013 13014Figure 17-3. Bit Offset for BIT[EAX, 21] 13015 13016 31 21 0 13017 ͻ 13018 13019 ͼ 13020 13021 BITOFFSET = 21 13022 13023 13024Figure 17-4. Memory Bit Indexing 13025 13026 BIT INDEXING (POSITIVE OFFSET) 13027 13028 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 13029 ͻ 13030 13031 ͼ 13032 BITBASE + 1 BITBASE BITBASE - 1 13033 13034 OFFSET = 13 13035 13036 BIT INDEXING (NEGATIVE OFFSET) 13037 13038 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 13039 ͻ 13040 13041 ͼ 13042 BITBASE BITBASE - 1 BITBASE - 2 13043 13044 OFFSET = -11 13045 13046 1304717.2.2.7 Flags Affected 13048 13049The "Flags Affected" section lists the flags that are affected by the 13050instruction, as follows: 13051 13052 If a flag is always cleared or always set by the instruction, the 13053 value is given (0 or 1) after the flag name. Arithmetic and logical 13054 instructions usually assign values to the status flags in the uniform 13055 manner described in Appendix C. Nonconventional assignments are 13056 described in the "Operation" section. 13057 13058 The values of flags listed as "undefined" may be changed by the 13059 instruction in an indeterminate manner. 13060 13061All flags not listed are unchanged by the instruction. 13062 13063 1306417.2.2.8 Protected Mode Exceptions 13065 13066This section lists the exceptions that can occur when the instruction is 13067executed in 80386 Protected Mode. The exception names are a pound sign (#) 13068followed by two letters and an optional error code in parentheses. For 13069example, #GP(0) denotes a general protection exception with an error code of 130700. Table 17-6 associates each two-letter name with the corresponding 13071interrupt number. 13072 13073Chapter 9 describes the exceptions and the 80386 state upon entry to the 13074exception. 13075 13076Application programmers should consult the documentation provided with 13077their operating systems to determine the actions taken when exceptions 13078occur. 13079 13080 13081Table 17-6. 80386 Exceptions 13082 13083Mnemonic Interrupt Description 13084 13085#UD 6 Invalid opcode 13086#NM 7 Coprocessor not available 13087#DF 8 Double fault 13088#TS 10 Invalid TSS 13089#NP 11 Segment or gate not present 13090#SS 12 Stack fault 13091#GP 13 General protection fault 13092#PF 14 Page fault 13093#MF 16 Math (coprocessor) fault 13094 13095 1309617.2.2.9 Real Address Mode Exceptions 13097 13098Because less error checking is performed by the 80386 in Real Address Mode, 13099this mode has fewer exception conditions. Refer to Chapter 14 for further 13100information on these exceptions. 13101 13102 1310317.2.2.10 Virtual-8086 Mode Exceptions 13104 13105Virtual 8086 tasks provide the ability to simulate Virtual 8086 machines. 13106Virtual 8086 Mode exceptions are similar to those for the 8086 processor, 13107but there are some differences. Refer to Chapter 15 for details. 13108 13109 13110AAA ASCII Adjust after Addition 13111 13112Opcode Instruction Clocks Description 13113 1311437 AAA 4 ASCII adjust AL after addition 13115 13116 13117Operation 13118 13119IF ((AL AND 0FH) > 9) OR (AF = 1) 13120THEN 13121 AL (AL + 6) AND 0FH; 13122 AH AH + 1; 13123 AF 1; 13124 CF 1; 13125ELSE 13126 CF 0; 13127 AF 0; 13128FI; 13129 13130Description 13131 13132Execute AAA only following an ADD instruction that leaves a byte result 13133in the AL register. The lower nibbles of the operands of the ADD instruction 13134should be in the range 0 through 9 (BCD digits). In this case, AAA adjusts 13135AL to contain the correct decimal digit result. If the addition produced a 13136decimal carry, the AH register is incremented, and the carry and auxiliary 13137carry flags are set to 1. If there was no decimal carry, the carry and 13138auxiliary flags are set to 0 and AH is unchanged. In either case, AL is left 13139with its top nibble set to 0. To convert AL to an ASCII result, follow the 13140AAA instruction with OR AL, 30H. 13141 13142Flags Affected 13143 13144AF and CF as described above; OF, SF, ZF, and PF are undefined 13145 13146Protected Mode Exceptions 13147 13148None 13149 13150Real Address Mode Exceptions 13151 13152None 13153 13154Virtual 8086 Mode Exceptions 13155 13156None 13157 13158 13159AAD ASCII Adjust AX before Division 13160 13161Opcode Instruction Clocks Description 13162 13163D5 0A AAD 19 ASCII adjust AX before division 13164 13165 13166Operation 13167 13168AL AH * 10 + AL; 13169AH 0; 13170 13171Description 13172 13173AAD is used to prepare two unpacked BCD digits (the least-significant 13174digit in AL, the most-significant digit in AH) for a division operation that 13175will yield an unpacked result. This is accomplished by setting AL to 13176AL + (10 * AH), and then setting AH to 0. AX is then equal to the binary 13177equivalent of the original unpacked two-digit number. 13178 13179Flags Affected 13180 13181SF, ZF, and PF as described in Appendix C; OF, AF, and CF are undefined 13182 13183Protected Mode Exceptions 13184 13185None 13186 13187Real Address Mode Exceptions 13188 13189None 13190 13191Virtual 8086 Mode Exceptions 13192 13193None 13194 13195 13196AAM ASCII Adjust AX after Multiply 13197 13198Opcode Instruction Clocks Description 13199 13200D4 0A AAM 17 ASCII adjust AX after multiply 13201 13202 13203Operation 13204 13205AH AL / 10; 13206AL AL MOD 10; 13207 13208Description 13209 13210Execute AAM only after executing a MUL instruction between two unpacked 13211BCD digits that leaves the result in the AX register. Because the result is 13212less than 100, it is contained entirely in the AL register. AAM unpacks the 13213AL result by dividing AL by 10, leaving the quotient (most-significant 13214digit) in AH and the remainder (least-significant digit) in AL. 13215 13216Flags Affected 13217 13218SF, ZF, and PF as described in Appendix C; OF, AF, and CF are undefined 13219 13220Protected Mode Exceptions 13221 13222None 13223 13224Real Address Mode Exceptions 13225 13226None 13227 13228Virtual 8086 Mode Exceptions 13229 13230None 13231 13232 13233AAS ASCII Adjust AL after Subtraction 13234 13235Opcode Instruction Clocks Description 13236 132373F AAS 4 ASCII adjust AL after subtraction 13238 13239 13240Operation 13241 13242IF (AL AND 0FH) > 9 OR AF = 1 13243THEN 13244 AL AL - 6; 13245 AL AL AND 0FH; 13246 AH AH - 1; 13247 AF 1; 13248 CF 1; 13249ELSE 13250 CF 0; 13251 AF 0; 13252FI; 13253 13254Description 13255 13256Execute AAS only after a SUB instruction that leaves the byte result in the 13257AL register. The lower nibbles of the operands of the SUB instruction must 13258have been in the range 0 through 9 (BCD digits). In this case, AAS adjusts 13259AL so it contains the correct decimal digit result. If the subtraction 13260produced a decimal carry, the AH register is decremented, and the carry and 13261auxiliary carry flags are set to 1. If no decimal carry occurred, the carry 13262and auxiliary carry flags are set to 0, and AH is unchanged. In either case, 13263AL is left with its top nibble set to 0. To convert AL to an ASCII result, 13264follow the AAS with OR AL, 30H. 13265 13266Flags Affected 13267 13268AF and CF as described above; OF, SF, ZF, and PF are undefined 13269 13270Protected Mode Exceptions 13271 13272None 13273 13274Real Address Mode Exceptions 13275 13276None 13277 13278Virtual 8086 Mode Exceptions 13279 13280None 13281 13282 13283ADC Add with Carry 13284 13285 13286Opcode Instruction Clocks Description 13287 1328814 ib ADC AL,imm8 2 Add with carry immediate byte to AL 1328915 iw ADC AX,imm16 2 Add with carry immediate word to AX 1329015 id ADC EAX,imm32 2 Add with carry immediate dword to EAX 1329180 /2 ib ADC r/m8,imm8 2/7 Add with carry immediate byte to r/m 13292 byte 1329381 /2 iw ADC r/m16,imm16 2/7 Add with carry immediate word to r/m 13294 word 1329581 /2 id ADC r/m32,imm32 2/7 Add with CF immediate dword to r/m 13296 dword 1329783 /2 ib ADC r/m16,imm8 2/7 Add with CF sign-extended immediate 13298 byte to r/m word 1329983 /2 ib ADC r/m32,imm8 2/7 Add with CF sign-extended immediate 13300 byte into r/m dword 1330110 /r ADC r/m8,r8 2/7 Add with carry byte register to r/m 13302 byte 1330311 /r ADC r/m16,r16 2/7 Add with carry word register to r/m 13304 word 1330511 /r ADC r/m32,r32 2/7 Add with CF dword register to r/m dword 1330612 /r ADC r8,r/m8 2/6 Add with carry r/m byte to byte 13307 register 1330813 /r ADC r16,r/m16 2/6 Add with carry r/m word to word 13309 register 1331013 /r ADC r32,r/m32 2/6 Add with CF r/m dword to dword register 13311 13312 13313Operation 13314 13315DEST DEST + SRC + CF; 13316 13317Description 13318 13319ADC performs an integer addition of the two operands DEST and SRC and the 13320carry flag, CF. The result of the addition is assigned to the first operand 13321(DEST), and the flags are set accordingly. ADC is usually executed as part 13322of a multi-byte or multi-word addition operation. When an immediate byte 13323value is added to a word or doubleword operand, the immediate value is first 13324sign-extended to the size of the word or doubleword operand. 13325 13326Flags Affected 13327 13328OF, SF, ZF, AF, CF, and PF as described in Appendix C 13329 13330Protected Mode Exceptions 13331 13332#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13333memory operand effective address in the CS, DS, ES, FS, or GS segments; 13334#SS(0) for an illegal address in the SS segment; #PF(fault-code) if page 13335fault 13336 13337Real Address Mode Exceptions 13338 13339Interrupt 13 if any part of the operand would lie outside of the effective 13340address space from 0 to 0FFFFH 13341 13342Virtual 8086 Mode Exceptions 13343 13344Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13345 13346 13347ADD Add 13348 13349Opcode Instruction Clocks Description 13350 1335104 ib ADD AL,imm8 2 Add immediate byte to AL 1335205 iw ADD AX,imm16 2 Add immediate word to AX 1335305 id ADD EAX,imm32 2 Add immediate dword to EAX 1335480 /0 ib ADD r/m8,imm8 2/7 Add immediate byte to r/m byte 1335581 /0 iw ADD r/m16,imm16 2/7 Add immediate word to r/m word 1335681 /0 id ADD r/m32,imm32 2/7 Add immediate dword to r/m dword 1335783 /0 ib ADD r/m16,imm8 2/7 Add sign-extended immediate byte 13358 to r/m word 1335983 /0 ib ADD r/m32,imm8 2/7 Add sign-extended immediate byte 13360 to r/m dword 1336100 /r ADD r/m8,r8 2/7 Add byte register to r/m byte 1336201 /r ADD r/m16,r16 2/7 Add word register to r/m word 1336301 /r ADD r/m32,r32 2/7 Add dword register to r/m dword 1336402 /r ADD r8,r/m8 2/6 Add r/m byte to byte register 1336503 /r ADD r16,r/m16 2/6 Add r/m word to word register 1336603 /r ADD r32,r/m32 2/6 Add r/m dword to dword register 13367 13368 13369Operation 13370 13371DEST DEST + SRC; 13372 13373Description 13374 13375ADD performs an integer addition of the two operands (DEST and SRC). The 13376result of the addition is assigned to the first operand (DEST), and the 13377flags are set accordingly. 13378 13379When an immediate byte is added to a word or doubleword operand, the 13380immediate value is sign-extended to the size of the word or doubleword 13381operand. 13382 13383Flags Affected 13384 13385OF, SF, ZF, AF, CF, and PF as described in Appendix C 13386 13387Protected Mode Exceptions 13388 13389#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13390memory operand effective address in the CS, DS, ES, FS, or GS segments; 13391#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13392fault 13393 13394Real Address Mode Exceptions 13395 13396Interrupt 13 if any part of the operand would lie outside of the effective 13397address space from 0 to 0FFFFH 13398 13399Virtual 8086 Mode Exceptions 13400 13401Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13402 13403 13404AND Logical AND 13405 13406Opcode Instruction Clocks Description 13407 1340824 ib AND AL,imm8 2 AND immediate byte to AL 1340925 iw AND AX,imm16 2 AND immediate word to AX 1341025 id AND EAX,imm32 2 AND immediate dword to EAX 1341180 /4 ib AND r/m8,imm8 2/7 AND immediate byte to r/m byte 1341281 /4 iw AND r/m16,imm16 2/7 AND immediate word to r/m word 1341381 /4 id AND r/m32,imm32 2/7 AND immediate dword to r/m dword 1341483 /4 ib AND r/m16,imm8 2/7 AND sign-extended immediate byte 13415 with r/m word 1341683 /4 ib AND r/m32,imm8 2/7 AND sign-extended immediate byte 13417 with r/m dword 1341820 /r AND r/m8,r8 2/7 AND byte register to r/m byte 1341921 /r AND r/m16,r16 2/7 AND word register to r/m word 1342021 /r AND r/m32,r32 2/7 AND dword register to r/m dword 1342122 /r AND r8,r/m8 2/6 AND r/m byte to byte register 1342223 /r AND r16,r/m16 2/6 AND r/m word to word register 1342323 /r AND r32,r/m32 2/6 AND r/m dword to dword register 13424 13425 13426Operation 13427 13428DEST DEST AND SRC; 13429CF 0; 13430OF 0; 13431 13432Description 13433 13434Each bit of the result of the AND instruction is a 1 if both corresponding 13435bits of the operands are 1; otherwise, it becomes a 0. 13436 13437Flags Affected 13438 13439CF = 0, OF = 0; PF, SF, and ZF as described in Appendix C 13440 13441Protected Mode Exceptions 13442 13443#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13444memory operand effective address in the CS, DS, ES, FS, or GS segments; 13445#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13446fault 13447 13448Real Address Mode Exceptions 13449 13450Interrupt 13 if any part of the operand would lie outside of the effective 13451address space from 0 to 0FFFFH 13452 13453Virtual 8086 Mode Exceptions 13454 13455Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13456 13457 13458ARPL Adjust RPL Field of Selector 13459 13460Opcode Instruction Clocks Description 13461 1346263 /r ARPL r/m16,r16 pm=20/21 Adjust RPL of r/m16 to not 13463 less than RPL of r16 13464 13465 13466Operation 13467 13468IF RPL bits(0,1) of DEST < RPL bits(0,1) of SRC 13469THEN 13470 ZF 1; 13471 RPL bits(0,1) of DEST RPL bits(0,1) of SRC; 13472ELSE 13473 ZF 0; 13474FI; 13475 13476Description 13477 13478The ARPL instruction has two operands. The first operand is a 16-bit 13479memory variable or word register that contains the value of a selector. The 13480second operand is a word register. If the RPL field ("requested privilege 13481level"bottom two bits) of the first operand is less than the RPL field of 13482the second operand, the zero flag is set to 1 and the RPL field of the 13483first operand is increased to match the second operand. Otherwise, the zero 13484flag is set to 0 and no change is made to the first operand. 13485 13486ARPL appears in operating system software, not in application programs. It 13487is used to guarantee that a selector parameter to a subroutine does not 13488request more privilege than the caller is allowed. The second operand of 13489ARPL is normally a register that contains the CS selector value of the 13490caller. 13491 13492Flags Affected 13493 13494ZF as described above 13495 13496Protected Mode Exceptions 13497 13498#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13499memory operand effective address in the CS, DS, ES, FS, or GS segments; 13500#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13501fault 13502 13503Real Address Mode Exceptions 13504 13505Interrupt 6; ARPL is not recognized in Real Address Mode 13506 13507Virtual 8086 Mode Exceptions 13508 13509Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13510 13511 13512BOUND Check Array Index Against Bounds 13513 13514Opcode Instruction Clocks Description 13515 1351662 /r BOUND r16,m16&16 10 Check if r16 is within bounds 13517 (passes test) 1351862 /r BOUND r32,m32&32 10 Check if r32 is within bounds 13519 (passes test) 13520 13521 13522Operation 13523 13524IF (LeftSRC < [RightSRC] OR LeftSRC > [RightSRC + OperandSize/8]) 13525 (* Under lower bound or over upper bound *) 13526THEN Interrupt 5; 13527FI; 13528 13529Description 13530 13531BOUND ensures that a signed array index is within the limits specified by a 13532block of memory consisting of an upper and a lower bound. Each bound uses 13533one word for an operand-size attribute of 16 bits and a doubleword for an 13534operand-size attribute of 32 bits. The first operand (a register) must be 13535greater than or equal to the first bound in memory (lower bound), and less 13536than or equal to the second bound in memory (upper bound). If the register 13537is not within bounds, an Interrupt 5 occurs; the return EIP points to the 13538BOUND instruction. 13539 13540The bounds limit data structure is usually placed just before the array 13541itself, making the limits addressable via a constant offset from the 13542beginning of the array. 13543 13544Flags Affected 13545 13546None 13547 13548Protected Mode Exceptions 13549 13550Interrupt 5 if the bounds test fails, as described above; #GP(0) for an 13551illegal memory operand effective address in the CS, DS, ES, FS, or GS 13552segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 13553for a page fault 13554 13555The second operand must be a memory operand, not a register. If BOUND is 13556executed with a ModRM byte representing a register as the second operand, 13557#UD occurs. 13558 13559Real Address Mode Exceptions 13560 13561Interrupt 5 if the bounds test fails; Interrupt 13 if any part of the 13562operand would lie outside of the effective address space from 0 to 0FFFFH; 13563Interrupt 6 if the second operand is a register 13564 13565Virtual 8086 Mode Exceptions 13566 13567Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13568 13569 13570BSF Bit Scan Forward 13571 13572Opcode Instruction Clocks Description 13573 135740F BC BSF r16,r/m16 10+3n Bit scan forward on r/m word 135750F BC BSF r32,r/m32 10+3n Bit scan forward on r/m dword 13576 13577 13578Notes 13579 13580 is the number of leading zero bits. 13581 13582Operation 13583 13584IF r/m = 0 13585THEN 13586 ZF 1; 13587 register UNDEFINED; 13588ELSE 13589 temp 0; 13590 ZF 0; 13591 WHILE BIT[r/m, temp = 0] 13592 DO 13593 temp temp + 1; 13594 register temp; 13595 OD; 13596FI; 13597 13598Description 13599 13600BSF scans the bits in the second word or doubleword operand starting with 13601bit 0. The ZF flag is cleared if the bits are all 0; otherwise, the ZF flag 13602is set and the destination register is loaded with the bit index of the 13603first set bit. 13604 13605Flags Affected 13606 13607ZF as described above 13608 13609Protected Mode Exceptions 13610 13611#GP(0) for an illegal memory operand effective address in the CS, DS, ES, 13612FS, or GS segments; #SS(0) for an illegal address in the SS segment; 13613#PF(fault-code) for a page fault 13614 13615Real Address Mode Exceptions 13616 13617Interrupt 13 if any part of the operand would lie outside of the effective 13618address space from 0 to 0FFFFH 13619 13620Virtual 8086 Mode Exceptions 13621 13622Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13623 13624 13625BSR Bit Scan Reverse 13626 13627Opcode Instruction Clocks Description 13628 136290F BD BSR r16,r/m16 10+3n Bit scan reverse on r/m word 136300F BD BSR r32,r/m32 10+3n Bit scan reverse on r/m dword 13631 13632 13633Operation 13634 13635IF r/m = 0 13636THEN 13637 ZF 1; 13638 register UNDEFINED; 13639ELSE 13640 temp OperandSize - 1; 13641 ZF 0; 13642 WHILE BIT[r/m, temp] = 0 13643 DO 13644 temp temp - 1; 13645 register temp; 13646 OD; 13647FI; 13648 13649Description 13650 13651BSR scans the bits in the second word or doubleword operand from the most 13652significant bit to the least significant bit. The ZF flag is cleared if the 13653bits are all 0; otherwise, ZF is set and the destination register is loaded 13654with the bit index of the first set bit found when scanning in the reverse 13655direction. 13656 13657Flags Affected 13658 13659ZF as described above 13660 13661Protected Mode Exceptions 13662 13663#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13664memory operand effective address in the CS, DS, ES, FS, or GS segments; 13665#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13666fault 13667 13668Real Address Mode Exceptions 13669 13670Interrupt 13 if any part of the operand would lie outside of the effective 13671address space from 0 to 0FFFFH 13672 13673Virtual 8086 Mode Exceptions 13674 13675Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13676 13677 13678BT Bit Test 13679 13680Opcode Instruction Clocks Description 13681 136820F A3 BT r/m16,r16 3/12 Save bit in carry flag 136830F A3 BT r/m32,r32 3/12 Save bit in carry flag 136840F BA /4 ib BT r/m16,imm8 3/6 Save bit in carry flag 136850F BA /4 ib BT r/m32,imm8 3/6 Save bit in carry flag 13686 13687 13688Operation 13689 13690CF BIT[LeftSRC, RightSRC]; 13691 13692Description 13693 13694BT saves the value of the bit indicated by the base (first operand) and the 13695bit offset (second operand) into the carry flag. 13696 13697Flags Affected 13698 13699CF as described above 13700 13701Protected Mode Exceptions 13702 13703#GP(0) for an illegal memory operand effective address in the CS, DS, ES, 13704FS, or GS segments; #SS(0) for an illegal address in the SS segment; 13705#PF(fault-code) for a page fault 13706 13707Real Address Mode Exceptions 13708 13709Interrupt 13 if any part of the operand would lie outside of the effective 13710address space from 0 to 0FFFFH 13711 13712Virtual 8086 Mode Exceptions 13713 13714Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13715 13716Notes 13717 13718The index of the selected bit can be given by the immediate constant in the 13719instruction or by a value in a general register. Only an 8-bit immediate 13720value is used in the instruction. This operand is taken modulo 32, so the 13721range of immediate bit offsets is 0..31. This allows any bit within a 13722register to be selected. For memory bit strings, this immediate field gives 13723only the bit offset within a word or doubleword. Immediate bit offsets 13724larger than 31 are supported by using the immediate bit offset field in 13725combination with the displacement field of the memory operand. The low-order 137263 to 5 bits of the immediate bit offset are stored in the immediate bit 13727offset field, and the high-order 27 to 29 bits are shifted and combined with 13728the byte displacement in the addressing mode. 13729 13730When accessing a bit in memory, the 80386 may access four bytes starting 13731from the memory address given by: 13732 13733 Effective Address + (4 * (BitOffset DIV 32)) 13734 13735for a 32-bit operand size, or two bytes starting from the memory address 13736given by: 13737 13738 Effective Address + (2 * (BitOffset DIV 16)) 13739 13740for a 16-bit operand size. It may do so even when only a single byte needs 13741to be accessed in order to reach the given bit. You must therefore avoid 13742referencing areas of memory close to address space holes. In particular, 13743avoid references to memory-mapped I/O registers. Instead, use the MOV 13744instructions to load from or store to these addresses, and use the register 13745form of these instructions to manipulate the data. 13746 13747 13748BTC Bit Test and Complement 13749 13750Opcode Instruction Clocks Description 13751 137520F BB BTC r/m16,r16 6/13 Save bit in carry flag and complement 137530F BB BTC r/m32,r32 6/13 Save bit in carry flag and complement 137540F BA /7 ib BTC r/m16,imm8 6/8 Save bit in carry flag and complement 137550F BA /7 ib BTC r/m32,imm8 6/8 Save bit in carry flag and complement 13756 13757 13758Operation 13759 13760CF BIT[LeftSRC, RightSRC]; 13761BIT[LeftSRC, RightSRC] NOT BIT[LeftSRC, RightSRC]; 13762 13763Description 13764 13765BTC saves the value of the bit indicated by the base (first operand) and the 13766bit offset (second operand) into the carry flag and then complements the 13767bit. 13768 13769Flags Affected 13770 13771CF as described above 13772 13773Protected Mode Exceptions 13774 13775#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13776memory operand effective address in the CS, DS, ES, FS, or GS segments; 13777#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13778fault 13779 13780Real Address Mode Exceptions 13781 13782Interrupt 13 if any part of the operand would lie outside of the effective 13783address space from 0 to 0FFFFH 13784 13785Virtual 8086 Mode Exceptions 13786 13787Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13788 13789Notes 13790 13791The index of the selected bit can be given by the immediate constant in the 13792instruction or by a value in a general register. Only an 8-bit immediate 13793value is used in the instruction. This operand is taken modulo 32, so the 13794range of immediate bit offsets is 0..31. This allows any bit within a 13795register to be selected. For memory bit strings, this immediate field gives 13796only the bit offset within a word or doubleword. Immediate bit offsets 13797larger than 31 are supported by using the immediate bit offset field in 13798combination with the displacement field of the memory operand. The low-order 137993 to 5 bits of the immediate bit offset are stored in the immediate bit 13800offset field, and the high-order 27 to 29 bits are shifted and combined with 13801the byte displacement in the addressing mode. 13802 13803When accessing a bit in memory, the 80386 may access four bytes starting 13804from the memory address given by: 13805 13806 Effective Address + (4 * (BitOffset DIV 32)) 13807 13808for a 32-bit operand size, or two bytes starting from the memory address 13809given by: 13810 13811 Effective Address + (2 * (BitOffset DIV 16)) 13812 13813for a 16-bit operand size. It may do so even when only a single byte needs 13814to be accessed in order to reach the given bit. You must therefore avoid 13815referencing areas of memory close to address space holes. In particular, 13816avoid references to memory-mapped I/O registers. Instead, use the MOV 13817instructions to load from or store to these addresses, and use the register 13818form of these instructions to manipulate the data. 13819 13820 13821BTR Bit Test and Reset 13822 13823Opcode Instruction Clocks Description 13824 138250F B3 BTR r/m16,r16 6/13 Save bit in carry flag and reset 138260F B3 BTR r/m32,r32 6/13 Save bit in carry flag and reset 138270F BA /6 ib BTR r/m16,imm8 6/8 Save bit in carry flag and reset 138280F BA /6 ib BTR r/m32,imm8 6/8 Save bit in carry flag and reset 13829 13830 13831Operation 13832 13833CF BIT[LeftSRC, RightSRC]; 13834BIT[LeftSRC, RightSRC] 0; 13835 13836Description 13837 13838BTR saves the value of the bit indicated by the base (first operand) and the 13839bit offset (second operand) into the carry flag and then stores 0 in the 13840bit. 13841 13842Flags Affected 13843 13844CF as described above 13845 13846Protected Mode Exceptions 13847 13848#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13849memory operand effective address in the CS, DS, ES, FS, or GS segments; 13850#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13851fault 13852 13853Real Address Mode Exceptions 13854 13855Interrupt 13 if any part of the operand would lie outside of the effective 13856address space from 0 to 0FFFFH 13857 13858Virtual 8086 Mode Exceptions 13859 13860Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13861 13862Notes 13863 13864The index of the selected bit can be given by the immediate constant in the 13865instruction or by a value in a general register. Only an 8-bit immediate 13866value is used in the instruction. This operand is taken modulo 32, so the 13867range of immediate bit offsets is 0..31. This allows any bit within a 13868register to be selected. For memory bit strings, this immediate field gives 13869only the bit offset within a word or doubleword. Immediate bit offsets 13870larger than 31 (or 15) are supported by using the immediate bit offset field 13871in combination with the displacement field of the memory operand. The 13872low-order 3 to 5 bits of the immediate bit offset are stored in the 13873immediate bit offset field, and the high-order 27 to 29 bits are shifted and 13874combined with the byte displacement in the addressing mode. 13875 13876When accessing a bit in memory, the 80386 may access four bytes starting 13877from the memory address given by: 13878 13879 Effective Address + 4 * (BitOffset DIV 32) 13880 13881for a 32-bit operand size, or two bytes starting from the memory address 13882given by: 13883 13884 Effective Address + 2 * (BitOffset DIV 16) 13885 13886for a 16-bit operand size. It may do so even when only a single byte needs 13887to be accessed in order to reach the given bit. You must therefore avoid 13888referencing areas of memory close to address space holes. In particular, 13889avoid references to memory-mapped I/O registers. Instead, use the MOV 13890instructions to load from or store to these addresses, and use the register 13891form of these instructions to manipulate the data. 13892 13893 13894BTS Bit Test and Set 13895 13896Opcode Instruction Clocks Description 13897 138980F AB BTS r/m16,r16 6/13 Save bit in carry flag and set 138990F AB BTS r/m32,r32 6/13 Save bit in carry flag and set 139000F BA /5 ib BTS r/m16,imm8 6/8 Save bit in carry flag and set 139010F BA /5 ib BTS r/m32,imm8 6/8 Save bit in carry flag and set 13902 13903 13904Operation 13905 13906CF BIT[LeftSRC, RightSRC]; 13907BIT[LeftSRC, RightSRC] 1; 13908 13909Description 13910 13911BTS saves the value of the bit indicated by the base (first operand) and the 13912bit offset (second operand) into the carry flag and then stores 1 in the 13913bit. 13914 13915Flags Affected 13916 13917CF as described above 13918 13919Protected Mode Exceptions 13920 13921#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 13922memory operand effective address in the CS, DS, ES, FS, or GS segments; 13923#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 13924fault 13925 13926Real Address Mode Exceptions 13927 13928Interrupt 13 if any part of the operand would lie outside of the effective 13929address space from 0 to 0FFFFH 13930 13931Virtual 8086 Mode Exceptions 13932 13933Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 13934 13935Notes 13936 13937The index of the selected bit can be given by the immediate constant in the 13938instruction or by a value in a general register. Only an 8-bit immediate 13939value is used in the instruction. This operand is taken modulo 32, so the 13940range of immediate bit offsets is 0..31. This allows any bit within a 13941register to be selected. For memory bit strings, this immediate field gives 13942only the bit offset within a word or doubleword. Immediate bit offsets 13943larger than 31 are supported by using the immediate bit offset field in 13944combination with the displacement field of the memory operand. The 13945low-order 3 to 5 bits of the immediate bit offset are stored in the 13946immediate bit offset field, and the high order 27 to 29 bits are shifted and 13947combined with the byte displacement in the addressing mode. 13948 13949When accessing a bit in memory, the processor may access four bytes starting 13950from the memory address given by: 13951 13952 Effective Address + (4 * (BitOffset DIV 32)) 13953 13954for a 32-bit operand size, or two bytes starting from the memory address 13955given by: 13956 13957 Effective Address + (2 * (BitOffset DIV 16)) 13958 13959for a 16-bit operand size. It may do this even when only a single byte needs 13960to be accessed in order to get at the given bit. Thus the programmer must be 13961careful to avoid referencing areas of memory close to address space holes. 13962In particular, avoid references to memory-mapped I/O registers. Instead, use 13963the MOV instructions to load from or store to these addresses, and use the 13964register form of these instructions to manipulate the data. 13965 13966 13967CALL Call Procedure 13968 13969 13970Opcode Instruction Clocks 13971 Values of ts are given by the following table: 13972 13973 New Task 13974 386 TSS 386 TSS 286 TSS 13975 Old VM = 0 VM = 1 13976 Task Via Task Gate? 13977 13978 N Y N Y N Y 13979 13980386 300 309 217 226 273 282 13981TSS VM=0 13982 13983286 298 307 217 226 273 282 13984TSS Description 13985 13986E8 cw CALL rel16 7+m Call near, displacement relative 13987 to next instruction 13988FF /2 CALL r/m16 7+m/10+m Call near, register 13989 indirect/memory indirect 139909A cd CALL ptr16:16 17+m,pm=34+m Call intersegment, to full 13991 pointer given 139929A cd CALL ptr16:16 pm=52+m Call gate, same privilege 139939A cd CALL ptr16:16 pm=86+m Call gate, more privilege, no 13994 parameters 139959A cd CALL ptr16:16 pm=94+4x+m Call gate, more privilege, x 13996 parameters 139979A cd CALL ptr16:16 ts Call to task 13998FF /3 CALL m16:16 22+m,pm=38+m Call intersegment, address at 13999 r/m dword 14000FF /3 CALL m16:16 pm=56+m Call gate, same privilege 14001FF /3 CALL m16:16 pm=90+m Call gate, more privilege, no 14002 parameters 14003FF /3 CALL m16:16 pm=98+4x+m Call gate, more privilege, x 14004 parameters 14005FF /3 CALL m16:16 5 + ts Call to task 14006E8 cd CALL rel32 7+m Call near, displacement relative 14007 to next instruction 14008FF /2 CALL r/m32 7+m/10+m Call near, indirect 140099A cp CALL ptr16:32 17+m,pm=34+m Call intersegment, to full 14010 pointer given 140119A cp CALL ptr16:32 pm=52+m Call gate, same privilege 140129A cp CALL ptr16:32 pm=86+m Call gate, more privilege, no 14013 parameters 140149A cp CALL ptr32:32 pm=94+4x+m Call gate, more privilege, x 14015 parameters 140169A cp CALL ptr16:32 ts Call to task 14017FF /3 CALL m16:32 22+m,pm=38+m Call intersegment, address at 14018 r/m dword 14019FF /3 CALL m16:32 pm=56+m Call gate, same privilege 14020FF /3 CALL m16:32 pm=90+m Call gate, more privilege, no 14021 parameters 14022FF /3 CALL m16:32 pm=98+4x+m Call gate, more privilege, x 14023 parameters 14024FF /3 CALL m16:32 5 + ts Call to task 14025 14026 14027 14028NOTE: 14029 Values of ts are given by the following table: 14030 14031 New Task 14032 386 TSS 386 TSS 286 TSS 14033 Old VM = 0 VM = 1 14034 Task Via Task Gate? 14035 14036 N Y N Y N Y 14037 14038386 300 309 217 226 273 282 14039TSS VM=0 14040 14041286 298 307 217 226 273 282 14042TSS 14043 14044 14045Operation 14046 14047IF rel16 or rel32 type of call 14048THEN (* near relative call *) 14049 IF OperandSize = 16 14050 THEN 14051 Push(IP); 14052 EIP (EIP + rel16) AND 0000FFFFH; 14053 ELSE (* OperandSize = 32 *) 14054 Push(EIP); 14055 EIP EIP + rel32; 14056 FI; 14057FI; 14058 14059IF r/m16 or r/m32 type of call 14060THEN (* near absolute call *) 14061 IF OperandSize = 16 14062 THEN 14063 Push(IP); 14064 EIP [r/m16] AND 0000FFFFH; 14065 ELSE (* OperandSize = 32 *) 14066 Push(EIP); 14067 EIP [r/m32]; 14068 FI; 14069FI; 14070 14071IF (PE = 0 OR (PE = 1 AND VM = 1)) 14072(* real mode or virtual 8086 mode *) 14073 AND instruction = far CALL 14074 (* i.e., operand type is m16:16, m16:32, ptr16:16, ptr16:32 *) 14075THEN 14076 IF OperandSize = 16 14077 THEN 14078 Push(CS); 14079 Push(IP); (* address of next instruction; 16 bits *) 14080 ELSE 14081 Push(CS); (* padded with 16 high-order bits *) 14082 Push(EIP); (* address of next instruction; 32 bits *) 14083 FI; 14084 IF operand type is m16:16 or m16:32 14085 THEN (* indirect far call *) 14086 IF OperandSize = 16 14087 THEN 14088 CS:IP [m16:16]; 14089 EIP EIP AND 0000FFFFH; (* clear upper 16 bits *) 14090 ELSE (* OperandSize = 32 *) 14091 CS:EIP [m16:32]; 14092 FI; 14093 FI; 14094 IF operand type is ptr16:16 or ptr16:32 14095 THEN (* direct far call *) 14096 IF OperandSize = 16 14097 THEN 14098 CS:IP ptr16:16; 14099 EIP EIP AND 0000FFFFH; (* clear upper 16 bits *) 14100 ELSE (* OperandSize = 32 *) 14101 CS:EIP ptr16:32; 14102 FI; 14103 FI; 14104FI; 14105 14106IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *) 14107 AND instruction = far CALL 14108THEN 14109 If indirect, then check access of EA doubleword; 14110 #GP(0) if limit violation; 14111 New CS selector must not be null else #GP(0); 14112 Check that new CS selector index is within its 14113 descriptor table limits; else #GP(new CS selector); 14114 Examine AR byte of selected descriptor for various legal values; 14115 depending on value: 14116 go to CONFORMING-CODE-SEGMENT; 14117 go to NONCONFORMING-CODE-SEGMENT; 14118 go to CALL-GATE; 14119 go to TASK-GATE; 14120 go to TASK-STATE-SEGMENT; 14121 ELSE #GP(code segment selector); 14122FI; 14123 14124CONFORMING-CODE-SEGMENT: 14125 DPL must be CPL ELSE #GP(code segment selector); 14126 Segment must be present ELSE #NP(code segment selector); 14127 Stack must be big enough for return address ELSE #SS(0); 14128 Instruction pointer must be in code segment limit ELSE #GP(0); 14129 Load code segment descriptor into CS register; 14130 Load CS with new code segment selector; 14131 Load EIP with zero-extend(new offset); 14132 IF OperandSize=16 THEN EIP EIP AND 0000FFFFH; FI; 14133 14134NONCONFORMING-CODE-SEGMENT: 14135 RPL must be CPL ELSE #GP(code segment selector) 14136 DPL must be = CPL ELSE #GP(code segment selector) 14137 Segment must be present ELSE #NP(code segment selector) 14138 Stack must be big enough for return address ELSE #SS(0) 14139 Instruction pointer must be in code segment limit ELSE #GP(0) 14140 Load code segment descriptor into CS register 14141 Load CS with new code segment selector 14142 Set RPL of CS to CPL 14143 Load EIP with zero-extend(new offset); 14144 IF OperandSize=16 THEN EIP EIP AND 0000FFFFH; FI; 14145 14146CALL-GATE: 14147 Call gate DPL must be CPL ELSE #GP(call gate selector) 14148 Call gate DPL must be RPL ELSE #GP(call gate selector) 14149 Call gate must be present ELSE #NP(call gate selector) 14150 Examine code segment selector in call gate descriptor: 14151 Selector must not be null ELSE #GP(0) 14152 Selector must be within its descriptor table 14153 limits ELSE #GP(code segment selector) 14154 AR byte of selected descriptor must indicate code 14155 segment ELSE #GP(code segment selector) 14156 DPL of selected descriptor must be CPL ELSE 14157 #GP(code segment selector) 14158 IF non-conforming code segment AND DPL < CPL 14159 THEN go to MORE-PRIVILEGE 14160 ELSE go to SAME-PRIVILEGE 14161 FI; 14162 14163MORE-PRIVILEGE: 14164 Get new SS selector for new privilege level from TSS 14165 Check selector and descriptor for new SS: 14166 Selector must not be null ELSE #TS(0) 14167 Selector index must be within its descriptor 14168 table limits ELSE #TS(SS selector) 14169 Selector's RPL must equal DPL of code segment 14170 ELSE #TS(SS selector) 14171 Stack segment DPL must equal DPL of code 14172 segment ELSE #TS(SS selector) 14173 Descriptor must indicate writable data segment 14174 ELSE #TS(SS selector) 14175 Segment present ELSE #SS(SS selector) 14176 IF OperandSize=32 14177 THEN 14178 New stack must have room for parameters plus 16 bytes 14179 ELSE #SS(0) 14180 EIP must be in code segment limit ELSE #GP(0) 14181 Load new SS:eSP value from TSS 14182 Load new CS:EIP value from gate 14183 ELSE 14184 New stack must have room for parameters plus 8 bytes ELSE #SS(0) 14185 IP must be in code segment limit ELSE #GP(0) 14186 Load new SS:eSP value from TSS 14187 Load new CS:IP value from gate 14188 FI; 14189 Load CS descriptor 14190 Load SS descriptor 14191 Push long pointer of old stack onto new stack 14192 Get word count from call gate, mask to 5 bits 14193 Copy parameters from old stack onto new stack 14194 Push return address onto new stack 14195 Set CPL to stack segment DPL 14196 Set RPL of CS to CPL 14197 14198SAME-PRIVILEGE: 14199 IF OperandSize=32 14200 THEN 14201 Stack must have room for 6-byte return address (padded to 8 bytes) 14202 ELSE #SS(0) 14203 EIP must be within code segment limit ELSE #GP(0) 14204 Load CS:EIP from gate 14205 ELSE 14206 Stack must have room for 4-byte return address ELSE #SS(0) 14207 IP must be within code segment limit ELSE #GP(0) 14208 Load CS:IP from gate 14209 FI; 14210 Push return address onto stack 14211 Load code segment descriptor into CS register 14212 Set RPL of CS to CPL 14213 14214TASK-GATE: 14215 Task gate DPL must be CPL ELSE #TS(gate selector) 14216 Task gate DPL must be RPL ELSE #TS(gate selector) 14217 Task Gate must be present ELSE #NP(gate selector) 14218 Examine selector to TSS, given in Task Gate descriptor: 14219 Must specify global in the local/global bit ELSE #TS(TSS selector) 14220 Index must be within GDT limits ELSE #TS(TSS selector) 14221 TSS descriptor AR byte must specify nonbusy TSS 14222 ELSE #TS(TSS selector) 14223 Task State Segment must be present ELSE #NP(TSS selector) 14224 SWITCH-TASKS (with nesting) to TSS 14225 IP must be in code segment limit ELSE #TS(0) 14226 14227TASK-STATE-SEGMENT: 14228 TSS DPL must be CPL else #TS(TSS selector) 14229 TSS DPL must be RPL ELSE #TS(TSS selector) 14230 TSS descriptor AR byte must specify available TSS 14231 ELSE #TS(TSS selector) 14232 Task State Segment must be present ELSE #NP(TSS selector) 14233 SWITCH-TASKS (with nesting) to TSS 14234 IP must be in code segment limit ELSE #TS(0) 14235 14236Description 14237 14238The CALL instruction causes the procedure named in the operand to be 14239executed. When the procedure is complete (a return instruction is executed 14240within the procedure), execution continues at the instruction that follows 14241the CALL instruction. 14242 14243The action of the different forms of the instruction are described below. 14244 14245Near calls are those with destinations of type r/m16, r/m32, rel16, rel32; 14246changing or saving the segment register value is not necessary. The CALL 14247rel16 and CALL rel32 forms add a signed offset to the address of the 14248instruction following CALL to determine the destination. The rel16 form is 14249used when the instruction's operand-size attribute is 16 bits; rel32 is used 14250when the operand-size attribute is 32 bits. The result is stored in the 1425132-bit EIP register. With rel16, the upper 16 bits of EIP are cleared, 14252resulting in an offset whose value does not exceed 16 bits. CALL r/m16 and 14253CALL r/m32 specify a register or memory location from which the absolute 14254segment offset is fetched. The offset fetched from r/m is 32 bits for an 14255operand-size attribute of 32 (r/m32), or 16 bits for an operand-size of 16 14256(r/m16). The offset of the instruction following CALL is pushed onto the 14257stack. It will be popped by a near RET instruction within the procedure. The 14258CS register is not changed by this form of CALL. 14259 14260The far calls, CALL ptr16:16 and CALL ptr16:32, use a four-byte or six-byte 14261operand as a long pointer to the procedure called. The CALL m16:16 and 14262m16:32 forms fetch the long pointer from the memory location 14263specified (indirection). In Real Address Mode or Virtual 8086 Mode, the long 14264pointer provides 16 bits for the CS register and 16 or 32 bits for the EIP 14265register (depending on the operand-size attribute). These forms of the 14266instruction push both CS and IP or EIP as a return address. 14267 14268In Protected Mode, both long pointer forms consult the AR byte in the 14269descriptor indexed by the selector part of the long pointer. Depending on 14270the value of the AR byte, the call will perform one of the following types 14271of control transfers: 14272 14273 A far call to the same protection level 14274 An inter-protection level far call 14275 A task switch 14276 14277For more information on Protected Mode control transfers, refer to 14278Chapter 6 and Chapter 7. 14279 14280Flags Affected 14281 14282All flags are affected if a task switch occurs; no flags are affected if a 14283task switch does not occur 14284 14285Protected Mode Exceptions 14286 14287For far calls: #GP, #NP, #SS, and #TS, as indicated in the list above 14288 14289For near direct calls: #GP(0) if procedure location is beyond the code 14290segment limits; #SS(0) if pushing the return address exceeds the bounds of 14291the stack segment; #PF (fault-code) for a page fault 14292 14293For a near indirect call: #GP(0) for an illegal memory operand effective 14294address in the CS, DS, ES, FS, or GS segments; #SS(0) for an illegal address 14295in the SS segment; #GP(0) if the indirect offset obtained is beyond the code 14296segment limits; #PF(fault-code) for a page fault 14297 14298Real Address Mode Exceptions 14299 14300Interrupt 13 if any part of the operand would lie outside of the effective 14301address space from 0 to 0FFFFH 14302 14303Virtual 8086 Mode Exceptions 14304 14305Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 14306 14307Notes 14308 14309Any far call from a 32-bit code segment to 16-bit code segments should be 14310made from the first 64K bytes of the 32-bit code segment, since the 14311operand-size attribute of the instruction is set to 16, thus allowing only a 1431216-bit return address offset to be saved. 14313 14314 14315CBW/CWDE Convert Byte to Word/Convert Word to Doubleword 14316 14317Opcode Instruction Clocks Description 14318 1431998 CBW 3 AX sign-extend of AL 1432098 CWDE 3 EAX sign-extend of AX 14321 14322 14323Operation 14324 14325IF OperandSize = 16 (* instruction = CBW *) 14326THEN AX SignExtend(AL); 14327ELSE (* OperandSize = 32, instruction = CWDE *) 14328 EAX SignExtend(AX); 14329FI; 14330 14331Description 14332 14333CBW converts the signed byte in AL to a signed word in AX by extending the 14334most significant bit of AL (the sign bit) into all of the bits of AH. CWDE 14335converts the signed word in AX to a doubleword in EAX by extending the most 14336significant bit of AX into the two most significant bytes of EAX. Note that 14337CWDE is different from CWD. CWD uses DX:AX rather than EAX as a destination. 14338 14339Flags Affected 14340 14341None 14342 14343Protected Mode Exceptions 14344 14345None 14346 14347Real Address Mode Exceptions 14348 14349None 14350 14351Virtual 8086 Mode Exceptions 14352 14353None 14354 14355 14356CLC Clear Carry Flag 14357 14358Opcode Instruction Clocks Description 14359 14360F8 CLC 2 Clear carry flag 14361 14362 14363Operation 14364 14365CF 0; 14366 14367Description 14368 14369CLC sets the carry flag to zero. It does not affect other flags or 14370registers. 14371 14372Flags Affected 14373 14374CF = 0 14375 14376Protected Mode Exceptions 14377 14378None 14379 14380Real Address Mode Exceptions 14381 14382None 14383 14384Virtual 8086 Mode Exceptions 14385 14386None 14387 14388 14389CLD Clear Direction Flag 14390 14391Opcode Instruction Clocks Description 14392 14393FC CLD 2 Clear direction flag; SI and DI 14394 will increment during string 14395 instructions 14396 14397 14398Operation 14399 14400DF 0; 14401 14402Description 14403 14404CLD clears the direction flag. No other flags or registers are affected. 14405After CLD is executed, string operations will increment the index registers 14406(SI and/or DI) that they use. 14407 14408Flags Affected 14409 14410DF = 0 14411 14412Protected Mode Exceptions 14413 14414None 14415 14416Real Address Mode Exceptions 14417 14418None 14419 14420Virtual 8086 Mode Exceptions 14421 14422None 14423 14424 14425CLI Clear Interrupt Flag 14426 14427Opcode Instruction Clocks Description 14428 14429FA CLI 3 Clear interrupt flag; interrupts disabled 14430 14431 14432Operation 14433 14434IF 0; 14435 14436Description 14437 14438CLI clears the interrupt flag if the current privilege level is at least as 14439privileged as IOPL. No other flags are affected. External interrupts are not 14440recognized at the end of the CLI instruction or from that point on until the 14441interrupt flag is set. 14442 14443Flags Affected 14444 14445IF = 0 14446 14447Protected Mode Exceptions 14448 14449#GP(0) if the current privilege level is greater (has less privilege) than 14450the IOPL in the flags register. IOPL specifies the least privileged level at 14451which I/O can be performed. 14452 14453Real Address Mode Exceptions 14454 14455None 14456 14457Virtual 8086 Mode Exceptions 14458 14459#GP(0) as for Protected Mode 14460 14461 14462CLTS Clear Task-Switched Flag in CR0 14463 14464Opcode Instruction Clocks Description 14465 14466OF 06 CLTS 5 Clear task-switched flag 14467 14468 14469Operation 14470 14471TS Flag in CR0 0; 14472 14473Description 14474 14475CLTS clears the task-switched (TS) flag in register CR0. This flag is set by 14476the 80386 every time a task switch occurs. The TS flag is used to manage 14477processor extensions as follows: 14478 14479 Every execution of an ESC instruction is trapped if the TS flag is set. 14480 14481 Execution of a WAIT instruction is trapped if the MP flag and the TS 14482 flag are both set. 14483 14484Thus, if a task switch was made after an ESC instruction was begun, the 14485processor extension's context may need to be saved before a new ESC 14486instruction can be issued. The fault handler saves the context and resets 14487the TS flag. 14488 14489CLTS appears in operating system software, not in application programs. It 14490is a privileged instruction that can only be executed at privilege level 0. 14491 14492Flags Affected 14493 14494TS = 0 (TS is in CR0, not the flag register) 14495 14496Protected Mode Exceptions 14497 14498#GP(0) if CLTS is executed with a current privilege level other than 0 14499 14500Real Address Mode Exceptions 14501 14502None (valid in Real Address Mode to allow initialization for Protected 14503Mode) 14504 14505Virtual 8086 Mode Exceptions 14506 14507Same exceptions as in Real Address Mode 14508 14509 14510CMC Complement Carry Flag 14511 14512Opcode Instruction Clocks Description 14513 14514F5 CMC 2 Complement carry flag 14515 14516 14517Operation 14518 14519CF NOT CF; 14520 14521Description 14522 14523CMC reverses the setting of the carry flag. No other flags are affected. 14524 14525Flags Affected 14526 14527CF as described above 14528 14529Protected Mode Exceptions 14530 14531None 14532 14533Real Address Mode Exceptions 14534 14535None 14536 14537Virtual 8086 Mode Exceptions 14538 14539None 14540 14541 14542CMP Compare Two Operands 14543 14544 14545Opcode Instruction Clocks Description 14546 145473C ib CMP AL,imm8 2 Compare immediate byte to AL 145483D iw CMP AX,imm16 2 Compare immediate word to AX 145493D id CMP EAX,imm32 2 Compare immediate dword to EAX 1455080 /7 ib CMP r/m8,imm8 2/5 Compare immediate byte to r/m 14551 byte 1455281 /7 iw CMP r/m16,imm16 2/5 Compare immediate word to r/m 14553 word 1455481 /7 id CMP r/m32,imm32 2/5 Compare immediate dword to r/m 14555 dword 1455683 /7 ib CMP r/m16,imm8 2/5 Compare sign extended immediate 14557 byte to r/m word 1455883 /7 ib CMP r/m32,imm8 2/5 Compare sign extended immediate 14559 byte to r/m dword 1456038 /r CMP r/m8,r8 2/5 Compare byte register to r/m 14561 byte 1456239 /r CMP r/m16,r16 2/5 Compare word register to r/m 14563 word 1456439 /r CMP r/m32,r32 2/5 Compare dword register to r/m 14565 dword 145663A /r CMP r8,r/m8 2/6 Compare r/m byte to byte 14567 register 145683B /r CMP r16,r/m16 2/6 Compare r/m word to word 14569 register 145703B /r CMP r32,r/m32 2/6 Compare r/m dword to dword 14571 register 14572 14573 14574Operation 14575 14576LeftSRC - SignExtend(RightSRC); 14577(* CMP does not store a result; its purpose is to set the flags *) 14578 14579Description 14580 14581CMP subtracts the second operand from the first but, unlike the SUB 14582instruction, does not store the result; only the flags are changed. CMP is 14583typically used in conjunction with conditional jumps and the SETcc 14584instruction. (Refer to Appendix D for the list of signed and unsigned flag 14585tests provided.) If an operand greater than one byte is compared to an 14586immediate byte, the byte value is first sign-extended. 14587 14588Flags Affected 14589 14590OF, SF, ZF, AF, PF, and CF as described in Appendix C 14591 14592Protected Mode Exceptions 14593 14594#GP(0) for an illegal memory operand effective address in the CS, DS, ES, 14595FS, or GS segments; #SS(0) for an illegal address in the SS segment; 14596#PF(fault-code) for a page fault 14597 14598Real Address Mode Exceptions 14599 14600Interrupt 13 if any part of the operand would lie outside of the effective 14601address space from 0 to 0FFFFH 14602 14603Virtual 8086 Mode Exceptions 14604 14605Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 14606 14607 14608CMPS/CMPSB/CMPSW/CMPSD Compare String Operands 14609 14610Opcode Instruction Clocks Description 14611 14612A6 CMPS m8,m8 10 Compare bytes ES:[(E)DI] (second 14613 operand) with [(E)SI] (first 14614 operand) 14615A7 CMPS m16,m16 10 Compare words ES:[(E)DI] (second 14616 operand) with [(E)SI] (first 14617 operand) 14618A7 CMPS m32,m32 10 Compare dwords ES:[(E)DI] 14619 (second operand) with [(E)SI] 14620 (first operand) 14621A6 CMPSB 10 Compare bytes ES:[(E)DI] with 14622 DS:[SI] 14623A7 CMPSW 10 Compare words ES:[(E)DI] with 14624 DS:[SI] 14625A7 CMPSD 10 Compare dwords ES:[(E)DI] with 14626 DS:[SI] 14627 14628 14629Operation 14630 14631IF (instruction = CMPSD) OR 14632 (instruction has operands of type DWORD) 14633THEN OperandSize 32; 14634ELSE OperandSize 16; 14635FI; 14636IF AddressSize = 16 14637THEN 14638 use SI for source-index and DI for destination-index 14639ELSE (* AddressSize = 32 *) 14640 use ESI for source-index and EDI for destination-index; 14641FI; 14642IF byte type of instruction 14643THEN 14644 [source-index] - [destination-index]; (* byte comparison *) 14645 IF DF = 0 THEN IncDec 1 ELSE IncDec -1; FI; 14646ELSE 14647 IF OperandSize = 16 14648 THEN 14649 [source-index] - [destination-index]; (* word comparison *) 14650 IF DF = 0 THEN IncDec 2 ELSE IncDec -2; FI; 14651 ELSE (* OperandSize = 32 *) 14652 [source-index] - [destination-index]; (* dword comparison *) 14653 IF DF = 0 THEN IncDec 4 ELSE IncDec -4; FI; 14654 FI; 14655FI; 14656source-index = source-index + IncDec; 14657destination-index = destination-index + IncDec; 14658 14659Description 14660 14661CMPS compares the byte, word, or doubleword pointed to by the source-index 14662register with the byte, word, or doubleword pointed to by the 14663destination-index register. 14664 14665If the address-size attribute of this instruction is 16 bits, SI and DI 14666will be used for source- and destination-index registers; otherwise ESI and 14667EDI will be used. Load the correct index values into SI and DI (or ESI and 14668EDI) before executing CMPS. 14669 14670The comparison is done by subtracting the operand indexed by 14671the destination-index register from the operand indexed by the source-index 14672register. 14673 14674Note that the direction of subtraction for CMPS is [SI] - [DI] or 14675[ESI] - [EDI]. The left operand (SI or ESI) is the source and the right 14676operand (DI or EDI) is the destination. This is the reverse of the usual 14677Intel convention in which the left operand is the destination and the right 14678operand is the source. 14679 14680The result of the subtraction is not stored; only the flags reflect the 14681change. The types of the operands determine whether bytes, words, or 14682doublewords are compared. For the first operand (SI or ESI), the DS register 14683is used, unless a segment override byte is present. The second operand (DI 14684or EDI) must be addressable from the ES register; no segment override is 14685possible. 14686 14687After the comparison is made, both the source-index register and 14688destination-index register are automatically advanced. If the direction flag 14689is 0 (CLD was executed), the registers increment; if the direction flag is 1 14690(STD was executed), the registers decrement. The registers increment or 14691decrement by 1 if a byte is compared, by 2 if a word is compared, or by 4 if 14692a doubleword is compared. 14693 14694CMPSB, CMPSW and CMPSD are synonyms for the byte, word, and 14695doubleword CMPS instructions, respectively. 14696 14697CMPS can be preceded by the REPE or REPNE prefix for block comparison of CX 14698or ECX bytes, words, or doublewords. Refer to the description of the REP 14699instruction for more information on this operation. 14700 14701Flags Affected 14702 14703OF, SF, ZF, AF, PF, and CF as described in Appendix C 14704 14705Protected Mode Exceptions 14706 14707#GP(0) for an illegal memory operand effective address in the CS, DS, ES, 14708FS, or GS segments; #SS(0) for an illegal address in the SS segment; 14709#PF(fault-code) for a page fault 14710 14711Real Address Mode Exceptions 14712 14713Interrupt 13 if any part of the operand would lie outside of the effective 14714address space from 0 to 0FFFFH 14715 14716Virtual 8086 Mode Exceptions 14717 14718Same exceptions as in Real Address Mode; #PF (fault-code) for a page fault 14719 14720 14721CWD/CDQ Convert Word to Doubleword/Convert Doubleword to 14722 Quadword 14723 14724Opcode Instruction Clocks Description 14725 1472699 CWD 2 DX:AX sign-extend of AX 1472799 CDQ 2 EDX:EAX sign-extend of EAX 14728 14729 14730Operation 14731 14732IF OperandSize = 16 (* CWD instruction *) 14733THEN 14734 IF AX < 0 THEN DX 0FFFFH; ELSE DX 0; FI; 14735ELSE (* OperandSize = 32, CDQ instruction *) 14736 IF EAX < 0 THEN EDX 0FFFFFFFFH; ELSE EDX 0; FI; 14737FI; 14738 14739Description 14740 14741CWD converts the signed word in AX to a signed doubleword in DX:AX 14742by extending the most significant bit of AX into all the bits of DX. CDQ 14743converts the signed doubleword in EAX to a signed 64-bit integer in the 14744register pair EDX:EAX by extending the most significant bit of EAX 14745(the sign bit) into all the bits of EDX. Note that CWD is different from 14746CWDE. CWDE uses EAX as a destination, instead of DX:AX. 14747 14748Flags Affected 14749 14750None 14751 14752Protected Mode Exceptions 14753 14754None 14755 14756Real Address Mode Exceptions 14757 14758None 14759 14760Virtual 8086 Mode Exceptions 14761 14762None 14763 14764 14765DAA Decimal Adjust AL after Addition 14766 14767Opcode Instruction Clocks Description 14768 1476927 DAA 4 Decimal adjust AL after addition 14770 14771 14772Operation 14773 14774IF ((AL AND 0FH) > 9) OR (AF = 1) 14775THEN 14776 AL AL + 6; 14777 AF 1; 14778ELSE 14779 AF 0; 14780FI; 14781IF (AL > 9FH) OR (CF = 1) 14782THEN 14783 AL AL + 60H; 14784 CF 1; 14785ELSE CF 0; 14786FI; 14787 14788Description 14789 14790Execute DAA only after executing an ADD instruction that leaves a 14791two-BCD-digit byte result in the AL register. The ADD operands should 14792consist of two packed BCD digits. The DAA instruction adjusts AL to 14793contain the correct two-digit packed decimal result. 14794 14795Flags Affected 14796 14797AF and CF as described above; SF, ZF, PF, and CF as described in 14798Appendix C. 14799 14800Protected Mode Exceptions 14801 14802None 14803 14804Real Address Mode Exceptions 14805 14806None 14807 14808Virtual 8086 Mode Exceptions 14809 14810None 14811 14812 14813DAS Decimal Adjust AL after Subtraction 14814 14815Opcode Instruction Clocks Description 14816 148172F DAS 4 Decimal adjust AL after subtraction 14818 14819 14820Operation 14821 14822IF (AL AND 0FH) > 9 OR AF = 1 14823THEN 14824 AL AL - 6; 14825 AF 1; 14826ELSE 14827 AF 0; 14828FI; 14829IF (AL > 9FH) OR (CF = 1) 14830THEN 14831 AL AL - 60H; 14832 CF 1; 14833ELSE CF 0; 14834FI; 14835 14836Description 14837 14838Execute DAS only after a subtraction instruction that leaves a 14839two-BCD-digit byte result in the AL register. The operands should consist 14840of two packed BCD digits. DAS adjusts AL to contain the correct packed 14841two-digit decimal result. 14842 14843Flags Affected 14844 14845AF and CF as described above; SF, ZF, and PF as described in Appendix C. 14846 14847Protected Mode Exceptions 14848 14849None 14850 14851Real Address Mode Exceptions 14852 14853None 14854 14855Virtual 8086 Mode Exceptions 14856 14857None 14858 14859 14860DEC Decrement by 1 14861 14862Opcode Instruction Clocks Description 14863 14864FE /1 DEC r/m8 2/6 Decrement r/m byte by 1 14865FF /1 DEC r/m16 2/6 Decrement r/m word by 1 14866 DEC r/m32 2/6 Decrement r/m dword by 1 1486748+rw DEC r16 2 Decrement word register by 1 1486848+rw DEC r32 2 Decrement dword register by 1 14869 14870 14871Operation 14872 14873DEST DEST - 1; 14874 14875Description 14876 14877DEC subtracts 1 from the operand. DEC does not change the carry flag. 14878To affect the carry flag, use the SUB instruction with an immediate 14879operand of 1. 14880 14881Flags Affected 14882 14883OF, SF, ZF, AF, and PF as described in Appendix C. 14884 14885Protected Mode Exceptions 14886 14887#GP(0) if the result is a nonwritable segment; #GP(0) for an illegal 14888memory operand effective address in the CS, DS, ES, FS, or GS 14889segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 14890for a page fault 14891 14892Real Address Mode Exceptions 14893 14894Interrupt 13 if any part of the operand would lie outside of the effective 14895address space from 0 to 0FFFFH 14896 14897Virtual 8086 Mode Exceptions 14898 14899Same exceptions as in Real Address Mode; #PF(fault-code) for a page 14900fault 14901 14902 14903DIV Unsigned Divide 14904 14905Opcode Instruction Clocks Description 14906 14907F6 /6 DIV AL,r/m8 14/17 Unsigned divide AX by r/m byte 14908 (AL=Quo, AH=Rem) 14909F7 /6 DIV AX,r/m16 22/25 Unsigned divide DX:AX by r/m 14910 word (AX=Quo, DX=Rem) 14911F7 /6 DIV EAX,r/m32 38/41 Unsigned divide EDX:EAX by r/m 14912 dword (EAX=Quo, EDX=Rem) 14913 14914 14915Operation 14916 14917temp dividend / divisor; 14918IF temp does not fit in quotient 14919THEN Interrupt 0; 14920ELSE 14921 quotient temp; 14922 remainder dividend MOD (r/m); 14923FI; 14924 14925 14926Note: 14927 Divisions are unsigned. The divisor is given by the r/m operand. 14928 The dividend, quotient, and remainder use implicit registers. Refer to 14929 the table under "Description." 14930 14931 14932Description 14933 14934DIV performs an unsigned division. The dividend is implicit; only the 14935divisor is given as an operand. The remainder is always less than the 14936divisor. The type of the divisor determines which registers to use as 14937follows: 14938 14939 Size Dividend Divisor Quotient Remainder 14940 byte AX r/m8 AL AH 14941 word DX:AX r/m16 AX DX 14942 dword EDX:EAX r/m32 EAX EDX 14943 14944Flags Affected 14945 14946OF, SF, ZF, AR, PF, CF are undefined. 14947 14948Protected Mode Exceptions 14949 14950Interrupt 0 if the quotient is too large to fit in the designated register 14951(AL, AX, or EAX), or if the divisor is 0; #GP(0) for an illegal memory 14952operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) 14953for an illegal address in the SS segment; #PF(fault-code) for a page fault 14954 14955Real Address Mode Exceptions 14956 14957Interrupt 0 if the quotient is too big to fit in the designated register 14958(AL, AX, or EAX), or if the divisor is 0; Interrupt 13 if any part of the 14959operand would lie outside of the effective address space from 0 to 0FFFFH 14960 14961Virtual 8086 Mode Exceptions 14962 14963Same exceptions as in Real Address Mode; #PF(fault-code) for a page 14964fault 14965 14966 14967ENTER Make Stack Frame for Procedure Parameters 14968 14969Opcode Instruction Clocks Description 14970 14971C8 iw 00 ENTER imm16,0 10 Make procedure stack frame 14972C8 iw 01 ENTER imm16,1 12 Make stack frame for procedure 14973 parameters 14974C8 iw ib ENTER imm16,imm8 15+4(n-1) Make stack frame for 14975 procedure parameters 14976 14977 14978Operation 14979 14980level level MOD 32 14981IF OperandSize = 16 THEN Push(BP) ELSE Push (EBP) FI; 14982 (* Save stack pointer *) 14983frame-ptr eSP 14984IF level > 0 14985THEN (* level is rightmost parameter *) 14986 FOR i 1 TO level - 1 14987 DO 14988 IF OperandSize = 16 14989 THEN 14990 BP BP - 2; 14991 Push[BP] 14992 ELSE (* OperandSize = 32 *) 14993 EBP EBP - 4; 14994 Push[EBP]; 14995 FI; 14996 OD; 14997 Push(frame-ptr) 14998FI; 14999IF OperandSize = 16 THEN BP frame-ptr ELSE EBP frame-ptr; FI; 15000IF StackAddrSize = 16 15001THEN SP SP - First operand; 15002ELSE ESP ESP - ZeroExtend(First operand); 15003FI; 15004 15005Description 15006 15007ENTER creates the stack frame required by most block-structured 15008high-level languages. The first operand specifies the number of bytes of 15009dynamic storage allocated on the stack for the routine being entered. 15010The second operand gives the lexical nesting level (0 to 31) of the routine 15011within the high-level language source code. It determines the number of 15012stack frame pointers copied into the new stack frame from the preceding 15013frame. BP (or EBP, if the operand-size attribute is 32 bits) is the current 15014stack frame pointer. 15015 15016If the operand-size attribute is 16 bits, the processor uses BP as the 15017frame pointer and SP as the stack pointer. If the operand-size attribute is 1501832 bits, the processor uses EBP for the frame pointer and ESP for the stack 15019pointer. 15020 15021If the second operand is 0, ENTER pushes the frame pointer (BP or 15022EBP) onto the stack; ENTER then subtracts the first operand from the 15023stack pointer and sets the frame pointer to the current stack-pointer 15024value. 15025 15026For example, a procedure with 12 bytes of local variables would have an 15027ENTER 12,0 instruction at its entry point and a LEAVE instruction 15028before every RET. The 12 local bytes would be addressed as negative 15029offsets from the frame pointer. 15030 15031Flags Affected 15032 15033None 15034 15035Protected Mode Exceptions 15036 15037#SS(0) if SP or ESP would exceed the stack limit at any point during 15038instruction execution; #PF(fault-code) for a page fault 15039 15040Real Address Mode Exceptions 15041 15042None 15043 15044Virtual 8086 Mode Exceptions 15045 15046None 15047 15048 15049HLT Halt 15050 15051Opcode Instruction Clocks Description 15052 15053F4 HLT 5 Halt 15054 15055 15056Operation 15057 15058Enter Halt state; 15059 15060Description 15061 15062HALT stops instruction execution and places the 80386 in a HALT state. 15063An enabled interrupt, NMI, or a reset will resume execution. If an 15064interrupt (including NMI) is used to resume execution after HLT, the saved 15065CS:IP (or CS:EIP) value points to the instruction following HLT. 15066 15067Flags Affected 15068 15069None 15070 15071Protected Mode Exceptions 15072 15073HLT is a privileged instruction; #GP(0) if the current privilege level is 15074not 0 15075 15076Real Address Mode Exceptions 15077 15078None 15079 15080Virtual 8086 Mode Exceptions 15081 15082#GP(0); HLT is a privileged instruction 15083 15084 15085IDIV Signed Divide 15086 15087Opcode Instruction Clocks Description 15088 15089F6 /7 IDIV r/m8 19 Signed divide AX by r/m byte 15090 (AL=Quo, AH=Rem) 15091F7 /7 IDIV AX,r/m16 27 Signed divide DX:AX by EA word 15092 (AX=Quo, DX=Rem) 15093F7 /7 IDIV EAX,r/m32 43 Signed divide EDX:EAX by DWORD 15094 byte (EAX=Quo, EDX=Rem) 15095 15096 15097Operation 15098 15099temp dividend / divisor; 15100IF temp does not fit in quotient 15101THEN Interrupt 0; 15102ELSE 15103 quotient temp; 15104 remainder dividend MOD (r/m); 15105FI; 15106 15107 15108Notes: 15109 Divisions are signed. The divisor is given by the r/m operand. The 15110 dividend, quotient, and remainder use implicit registers. Refer to the 15111 table under "Description." 15112 15113 15114Description 15115 15116IDIV performs a signed division. The dividend, quotient, and remainder 15117are implicitly allocated to fixed registers. Only the divisor is given as 15118an explicit r/m operand. The type of the divisor determines which registers 15119to use as follows: 15120 15121Size Divisor Quotient Remainder Dividend 15122byte r/m8 AL AH AX 15123word r/m16 AX DX DX:AX 15124dword r/m32 EAX EDX EDX:EAX 15125 15126If the resulting quotient is too large to fit in the destination, or if the 15127division is 0, an Interrupt 0 is generated. Nonintegral quotients are 15128truncated toward 0. The remainder has the same sign as the dividend 15129and the absolute value of the remainder is always less than the absolute 15130value of the divisor. 15131 15132Flags Affected 15133 15134OF, SF, ZF, AR, PF, CF are undefined. 15135 15136Protected Mode Exceptions 15137 15138Interrupt 0 if the quotient is too large to fit in the designated register 15139(AL or AX), or if the divisor is 0; #GP (0) for an illegal memory operand 15140effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an 15141illegal address in the SS segment; #PF(fault-code) for a page fault 15142 15143Real Address Mode Exceptions 15144 15145Interrupt 0 if the quotient is too large to fit in the designated register 15146(AL or AX), or if the divisor is 0; Interrupt 13 if any part of the operand 15147would lie outside of the effective address space from 0 to 0FFFFH 15148 15149Virtual 8086 Mode Exceptions 15150 15151Same exceptions as in Real Address Mode; #PF(fault-code) for a page 15152fault 15153 15154 15155IMUL Signed Multiply 15156 15157 15158Opcode Instruction Clocks Description 15159 15160F6 /5 IMUL r/m8 9-14/12-17 AX AL * r/m byte 15161F7 /5 IMUL r/m16 9-22/12-25 DX:AX AX * r/m word 15162F7 /5 IMUL r/m32 9-38/12-41 EDX:EAX EAX * r/m dword 151630F AF /r IMUL r16,r/m16 9-22/12-25 word register word 15164 register * r/m word 151650F AF /r IMUL r32,r/m32 9-38/12-41 dword register dword 15166 register * r/m dword 151676B /r ib IMUL r16,r/m16,imm8 9-14/12-17 word register r/m16 * 15168 sign-extended immediate byte 151696B /r ib IMUL r32,r/m32,imm8 9-14/12-17 dword register r/m32 * 15170 sign-extended immediate byte 151716B /r ib IMUL r16,imm8 9-14/12-17 word register word 15172 register * sign-extended 15173 immediate byte 151746B /r ib IMUL r32,imm8 9-14/12-17 dword register dword 15175 register * sign-extended 15176 immediate byte 1517769 /r iw IMUL r16,r/m16,imm16 9-22/12-25 word register r/m16 * 15178 immediate word 1517969 /r id IMUL r32,r/m32,imm32 9-38/12-41 dword register r/m32 * 15180 immediate dword 1518169 /r iw IMUL r16,imm16 9-22/12-25 word register r/m16 * 15182 immediate word 1518369 /r id IMUL r32,imm32 9-38/12-41 dword register r/m32 * 15184 immediate dword 15185 15186 15187 15188NOTES: 15189 The 80386 uses an early-out multiply algorithm. The actual number of 15190 clocks depends on the position of the most significant bit in the 15191 optimizing multiplier, shown underlined above. The optimization occurs for 15192 positive and negative values. Because of the early-out algorithm, clock 15193 counts given are minimum to maximum. To calculate the actual clocks, use 15194 the following formula: 15195 15196 15197 Actual clock = if m <> 0 then max(ceiling(log{2} m), 3) + 6 clocks 15198 Actual clock = if m = 0 then 9 clocks 15199 (where m is the multiplier) 15200 15201Add three clocks if the multiplier is a memory operand. 15202 15203Operation 15204 15205result multiplicand * multiplier; 15206 15207Description 15208 15209IMUL performs signed multiplication. Some forms of the instruction 15210use implicit register operands. The operand combinations for all forms 15211of the instruction are shown in the "Description" column above. 15212 15213IMUL clears the overflow and carry flags under the following conditions: 15214 15215 Instruction Form Condition for Clearing CF and OF 15216 r/m8 AL = sign-extend of AL to 16 bits 15217 r/m16 AX = sign-extend of AX to 32 bits 15218 r/m32 EDX:EAX = sign-extend of EAX to 32 bits 15219 r16,r/m16 Result exactly fits within r16 15220 r/32,r/m32 Result exactly fits within r32 15221 r16,r/m16,imm16 Result exactly fits within r16 15222 r32,r/m32,imm32 Result exactly fits within r32 15223 15224Flags Affected 15225 15226OF and CF as described above; SF, ZF, AF, and PF are undefined 15227 15228Protected Mode Exceptions 15229 15230#GP(0) for an illegal memory operand effective address in the CS, DS, 15231ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 15232#PF(fault-code) for a page fault 15233 15234Real Address Mode Exceptions 15235 15236Interrupt 13 if any part of the operand would lie outside of the effective 15237address space from 0 to 0FFFFH 15238 15239Virtual 8086 Mode Exceptions 15240 15241Same exeptions as in Real Address Mode; #PF(fault-code) for a page 15242fault 15243 15244Notes 15245 15246When using the accumulator forms (IMUL r/m8, IMUL r/m16, or IMUL 15247r/m32), the result of the multiplication is available even if the overflow 15248flag is set because the result is two times the size of the multiplicand 15249and multiplier. This is large enough to handle any possible result. 15250 15251 15252IN Input from Port 15253 15254Opcode Instruction Clocks Description 15255 15256E4 ib IN AL,imm8 12,pm=6*/26** Input byte from immediate port 15257 into AL 15258E5 ib IN AX,imm8 12,pm=6*/26** Input word from immediate port 15259 into AX 15260E5 ib IN EAX,imm8 12,pm=6*/26** Input dword from immediate port 15261 into EAX 15262EC IN AL,DX 13,pm=7*/27** Input byte from port DX into AL 15263ED IN AX,DX 13,pm=7*/27** Input word from port DX into AX 15264ED IN EAX,DX 13,pm=7*/27** Input dword from port DX into 15265 EAX 15266 15267 15268 15269NOTES: 15270 *If CPL IOPL 15271 **If CPL > IOPL or if in virtual 8086 mode 15272 15273 15274Operation 15275 15276IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) 15277THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) 15278 IF NOT I-O-Permission (SRC, width(SRC)) 15279 THEN #GP(0); 15280 FI; 15281FI; 15282DEST [SRC]; (* Reads from I/O address space *) 15283 15284Description 15285 15286IN transfers a data byte or data word from the port numbered by the 15287second operand into the register (AL, AX, or EAX) specified by the first 15288operand. Access any port from 0 to 65535 by placing the port number 15289in the DX register and using an IN instruction with DX as the second 15290parameter. These I/O instructions can be shortened by using an 8-bit 15291port I/O in the instruction. The upper eight bits of the port address will 15292be 0 when 8-bit port I/O is used. 15293 15294Flags Affected 15295 15296None 15297 15298Protected Mode Exceptions 15299 15300#GP(0) if the current privilege level is larger (has less privilege) than 15301IOPL and any of the corresponding I/O permission bits in TSS equals 1 15302 15303Real Address Mode Exceptions 15304 15305None 15306 15307Virtual 8086 Mode Exceptions 15308 15309#GP(0) fault if any of the corresponding I/O permission bits in TSS 15310equals 1 15311 15312 15313INC Increment by 1 15314 15315Opcode Instruction Clocks Description 15316 15317FE /0 INC r/m8 Increment r/m byte by 1 15318FF /0 INC r/m16 Increment r/m word by 1 15319FF /6 INC r/m32 Increment r/m dword by 1 1532040 + rw INC r16 Increment word register by 1 1532140 + rd INC r32 Increment dword register by 1 15322 15323 15324Operation 15325 15326DEST DEST + 1; 15327 15328Description 15329 15330INC adds 1 to the operand. It does not change the carry flag. To affect 15331the carry flag, use the ADD instruction with a second operand of 1. 15332 15333Flags Affected 15334 15335OF, SF, ZF, AF, and PF as described in Appendix C 15336 15337Protected Mode Exceptions 15338 15339#GP(0) if the operand is in a nonwritable segment; #GP(0) for an illegal 15340memory operand effective address in the CS, DS, ES, FS, or GS 15341segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 15342for a page fault 15343 15344Real Address Mode Exceptions 15345 15346Interrupt 13 if any part of the operand would lie outside of the effective 15347address space from 0 to 0FFFFH 15348 15349Virtual 8086 Mode Exceptions 15350 15351Same exceptions as in Real Address Mode; #PF(fault-code) for a page 15352fault 15353 15354 15355INS/INSB/INSW/INSD Input from Port to String 15356 15357Opcode Instruction Clocks Description 15358 153596C INS r/m8,DX 15,pm=9*/29** Input byte from port DX into ES:(E)DI 153606D INS r/m16,DX 15,pm=9*/29** Input word from port DX into ES:(E)DI 153616D INS r/m32,DX 15,pm=9*/29** Input dword from port DX into ES:(E)DI 153626C INSB 15,pm=9*/29** Input byte from port DX into ES:(E)DI 153636D INSW 15,pm=9*/29** Input word from port DX into ES:(E)DI 153646D INSD 15,pm=9*/29** Input dword from port DX into ES:(E)DI 15365 15366 15367 15368NOTES: 15369 *If CPL IOPL 15370 **If CPL > IOPL or if in virtual 8086 mode 15371 15372 15373Operation 15374 15375IF AddressSize = 16 15376THEN use DI for dest-index; 15377ELSE (* AddressSize = 32 *) 15378 use EDI for dest-index; 15379FI; 15380IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) 15381THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) 15382 IF NOT I-O-Permission (SRC, width(SRC)) 15383 THEN #GP(0); 15384 FI; 15385FI; 15386IF byte type of instruction 15387THEN 15388 ES:[dest-index] [DX]; (* Reads byte at DX from I/O address space *) 15389 IF DF = 0 THEN IncDec 1 ELSE IncDec -1; FI; 15390FI; 15391IF OperandSize = 16 15392THEN 15393 ES:[dest-index] [DX]; (* Reads word at DX from I/O address space *) 15394 IF DF = 0 THEN IncDec 2 ELSE IncDec -2; FI; 15395FI; 15396IF OperandSize = 32 15397THEN 15398 ES:[dest-index] [DX]; (* Reads dword at DX from I/O address space *) 15399 IF DF = 0 THEN IncDec 4 ELSE IncDec -4; FI; 15400FI; 15401dest-index dest-index + IncDec; 15402 15403Description 15404 15405INS transfers data from the input port numbered by the DX register to 15406the memory byte or word at ES:dest-index. The memory operand must 15407be addressable from ES; no segment override is possible. The destination 15408register is DI if the address-size attribute of the instruction is 16 bits, 15409or EDI if the address-size attribute is 32 bits. 15410 15411INS does not allow the specification of the port number as an immediate 15412value. The port must be addressed through the DX register value. Load 15413the correct value into DX before executing the INS instruction. 15414 15415The destination address is determined by the contents of the destination 15416index register. Load the correct index into the destination index register 15417before executing INS. 15418 15419After the transfer is made, DI or EDI advances automatically. If the 15420direction flag is 0 (CLD was executed), DI or EDI increments; if the 15421direction flag is 1 (STD was executed), DI or EDI decrements. DI 15422increments or decrements by 1 if a byte is input, by 2 if a word is input, 15423or by 4 if a doubleword is input. 15424 15425INSB, INSW and INSD are synonyms of the byte, word, and doubleword 15426INS instructions. INS can be preceded by the REP prefix for block input of 15427CX bytes or words. Refer to the REP instruction for details of this 15428operation. 15429 15430Flags Affected 15431 15432None 15433 15434Protected Mode Exceptions 15435 15436#GP(0) if CPL is numerically greater than IOPL and any of the 15437corresponding I/O permission bits in TSS equals 1; #GP(0) if the 15438destination is in a nonwritable segment; #GP(0) for an illegal memory 15439operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for 15440an illegal address in the SS segment; #PF(fault-code) for a page fault 15441 15442Real Address Mode Exceptions 15443 15444Interrupt 13 if any part of the operand would lie outside of the effective 15445address space from 0 to 0FFFFH 15446 15447Virtual 8086 Mode Exceptions 15448 15449#GP(0) fault if any of the corresponding I/O permission bits in TSS 15450equals 1; #PF(fault-code) for a page fault 15451 15452 15453INT/INTO Call to Interrupt Procedure 15454 15455 15456Opcode Instruction Clocks Description 15457 15458CC INT 3 33 Interrupt 3--trap to debugger 15459CC INT 3 pm=59 Interrupt 3--Protected Mode, same 15460 privilege 15461CC INT 3 pm=99 Interrupt 3--Protected Mode, more 15462 privilege 15463CC INT 3 pm=119 Interrupt 3--from V86 mode to PL 0 15464CC INT 3 ts Interrupt 3--Protected Mode, via 15465 task gate 15466CD ib INT imm8 37 Interrupt numbered by immediate 15467 byte 15468CD ib INT imm8 pm=59 Interrupt--Protected Mode, same 15469 privilege 15470CD ib INT imm8 pm=99 Interrupt--Protected Mode, more 15471 privilege 15472CD ib INT imm8 pm=119 Interrupt--from V86 mode to PL 0 15473CD ib INT imm8 ts Interrupt--Protected Mode, via task 15474 gate 15475CE INTO Fail:3,pm=3; 15476 Pass:35 Interrupt 4--if overflow flag is 1 15477CE INTO pm=59 Interrupt 4--Protected Mode, same 15478 privilege 15479CE INTO pm=99 Interrupt 4--Protected Mode, more 15480 privilege 15481CE INTO pm=119 Interrupt 4--from V86 mode to PL 0 15482CE INTO ts Interrupt 4--Protected Mode, via 15483 task gate 15484 15485 15486 15487NOTE: 15488 Approximate values of ts are given by the following table: 15489 15490 New Task 15491 15492Old Task 386 TSS 386 TSS 286 TSS 15493 VM = 0 VM = 1 15494 15495386 15496TSS VM=0 309 226 282 15497 15498386 15499TSS VM=1 314 231 287 15500 15501286 15502TSS 307 224 280 15503 15504 15505Operation 15506 15507 15508NOTE: 15509 The following operational description applies not only to the 15510 above instructions but also to external interrupts and exceptions. 15511 15512 15513IF PE = 0 15514THEN GOTO REAL-ADDRESS-MODE; 15515ELSE GOTO PROTECTED-MODE; 15516FI; 15517 15518REAL-ADDRESS-MODE: 15519 Push (FLAGS); 15520 IF 0; (* Clear interrupt flag *) 15521 TF 0; (* Clear trap flag *) 15522 Push(CS); 15523 Push(IP); 15524 (* No error codes are pushed *) 15525 CS IDT[Interrupt number * 4].selector; 15526 IP IDT[Interrupt number * 4].offset; 15527 15528PROTECTED-MODE: 15529 Interrupt vector must be within IDT table limits, 15530 else #GP(vector number * 8+2+EXT); 15531 Descriptor AR byte must indicate interrupt gate, trap gate, or task gate, 15532 else #GP(vector number * 8+2+EXT); 15533 IF software interrupt (* i.e. caused by INT n, INT 3, or INTO *) 15534 THEN 15535 IF gate descriptor DPL < CPL 15536 THEN #GP(vector number * 8+2+EXT); 15537 FI; 15538 FI; 15539 Gate must be present, else #NP(vector number * 8+2+EXT); 15540 IF trap gate OR interrupt gate 15541 THEN GOTO TRAP-GATE-OR-INTERRUPT-GATE; 15542 ELSE GOTO TASK-GATE; 15543 FI; 15544 15545TRAP-GATE-OR-INTERRUPT-GATE: 15546 Examine CS selector and descriptor given in the gate descriptor; 15547 Selector must be non-null, else #GP (EXT); 15548 Selector must be within its descriptor table limits 15549 ELSE #GP(selector+EXT); 15550 Descriptor AR byte must indicate code segment 15551 ELSE #GP(selector + EXT); 15552 Segment must be present, else #NP(selector+EXT); 15553 IF code segment is non-conforming AND DPL < CPL 15554 THEN GOTO INTERRUPT-TO-INNER-PRIVILEGE; 15555 ELSE 15556 IF code segment is conforming OR code segment DPL = CPL 15557 THEN GOTO INTERRUPT-TO-SAME-PRIVILEGE-LEVEL; 15558 ELSE #GP(CS selector + EXT); 15559 FI; 15560 FI; 15561 15562INTERRUPT-TO-INNER-PRIVILEGE: 15563 Check selector and descriptor for new stack in current TSS; 15564 Selector must be non-null, else #GP(EXT); 15565 Selector index must be within its descriptor table limits 15566 ELSE #TS(SS selector+EXT); 15567 Selector's RPL must equal DPL of code segment, else #TS(SS 15568 selector+EXT); 15569 Stack segment DPL must equal DPL of code segment, else #TS(SS 15570 selector+EXT); 15571 Descriptor must indicate writable data segment, else #TS(SS 15572 selector+EXT); 15573 Segment must be present, else #SS(SS selector+EXT); 15574 IF 32-bit gate 15575 THEN New stack must have room for 20 bytes else #SS(0) 15576 ELSE New stack must have room for 10 bytes else #SS(0) 15577 FI; 15578 Instruction pointer must be within CS segment boundaries else #GP(0); 15579 Load new SS and eSP value from TSS; 15580 IF 32-bit gate 15581 THEN CS:EIP selector:offset from gate; 15582 ELSE CS:IP selector:offset from gate; 15583 FI; 15584 Load CS descriptor into invisible portion of CS register; 15585 Load SS descriptor into invisible portion of SS register; 15586 IF 32-bit gate 15587 THEN 15588 Push (long pointer to old stack) (* 3 words padded to 4 *); 15589 Push (EFLAGS); 15590 Push (long pointer to return location) (* 3 words padded to 4*); 15591 ELSE 15592 Push (long pointer to old stack) (* 2 words *); 15593 Push (FLAGS); 15594 Push (long pointer to return location) (* 2 words *); 15595 FI; 15596 Set CPL to new code segment DPL; 15597 Set RPL of CS to CPL; 15598 IF interrupt gate THEN IF 0 (* interrupt flag to 0 (disabled) *); FI; 15599 TF 0; 15600 NT 0; 15601 15602INTERRUPT-FROM-V86-MODE: 15603 TempEFlags EFLAGS; 15604 VM 0; 15605 TF 0; 15606 IF service through Interrupt Gate THEN IF 0; 15607 TempSS SS; 15608 TempESP ESP; 15609 SS TSS.SS0; (* Change to level 0 stack segment *) 15610 ESP TSS.ESP0; (* Change to level 0 stack pointer *) 15611 Push(GS); (* padded to two words *) 15612 Push(FS); (* padded to two words *) 15613 Push(DS); (* padded to two words *) 15614 Push(ES); (* padded to two words *) 15615 GS 0; 15616 FS 0; 15617 DS 0; 15618 ES 0; 15619 Push(TempSS); (* padded to two words *) 15620 Push(TempESP); 15621 Push(TempEFlags); 15622 Push(CS); (* padded to two words *) 15623 Push(EIP); 15624 CS:EIP selector:offset from interrupt gate; 15625 (* Starts execution of new routine in 80386 Protected Mode *) 15626 15627INTERRUPT-TO-SAME-PRIVILEGE-LEVEL: 15628 IF 32-bit gate 15629 THEN Current stack limits must allow pushing 10 bytes, else #SS(0); 15630 ELSE Current stack limits must allow pushing 6 bytes, else #SS(0); 15631 FI; 15632 IF interrupt was caused by exception with error code 15633 THEN Stack limits must allow push of two more bytes; 15634 ELSE #SS(0); 15635 FI; 15636 Instruction pointer must be in CS limit, else #GP(0); 15637 IF 32-bit gate 15638 THEN 15639 Push (EFLAGS); 15640 Push (long pointer to return location); (* 3 words padded to 4 *) 15641 CS:EIP selector:offset from gate; 15642 ELSE (* 16-bit gate *) 15643 Push (FLAGS); 15644 Push (long pointer to return location); (* 2 words *) 15645 CS:IP selector:offset from gate; 15646 FI; 15647 Load CS descriptor into invisible portion of CS register; 15648 Set the RPL field of CS to CPL; 15649 Push (error code); (* if any *) 15650 IF interrupt gate THEN IF 0; FI; 15651 TF 0; 15652 NT 0; 15653 15654TASK-GATE: 15655 Examine selector to TSS, given in task gate descriptor; 15656 Must specify global in the local/global bit, else #TS(TSS selector); 15657 Index must be within GDT limits, else #TS(TSS selector); 15658 AR byte must specify available TSS (bottom bits 00001), 15659 else #TS(TSS selector; 15660 TSS must be present, else #NP(TSS selector); 15661 SWITCH-TASKS with nesting to TSS; 15662 IF interrupt was caused by fault with error code 15663 THEN 15664 Stack limits must allow push of two more bytes, else #SS(0); 15665 Push error code onto stack; 15666 FI; 15667 Instruction pointer must be in CS limit, else #GP(0); 15668 15669Description 15670 15671The INT instruction generates via software a call to an interrupt 15672handler. The immediate operand, from 0 to 255, gives the index number 15673into the Interrupt Descriptor Table (IDT) of the interrupt routine to be 15674called. In Protected Mode, the IDT consists of an array of eight-byte 15675descriptors; the descriptor for the interrupt invoked must indicate an 15676interrupt, trap, or task gate. In Real Address Mode, the IDT is an array 15677of four byte-long pointers. In Protected and Real Address Modes, the 15678base linear address of the IDT is defined by the contents of the IDTR. 15679 15680The INTO conditional software instruction is identical to the INT 15681interrupt instruction except that the interrupt number is implicitly 4, 15682and the interrupt is made only if the 80386 overflow flag is set. 15683 15684The first 32 interrupts are reserved by Intel for system use. Some of 15685these interrupts are use for internally generated exceptions. 15686 15687INT n generally behaves like a far call except that the flags register is 15688pushed onto the stack before the return address. Interrupt procedures 15689return via the IRET instruction, which pops the flags and return address 15690from the stack. 15691 15692In Real Address Mode, INT n pushes the flags, CS, and the return IP 15693onto the stack, in that order, then jumps to the long pointer indexed by 15694the interrupt number. 15695 15696Flags Affected 15697 15698None 15699 15700Protected Mode Exceptions 15701 15702#GP, #NP, #SS, and #TS as indicated under "Operation" above 15703 15704Real Address Mode Exceptions 15705 15706None; if the SP or ESP = 1, 3, or 5 before executing INT or INTO, 15707the 80386 will shut down due to insufficient stack space 15708 15709Virtual 8086 Mode Exceptions 15710 15711#GP(0) fault if IOPL is less than 3, for INT only, to permit emulation; 15712Interrupt 3 (0CCH) generates Interrupt 3; INTO generates Interrupt 4 15713if the overflow flag equals 1 15714 15715 15716IRET/IRETD Interrupt Return 15717 15718Opcode Instruction Clocks Description 15719 15720CF IRET 22,pm=38 Interrupt return (far return and pop 15721 flags) 15722CF IRET pm=82 Interrupt return to lesser privilege 15723CF IRET ts Interrupt return, different task (NT = 1) 15724CF IRETD 22,pm=38 Interrupt return (far return and pop 15725 flags) 15726CF IRETD pm=82 Interrupt return to lesser privilege 15727CF IRETD pm=60 Interrupt return to V86 mode 15728CF IRETD ts Interrupt return, different task (NT = 1) 15729 15730 15731 15732NOTE: 15733 Values of ts are given by the following table: 15734 15735 New Task 15736 15737Old Task 386 TSS 386 TSS 286 TSS 15738 VM = 0 VM = 1 15739 15740386 15741TSS VM=0 275 224 271 15742 15743286 15744TSS 265 214 232 15745 15746 15747Operation 15748 15749IF PE = 0 15750THEN (* Real-address mode *) 15751 IF OperandSize = 32 (* Instruction = IRETD *) 15752 THEN EIP Pop(); 15753 ELSE (* Instruction = IRET *) 15754 IP Pop(); 15755 FI; 15756 CS Pop(); 15757 IF OperandSize = 32 (* Instruction = IRETD *) 15758 THEN EFLAGS Pop(); 15759 ELSE (* Instruction = IRET *) 15760 FLAGS Pop(); 15761 FI; 15762ELSE (* Protected mode *) 15763 IF VM = 1 15764 THEN #GP(0); 15765 ELSE 15766 IF NT = 1 15767 THEN GOTO TASK-RETURN; 15768 ELSE 15769 IF VM = 1 in flags image on stack 15770 THEN GO TO STACK-RETURN-TO-V86; 15771 ELSE GOTO STACK-RETURN; 15772 FI; 15773 FI; 15774 FI; 15775FI;STACK-RETURN-TO-V86: (* Interrupted procedure was in V86 mode *) 15776 IF return CS selector RPL < > 3 15777 THEN #GP(Return selector); 15778 FI; 15779 IF top 36 bytes of stack not within limits 15780 THEN #SS(0); 15781 FI; 15782 Examine return CS selector and associated descriptor: 15783 IF selector is null, THEN #GP(0); FI; 15784 IF selector index not within its descriptor table limits; 15785 THEN #GP(Return selector); 15786 FI; 15787 IF AR byte does not indicate code segment 15788 THEN #GP(Return selector); 15789 FI; 15790 IF code segment DPL not = 3; 15791 THEN #GP(Return selector); 15792 FI; 15793 IF code segment not present 15794 THEN #NP(Return selector); 15795 FI; 15796 15797 Examine return SS selector and associated descriptor: 15798 IF selector is null THEN #GP(0); FI; 15799 IF selector index not within its descriptor table limits 15800 THEN #GP(SS selector); 15801 FI; 15802 IF selector RPL not = RPL of return CS selector 15803 THEN #GP(SS selector); 15804 FI; 15805 IF AR byte does not indicate a writable data segment 15806 THEN #GP(SS selector); 15807 FI; 15808 IF stack segment DPL not = RPL of return CS selector 15809 THEN #GP(SS selector); 15810 FI; 15811 IF SS not present 15812 THEN #NP(SS selector); 15813 FI; 15814 15815 IF instruction pointer not within code segment limit THEN #GP(0); 15816 FI; 15817 EFLAGS SS:[eSP + 8]; (* Sets VM in interrupted routine *) 15818 EIP Pop(); 15819 CS Pop(); (* CS behaves as in 8086, due to VM = 1 *) 15820 throwaway Pop(); (* pop away EFLAGS already read *) 15821 ES Pop(); (* pop 2 words; throw away high-order word *) 15822 DS Pop(); (* pop 2 words; throw away high-order word *) 15823 FS Pop(); (* pop 2 words; throw away high-order word *) 15824 GS Pop(); (* pop 2 words; throw away high-order word *) 15825 IF CS.RPL > CPL 15826 THEN 15827 TempESP Pop(); 15828 TempSS Pop(); 15829 SS:ESP TempSS:TempESP; 15830 FI; 15831 15832 (* Resume execution in Virtual 8086 mode *) 15833 15834TASK-RETURN: 15835 Examine Back Link Selector in TSS addressed by the current task 15836 register: 15837 Must specify global in the local/global bit, else #TS(new TSS 15838 selector); 15839 Index must be within GDT limits, else #TS(new TSS selector); 15840 AR byte must specify TSS, else #TS(new TSS selector); 15841 New TSS must be busy, else #TS(new TSS selector); 15842 TSS must be present, else #NP(new TSS selector); 15843 SWITCH-TASKS without nesting to TSS specified by back link selector; 15844 Mark the task just abandoned as NOT BUSY; 15845 Instruction pointer must be within code segment limit ELSE #GP(0); 15846 15847STACK-RETURN: 15848 IF OperandSize=32 15849 THEN Third word on stack must be within stack limits, else #SS(0); 15850 ELSE Second word on stack must be within stack limits, else #SS(0); 15851 FI; 15852 Return CS selector RPL must be CPL, else #GP(Return selector); 15853 IF return selector RPL = CPL 15854 THEN GOTO RETURN-SAME-LEVEL; 15855 ELSE GOTO RETURN-OUTER-LEVEL; 15856 FI; 15857 15858RETURN-SAME-LEVEL: 15859 IF OperandSize=32 15860 THEN 15861 Top 12 bytes on stack must be within limits, else #SS(0); 15862 Return CS selector (at eSP+4) must be non-null, else #GP(0); 15863 ELSE 15864 Top 6 bytes on stack must be within limits, else #SS(0); 15865 Return CS selector (at eSP+2) must be non-null, else #GP(0); 15866 FI; 15867 Selector index must be within its descriptor table limits, else #GP 15868 (Return selector); 15869 AR byte must indicate code segment, else #GP(Return selector); 15870 IF non-conforming 15871 THEN code segment DPL must = CPL; 15872 ELSE #GP(Return selector); 15873 FI; 15874 IF conforming 15875 THEN code segment DPL must be CPL, else #GP(Return selector); 15876 Segment must be present, else #NP(Return selector); 15877 Instruction pointer must be within code segment boundaries, else #GP(0); 15878 FI; 15879 IF OperandSize=32 15880 THEN 15881 Load CS:EIP from stack; 15882 Load CS-register with new code segment descriptor; 15883 Load EFLAGS with third doubleword from stack; 15884 Increment eSP by 12; 15885 ELSE 15886 Load CS-register with new code segment descriptor; 15887 Load FLAGS with third word on stack; 15888 Increment eSP by 6; 15889 FI; 15890 15891RETURN-OUTER-LEVEL: 15892 IF OperandSize=32 15893 THEN Top 20 bytes on stack must be within limits, else #SS(0); 15894 ELSE Top 10 bytes on stack must be within limits, else #SS(0); 15895 FI; 15896 Examine return CS selector and associated descriptor: 15897 Selector must be non-null, else #GP(0); 15898 Selector index must be within its descriptor table limits; 15899 ELSE #GP(Return selector); 15900 AR byte must indicate code segment, else #GP(Return selector); 15901 IF non-conforming 15902 THEN code segment DPL must = CS selector RPL; 15903 ELSE #GP(Return selector); 15904 FI; 15905 IF conforming 15906 THEN code segment DPL must be > CPL; 15907 ELSE #GP(Return selector); 15908 FI; 15909 Segment must be present, else #NP(Return selector); 15910 Examine return SS selector and associated descriptor: 15911 Selector must be non-null, else #GP(0); 15912 Selector index must be within its descriptor table limits 15913 ELSE #GP(SS selector); 15914 Selector RPL must equal the RPL of the return CS selector 15915 ELSE #GP(SS selector); 15916 AR byte must indicate a writable data segment, else #GP(SS selector); 15917 Stack segment DPL must equal the RPL of the return CS selector 15918 ELSE #GP(SS selector); 15919 SS must be present, else #NP(SS selector); 15920 15921 Instruction pointer must be within code segment limit ELSE #GP(0); 15922 IF OperandSize=32 15923 THEN 15924 Load CS:EIP from stack; 15925 Load EFLAGS with values at (eSP+8); 15926 ELSE 15927 Load CS:IP from stack; 15928 Load FLAGS with values at (eSP+4); 15929 FI; 15930 Load SS:eSP from stack; 15931 Set CPL to the RPL of the return CS selector; 15932 Load the CS register with the CS descriptor; 15933 Load the SS register with the SS descriptor; 15934 FOR each of ES, FS, GS, and DS 15935 DO; 15936 IF the current value of the register is not valid for the outer level; 15937 THEN zero the register and clear the valid flag; 15938 FI; 15939 To be valid, the register setting must satisfy the following 15940 properties: 15941 Selector index must be within descriptor table limits; 15942 AR byte must indicate data or readable code segment; 15943 IF segment is data or non-conforming code, 15944 THEN DPL must be CPL, or DPL must be RPL; 15945 OD; 15946 15947Description 15948 15949In Real Address Mode, IRET pops the instruction pointer, CS, and the 15950flags register from the stack and resumes the interrupted routine. 15951 15952In Protected Mode, the action of IRET depends on the setting of the 15953nested task flag (NT) bit in the flag register. When popping the new 15954flag image from the stack, the IOPL bits in the flag register are changed 15955only when CPL equals 0. 15956 15957If NT equals 0, IRET returns from an interrupt procedure without a 15958task switch. The code returned to must be equally or less privileged than 15959the interrupt routine (as indicated by the RPL bits of the CS selector 15960popped from the stack). If the destination code is less privileged, IRET 15961also pops the stack pointer and SS from the stack. 15962 15963If NT equals 1, IRET reverses the operation of a CALL or INT that 15964caused a task switch. The updated state of the task executing IRET is 15965saved in its task state segment. If the task is reentered later, the code 15966that follows IRET is executed. 15967 15968Flags Affected 15969 15970All; the flags register is popped from stack 15971 15972Protected Mode Exceptions 15973 15974#GP, #NP, or #SS, as indicated under "Operation" above 15975 15976Real Address Mode Exceptions 15977 15978Interrupt 13 if any part of the operand being popped lies beyond address 159790FFFFH 15980 15981Virtual 8086 Mode Exceptions 15982 15983#GP(0) fault if IOPL is less than 3, to permit emulation 15984 15985 15986Jcc Jump if Condition is Met 15987 15988 15989Opcode Instruction Clocks Description 15990 1599177 cb JA rel8 7+m,3 Jump short if above (CF=0 and 15992 ZF=0) 1599373 cb JAE rel8 7+m,3 Jump short if above or equal 15994 (CF=0) 1599572 cb JB rel8 7+m,3 Jump short if below (CF=1) 1599676 cb JBE rel8 7+m,3 Jump short if below or equal 15997 (CF=1 or ZF=1) 1599872 cb JC rel8 7+m,3 Jump short if carry (CF=1) 15999E3 cb JCXZ rel8 9+m,5 Jump short if CX register is 0 16000E3 cb JECXZ rel8 9+m,5 Jump short if ECX register is 0 1600174 cb JE rel8 7+m,3 Jump short if equal (ZF=1) 1600274 cb JZ rel8 7+m,3 Jump short if 0 (ZF=1) 160037F cb JG rel8 7+m,3 Jump short if greater (ZF=0 and 16004 SF=OF) 160057D cb JGE rel8 7+m,3 Jump short if greater or equal 16006 (SF=OF) 160077C cb JL rel8 7+m,3 Jump short if less (SF<>OF) 160087E cb JLE rel8 7+m,3 Jump short if less or equal 16009 (ZF=1 and SF<>OF) 1601076 cb JNA rel8 7+m,3 Jump short if not above (CF=1 or 16011 ZF=1) 1601272 cb JNAE rel8 7+m,3 Jump short if not above or equal 16013 (CF=1) 1601473 cb JNB rel8 7+m,3 Jump short if not below (CF=0) 1601577 cb JNBE rel8 7+m,3 Jump short if not below or equal 16016 (CF=0 and ZF=0) 1601773 cb JNC rel8 7+m,3 Jump short if not carry (CF=0) 1601875 cb JNE rel8 7+m,3 Jump short if not equal (ZF=0) 160197E cb JNG rel8 7+m,3 Jump short if not greater (ZF=1 16020 or SF<>OF) 160217C cb JNGE rel8 7+m,3 Jump short if not greater or 16022 equal (SF<>OF) 160237D cb JNL rel8 7+m,3 Jump short if not less (SF=OF) 160247F cb JNLE rel8 7+m,3 Jump short if not less or equal 16025 (ZF=0 and SF=OF) 1602671 cb JNO rel8 7+m,3 Jump short if not overflow 16027 (OF=0) 160287B cb JNP rel8 7+m,3 Jump short if not parity (PF=0) 1602979 cb JNS rel8 7+m,3 Jump short if not sign (SF=0) 1603075 cb JNZ rel8 7+m,3 Jump short if not zero (ZF=0) 1603170 cb JO rel8 7+m,3 Jump short if overflow (OF=1) 160327A cb JP rel8 7+m,3 Jump short if parity (PF=1) 160337A cb JPE rel8 7+m,3 Jump short if parity even (PF=1) 160347B cb JPO rel8 7+m,3 Jump short if parity odd (PF=0) 1603578 cb JS rel8 7+m,3 Jump short if sign (SF=1) 1603674 cb JZ rel8 7+m,3 Jump short if zero (ZF = 1) 160370F 87 cw/cd JA rel16/32 7+m,3 Jump near if above (CF=0 and 16038 ZF=0) 160390F 83 cw/cd JAE rel16/32 7+m,3 Jump near if above or equal 16040 (CF=0) 160410F 82 cw/cd JB rel16/32 7+m,3 Jump near if below (CF=1) 160420F 86 cw/cd JBE rel16/32 7+m,3 Jump near if below or equal 16043 (CF=1 or ZF=1) 160440F 82 cw/cd JC rel16/32 7+m,3 Jump near if carry (CF=1) 160450F 84 cw/cd JE rel16/32 7+m,3 Jump near if equal (ZF=1) 160460F 84 cw/cd JZ rel16/32 7+m,3 Jump near if 0 (ZF=1) 160470F 8F cw/cd JG rel16/32 7+m,3 Jump near if greater (ZF=0 and 16048 SF=OF) 160490F 8D cw/cd JGE rel16/32 7+m,3 Jump near if greater or equal 16050 (SF=OF) 160510F 8C cw/cd JL rel16/32 7+m,3 Jump near if less (SF<>OF) 160520F 8E cw/cd JLE rel16/32 7+m,3 Jump near if less or equal (ZF=1 16053 and SF<>OF) 160540F 86 cw/cd JNA rel16/32 7+m,3 Jump near if not above (CF=1 or 16055 ZF=1) 160560F 82 cw/cd JNAE rel16/32 7+m,3 Jump near if not above or equal 16057 (CF=1) 160580F 83 cw/cd JNB rel16/32 7+m,3 Jump near if not below (CF=0) 160590F 87 cw/cd JNBE rel16/32 7+m,3 Jump near if not below or equal 16060 (CF=0 and ZF=0) 160610F 83 cw/cd JNC rel16/32 7+m,3 Jump near if not carry (CF=0) 160620F 85 cw/cd JNE rel16/32 7+m,3 Jump near if not equal (ZF=0) 160630F 8E cw/cd JNG rel16/32 7+m,3 Jump near if not greater (ZF=1 16064 or SF<>OF) 160650F 8C cw/cd JNGE rel16/32 7+m,3 Jump near if not greater or 16066 equal (SF<>OF) 160670F 8D cw/cd JNL rel16/32 7+m,3 Jump near if not less (SF=OF) 160680F 8F cw/cd JNLE rel16/32 7+m,3 Jump near if not less or equal 16069 (ZF=0 and SF=OF) 160700F 81 cw/cd JNO rel16/32 7+m,3 Jump near if not overflow (OF=0) 160710F 8B cw/cd JNP rel16/32 7+m,3 Jump near if not parity (PF=0) 160720F 89 cw/cd JNS rel16/32 7+m,3 Jump near if not sign (SF=0) 160730F 85 cw/cd JNZ rel16/32 7+m,3 Jump near if not zero (ZF=0) 160740F 80 cw/cd JO rel16/32 7+m,3 Jump near if overflow (OF=1) 160750F 8A cw/cd JP rel16/32 7+m,3 Jump near if parity (PF=1) 160760F 8A cw/cd JPE rel16/32 7+m,3 Jump near if parity even (PF=1) 160770F 8B cw/cd JPO rel16/32 7+m,3 Jump near if parity odd (PF=0) 160780F 88 cw/cd JS rel16/32 7+m,3 Jump near if sign (SF=1) 160790F 84 cw/cd JZ rel16/32 7+m,3 Jump near if 0 (ZF=1) 16080 16081 16082 16083NOTES: 16084 The first clock count is for the true condition (branch taken); the 16085 second clock count is for the false condition (branch not taken). rel16/32 16086 indicates that these instructions map to two; one with a 16-bit relative 16087 displacement, the other with a 32-bit relative displacement, depending on 16088 the operand-size attribute of the instruction. 16089 16090 16091Operation 16092 16093IF condition 16094THEN 16095 EIP EIP + SignExtend(rel8/16/32); 16096 IF OperandSize = 16 16097 THEN EIP EIP AND 0000FFFFH; 16098 FI; 16099FI; 16100 16101Description 16102 16103Conditional jumps (except JCXZ) test the flags which have been set by 16104a previous instruction. The conditions for each mnemonic are given in 16105parentheses after each description above. The terms "less" and "greater" 16106are used for comparisons of signed integers; "above" and "below" are 16107used for unsigned integers. 16108 16109If the given condition is true, a jump is made to the location provided as 16110the operand. Instruction coding is most efficient when the target for the 16111conditional jump is in the current code segment and within -128 to 16112+127 bytes of the next instruction's first byte. The jump can also target 16113-32768 thru +32767 (segment size attribute 16) or -2^(31) thru +2^(31) -1 16114(segment size attribute 32) relative to the next instruction's first byte. 16115When the target for the conditional jump is in a different segment, use 16116the opposite case of the jump instruction (i.e., JE and JNE), and then 16117access the target with an unconditional far jump to the other segment. 16118For example, you cannot code 16119 16120JZ FARLABEL; 16121 16122You must instead code 16123 16124 JNZ BEYOND; 16125 JMP FARLABEL; 16126BEYOND: 16127 16128Because there can be several ways to interpret a particular state of the 16129flags, ASM386 provides more than one mnemonic for most of the 16130conditional jump opcodes. For example, if you compared two characters in 16131AX and want to jump if they are equal, use JE; or, if you ANDed AX 16132with a bit field mask and only want to jump if the result is 0, use JZ, a 16133synonym for JE. 16134 16135JCXZ differs from other conditional jumps because it tests the contents of 16136the CX or ECX register for 0, not the flags. JCXZ is useful at the beginning 16137of a conditional loop that terminates with a conditional loop instruction 16138(such as LOOPNE TARGET LABEL. The JCXZ prevents entering the loop with CX or 16139ECX equal to zero, which would cause the loop to execute 64K or 32G times 16140instead of zero times. 16141 16142Flags Affected 16143 16144None 16145 16146Protected Mode Exceptions 16147 16148#GP(0) if the offset jumped to is beyond the limits of the code segment 16149 16150Real Address Mode Exceptions 16151 16152None 16153 16154Virtual 8086 Mode Exceptions 16155 16156None 16157 16158 16159JMP Jump 16160 16161 16162Opcode Instruction Clocks Description 16163 16164EB cb JMP rel8 7+m Jump short 16165E9 cw JMP rel16 7+m Jump near, displacement relative 16166 to next instruction 16167FF /4 JMP r/m16 7+m/10+m Jump near indirect 16168EA cd JMP ptr16:16 12+m,pm=27+m Jump intersegment, 4-byte 16169 immediate address 16170EA cd JMP ptr16:16 pm=45+m Jump to call gate, same 16171 privilege 16172EA cd JMP ptr16:16 ts Jump via task state segment 16173EA cd JMP ptr16:16 ts Jump via task gate 16174FF /5 JMP m16:16 43+m,pm=31+m Jump r/m16:16 indirect and 16175 intersegment 16176FF /5 JMP m16:16 pm=49+m Jump to call gate, same 16177 privilege 16178FF /5 JMP m16:16 5 + ts Jump via task state segment 16179FF /5 JMP m16:16 5 + ts Jump via task gate 16180E9 cd JMP rel32 7+m Jump near, displacement relative 16181 to next instruction 16182FF /4 JMP r/m32 7+m,10+m Jump near, indirect 16183EA cp JMP ptr16:32 12+m,pm=27+m Jump intersegment, 6-byte 16184 immediate address 16185EA cp JMP ptr16:32 pm=45+m Jump to call gate, same 16186 privilege 16187EA cp JMP ptr16:32 ts Jump via task state segment 16188EA cp JMP ptr16:32 ts Jump via task gate 16189FF /5 JMP m16:32 43+m,pm=31+m Jump intersegment, address at 16190 r/m dword 16191FF /5 JMP m16:32 pm=49+m Jump to call gate, same 16192 privilege 16193FF /5 JMP m16:32 5 + ts Jump via task state segment 16194FF /5 JMP m16:32 5 + ts Jump via task gate 16195 16196 16197 16198NOTE: 16199Values of ts are given by the following table: 16200 16201 New Task 16202 16203 386 TSS 386 TASK 286 TSS 16204 VM = 0 VM = 1 16205 16206Old Task Via Task Gate? 16207 16208 N Y N Y N Y 16209386 16210TSS VM=0 303 312 220 229 276 285 16211 16212286 16213TSS 301 310 218 227 274 283 16214 16215 16216Operation 16217 16218IF instruction = relative JMP 16219 (* i.e. operand is rel8, rel16, or rel32 *) 16220THEN 16221 EIP EIP + rel8/16/32; 16222 IF OperandSize = 16 16223 THEN EIP EIP AND 0000FFFFH; 16224 FI; 16225FI; 16226IF instruction = near indirect JMP 16227 (* i.e. operand is r/m16 or r/m32 *) 16228THEN 16229 IF OperandSize = 16 16230 THEN 16231 EIP [r/m16] AND 0000FFFFH; 16232 ELSE (* OperandSize = 32 *) 16233 EIP [r/m32]; 16234 FI; 16235FI; 16236 16237IF (PE = 0 OR (PE = 1 AND VM = 1)) (* real mode or V86 mode *) 16238 AND instruction = far JMP 16239 (* i.e., operand type is m16:16, m16:32, ptr16:16, ptr16:32 *) 16240THEN GOTO REAL-OR-V86-MODE; 16241 IF operand type = m16:16 or m16:32 16242 THEN (* indirect *) 16243 IF OperandSize = 16 16244 THEN 16245 CS:IP [m16:16]; 16246 EIP EIP AND 0000FFFFH; (* clear upper 16 bits *) 16247 ELSE (* OperandSize = 32 *) 16248 CS:EIP [m16:32]; 16249 FI; 16250 FI; 16251 IF operand type = ptr16:16 or ptr16:32 16252 THEN 16253 IF OperandSize = 16 16254 THEN 16255 CS:IP ptr16:16; 16256 EIP EIP AND 0000FFFFH; (* clear upper 16 bits *) 16257 ELSE (* OperandSize = 32 *) 16258 CS:EIP ptr16:32; 16259 FI; 16260 FI; 16261FI; 16262 16263IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *) 16264 AND instruction = far JMP 16265THEN 16266 IF operand type = m16:16 or m16:32 16267 THEN (* indirect *) 16268 check access of EA dword; 16269 #GP(0) or #SS(0) IF limit violation; 16270 FI; 16271 Destination selector is not null ELSE #GP(0) 16272 Destination selector index is within its descriptor table limits ELSE 16273#GP(selector) 16274 Depending on AR byte of destination descriptor: 16275 GOTO CONFORMING-CODE-SEGMENT; 16276 GOTO NONCONFORMING-CODE-SEGMENT; 16277 GOTO CALL-GATE; 16278 GOTO TASK-GATE; 16279 GOTO TASK-STATE-SEGMENT; 16280 ELSE #GP(selector); (* illegal AR byte in descriptor *) 16281FI; 16282 16283CONFORMING-CODE-SEGMENT: 16284 Descriptor DPL must be CPL ELSE #GP(selector); 16285 Segment must be present ELSE #NP(selector); 16286 Instruction pointer must be within code-segment limit ELSE #GP(0); 16287 IF OperandSize = 32 16288 THEN Load CS:EIP from destination pointer; 16289 ELSE Load CS:IP from destination pointer; 16290 FI; 16291 Load CS register with new segment descriptor; 16292 16293NONCONFORMING-CODE-SEGMENT: 16294 RPL of destination selector must be CPL ELSE #GP(selector); 16295 Descriptor DPL must be = CPL ELSE #GP(selector); 16296 Segment must be present ELSE # NP(selector); 16297 Instruction pointer must be within code-segment limit ELSE #GP(0); 16298 IF OperandSize = 32 16299 THEN Load CS:EIP from destination pointer; 16300 ELSE Load CS:IP from destination pointer; 16301 FI; 16302 Load CS register with new segment descriptor; 16303 Set RPL field of CS register to CPL; 16304 16305CALL-GATE: 16306 Descriptor DPL must be CPL ELSE #GP(gate selector); 16307 Descriptor DPL must be gate selector RPL ELSE #GP(gate selector); 16308 Gate must be present ELSE #NP(gate selector); 16309 Examine selector to code segment given in call gate descriptor: 16310 Selector must not be null ELSE #GP(0); 16311 Selector must be within its descriptor table limits ELSE 16312 #GP(CS selector); 16313 Descriptor AR byte must indicate code segment 16314 ELSE #GP(CS selector); 16315 IF non-conforming 16316 THEN code-segment descriptor, DPL must = CPL 16317 ELSE #GP(CS selector); 16318 FI; 16319 IF conforming 16320 THEN code-segment descriptor DPL must be CPL; 16321 ELSE #GP(CS selector); 16322 Code segment must be present ELSE #NP(CS selector); 16323 Instruction pointer must be within code-segment limit ELSE #GP(0); 16324 IF OperandSize = 32 16325 THEN Load CS:EIP from call gate; 16326 ELSE Load CS:IP from call gate; 16327 FI; 16328 Load CS register with new code-segment descriptor; 16329 Set RPL of CS to CPL 16330 16331TASK-GATE: 16332 Gate descriptor DPL must be CPL ELSE #GP(gate selector); 16333 Gate descriptor DPL must be gate selector RPL ELSE #GP(gate 16334 selector); 16335 Task Gate must be present ELSE #NP(gate selector); 16336 Examine selector to TSS, given in Task Gate descriptor: 16337 Must specify global in the local/global bit ELSE #GP(TSS selector); 16338 Index must be within GDT limits ELSE #GP(TSS selector); 16339 Descriptor AR byte must specify available TSS (bottom bits 00001); 16340 ELSE #GP(TSS selector); 16341 Task State Segment must be present ELSE #NP(TSS selector); 16342SWITCH-TASKS (without nesting) to TSS; 16343Instruction pointer must be within code-segment limit ELSE #GP(0); 16344 16345TASK-STATE-SEGMENT: 16346 TSS DPL must be CPL ELSE #GP(TSS selector); 16347 TSS DPL must be TSS selector RPL ELSE #GP(TSS selector); 16348 Descriptor AR byte must specify available TSS (bottom bits 00001) 16349 ELSE #GP(TSS selector); 16350 Task State Segment must be present ELSE #NP(TSS selector); 16351 SWITCH-TASKS (without nesting) to TSS; 16352 Instruction pointer must be within code-segment limit ELSE #GP(0); 16353 16354Description 16355 16356The JMP instruction transfers control to a different point in the 16357instruction stream without recording return information. 16358 16359The action of the various forms of the instruction are shown below. 16360 16361Jumps with destinations of type r/m16, r/m32, rel16, and rel32 are near 16362jumps and do not involve changing the segment register value. 16363 16364The JMP rel16 and JMP rel32 forms of the instruction add an offset to 16365the address of the instruction following the JMP to determine the 16366destination. The rel16 form is used when the instruction's operand-size 16367attribute is 16 bits (segment size attribute 16 only); rel32 is used when 16368the operand-size attribute is 32 bits (segment size attribute 32 only). The 16369result is stored in the 32-bit EIP register. With rel16, the upper 16 bits 16370of EIP are cleared, which results in an offset whose value does not exceed 1637116 bits. 16372 16373JMP r/m16 and JMP r/m32 specifies a register or memory location from which 16374the absolute offset from the procedure is fetched. The offset fetched from 16375r/m is 32 bits for an operand-size attribute of 32 bits (r/m32), or 16 bits 16376for an operand-size attribute of 16 bits (r/m16). 16377 16378The JMP ptr16:16 and ptr16:32 forms of the instruction use a four-byte 16379or six-byte operand as a long pointer to the destination. The JMP 16380and forms fetch the long pointer from the memory location 16381specified (indirection). In Real Address Mode or Virtual 8086 Mode, 16382the long pointer provides 16 bits for the CS register and 16 or 32 bits 16383for the EIP register (depending on the operand-size attribute). In 16384Protected Mode, both long pointer forms consult the Access Rights (AR) 16385byte in the descriptor indexed by the selector part of the long pointer. 16386 16387Depending on the value of the AR byte, the jump will perform one of 16388the following types of control transfers: 16389 16390 A jump to a code segment at the same privilege level 16391 A task switch 16392 16393For more information on protected mode control transfers, refer to 16394Chapter 6 and Chapter 7. 16395 16396Flags Affected 16397 16398All if a task switch takes place; none if no task switch occurs 16399 16400Protected Mode Exceptions 16401 16402Far jumps: #GP, #NP, #SS, and #TS, as indicated in the list above. 16403 16404Near direct jumps: #GP(0) if procedure location is beyond the code 16405segment limits. 16406 16407Near indirect jumps: #GP(0) for an illegal memory operand effective 16408address in the CS, DS, ES, FS, or GS segments: #SS(0) for an illegal 16409address in the SS segment; #GP if the indirect offset obtained is beyond 16410the code segment limits; #PF(fault-code) for a page fault. 16411 16412Real Address Mode Exceptions 16413 16414Interrupt 13 if any part of the operand would be outside of the effective 16415address space from 0 to 0FFFFH 16416 16417Virtual 8086 Mode Exceptions 16418 16419Same exceptions as under Real Address Mode; #PF(fault-code) for a 16420page fault 16421 16422 16423LAHF Load Flags into AH Register 16424 16425Opcode Instruction Clocks Description 16426 164279F LAHF 2 Load: AH = flags SF ZF xx AF xx PF xx CF 16428 16429 16430Operation 16431 16432AH SF:ZF:xx:AF:xx:PF:xx:CF; 16433 16434Description 16435 16436LAHF transfers the low byte of the flags word to AH. The bits, from 16437MSB to LSB, are sign, zero, indeterminate, auxiliary, carry, 16438indeterminate, parity, indeterminate, and carry. 16439 16440Flags Affected 16441 16442None 16443 16444Protected Mode Exceptions 16445 16446None 16447 16448Real Address Mode Exceptions 16449 16450None 16451 16452Virtual 8086 Mode Exceptions 16453 16454None 16455 16456 16457LAR Load Access Rights Byte 16458 16459Opcode Instruction Clocks Description 16460 164610F 02 /r LAR r16,r/m16 pm=15/16 r16 r/m16 masked by FF00 164620F 02 /r LAR r32,r/m32 pm=15/16 r32 r/m32 masked by 00FxFF00 16463 16464 16465Description 16466 16467The LAR instruction stores a marked form of the second doubleword of 16468the descriptor for the source selector if the selector is visible at the 16469CPL (modified by the selector's RPL) and is a valid descriptor type. The 16470destination register is loaded with the high-order doubleword of the 16471descriptor masked by 00FxFF00, and ZF is set to 1. The x indicates that the 16472four bits corresponding to the upper four bits of the limit are undefined in 16473the value loaded by LAR. If the selector is invisible or of the wrong type, 16474ZF is cleared. 16475 16476If the 32-bit operand size is specified, the entire 32-bit value is loaded 16477into the 32-bit destination register. If the 16-bit operand size is 16478specified, the lower 16-bits of this value are stored in the 16-bit 16479destination register. 16480 16481All code and data segment descriptors are valid for LAR. 16482 16483The valid special segment and gate descriptor types for LAR are given 16484in the following table: 16485 16486Type Name Valid/Invalid 16487 16488 0 Invalid Invalid 16489 1 Available 80286 TSS Valid 16490 2 LDT Valid 16491 3 Busy 80286 TSS Valid 16492 4 80286 call gate Valid 16493 5 80286/80386 task gate Valid 16494 6 80286 trap gate Valid 16495 7 80286 interrupt gate Valid 16496 8 Invalid Invalid 16497 9 Available 80386 TSS Valid 16498 A Invalid Invalid 16499 B Busy 80386 TSS Valid 16500 C 80386 call gate Valid 16501 D Invalid Invalid 16502 E 80386 trap gate Valid 16503 F 80386 interrupt gate Valid 16504 16505Flags Affected 16506 16507ZF as described above 16508 16509Protected Mode Exceptions 16510 16511#GP(0) for an illegal memory operand effective address in the CS, DS, 16512ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 16513#PF(fault-code) for a page fault 16514 16515Real Address Mode Exceptions 16516 16517Interrupt 6; LAR is unrecognized in Real Address Mode 16518 16519Virtual 8086 Mode Exceptions 16520 16521Same exceptions as in Real Address Mode 16522 16523 16524LEA Load Effective Address 16525 16526Opcode Instruction Clocks Description 16527 165288D /r LEA r16,m 2 Store effective address for m in register r16 165298D /r LEA r32,m 2 Store effective address for m in register r32 165308D /r LEA r16,m 2 Store effective address for m in register r16 165318D /r LEA r32,m 2 Store effective address for m in register r32 16532 16533 16534Operation 16535 16536IF OperandSize = 16 AND AddressSize = 16 16537THEN r16 Addr(m); 16538ELSE 16539 IF OperandSize = 16 AND AddressSize = 32 16540 THEN 16541 r16 Truncate_to_16bits(Addr(m)); (* 32-bit address *) 16542 ELSE 16543 IF OperandSize = 32 AND AddressSize = 16 16544 THEN 16545 r32 Truncate_to_16bits(Addr(m)); 16546 ELSE 16547 IF OperandSize = 32 AND AddressSize = 32 16548 THEN r32 Addr(m); 16549 FI; 16550 FI; 16551 FI; 16552FI; 16553 16554Description 16555 16556LEA calculates the effective address (offset part) and stores it in the 16557specified register. The operand-size attribute of the instruction 16558(represented by OperandSize in the algorithm under "Operation" above) is 16559determined by the chosen register. The address-size attribute (represented 16560by AddressSize) is determined by the USE attribute of the segment containing 16561the second operand. The address-size and operand-size attributes affect the 16562action performed by LEA, as follows: 16563 16564Operand Size Address Size Action Performed 16565 16566 16 16 16-bit effective address is calculated and 16567 stored in requested 16-bit register 16568 destination. 16569 16570 16 32 32-bit effective address is calculated. The 16571 lower 16 bits of the address are stored in 16572 the requested 16-bit register destination. 16573 16574 32 16 16-bit effective address is calculated. The 16575 16-bit address is zero-extended and stored 16576 in the requested 32-bit register destination. 16577 16578 32 32 32-bit effective address is calculated and 16579 stored in the requested 32-bit register 16580 destination. 16581 16582Flags Affected 16583 16584None 16585 16586Protected Mode Exceptions 16587 16588#UD if the second operand is a register 16589 16590Real Address Mode Exceptions 16591 16592Interrupt 6 if the second operand is a register 16593 16594Virtual 8086 Mode Exceptions 16595 16596Same exceptions as in Real Address Mode 16597 16598 16599LEAVE High Level Procedure Exit 16600 16601Opcode Instruction Clocks Description 16602 16603C9 LEAVE 4 Set SP to BP, then pop BP 16604C9 LEAVE 4 Set ESP to EBP, then pop EBP 16605 16606 16607Operation 16608 16609IF StackAddrSize = 16 16610THEN 16611 SP BP; 16612ELSE (* StackAddrSize = 32 *) 16613 ESP EBP; 16614FI; 16615IF OperandSize = 16 16616THEN 16617 BP Pop(); 16618ELSE (* OperandSize = 32 *) 16619 EBP Pop(); 16620FI; 16621 16622Description 16623 16624LEAVE reverses the actions of the ENTER instruction. By copying the 16625frame pointer to the stack pointer, LEAVE releases the stack space used 16626by a procedure for its local variables. The old frame pointer is popped 16627into BP or EBP, restoring the caller's frame. A subsequent RET 16628instruction removes any arguments pushed onto the stack of the exiting 16629procedure. 16630 16631Flags Affected 16632 16633None 16634 16635Protected Mode Exceptions 16636 16637#SS(0) if BP does not point to a location within the limits of the current 16638stack segment 16639 16640Real Address Mode Exceptions 16641 16642Interrupt 13 if any part of the operand would lie outside of the effective 16643address space from 0 to 0FFFFH 16644 16645Virtual 8086 Mode Exceptions 16646 16647Same exceptions as in Real Address Mode 16648 16649 16650LGDT/LIDT Load Global/Interrupt Descriptor Table Register 16651 16652Opcode Instruction Clocks Description 16653 166540F 01 /2 LGDT m16&32 11 Load m into GDTR 166550F 01 /3 LIDT m16&32 11 Load m into IDTR 16656 16657 16658Operation 16659 16660IF instruction = LIDT 16661THEN 16662 IF OperandSize = 16 16663 THEN IDTR.Limit:Base m16:24 (* 24 bits of base loaded *) 16664 ELSE IDTR.Limit:Base m16:32 16665 FI; 16666ELSE (* instruction = LGDT *) 16667 IF OperandSize = 16 16668 THEN GDTR.Limit:Base m16:24 (* 24 bits of base loaded *) 16669 ELSE GDTR.Limit:Base m16:32; 16670 FI; 16671FI; 16672 16673Description 16674 16675The LGDT and LIDT instructions load a linear base address and limit 16676value from a six-byte data operand in memory into the GDTR or IDTR, 16677respectively. If a 16-bit operand is used with LGDT or LIDT, the 16678register is loaded with a 16-bit limit and a 24-bit base, and the 16679high-order eight bits of the six-byte data operand are not used. If a 32-bit 16680operand is used, a 16-bit limit and a 32-bit base is loaded; the high-order 16681eight bits of the six-byte operand are used as high-order base address bits. 16682 16683The SGDT and SIDT instructions always store into all 48 bits of the 16684six-byte data operand. With the 80286, the upper eight bits are undefined 16685after SGDT or SIDT is executed. With the 80386, the upper eight bits 16686are written with the high-order eight address bits, for both a 16-bit 16687operand and a 32-bit operand. If LGDT or LIDT is used with a 16-bit 16688operand to load the register stored by SGDT or SIDT, the upper eight 16689bits are stored as zeros. 16690 16691LGDT and LIDT appear in operating system software; they are not used 16692in application programs. They are the only instructions that directly load 16693a linear address (i.e., not a segment relative address) in 80386 Protected 16694Mode. 16695 16696Flags Affected 16697 16698None 16699 16700Protected Mode Exceptions 16701 16702#GP(0) if the current privilege level is not 0; #UD if the source operand 16703is a register; #GP(0) for an illegal memory operand effective address in 16704the CS, DS, ES, FS, or GS segments; #SS(0) for an illegal address in 16705the SS segment; #PF(fault-code) for a page fault 16706 16707Real Address Mode Exceptions 16708 16709Interrupt 13 if any part of the operand would lie outside of the effective 16710address space from 0 to 0FFFFH; Interrupt 6 if the source operand is a 16711register 16712 16713 16714Note: 16715 These instructions are valid in Real Address Mode to allow 16716 power-up initialization for Protected Mode 16717 16718 16719Virtual 8086 Mode Exceptions 16720 16721Same exceptions as in Real Address Mode; #PF(fault-code) for a page 16722fault 16723 16724 16725LGS/LSS/LDS/LES/LFS Load Full Pointer 16726 16727Opcode Instruction Clocks Description 16728 16729C5 /r LDS r16,m16:16 7,p=22 Load DS:r16 with pointer from memory 16730C5 /r LDS r32,m16:32 7,p=22 Load DS:r32 with pointer from memory 167310F B2 /r LSS r16,m16:16 7,p=22 Load SS:r16 with pointer from memory 167320F B2 /r LSS r32,m16:32 7,p=22 Load SS:r32 with pointer from memory 16733C4 /r LES r16,m16:16 7,p=22 Load ES:r16 with pointer from memory 16734C4 /r LES r32,m16:32 7,p=22 Load ES:r32 with pointer from memory 167350F B4 /r LFS r16,m16:16 7,p=25 Load FS:r16 with pointer from memory 167360F B4 /r LFS r32,m16:32 7,p=25 Load FS:r32 with pointer from memory 167370F B5 /r LGS r16,m16:16 7,p=25 Load GS:r16 with pointer from memory 167380F B5 /r LGS r32,m16:32 7,p=25 Load GS:r32 with pointer from memory 16739 16740 16741Operation 16742 16743CASE instruction OF 16744 LSS: Sreg is SS; (* Load SS register *) 16745 LDS: Sreg is DS; (* Load DS register *) 16746 LES: Sreg is ES; (* Load ES register *) 16747 LFS: Sreg is FS; (* Load FS register *) 16748 LGS: Sreg is DS; (* Load GS register *) 16749ESAC; 16750IF (OperandSize = 16) 16751THEN 16752 r16 [Effective Address]; (* 16-bit transfer *) 16753 Sreg [Effective Address + 2]; (* 16-bit transfer *) 16754 (* In Protected Mode, load the descriptor into the segment register *) 16755ELSE (* OperandSize = 32 *) 16756 r32 [Effective Address]; (* 32-bit transfer *) 16757 Sreg [Effective Address + 4]; (* 16-bit transfer *) 16758 (* In Protected Mode, load the descriptor into the segment register *) 16759FI; 16760 16761Description 16762 16763These instructions read a full pointer from memory and store it in the 16764selected segment register:register pair. The full pointer loads 16 bits 16765into the segment register SS, DS, ES, FS, or GS. The other register loads 32 16766bits if the operand-size attribute is 32 bits, or loads 16 bits if the 16767operand-size attribute is 16 bits. The other 16- or 32-bit register to be 16768loaded is determined by the r16 or r32 register operand specified. 16769 16770When an assignment is made to one of the segment registers, the 16771descriptor is also loaded into the segment register. The data for the 16772register is obtained from the descriptor table entry for the selector 16773given. 16774 16775A null selector (values 0000-0003) can be loaded into DS, ES, FS, or 16776GS registers without causing a protection exception. (Any subsequent 16777reference to a segment whose corresponding segment register is loaded 16778with a null selector to address memory causes a #GP(0) exception. No 16779memory reference to the segment occurs.) 16780 16781The following is a listing of the Protected Mode checks and actions taken in 16782the loading of a segment register: 16783 16784IF SS is loaded: 16785 IF selector is null THEN #GP(0); FI; 16786 Selector index must be within its descriptor table limits ELSE 16787 #GP(selector); 16788 Selector's RPL must equal CPL ELSE #GP(selector); 16789 AR byte must indicate a writable data segment ELSE #GP(selector); 16790 DPL in the AR byte must equal CPL ELSE #GP(selector); 16791 Segment must be marked present ELSE #SS(selector); 16792 Load SS with selector; 16793 Load SS with descriptor; 16794IF DS, ES, FS, or GS is loaded with non-null selector: 16795 Selector index must be within its descriptor table limits ELSE 16796 #GP(selector); 16797 AR byte must indicate data or readable code segment ELSE 16798 #GP(selector); 16799 IF data or nonconforming code 16800 THEN both the RPL and the CPL must be less than or equal to DPL in 16801 AR byte; 16802 ELSE #GP(selector); 16803 Segment must be marked present ELSE #NP(selector); 16804Load segment register with selector and RPL bits; 16805Load segment register with descriptor; 16806IF DS, ES, FS or GS is loaded with a null selector: 16807 Clear descriptor valid bit; 16808 16809Flags Affected 16810 16811None 16812 16813Protected Mode Exceptions 16814 16815#GP(0) for an illegal memory operand effective address in the CS, DS, 16816ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 16817the second operand must be a memory operand, not a register; #GP(0) 16818if a null selector is loaded into SS; #PF(fault-code) for a page fault 16819 16820Real Address Mode Exceptions 16821 16822The second operand must be a memory operand, not a register; Interrupt 1682313 if any part of the operand would lie outside of the effective address 16824space from 0 to 0FFFFH 16825 16826Virtual 8086 Mode Exceptions 16827 16828Same exceptions as in Real Address Mode; #PF(fault-code) for a page 16829fault 16830 16831 16832LLDT Load Local Descriptor Table Register 16833 16834Opcode Instruction Clocks Description 16835 168360F 00 /2 LLDT r/m16 20 Load selector r/m16 into LDTR 16837 16838 16839Operation 16840 16841LDTR SRC; 16842 16843Description 16844 16845LLDT loads the Local Descriptor Table register (LDTR). The word 16846operand (memory or register) to LLDT should contain a selector to the 16847Global Descriptor Table (GDT). The GDT entry should be a Local Descriptor 16848Table. If so, then the LDTR is loaded from the entry. The descriptor 16849registers DS, ES, SS, FS, GS, and CS are not affected. The LDT field in the 16850task state segment does not change. 16851 16852The selector operand can be 0; if so, the LDTR is marked invalid. All 16853descriptor references (except by the LAR, VERR, VERW or LSL 16854instructions) cause a #GP fault. 16855 16856LLDT is used in operating system software; it is not used in application 16857programs. 16858 16859Flags Affected 16860 16861None 16862 16863Protected Mode Exceptions 16864 16865#GP(0) if the current privilege level is not 0; #GP(selector) if the 16866selector operand does not point into the Global Descriptor Table, or if the 16867entry in the GDT is not a Local Descriptor Table; #NP(selector) if the 16868LDT descriptor is not present; #GP(0) for an illegal memory operand 16869effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an 16870illegal address in the SS segment; #PF(fault-code) for a page fault 16871 16872Real Address Mode Exceptions 16873 16874Interrupt 6; LLDT is not recognized in Real Address Mode 16875 16876Virtual 8086 Mode Exceptions 16877 16878Same exceptions as in Real Address Mode (because the instruction is 16879not recognized, it will not execute or perform a memory reference) 16880 16881Note 16882 16883The operand-size attribute has no effect on this instruction. 16884 16885 16886LMSW Load Machine Status Word 16887 16888Opcode Instruction Clocks Description 16889 168900F 01 /6 LMSW r/m16 10/13 Load r/m16 in machine status word 16891 16892 16893Operation 16894 16895MSW r/m16; (* 16 bits is stored in the machine status word *) 16896 16897Description 16898 16899LMSW loads the machine status word (part of CR0) from the source 16900operand. This instruction can be used to switch to Protected Mode; if so, 16901it must be followed by an intrasegment jump to flush the instruction 16902queue. LMSW will not switch back to Real Address Mode. 16903 16904LMSW is used only in operating system software. It is not used in 16905application programs. 16906 16907Flags Affected 16908 16909None 16910 16911Protected Mode Exceptions 16912 16913#GP(0) if the current privilege level is not 0; #GP(0) for an illegal 16914memory operand effective address in the CS, DS, ES, FS, or GS 16915segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 16916for a page fault 16917 16918Real Address Mode Exceptions 16919 16920Interrupt 13 if any part of the operand would lie outside of the effective 16921address space from 0 to 0FFFFH 16922 16923Virtual 8086 Mode Exceptions 16924 16925Same exceptions as in Real Address Mode; #PF(fault-code) for a page 16926fault 16927 16928Notes 16929 16930The operand-size attribute has no effect on this instruction. This 16931instruction is provided for compatibility with the 80286; 80386 programs 16932should use MOV CR0, ... instead. 16933 16934 16935LOCK Assert LOCK# Signal Prefix 16936 16937Opcode Instruction Clocks Description 16938 16939F0 LOCK 0 Assert LOCK# signal for the next instruction 16940 16941 16942Description 16943 16944The LOCK prefix causes the LOCK# signal of the 80386 to be asserted 16945during execution of the instruction that follows it. In a multiprocessor 16946environment, this signal can be used to ensure that the 80386 has 16947exclusive use of any shared memory while LOCK# is asserted. The 16948read-modify-write sequence typically used to implement test-and-set on the 1694980386 is the BTS instruction. 16950 16951The LOCK prefix functions only with the following instructions: 16952 16953BT, BTS, BTR, BTC mem, reg/imm 16954XCHG reg, mem 16955XCHG mem, reg 16956ADD, OR, ADC, SBB, AND, SUB, XOR mem, reg/imm 16957NOT, NEG, INC, DEC mem 16958 16959An undefined opcode trap will be generated if a LOCK prefix is used 16960with any instruction not listed above. 16961 16962XCHG always asserts LOCK# regardless of the presence or absence of 16963the LOCK prefix. 16964 16965The integrity of the LOCK is not affected by the alignment of the 16966memory field. Memory locking is observed for arbitrarily misaligned 16967fields. 16968 16969Locked access is not assured if another 80386 processor is executing an 16970instruction concurrently that has one of the following characteristics: 16971 16972 Is not preceded by a LOCK prefix 16973 16974 Is not one of the instructions in the preceding list 16975 16976 Specifies a memory operand that does not exactly overlap the 16977 destination operand. Locking is not guaranteed for partial overlap, 16978 even if one memory operand is wholly contained within another. 16979 16980Flags Affected 16981 16982None 16983 16984Protected Mode Exceptions 16985 16986#UD if LOCK is used with an instruction not listed in the "Description" 16987section above; other exceptions can be generated by the subsequent 16988(locked) instruction 16989 16990Real Address Mode Exceptions 16991 16992Interrupt 6 if LOCK is used with an instruction not listed in the 16993"Description" section above; exceptions can still be generated by the 16994subsequent (locked) instruction 16995 16996Virtual 8086 Mode Exceptions 16997 16998#UD if LOCK is used with an instruction not listed in the "Description" 16999section above; exceptions can still be generated by the subsequent (locked) 17000instruction 17001 17002 17003LODS/LODSB/LODSW/LODSD Load String Operand 17004 17005Opcode Instruction Clocks Description 17006 17007AC LODS m8 5 Load byte [(E)SI] into AL 17008AD LODS m16 5 Load word [(E)SI] into AX 17009AD LODS m32 5 Load dword [(E)SI] into EAX 17010AC LODSB 5 Load byte DS:[(E)SI] into AL 17011AD LODSW 5 Load word DS:[(E)SI] into AX 17012AD LODSD 5 Load dword DS:[(E)SI] into EAX 17013 17014 17015Operation 17016 17017IF AddressSize = 16 17018THEN use SI for source-index 17019ELSE (* AddressSize = 32 *) 17020 use ESI for source-index; 17021FI; 17022IF byte type of instruction 17023THEN 17024 AL [source-index]; (* byte load *) 17025 IF DF = 0 THEN IncDec 1 ELSE IncDec -1; FI; 17026ELSE 17027 IF OperandSize = 16 17028 THEN 17029 AX [source-index]; (* word load *) 17030 IF DF = 0 THEN IncDec 2 ELSE IncDec -2; FI; 17031 ELSE (* OperandSize = 32 *) 17032 EAX [source-index]; (* dword load *) 17033 IF DF = 0 THEN IncDec 4 ELSE IncDec -4; FI; 17034 FI; 17035FI; 17036source-index source-index + IncDec 17037 17038Description 17039 17040LODS loads the AL, AX, or EAX register with the memory byte, word, 17041or doubleword at the location pointed to by the source-index register. 17042After the transfer is made, the source-index register is automatically 17043advanced. If the direction flag is 0 (CLD was executed), the source index 17044increments; if the direction flag is 1 (STD was executed), it decrements. 17045The increment or decrement is 1 if a byte is loaded, 2 if a word is loaded, 17046or 4 if a doubleword is loaded. 17047 17048If the address-size attribute for this instruction is 16 bits, SI is used 17049for the source-index register; otherwise the address-size attribute is 32 17050bits, and the ESI register is used. The address of the source data is 17051determined solely by the contents of ESI/SI. Load the correct index value 17052into SI before executing the LODS instruction. LODSB, LODSW, LODSD are 17053synonyms for the byte, word, and doubleword LODS instructions. 17054 17055LODS can be preceded by the REP prefix; however, LODS is used more typically 17056within a LOOP construct, because further processing of the data moved into 17057EAX, AX, or AL is usually necessary. 17058 17059Flags Affected 17060 17061None 17062 17063Protected Mode Exceptions 17064 17065#GP(0) for an illegal memory operand effective address in the CS, DS, 17066ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 17067#PF(fault-code) for a page fault 17068 17069Real Address Mode Exceptions 17070 17071Interrupt 13 if any part of the operand would lie outside of the effective 17072address space from 0 to 0FFFFH 17073 17074Virtual 8086 Mode Exceptions 17075 17076Same exceptions as in Real Address Mode; #PF(fault-code) for a page 17077fault 17078 17079 17080LOOP/LOOPcond Loop Control with CX Counter 17081 17082Opcode Instruction Clocks Description 17083 17084E2 cb LOOP rel8 11+m DEC count; jump short if count <> 0 17085E1 cb LOOPE rel8 11+m DEC count; jump short if count <> 0 and ZF=1 17086E1 cb LOOPZ rel8 11+m DEC count; jump short if count <> 0 and ZF=1 17087E0 cb LOOPNE rel8 11+m DEC count; jump short if count <> 0 and ZF=0 17088E0 cb LOOPNZ rel8 11+m DEC count; jump short if count <> 0 and ZF=0 17089 17090 17091Operation 17092 17093IF AddressSize = 16 THEN CountReg is CX ELSE CountReg is ECX; FI; 17094CountReg CountReg - 1; 17095IF instruction <> LOOP 17096THEN 17097 IF (instruction = LOOPE) OR (instruction = LOOPZ) 17098 THEN BranchCond (ZF = 1) AND (CountReg <> 0); 17099 FI; 17100 IF (instruction = LOOPNE) OR (instruction = LOOPNZ) 17101 THEN BranchCond (ZF = 0) AND (CountReg <> 0); 17102 FI; 17103FI; 17104 17105IF BranchCond 17106THEN 17107 IF OperandSize = 16 17108 THEN 17109 IP IP + SignExtend(rel8); 17110 ELSE (* OperandSize = 32 *) 17111 EIP EIP + SignExtend(rel8); 17112 FI; 17113FI; 17114 17115Description 17116 17117LOOP decrements the count register without changing any of the flags. 17118Conditions are then checked for the form of LOOP being used. If the 17119conditions are met, a short jump is made to the label given by the operand 17120to LOOP. If the address-size attribute is 16 bits, the CX register is used 17121as the count register; otherwise the ECX register is used. The operand 17122of LOOP must be in the range from 128 (decimal) bytes before the 17123instruction to 127 bytes ahead of the instruction. 17124 17125The LOOP instructions provide iteration control and combine loop index 17126management with conditional branching. Use the LOOP instruction by 17127loading an unsigned iteration count into the count register, then code the 17128LOOP at the end of a series of instructions to be iterated. The 17129destination of LOOP is a label that points to the beginning of the 17130iteration. 17131 17132Flags Affected 17133 17134None 17135 17136Protected Mode Exceptions 17137 17138#GP(0) if the offset jumped to is beyond the limits of the current code 17139segment 17140 17141Real Address Mode Exceptions 17142 17143None 17144 17145Virtual 8086 Mode Exceptions 17146 17147None 17148 17149 17150LSL Load Segment Limit 17151 17152Opcode Instruction Clocks Description 17153 171540F 03 /r LSL r16,r/m16 pm=20/21 Load: r16 segment limit, 17155 selector r/m16 (byte granular) 171560F 03 /r LSL r32,r/m32 pm=20/21 Load: r32 segment limit, 17157 selector r/m32 (byte granular) 171580F 03 /r LSL r16,r/m16 pm=25/26 Load: r16 segment limit, 17159 selector r/m16 (page granular) 171600F 03 /r LSL r32,r/m32 pm=25/26 Load: r32 segment limit, 17161 selector r/m32 (page granular) 17162 17163 17164Description 17165 17166The LSL instruction loads a register with an unscrambled segment limit, 17167and sets ZF to 1, provided that the source selector is visible at the CPL 17168weakened by RPL, and that the descriptor is a type accepted by LSL. 17169Otherwise, ZF is cleared to 0, and the destination register is unchanged. 17170The segment limit is loaded as a byte granular value. If the descriptor 17171has a page granular segment limit, LSL will translate it to a byte limit 17172before loading it in the destination register (shift left 12 the 20-bit 17173"raw" limit from descriptor, then OR with 00000FFFH). 17174 17175The 32-bit forms of this instruction store the 32-bit byte granular limit 17176in the 16-bit destination register. 17177 17178Code and data segment descriptors are valid for LSL. 17179 17180The valid special segment and gate descriptor types for LSL are given 17181in the following table: 17182 17183Type Name Valid/Invalid 17184 17185 0 Invalid Invalid 17186 1 Available 80286 TSS Valid 17187 2 LDT Valid 17188 3 Busy 80286 TSS Valid 17189 4 80286 call gate Invalid 17190 5 80286/80386 task gate Invalid 17191 6 80286 trap gate Invalid 17192 7 80286 interrupt gate Invalid 17193 8 Invalid Valid 17194 9 Available 80386 TSS Valid 17195 A Invalid Invalid 17196 B Busy 80386 TSS Valid 17197 C 80386 call gate Invalid 17198 D Invalid Invalid 17199 E 80386 trap gate Invalid 17200 F 80386 interrupt gate Invalid 17201 17202Flags Affected 17203 17204ZF as described above 17205 17206Protected Mode Exceptions 17207 17208#GP(0) for an illegal memory operand effective address in the CS, DS, 17209ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 17210#PF(fault-code) for a page fault 17211 17212Real Address Mode Exceptions 17213 17214Interrupt 6; LSL is not recognized in Real Address Mode 17215 17216Virtual 8086 Mode Exceptions 17217 17218Same exceptions as in Real Address Mode 17219 17220 17221LTR Load Task Register 17222 17223Opcode Instruction Clocks Description 17224 172250F 00 /3 LTR r/m16 pm=23/27 Load EA word into task register 17226 17227 17228Description 17229 17230LTR loads the task register from the source register or memory location 17231specified by the operand. The loaded task state segment is marked busy. 17232A task switch does not occur. 17233 17234LTR is used only in operating system software; it is not used in 17235application programs. 17236 17237Flags Affected 17238 17239None 17240 17241Protected Mode Exceptions 17242 17243#GP(0) for an illegal memory operand effective address in the CS, DS, 17244ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 17245#GP(0) if the current privilege level is not 0; #GP(selector) if the object 17246named by the source selector is not a TSS or is already busy; 17247#NP(selector) if the TSS is marked "not present"; #PF(fault-code) for 17248a page fault 17249 17250Real Address Mode Exceptions 17251 17252Interrupt 6; LTR is not recognized in Real Address Mode 17253 17254Virtual 8086 Mode Exceptions 17255 17256Same exceptions as in Real Address Mode 17257 17258Notes 17259 17260The operand-size attribute has no effect on this instruction. 17261 17262 17263MOV Move Data 17264 17265 17266Opcode Instruction Clocks Description 17267 1726888 /r MOV r/m8,r8 2/2 Move byte register to r/m byte 1726989 /r MOV r/m16,r16 2/2 Move word register to r/m word 1727089 /r MOV r/m32,r32 2/2 Move dword register to r/m dword 172718A /r MOV r8,r/m8 2/4 Move r/m byte to byte register 172728B /r MOV r16,r/m16 2/4 Move r/m word to word register 172738B /r MOV r32,r/m32 2/4 Move r/m dword to dword register 172748C /r MOV r/m16,Sreg 2/2 Move segment register to r/m word 172758D /r MOV Sreg,r/m16 2/5,pm=18/19 Move r/m word to segment register 17276A0 MOV AL,moffs8 4 Move byte at (seg:offset) to AL 17277A1 MOV AX,moffs16 4 Move word at (seg:offset) to AX 17278A1 MOV EAX,moffs32 4 Move dword at (seg:offset) to EAX 17279A2 MOV moffs8,AL 2 Move AL to (seg:offset) 17280A3 MOV moffs16,AX 2 Move AX to (seg:offset) 17281A3 MOV moffs32,EAX 2 Move EAX to (seg:offset) 17282B0 + rb MOV reg8,imm8 2 Move immediate byte to register 17283B8 + rw MOV reg16,imm16 2 Move immediate word to register 17284B8 + rd MOV reg32,imm32 2 Move immediate dword to register 17285C6 MOV r/m8,imm8 2/2 Move immediate byte to r/m byte 17286C7 MOV r/m16,imm16 2/2 Move immediate word to r/m word 17287C7 MOV r/m32,imm32 2/2 Move immediate dword to r/m dword 17288 17289 17290 17291NOTES: 17292 moffs8, moffs16, and moffs32 all consist of a simple offset relative 17293 to the segment base. The 8, 16, and 32 refer to the size of the data. The 17294 address-size attribute of the instruction determines the size of the 17295 offset, either 16 or 32 bits. 17296 17297 17298Operation 17299 17300DEST SRC; 17301 17302Description 17303 17304MOV copies the second operand to the first operand. 17305 17306If the destination operand is a segment register (DS, ES, SS, etc.), then 17307data from a descriptor is also loaded into the register. The data for the 17308register is obtained from the descriptor table entry for the selector 17309given. A null selector (values 0000-0003) can be loaded into DS and ES 17310registers without causing an exception; however, use of DS or ES causes a 17311#GP(0), and no memory reference occurs. 17312 17313A MOV into SS inhibits all interrupts until after the execution of the 17314next instruction (which is presumably a MOV into eSP). 17315 17316Loading a segment register under 80386 Protected Mode results in special 17317checks and actions, as described in the following listing: 17318 17319IF SS is loaded; 17320THEN 17321 IF selector is null THEN #GP(0); 17322FI; 17323 Selector index must be within its descriptor table limits else 17324 #GP(selector); 17325 Selector's RPL must equal CPL else #GP(selector); 17326AR byte must indicate a writable data segment else #GP(selector); 17327 DPL in the AR byte must equal CPL else #GP(selector); 17328 Segment must be marked present else #SS(selector); 17329 Load SS with selector; 17330 Load SS with descriptor. 17331FI; 17332IF DS, ES, FS or GS is loaded with non-null selector; 17333THEN 17334 Selector index must be within its descriptor table limits 17335 else #GP(selector); 17336 AR byte must indicate data or readable code segment else 17337 #GP(selector); 17338 IF data or nonconforming code segment 17339 THEN both the RPL and the CPL must be less than or equal to DPL in 17340 AR byte; 17341 ELSE #GP(selector); 17342 FI; 17343 Segment must be marked present else #NP(selector); 17344 Load segment register with selector; 17345 Load segment register with descriptor; 17346FI; 17347IF DS, ES, FS or GS is loaded with a null selector; 17348THEN 17349 Load segment register with selector; 17350 Clear descriptor valid bit; 17351FI; 17352 17353Flags Affected 17354 17355None 17356 17357Protected Mode Exceptions 17358 17359#GP, #SS, and #NP if a segment register is being loaded; otherwise, 17360#GP(0) if the destination is in a nonwritable segment; #GP(0) for an 17361illegal memory operand effective address in the CS, DS, ES, FS, or GS 17362segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 17363for a page fault 17364 17365Real Address Mode Exceptions 17366 17367Interrupt 13 if any part of the operand would lie outside of the effective 17368address space from 0 to 0FFFFH 17369 17370Virtual 8086 Mode Exceptions 17371 17372Same exceptions as in Real Address Mode; #PF(fault-code) for a page 17373fault 17374 17375 17376MOV Move to/from Special Registers 17377 17378Opcode Instruction Clocks Description 17379 173800F 20 /r MOV r32,CR0/CR2/CR3 6 Move (control register) to 17381 (register) 173820F 22 /r MOV CR0/CR2/CR3,r32 10/4/5 Move (register) to (control 17383 register) 173840F 21 /r MOV r32,DR0 -- 3 22 Move (debug register) to 17385 (register) 173860F 21 /r MOV r32,DR6/DR7 14 Move (debug register) to 17387 (register) 173880F 23 /r MOV DR0 -- 3,r32 22 Move (register) to (debug 17389 register) 173900F 23 /r MOV DR6/DR7,r32 16 Move (register) to (debug 17391 register) 173920F 24 /r MOV r32,TR6/TR7 12 Move (test register) to 17393 (register) 173940F 26 /r MOV TR6/TR7,r32 12 Move (register) to (test 17395 register) 17396 17397 17398Operation 17399 17400DEST SRC; 17401 17402Description 17403 17404The above forms of MOV store or load the following special registers in 17405or from a general purpose register: 17406 17407 Control registers CR0, CR2, and CR3 17408 Debug Registers DR0, DR1, DR2, DR3, DR6, and DR7 17409 Test Registers TR6 and TR7 17410 1741132-bit operands are always used with these instructions, regardless of the 17412operand-size attribute. 17413 17414Flags Affected 17415 17416OF, SF, ZF, AF, PF, and CF are undefined 17417 17418Protected Mode Exceptions 17419 17420#GP(0) if the current privilege level is not 0 17421 17422Real Address Mode Exceptions 17423 17424None 17425 17426Virtual 8086 Mode Exceptions 17427 17428#GP(0) if instruction execution is attempted 17429 17430Notes 17431 17432The instructions must be executed at privilege level 0 or in real-address 17433mode; otherwise, a protection exception will be raised. 17434 17435The reg field within the ModRM byte specifies which of the special 17436registers in each category is involved. The two bits in the field are 17437always 11. The r/m field specifies the general register involved. 17438 17439 17440MOVS/MOVSB/MOVSW/MOVSD Move Data from String to String 17441 17442Opcode Instruction Clocks Description 17443 17444A4 MOVS m8,m8 7 Move byte [(E)SI] to ES:[(E)DI] 17445A5 MOVS m16,m16 7 Move word [(E)SI] to ES:[(E)DI] 17446A5 MOVS m32,m32 7 Move dword [(E)SI] to ES:[(E)DI] 17447A4 MOVSB 7 Move byte DS:[(E)SI] to ES:[(E)DI] 17448A5 MOVSW 7 Move word DS:[(E)SI] to ES:[(E)DI] 17449A5 MOVSD 7 Move dword DS:[(E)SI] to ES:[(E)DI] 17450 17451 17452Operation 17453 17454IF (instruction = MOVSD) OR (instruction has doubleword operands) 17455THEN OperandSize 32; 17456ELSE OperandSize 16; 17457IF AddressSize = 16 17458THEN use SI for source-index and DI for destination-index; 17459ELSE (* AddressSize = 32 *) 17460 use ESI for source-index and EDI for destination-index; 17461FI; 17462IF byte type of instruction 17463THEN 17464 [destination-index] [source-index]; (* byte assignment *) 17465 IF DF = 0 THEN IncDec 1 ELSE IncDec -1; FI; 17466ELSE 17467 IF OperandSize = 16 17468 THEN 17469 [destination-index] [source-index]; (* word assignment *) 17470 IF DF = 0 THEN IncDec 2 ELSE IncDec -2; FI; 17471 ELSE (* OperandSize = 32 *) 17472 [destination-index] [source-index]; (* doubleword assignment *) 17473 IF DF = 0 THEN IncDec 4 ELSE IncDec -4; FI; 17474 FI; 17475FI; 17476source-index source-index + IncDec; 17477destination-index destination-index + IncDec; 17478 17479Description 17480 17481MOVS copies the byte or word at [(E)SI] to the byte or word at 17482ES:[(E)DI]. The destination operand must be addressable from the ES 17483register; no segment override is possible for the destination. A segment 17484override can be used for the source operand; the default is DS. 17485 17486The addresses of the source and destination are determined solely by the 17487contents of (E)SI and (E)DI. Load the correct index values into (E)SI 17488and (E)DI before executing the MOVS instruction. MOVSB, MOVSW, 17489and MOVSD are synonyms for the byte, word, and doubleword MOVS 17490instructions. 17491 17492After the data is moved, both (E)SI and (E)DI are advanced 17493automatically. If the direction flag is 0 (CLD was executed), the registers 17494are incremented; if the direction flag is 1 (STD was executed), the 17495registers are decremented. The registers are incremented or decremented by 1 17496if a byte was moved, 2 if a word was moved, or 4 if a doubleword was moved. 17497 17498MOVS can be preceded by the REP prefix for block movement of CX 17499bytes or words. Refer to the REP instruction for details of this operation. 17500 17501Flags Affected 17502 17503None 17504 17505Protected Mode Exceptions 17506 17507#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 17508memory operand effective address in the CS, DS, ES, FS, or GS 17509segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 17510for a page fault 17511 17512Real Address Mode Exceptions 17513 17514Interrupt 13 if any part of the operand would lie outside of the effective 17515address space from 0 to 0FFFFH 17516 17517Virtual 8086 Mode Exceptions 17518 17519Same exceptions as in Real Address Mode; #PF(fault-code) for a page 17520fault 17521 17522 17523MOVSX Move with Sign-Extend 17524 17525Opcode Instruction Clocks Description 17526 175270F BE /r MOVSX r16,r/m8 3/6 Move byte to word with sign-extend 175280F BE /r MOVSX r32,r/m8 3/6 Move byte to dword, sign-extend 175290F BF /r MOVSX r32,r/m16 3/6 Move word to dword, sign-extend 17530 17531 17532Operation 17533 17534DEST SignExtend(SRC); 17535 17536Description 17537 17538MOVSX reads the contents of the effective address or register as a byte 17539or a word, sign-extends the value to the operand-size attribute of the 17540instruction (16 or 32 bits), and stores the result in the destination 17541register. 17542 17543Flags Affected 17544 17545None 17546 17547Protected Mode Exceptions 17548 17549#GP(0) for an illegal memory operand effective address in the CS, DS, 17550ES, FS or GS segments; #SS(0) for an illegal address in the SS segment; 17551#PF(fault-code) for a page fault 17552 17553Real Address Mode Exceptions 17554 17555Interrupt 13 if any part of the operand would lie outside of the effective 17556address space from 0 to 0FFFFH 17557 17558Virtual 8086 Mode Exceptions 17559 17560Same exceptions as in Real Address Mode; #PF(fault-code) for a page 17561fault 17562 17563 17564MOVZX Move with Zero-Extend 17565 17566Opcode Instruction Clocks Description 17567 175680F B6 /r MOVZX r16,r/m8 3/6 Move byte to word with zero-extend 175690F B6 /r MOVZX r32,r/m8 3/6 Move byte to dword, zero-extend 175700F B7 /r MOVZX r32,r/m16 3/6 Move word to dword, zero-extend 17571 17572 17573Operation 17574 17575DEST ZeroExtend(SRC); 17576 17577Description 17578 17579MOVZX reads the contents of the effective address or register as a byte 17580or a word, zero extends the value to the operand-size attribute of the 17581instruction (16 or 32 bits), and stores the result in the destination 17582register. 17583 17584Flags Affected 17585 17586None 17587 17588Protected Mode Exceptions 17589 17590#GP(0) for an illegal memory operand effective address in the CS, DS, 17591ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 17592#PF(fault-code) for a page fault 17593 17594Real Address Mode Exceptions 17595 17596Interrupt 13 if any part of the operand would lie outside of the effective 17597address space from 0 to 0FFFFH 17598 17599Virtual 8086 Mode Exceptions 17600 17601Same exceptions as in Real Address Mode; #PF(fault-code) for a page 17602fault 17603 17604 17605MUL Unsigned Multiplication of AL or AX 17606 17607Opcode Instruction Clocks Description 17608 17609F6 /4 MUL AL,r/m8 9-14/12-17 Unsigned multiply (AX AL * r/m byte) 17610F7 /4 MUL AX,r/m16 9-22/12-25 Unsigned multiply (DX:AX AX * r/m 17611 word) 17612F7 /4 MUL EAX,r/m32 9-38/12-41 Unsigned multiply (EDX:EAX EAX * r/m 17613 dword) 17614 17615 17616 17617NOTES: 17618 The 80386 uses an early-out multiply algorithm. The actual number of 17619 clocks depends on the position of the most significant bit in the 17620 optimizing multiplier, shown underlined above. The optimization occurs 17621 for positive and negative multiplier values. Because of the early-out 17622 algorithm, clock counts given are minimum to maximum. To calculate the 17623 actual clocks, use the following formula: 17624 17625 Actual clock = if <> 0 then max(ceiling(log{2} m), 3) + 6 clocks; 17626 17627 Actual clock = if = 0 then 9 clocks 17628 17629 where m is the multiplier. 17630 17631 17632Operation 17633 17634IF byte-size operation 17635THEN AX AL * r/m8 17636ELSE (* word or doubleword operation *) 17637 IF OperandSize = 16 17638 THEN DX:AX AX * r/m16 17639 ELSE (* OperandSize = 32 *) 17640 EDX:EAX EAX * r/m32 17641 FI; 17642FI; 17643 17644Description 17645 17646MUL performs unsigned multiplication. Its actions depend on the size 17647of its operand, as follows: 17648 17649 A byte operand is multiplied by AL; the result is left in AX. The 17650 carry and overflow flags are set to 0 if AH is 0; otherwise, they are 17651 set to 1. 17652 17653 A word operand is multiplied by AX; the result is left in DX:AX. 17654 DX contains the high-order 16 bits of the product. The carry and 17655 overflow flags are set to 0 if DX is 0; otherwise, they are set to 1. 17656 17657 A doubleword operand is multiplied by EAX and the result is left in 17658 EDX:EAX. EDX contains the high-order 32 bits of the product. The 17659 carry and overflow flags are set to 0 if EDX is 0; otherwise, they are 17660 set to 1. 17661 17662Flags Affected 17663 17664OF and CF as described above; SF, ZF, AF, PF, and CF are undefined 17665 17666Protected Mode Exceptions 17667 17668#GP(0) for an illegal memory operand effective address in the CS, DS, 17669ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 17670#PF(fault-code) for a page fault 17671 17672Real Address Mode Exceptions 17673 17674Interrupt 13 if any part of the operand would lie outside of the effective 17675address space from 0 to 0FFFFH 17676 17677Virtual 8086 Mode Exceptions 17678 17679Same exceptions as in Real Address Mode; #PF(fault-code) for a page 17680fault 17681 17682 17683NEG Two's Complement Negation 17684 17685Opcode Instruction Clocks Description 17686 17687F6 /3 NEG r/m8 2/6 Two's complement negate r/m byte 17688F7 /3 NEG r/m16 2/6 Two's complement negate r/m word 17689F7 /3 NEG r/m32 2/6 Two's complement negate r/m dword 17690 17691 17692Operation 17693 17694IF r/m = 0 THEN CF 0 ELSE CF 1; FI; 17695r/m - r/m; 17696 17697Description 17698 17699NEG replaces the value of a register or memory operand with its two's 17700complement. The operand is subtracted from zero, and the result is placed 17701in the operand. 17702 17703The carry flag is set to 1, unless the operand is zero, in which case the 17704carry flag is cleared to 0. 17705 17706Flags Affected 17707 17708CF as described above; OF, SF, ZF, and PF as described in Appendix C 17709 17710Protected Mode Exceptions 17711 17712#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 17713memory operand effective address in the CS, DS, ES, FS, or GS 17714segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 17715for a page fault 17716 17717Real Address Mode Exceptions 17718 17719Interrupt 13 if any part of the operand would lie outside of the effective 17720address space from 0 to 0FFFFH 17721 17722Virtual 8086 Mode Exceptions 17723 17724Same exceptions as in real-address mode; #PF(fault-code) for a page 17725fault 17726 17727 17728NOP No Operation 17729 17730Opcode Instruction Clocks Description 17731 1773290 NOP 3 No operation 17733 17734 17735Description 17736 17737NOP performs no operation. NOP is a one-byte instruction that takes 17738up space but affects none of the machine context except (E)IP. 17739 17740NOP is an alias mnemonic for the XCHG (E)AX, (E)AX instruction. 17741 17742Flags Affected 17743 17744None 17745 17746Protected Mode Exceptions 17747 17748None 17749 17750Real Address Mode Exceptions 17751 17752None 17753 17754Virtual 8086 Mode Exceptions 17755 17756None 17757 17758 17759NOT One's Complement Negation 17760 17761Opcode Instruction Clocks Description 17762 17763F6 /2 NOT r/m8 2/6 Reverse each bit of r/m byte 17764F7 /2 NOT r/m16 2/6 Reverse each bit of r/m word 17765F7 /2 NOT r/m32 2/6 Reverse each bit of r/m dword 17766 17767 17768Operation 17769 17770r/m NOT r/m; 17771 17772Description 17773 17774NOT inverts the operand; every 1 becomes a 0, and vice versa. 17775 17776Flags Affected 17777 17778None 17779 17780Protected Mode Exceptions 17781 17782#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 17783memory operand effective address in the CS, DS, ES, FS, or GS 17784segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 17785for a page fault 17786 17787Real Address Mode Exceptions 17788 17789Interrupt 13 if any part of the operand would lie outside of the effective 17790address space from 0 to 0FFFFH 17791 17792Virtual 8086 Mode Exceptions 17793 17794Same exceptions as in real-address mode; #PF(fault-code) for a page 17795fault 17796 17797 17798OR Logical Inclusive OR 17799 17800Opcode Instruction Clocks Description 17801 178020C ib OR AL,imm8 2 OR immediate byte to AL 178030D iw OR AX,imm16 2 OR immediate word to AX 178040D id OR EAX,imm32 2 OR immediate dword to EAX 1780580 /1 ib OR r/m8,imm8 2/7 OR immediate byte to r/m byte 1780681 /1 iw OR r/m16,imm16 2/7 OR immediate word to r/m word 1780781 /1 id OR r/m32,imm32 2/7 OR immediate dword to r/m dword 1780883 /1 ib OR r/m16,imm8 2/7 OR sign-extended immediate byte 17809 with r/m word 1781083 /1 ib OR r/m32,imm8 2/7 OR sign-extended immediate byte 17811 with r/m dword 1781208 /r OR r/m8,r8 2/6 OR byte register to r/m byte 1781309 /r OR r/m16,r16 2/6 OR word register to r/m word 1781409 /r OR r/m32,r32 2/6 OR dword register to r/m dword 178150A /r OR r8,r/m8 2/7 OR byte register to r/m byte 178160B /r OR r16,r/m16 2/7 OR word register to r/m word 178170B /r OR r32,r/m32 2/7 OR dword register to r/m dword 17818 17819 17820Operation 17821 17822DEST DEST OR SRC; 17823CF 0; 17824OF 0 17825 17826Description 17827 17828OR computes the inclusive OR of its two operands and places the result 17829in the first operand. Each bit of the result is 0 if both corresponding 17830bits of the operands are 0; otherwise, each bit is 1. 17831 17832Flags Affected 17833 17834OF 0, CF 0; SF, ZF, and PF as described in Appendix C; AF is 17835undefined 17836 17837Protected Mode Exceptions 17838 17839#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 17840memory operand effective address in the CS, DS, ES, FS, or GS 17841segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 17842for a page fault 17843 17844Real Address Mode Exceptions 17845 17846Interrupt 13 if any part of the operand would lie outside of the effective 17847address space from 0 to 0FFFFH 17848 17849Virtual 8086 Mode Exceptions 17850 17851Same exceptions as in real-address mode; #PF(fault-code) for a page 17852fault 17853 17854 17855OUT Output to Port 17856 17857Opcode Instruction Clocks Description 17858 17859E6 ib OUT imm8,AL 10,pm=4*/24** Output byte AL to immediate port 17860 number 17861E7 ib OUT imm8,AX 10,pm=4*/24** Output word AL to immediate port 17862 number 17863E7 ib OUT imm8,EAX 10,pm=4*/24** Output dword AL to immediate 17864 port number 17865EE OUT DX,AL 11,pm=5*/25** Output byte AL to port number in 17866DX 17867EF OUT DX,AX 11,pm=5*/25** Output word AL to port number in 17868DX 17869EF OUT DX,EAX 11,pm=5*/25** Output dword AL to port number 17870 in DX 17871 17872 17873 17874NOTES: 17875 *If CPL IOPL 17876 **If CPL > IOPL or if in virtual 8086 mode 17877 17878 17879Operation 17880 17881IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) 17882THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) 17883 IF NOT I-O-Permission (DEST, width(DEST)) 17884 THEN #GP(0); 17885 FI; 17886FI; 17887[DEST] SRC; (* I/O address space used *) 17888 17889Description 17890 17891OUT transfers a data byte or data word from the register (AL, AX, or 17892EAX) given as the second operand to the output port numbered by the 17893first operand. Output to any port from 0 to 65535 is performed by placing 17894the port number in the DX register and then using an OUT instruction 17895with DX as the first operand. If the instruction contains an eight-bit port 17896ID, that value is zero-extended to 16 bits. 17897 17898Flags Affected 17899 17900None 17901 17902Protected Mode Exceptions 17903 17904#GP(0) if the current privilege level is higher (has less privilege) than 17905IOPL and any of the corresponding I/O permission bits in TSS equals 1 17906 17907Real Address Mode Exceptions 17908 17909None 17910 17911Virtual 8086 Mode Exceptions 17912 17913#GP(0) fault if any of the corresponding I/O permission bits in TSS 17914equals 1 17915 17916 17917OUTS/OUTSB/OUTSW/OUTSD Output String to Port 17918 17919Opcode Instruction Clocks Description 17920 179216E OUTS DX,r/m8 14,pm=8*/28** Output byte [(E)SI] to port in DX 179226F OUTS DX,r/m16 14,pm=8*/28** Output word [(E)SI] to port in DX 179236F OUTS DX,r/m32 14,pm=8*/28** Output dword [(E)SI] to port in DX 179246E OUTSB 14,pm=8*/28** Output byte DS:[(E)SI] to port in 17925 DX 179266F OUTSW 14,pm=8*/28** Output word DS:[(E)SI] to port in 17927 DX 179286F OUTSD 14,pm=8*/28** Output dword DS:[(E)SI] to port in 17929 DX 17930 17931 17932 17933NOTES: 17934 *If CPL IOPL 17935 **If CPL > IOPL or if in virtual 8086 mode 17936 17937 17938Operation 17939 17940IF AddressSize = 16 17941THEN use SI for source-index; 17942ELSE (* AddressSize = 32 *) 17943 use ESI for source-index; 17944FI; 17945 17946IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) 17947THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) 17948 IF NOT I-O-Permission (DEST, width(DEST)) 17949 THEN #GP(0); 17950 FI; 17951FI; 17952IF byte type of instruction 17953THEN 17954 [DX] [source-index]; (* Write byte at DX I/O address *) 17955 IF DF = 0 THEN IncDec 1 ELSE IncDec -1; FI; 17956FI; 17957IF OperandSize = 16 17958THEN 17959 [DX] [source-index]; (* Write word at DX I/O address *) 17960 IF DF = 0 THEN IncDec 2 ELSE IncDec -2; FI; 17961FI; 17962IF OperandSize = 32 17963THEN 17964 [DX] [source-index]; (* Write dword at DX I/O address *) 17965 IF DF = 0 THEN IncDec 4 ELSE IncDec -4; FI; 17966 FI; 17967FI; 17968source-index source-index + IncDec; 17969 17970Description 17971 17972OUTS transfers data from the memory byte, word, or doubleword at the 17973source-index register to the output port addressed by the DX register. If 17974the address-size attribute for this instruction is 16 bits, SI is used for 17975the source-index register; otherwise, the address-size attribute is 32 bits, 17976and ESI is used for the source-index register. 17977 17978OUTS does not allow specification of the port number as an immediate value. 17979The port must be addressed through the DX register value. Load the correct 17980value into DX before executing the OUTS instruction. 17981 17982The address of the source data is determined by the contents of 17983source-index register. Load the correct index value into SI or ESI before 17984executing the OUTS instruction. 17985 17986After the transfer, source-index register is advanced automatically. If 17987the direction flag is 0 (CLD was executed), the source-index register is 17988incremented; if the direction flag is 1 (STD was executed), it is 17989decremented. The amount of the increment or decrement is 1 if a byte is 17990output, 2 if a word is output, or 4 if a doubleword is output. 17991 17992OUTSB, OUTSW, and OUTSD are synonyms for the byte, word, and 17993doubleword OUTS instructions. OUTS can be preceded by the REP 17994prefix for block output of CX bytes or words. Refer to the REP 17995instruction for details on this operation. 17996 17997Flags Affected 17998 17999None 18000 18001Protected Mode Exceptions 18002 18003#GP(0) if CPL is greater than IOPL and any of the corresponding I/O 18004permission bits in TSS equals 1; #GP(0) for an illegal memory operand 18005effective address in the CS, DS, or ES segments; #SS(0) for an illegal 18006address in the SS segment; #PF(fault-code) for a page fault 18007 18008Real Address Mode Exceptions 18009 18010Interrupt 13 if any part of the operand would lie outside of the effective 18011address space from 0 to 0FFFFH 18012 18013Virtual 8086 Mode Exceptions 18014 18015#GP(0) fault if any of the corresponding I/O permission bits in TSS 18016equals 1; #PF(fault-code) for a page fault 18017 18018 18019POP Pop a Word from the Stack 18020 18021Opcode Instruction Clocks Description 18022 180238F /0 POP m16 5 Pop top of stack into memory word 180248F /0 POP m32 5 Pop top of stack into memory dword 1802558 + rw POP r16 4 Pop top of stack into word register 1802658 + rd POP r32 4 Pop top of stack into dword register 180271F POP DS 7,pm=21 Pop top of stack into DS 1802807 POP ES 7,pm=21 Pop top of stack into ES 1802917 POP SS 7,pm=21 Pop top of stack into SS 180300F A1 POP FS 7,pm=21 Pop top of stack into FS 180310F A9 POP GS 7,pm=21 Pop top of stack into GS 18032 18033 18034Operation 18035 18036IF StackAddrSize = 16 18037THEN 18038 IF OperandSize = 16 18039 THEN 18040 DEST (SS:SP); (* copy a word *) 18041 SP SP + 2; 18042 ELSE (* OperandSize = 32 *) 18043 DEST (SS:SP); (* copy a dword *) 18044 SP SP + 4; 18045 FI; 18046ELSE (* StackAddrSize = 32 * ) 18047 IF OperandSize = 16 18048 THEN 18049 DEST (SS:ESP); (* copy a word *) 18050 ESP ESP + 2; 18051 ELSE (* OperandSize = 32 *) 18052 DEST (SS:ESP); (* copy a dword *) 18053 ESP ESP + 4; 18054 FI; 18055FI; 18056 18057Description 18058 18059POP replaces the previous contents of the memory, the register, or the 18060segment register operand with the word on the top of the 80386 stack, 18061addressed by SS:SP (address-size attribute of 16 bits) or SS:ESP 18062(addresssize attribute of 32 bits). The stack pointer SP is incremented 18063by 2 for an operand-size of 16 bits or by 4 for an operand-size of 32 bits. 18064It then points to the new top of stack. 18065 18066POP CS is not an 80386 instruction. Popping from the stack into the CS 18067register is accomplished with a RET instruction. 18068 18069If the destination operand is a segment register (DS, ES, FS, GS, or 18070SS), the value popped must be a selector. In protected mode, loading the 18071selector initiates automatic loading of the descriptor information 18072associated with that selector into the hidden part of the segment register; 18073loading also initiates validation of both the selector and the descriptor 18074information. 18075 18076A null value (0000-0003) may be popped into the DS, ES, FS, or GS 18077register without causing a protection exception. An attempt to reference 18078a segment whose corresponding segment register is loaded with a null 18079value causes a #GP(0) exception. No memory reference occurs. The saved 18080value of the segment register is null. 18081 18082A POP SS instruction inhibits all interrupts, including NMI, until after 18083execution of the next instruction. This allows sequential execution of POP 18084SS and POP eSP instructions without danger of having an invalid stack 18085during an interrupt. However, use of the LSS instruction is the preferred 18086method of loading the SS and eSP registers. 18087 18088Loading a segment register while in protected mode results in special 18089checks and actions, as described in the following listing: 18090 18091IF SS is loaded: 18092 IF selector is null THEN #GP(0); 18093 Selector index must be within its descriptor table limits ELSE 18094 #GP(selector); 18095 Selector's RPL must equal CPL ELSE #GP(selector); 18096 AR byte must indicate a writable data segment ELSE #GP(selector); 18097 DPL in the AR byte must equal CPL ELSE #GP(selector); 18098 Segment must be marked present ELSE #SS(selector); 18099 Load SS register with selector; 18100 Load SS register with descriptor; 18101 18102IF DS, ES, FS or GS is loaded with non-null selector: 18103 AR byte must indicate data or readable code segment ELSE 18104 #GP(selector); 18105 IF data or nonconforming code 18106 THEN both the RPL and the CPL must be less than or equal to DPL in 18107 AR byte 18108 ELSE #GP(selector); 18109 FI; 18110 Segment must be marked present ELSE #NP(selector); 18111 Load segment register with selector; 18112 Load segment register with descriptor; 18113 18114IF DS, ES, FS, or GS is loaded with a null selector: 18115 Load segment register with selector 18116 Clear valid bit in invisible portion of register 18117 18118Flags Affected 18119 18120None 18121 18122Protected Mode Exceptions 18123 18124#GP, #SS, and #NP if a segment register is being loaded; #SS(0) if the 18125current top of stack is not within the stack segment; #GP(0) if the result 18126is in a nonwritable segment; #GP(0) for an illegal memory operand 18127effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an 18128illegal address in the SS segment; #PF(fault-code) for a page fault 18129 18130Real Address Mode Exceptions 18131 18132Interrupt 13 if any part of the operand would lie outside of the effective 18133address space from 0 to 0FFFFH 18134 18135Virtual 8086 Mode Exceptions 18136 18137Same exceptions as in real-address mode; #PF(fault-code) for a page 18138fault 18139 18140 18141POPA/POPAD Pop all General Registers 18142 18143Opcode Instruction Clocks Description 18144 1814561 POPA 24 Pop DI, SI, BP, SP, BX, DX, CX, and AX 1814661 POPAD 24 Pop EDI, ESI, EBP, ESP, EDX, ECX, and EAX 18147 18148 18149Operation 18150 18151IF OperandSize = 16 (* instruction = POPA *) 18152THEN 18153 DI Pop(); 18154 SI Pop(); 18155 BP Pop(); 18156 throwaway Pop (); (* Skip SP *) 18157 BX Pop(); 18158 DX Pop(); 18159 CX Pop(); 18160 AX Pop(); 18161ELSE (* OperandSize = 32, instruction = POPAD *) 18162 EDI Pop(); 18163 ESI Pop(); 18164 EBP Pop(); 18165 throwaway Pop (); (* Skip ESP *) 18166 EBX Pop(); 18167 EDX Pop(); 18168 ECX Pop(); 18169 EAX Pop(); 18170FI; 18171 18172Description 18173 18174POPA pops the eight 16-bit general registers. However, the SP value is 18175discarded instead of loaded into SP. POPA reverses a previous PUSHA, 18176restoring the general registers to their values before PUSHA was 18177executed. The first register popped is DI. 18178 18179POPAD pops the eight 32-bit general registers. The ESP value is 18180discarded instead of loaded into ESP. POPAD reverses the previous 18181PUSHAD, restoring the general registers to their values before PUSHAD 18182was executed. The first register popped is EDI. 18183 18184Flags Affected 18185 18186None 18187 18188Protected Mode Exceptions 18189 18190#SS(0) if the starting or ending stack address is not within the stack 18191segment; #PF(fault-code) for a page fault 18192 18193Real Address Mode Exceptions 18194 18195Interrupt 13 if any part of the operand would lie outside of the effective 18196address space from 0 to 0FFFFH 18197 18198Virtual 8086 Mode Exceptions 18199 18200Same exceptions as in real-address mode; #PF(fault-code) for a page 18201fault 18202 18203 18204POPF/POPFD Pop Stack into FLAGS or EFLAGS Register 18205 18206Opcode Instruction Clocks Description 18207 182089D POPF 5 Pop top of stack FLAGS 182099D POPFD 5 Pop top of stack into EFLAGS 18210 18211 18212Operation 18213 18214Flags Pop(); 18215 18216Description 18217 18218POPF/POPFD pops the word or doubleword on the top of the stack and 18219stores the value in the flags register. If the operand-size attribute of 18220the instruction is 16 bits, then a word is popped and the value is stored in 18221FLAGS. If the operand-size attribute is 32 bits, then a doubleword is popped 18222and the value is stored in EFLAGS. 18223 18224Refer to Chapter 2 and Chapter 4 for information about the FLAGS 18225and EFLAGS registers. Note that bits 16 and 17 of EFLAGS, called 18226VM and RF, respectively, are not affected by POPF or POPFD. 18227 18228The I/O privilege level is altered only when executing at privilege level 182290. The interrupt flag is altered only when executing at a level at least as 18230privileged as the I/O privilege level. (Real-address mode is equivalent to 18231privilege level 0.) If a POPF instruction is executed with insufficient 18232privilege, an exception does not occur, but the privileged bits do not 18233change. 18234 18235Flags Affected 18236 18237All flags except VM and RF 18238 18239Protected Mode Exceptions 18240 18241#SS(0) if the top of stack is not within the stack segment 18242 18243Real Address Mode Exceptions 18244 18245Interrupt 13 if any part of the operand would lie outside of the effective 18246address space from 0 to 0FFFFH 18247 18248Virtual 8086 Mode Exceptions 18249 18250#GP(0) fault if IOPL is less than 3, to permit emulation 18251 18252 18253PUSH Push Operand onto the Stack 18254 18255Opcode Instruction Clocks Description 18256 18257FF /6 PUSH m16 5 Push memory word 18258FF /6 PUSH m32 5 Push memory dword 1825950 + /r PUSH r16 2 Push register word 1826050 + /r PUSH r32 2 Push register dword 182616A PUSH imm8 2 Push immediate byte 1826268 PUSH imm16 2 Push immediate word 1826368 PUSH imm32 2 Push immediate dword 182640E PUSH CS 2 Push CS 1826516 PUSH SS 2 Push SS 182661E PUSH DS 2 Push DS 1826706 PUSH ES 2 Push ES 182680F A0 PUSH FS 2 Push FS 18269OF A8 PUSH GS 2 Push GS 18270 18271 18272Operation 18273 18274IF StackAddrSize = 16 18275THEN 18276 IF OperandSize = 16 THEN 18277 SP SP - 2; 18278 (SS:SP) (SOURCE); (* word assignment *) 18279 ELSE 18280 SP SP - 4; 18281 (SS:SP) (SOURCE); (* dword assignment *) 18282 FI; 18283ELSE (* StackAddrSize = 32 *) 18284 IF OperandSize = 16 18285 THEN 18286 ESP ESP - 2; 18287 (SS:ESP) (SOURCE); (* word assignment *) 18288 ELSE 18289 ESP ESP - 4; 18290 (SS:ESP) (SOURCE); (* dword assignment *) 18291 FI; 18292FI; 18293 18294Description 18295 18296PUSH decrements the stack pointer by 2 if the operand-size attribute of 18297the instruction is 16 bits; otherwise, it decrements the stack pointer by 182984. PUSH then places the operand on the new top of stack, which is 18299pointed to by the stack pointer. 18300 18301The 80386 PUSH eSP instruction pushes the value of eSP as it existed 18302before the instruction. This differs from the 8086, where PUSH SP 18303pushes the new value (decremented by 2). 18304 18305Flags Affected 18306 18307None 18308 18309Protected Mode Exceptions 18310 18311#SS(0) if the new value of SP or ESP is outside the stack segment limit; 18312#GP(0) for an illegal memory operand effective address in the CS, DS, 18313ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 18314#PF(fault-code) for a page fault 18315 18316Real Address Mode Exceptions 18317 18318None; if SP or ESP is 1, the 80386 shuts down due to a lack of stack 18319space 18320 18321Virtual 8086 Mode Exceptions 18322 18323Same exceptions as in real-address mode; #PF(fault-code) for a page 18324fault 18325 18326 18327PUSHA/PUSHAD Push all General Registers 18328 18329Opcode Instruction Clocks Description 18330 1833160 PUSHA 18 Push AX, CX, DX, BX, original SP, BP, SI, and 18332 DI 1833360 PUSHAD 18 Push EAX, ECX, EDX, EBX, original ESP, EBP, 18334 ESI, and EDI 18335 18336 18337Operation 18338 18339IF OperandSize = 16 (* PUSHA instruction *) 18340THEN 18341 Temp (SP); 18342 Push(AX); 18343 Push(CX); 18344 Push(DX); 18345 Push(BX); 18346 Push(Temp); 18347 Push(BP); 18348 Push(SI); 18349 Push(DI); 18350ELSE (* OperandSize = 32, PUSHAD instruction *) 18351 Temp (ESP); 18352 Push(EAX); 18353 Push(ECX); 18354 Push(EDX); 18355 Push(EBX); 18356 Push(Temp); 18357 Push(EBP); 18358 Push(ESI); 18359 Push(EDI); 18360FI; 18361 18362Description 18363 18364PUSHA and PUSHAD save the 16-bit or 32-bit general registers, 18365respectively, on the 80386 stack. PUSHA decrements the stack pointer 18366(SP) by 16 to hold the eight word values. PUSHAD decrements the 18367stack pointer (ESP) by 32 to hold the eight doubleword values. Because 18368the registers are pushed onto the stack in the order in which they were 18369given, they appear in the 16 or 32 new stack bytes in reverse order. The 18370last register pushed is DI or EDI. 18371 18372Flags Affected 18373 18374None 18375 18376Protected Mode Exceptions 18377 18378#SS(0) if the starting or ending stack address is outside the stack segment 18379limit; #PF(fault-code) for a page fault 18380 18381Real Address Mode Exceptions 18382 18383Before executing PUSHA or PUSHAD, the 80386 shuts down if SP or 18384ESP equals 1, 3, or 5; if SP or ESP equals 7, 9, 11, 13, or 15, exception 1838513 occurs 18386 18387Virtual 8086 Mode Exceptions 18388 18389Same exceptions as in real-address mode; #PF(fault-code) for a page 18390fault 18391 18392 18393PUSHF/PUSHFD Push Flags Register onto the Stack 18394 18395Opcode Instruction Clocks Description 18396 183979C PUSHF 4 Push FLAGS 183989C PUSHFD 4 Push EFLAGS 18399 18400 18401Operation 18402 18403IF OperandSize = 32 18404THEN push(EFLAGS); 18405ELSE push(FLAGS); 18406FI; 18407 18408Description 18409 18410PUSHF decrements the stack pointer by 2 and copies the FLAGS 18411register to the new top of stack; PUSHFD decrements the stack pointer by 184124, and the 80386 EFLAGS register is copied to the new top of stack 18413which is pointed to by SS:eSP. Refer to Chapter 2 and Chapter 4 for 18414information on the EFLAGS register. 18415 18416Flags Affected 18417 18418None 18419 18420Protected Mode Exceptions 18421 18422#SS(0) if the new value of eSP is outside the stack segment boundaries 18423 18424Real Address Mode Exceptions 18425 18426None; the 80386 shuts down due to a lack of stack space 18427 18428Virtual 8086 Mode Exceptions 18429 18430#GP(0) fault if IOPL is less than 3, to permit emulation 18431 18432 18433RCL/RCR/ROL/ROR Rotate 18434 18435 18436Opcode Instruction Clocks Description 18437 18438D0 /2 RCL r/m8,1 9/10 Rotate 9 bits (CF,r/m byte) left 18439 once 18440D2 /2 RCL r/m8,CL 9/10 Rotate 9 bits (CF,r/m byte) left CL 18441 times 18442C0 /2 ib RCL r/m8,imm8 9/10 Rotate 9 bits (CF,r/m byte) left 18443 imm8 times 18444D1 /2 RCL r/m16,1 9/10 Rotate 17 bits (CF,r/m word) left 18445 once 18446D3 /2 RCL r/m16,CL 9/10 Rotate 17 bits (CF,r/m word) left 18447 CL times 18448C1 /2 ib RCL r/m16,imm8 9/10 Rotate 17 bits (CF,r/m word) left 18449 imm8 times 18450D1 /2 RCL r/m32,1 9/10 Rotate 33 bits (CF,r/m dword) left 18451 once 18452D3 /2 RCL r/m32,CL 9/10 Rotate 33 bits (CF,r/m dword) left 18453 CL times 18454C1 /2 ib RCL r/m32,imm8 9/10 Rotate 33 bits (CF,r/m dword) left 18455 imm8 times 18456D0 /3 RCR r/m8,1 9/10 Rotate 9 bits (CF,r/m byte) right 18457 once 18458D2 /3 RCR r/m8,CL 9/10 Rotate 9 bits (CF,r/m byte) right 18459 CL times 18460C0 /3 ib RCR r/m8,imm8 9/10 Rotate 9 bits (CF,r/m byte) right 18461 imm8 times 18462D1 /3 RCR r/m16,1 9/10 Rotate 17 bits (CF,r/m word) right 18463 once 18464D3 /3 RCR r/m16,CL 9/10 Rotate 17 bits (CF,r/m word) right 18465 CL times 18466C1 /3 ib RCR r/m16,imm8 9/10 Rotate 17 bits (CF,r/m word) right 18467 imm8 times 18468D1 /3 RCR r/m32,1 9/10 Rotate 33 bits (CF,r/m dword) right 18469 once 18470D3 /3 RCR r/m32,CL 9/10 Rotate 33 bits (CF,r/m dword) right 18471 CL times 18472C1 /3 ib RCR r/m32,imm8 9/10 Rotate 33 bits (CF,r/m dword) right 18473 imm8 times 18474D0 /0 ROL r/m8,1 3/7 Rotate 8 bits r/m byte left once 18475D2 /0 ROL r/m8,CL 3/7 Rotate 8 bits r/m byte left CL 18476 times 18477C0 /0 ib ROL r/m8,imm8 3/7 Rotate 8 bits r/m byte left imm8 18478 times 18479D1 /0 ROL r/m16,1 3/7 Rotate 16 bits r/m word left once 18480D3 /0 ROL r/m16,CL 3/7 Rotate 16 bits r/m word left CL 18481 times 18482C1 /0 ib ROL r/m16,imm8 3/7 Rotate 16 bits r/m word left imm8 18483 times 18484D1 /0 ROL r/m32,1 3/7 Rotate 32 bits r/m dword left once 18485D3 /0 ROL r/m32,CL 3/7 Rotate 32 bits r/m dword left CL 18486 times 18487C1 /0 ib ROL r/m32,imm8 3/7 Rotate 32 bits r/m dword left imm8 18488 times 18489D0 /1 ROR r/m8,1 3/7 Rotate 8 bits r/m byte right once 18490D2 /1 ROR r/m8,CL 3/7 Rotate 8 bits r/m byte right CL 18491 times 18492C0 /1 ib ROR r/m8,imm8 3/7 Rotate 8 bits r/m word right imm8 18493 times 18494D1 /1 ROR r/m16,1 3/7 Rotate 16 bits r/m word right once 18495D3 /1 ROR r/m16,CL 3/7 Rotate 16 bits r/m word right CL 18496 times 18497C1 /1 ib ROR r/m16,imm8 3/7 Rotate 16 bits r/m word right imm8 18498 times 18499D1 /1 ROR r/m32,1 3/7 Rotate 32 bits r/m dword right once 18500D3 /1 ROR r/m32,CL 3/7 Rotate 32 bits r/m dword right CL 18501 times 18502C1 /1 ib ROR r/m32,imm8 3/7 Rotate 32 bits r/m dword right imm8 18503 times 18504 18505 18506Operation 18507 18508(* ROL - Rotate Left *) 18509temp COUNT; 18510WHILE (temp <> 0) 18511DO 18512 tmpcf high-order bit of (r/m); 18513 r/m r/m * 2 + (tmpcf); 18514 temp temp - 1; 18515OD; 18516IF COUNT = 1 18517THEN 18518 IF high-order bit of r/m <> CF 18519 THEN OF 1; 18520 ELSE OF 0; 18521 FI; 18522ELSE OF undefined; 18523FI; 18524(* ROR - Rotate Right *) 18525temp COUNT; 18526WHILE (temp <> 0 ) 18527DO 18528 tmpcf low-order bit of (r/m); 18529 r/m r/m / 2 + (tmpcf * 2^(width(r/m))); 18530 temp temp - 1; 18531DO; 18532IF COUNT = 1 18533THEN 18534 IF (high-order bit of r/m) <> (bit next to high-order bit of r/m) 18535 THEN OF 1; 18536 ELSE OF 0; 18537 FI; 18538ELSE OF undefined; 18539FI; 18540 18541Description 18542 18543Each rotate instruction shifts the bits of the register or memory operand 18544given. The left rotate instructions shift all the bits upward, except for 18545the top bit, which is returned to the bottom. The right rotate instructions 18546do the reverse: the bits shift downward until the bottom bit arrives at 18547the top. 18548 18549For the RCL and RCR instructions, the carry flag is part of the rotated 18550quantity. RCL shifts the carry flag into the bottom bit and shifts the top 18551bit into the carry flag; RCR shifts the carry flag into the top bit and 18552shifts the bottom bit into the carry flag. For the ROL and ROR 18553instructions, the original value of the carry flag is not a part of the 18554result, but the carry flag receives a copy of the bit that was shifted from 18555one end to the other. 18556 18557The rotate is repeated the number of times indicated by the second 18558operand, which is either an immediate number or the contents of the CL 18559register. To reduce the maximum instruction execution time, the 80386 18560does not allow rotation counts greater than 31. If a rotation count greater 18561than 31 is attempted, only the bottom five bits of the rotation are used. 18562The 8086 does not mask rotation counts. The 80386 in Virtual 8086 Mode does 18563mask rotation counts. 18564 18565The overflow flag is defined only for the single-rotate forms of the 18566instructions (second operand = 1). It is undefined in all other cases. For 18567left shifts/rotates, the CF bit after the shift is XORed with the 18568high-order result bit. For right shifts/rotates, the high-order two bits of 18569the result are XORed to get OF. 18570 18571Flags Affected 18572 18573OF only for single rotates; OF is undefined for multi-bit rotates; CF as 18574described above 18575 18576Protected Mode Exceptions 18577 18578#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 18579memory operand effective address in the CS, DS, ES, FS, or GS 18580segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 18581for a page fault 18582 18583Real Address Mode Exceptions 18584 18585Interrupt 13 if any part of the operand would lie outside of the effective 18586address space from 0 to 0FFFFH 18587 18588Virtual 8086 Mode Exceptions 18589 18590Same exceptions as in Real Address Mode; #PF(fault-code) for a page 18591fault 18592 18593 18594REP/REPE/REPZ/REPNE/REPNZ Repeat Following String Operation 18595 18596 18597Opcode Instruction Clocks Description 18598 18599F3 6C REP INS r/m8, DX 13+6*(E)CX, 18600 pm=7+6*(E)CX 18601If CPL IOPL/ 18602 27+6*(E)CX 18603If CPL > IOPL or if in virtual 8086 mode Input (E)CX bytes from port 18604 DX into ES:[(E)DI] 18605F3 6D REP INS r/m16,DX 13+6*(E)CX, 18606 pm=7+6*(E)CX 18607If CPL IOPL/ 18608 27+6*(E)CX 18609If CPL > IOPL or if in virtual 8086 mode Input (E)CX words from port 18610 DX into ES:[(E)DI] 18611F3 6D REP INS r/m32,DX 13+6*(E)CX, 18612 pm=7+6*(E)CX 18613If CPL IOPL/ 18614 27+6*(E)CX 18615If CPL > IOPL or if in virtual 8086 mode Input (E)CX dwords from port 18616 DX into ES:[(E)DI] 18617F3 A4 REP MOVS m8,m8 5+4*(E)CX Move (E)CX bytes from 18618 [(E)SI] to ES:[(E)DI] 18619F3 A5 REP MOVS m16,m16 5+4*(E)CX Move (E)CX words from 18620 [(E)SI] to ES:[(E)DI] 18621F3 A5 REP MOVS m32,m32 5+4*(E)CX Move (E)CX dwords from 18622 [(E)SI] to ES:[(E)DI] 18623F3 6E REP OUTS DX,r/m8 5+12*(E)CX, 18624 pm=6+5*(E)CX 18625If CPL IOPL/ 18626 26+5*(E)CX 18627If CPL > IOPL or if in virtual 8086 mode Output (E)CX bytes from 18628 [(E)SI] to port DX 18629F3 6F REP OUTS DX,r/m16 5+12*(E)CX, 18630 pm=6+5*(E)CX 18631If CPL IOPL/ 18632 26+5*(E)CX 18633If CPL > IOPL or if in virtual 8086 mode Output (E)CX words from 18634 [(E)SI] to port DX 18635F3 6F REP OUTS DX,r/m32 5+12*(E)CX, 18636 pm=6+5*(E)CX 18637If CPL IOPL/ 18638 26+5*(E)CX 18639If CPL > IOPL or if in virtual 8086 mode Output (E)CX dwords from 18640 [(E)SI] to port DX 18641F3 AA REP STOS m8 5+5*(E)CX Fill (E)CX bytes at 18642 ES:[(E)DI] with AL 18643F3 AB REP STOS m16 5+5*(E)CX Fill (E)CX words at 18644 ES:[(E)DI] with AX 18645F3 AB REP STOS m32 5+5*(E)CX Fill (E)CX dwords at 18646 ES:[(E)DI] with EAX 18647F3 A6 REPE CMPS m8,m8 5+9*N Find nonmatching bytes in 18648 ES:[(E)DI] and [(E)SI] 18649F3 A7 REPE CMPS m16,m16 5+9*N Find nonmatching words in 18650 ES:[(E)DI] and [(E)SI] 18651F3 A7 REPE CMPS m32,m32 5+9*N Find nonmatching dwords in 18652 ES:[(E)DI] and [(E)SI] 18653F3 AE REPE SCAS m8 5+8*N Find non-AL byte starting 18654 at ES:[(E)DI] 18655F3 AF REPE SCAS m16 5+8*N Find non-AX word starting 18656 at ES:[(E)DI] 18657F3 AF REPE SCAS m32 5+8*N Find non-EAX dword starting 18658 at ES:[(E)DI] 18659F2 A6 REPNE CMPS m8,m8 5+9*N Find matching bytes in 18660 ES:[(E)DI] and [(E)SI] 18661F2 A7 REPNE CMPS m16,m16 5+9*N Find matching words in 18662 ES:[(E)DI] and [(E)SI] 18663F2 A7 REPNE CMPS m32,m32 5+9*N Find matching dwords in 18664 ES:[(E)DI] and [(E)SI] 18665F2 AE REPNE SCAS m8 5+8*N Find AL, starting at 18666 ES:[(E)DI] 18667F2 AF REPNE SCAS m16 5+8*N Find AX, starting at 18668 ES:[(E)DI] 18669F2 AF REPNE SCAS m32 5+8*N Find EAX, starting at 18670 ES:[(E)DI] 18671 18672 18673Operation 18674 18675IF AddressSize = 16 18676THEN use CX for CountReg; 18677ELSE (* AddressSize = 32 *) use ECX for CountReg; 18678FI; 18679WHILE CountReg <> 0 18680DO 18681 service pending interrupts (if any); 18682 perform primitive string instruction; 18683 CountReg CountReg - 1; 18684 IF primitive operation is CMPB, CMPW, SCAB, or SCAW 18685 THEN 18686 IF (instruction is REP/REPE/REPZ) AND (ZF=1) 18687 THEN exit WHILE loop 18688 ELSE 18689 IF (instruction is REPNZ or REPNE) AND (ZF=0) 18690 THEN exit WHILE loop; 18691 FI; 18692 FI; 18693 FI; 18694OD; 18695 18696Description 18697 18698REP, REPE (repeat while equal), and REPNE (repeat while not equal) 18699are prefix that are applied to string operation. Each prefix cause the 18700string instruction that follows to be repeated the number of times 18701indicated in the count register or (for REPE and REPNE) until the 18702indicated condition in the zero flag is no longer met. 18703 18704Synonymous forms of REPE and REPNE are REPZ and REPNZ, 18705respectively. 18706 18707The REP prefixes apply only to one string instruction at a time. To repeat 18708a block of instructions, use the LOOP instruction or another looping 18709construct. 18710 18711The precise action for each iteration is as follows: 18712 18713 1. If the address-size attribute is 16 bits, use CX for the count 18714 register; if the address-size attribute is 32 bits, use ECX for the 18715 count register. 18716 18717 2. Check CX. If it is zero, exit the iteration, and move to the next 18718 instruction. 18719 18720 3. Acknowledge any pending interrupts. 18721 18722 4. Perform the string operation once. 18723 18724 5. Decrement CX or ECX by one; no flags are modified. 18725 18726 6. Check the zero flag if the string operation is SCAS or CMPS. If 18727 the repeat condition does not hold, exit the iteration and move to 18728 the next instruction. Exit the iteration if the prefix is REPE and ZF 18729 is 0 (the last comparison was not equal), or if the prefix is REPNE 18730 and ZF is one (the last comparison was equal). 18731 18732 7. Return to step 1 for the next iteration. 18733 18734Repeated CMPS and SCAS instructions can be exited if the count is 18735exhausted or if the zero flag fails the repeat condition. These two cases 18736can be distinguished by using either the JCXZ instruction, or by using 18737the conditional jumps that test the zero flag (JZ, JNZ, and JNE). 18738 18739Flags Affected 18740 18741ZF by REP CMPS and REP SCAS as described above 18742 18743Protected Mode Exceptions 18744 18745#UD if a repeat prefix is used before an instruction that is not in the 18746list above; further exceptions can be generated when the string operation is 18747executed; refer to the descriptions of the string instructions themselves 18748 18749Real Address Mode Exceptions 18750 18751Interrupt 6 if a repeat prefix is used before an instruction that is not in 18752the list above; further exceptions can be generated when the string 18753operation is executed; refer to the descriptions of the string instructions 18754themselves 18755 18756Virtual 8086 Mode Exceptions 18757 18758#UD if a repeat prefix is used before an instruction that is not in the 18759list above; further exceptions can be generated when the string operation is 18760executed; refer to the descriptions of the string instructions themselves 18761 18762Notes 18763 18764Not all input/output ports can handle the rate at which the REP INS 18765and REP OUTS instructions execute. 18766 18767 18768RET Return from Procedure 18769 18770Opcode Instruction Clocks Description 18771 18772C3 RET 10+m Return (near) to caller 18773CB RET 18+m,pm=32+m Return (far) to caller, same 18774 privilege 18775CB RET pm=68 Return (far), lesser privilege, 18776 switch stacks 18777C2 iw RET imm16 10+m Return (near), pop imm16 bytes of 18778 parameters 18779CA iw RET imm16 18+m,pm=32+m Return (far), same privilege, pop 18780 imm16 bytes 18781CA iw RET imm16 pm=68 Return (far), lesser privilege, pop 18782 imm16 bytes 18783 18784 18785Operation 18786 18787IF instruction = near RET 18788THEN; 18789 IF OperandSize = 16 18790 THEN 18791 IP Pop(); 18792 EIP EIP AND 0000FFFFH; 18793 ELSE (* OperandSize = 32 *) 18794 EIP Pop(); 18795 FI; 18796 IF instruction has immediate operand THEN eSP eSP + imm16; FI; 18797FI; 18798 18799IF (PE = 0 OR (PE = 1 AND VM = 1)) 18800 (* real mode or virtual 8086 mode *) 18801 AND instruction = far RET 18802THEN; 18803 IF OperandSize = 16 18804 THEN 18805 IP Pop(); 18806 EIP EIP AND 0000FFFFH; 18807 CS Pop(); (* 16-bit pop *) 18808 ELSE (* OperandSize = 32 *) 18809 EIP Pop(); 18810 CS Pop(); (* 32-bit pop, high-order 16-bits discarded *) 18811 FI; 18812 IF instruction has immediate operand THEN eSP eSP + imm16; FI; 18813FI; 18814 18815IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *) 18816 AND instruction = far RET 18817THEN 18818 IF OperandSize=32 18819 THEN Third word on stack must be within stack limits else #SS(0); 18820 ELSE Second word on stack must be within stack limits else #SS(0); 18821 FI; 18822 Return selector RPL must be CPL ELSE #GP(return selector) 18823 IF return selector RPL = CPL 18824 THEN GOTO SAME-LEVEL; 18825 ELSE GOTO OUTER-PRIVILEGE-LEVEL; 18826 FI; 18827FI; 18828 18829SAME-LEVEL: 18830 Return selector must be non-null ELSE #GP(0) 18831 Selector index must be within its descriptor table limits ELSE 18832 #GP(selector) 18833 Descriptor AR byte must indicate code segment ELSE #GP(selector) 18834 IF non-conforming 18835 THEN code segment DPL must equal CPL; 18836 ELSE #GP(selector); 18837 FI; 18838 IF conforming 18839 THEN code segment DPL must be CPL; 18840 ELSE #GP(selector); 18841 FI; 18842 Code segment must be present ELSE #NP(selector); 18843 Top word on stack must be within stack limits ELSE #SS(0); 18844 IP must be in code segment limit ELSE #GP(0); 18845 IF OperandSize=32 18846 THEN 18847 Load CS:EIP from stack 18848 Load CS register with descriptor 18849 Increment eSP by 8 plus the immediate offset if it exists 18850 ELSE (* OperandSize=16 *) 18851 Load CS:IP from stack 18852 Load CS register with descriptor 18853 Increment eSP by 4 plus the immediate offset if it exists 18854 FI; 18855 18856OUTER-PRIVILEGE-LEVEL: 18857 IF OperandSize=32 18858 THEN Top (16+immediate) bytes on stack must be within stack limits 18859 ELSE #SS(0); 18860 ELSE Top (8+immediate) bytes on stack must be within stack limits ELSE 18861 #SS(0); 18862 FI; 18863 Examine return CS selector and associated descriptor: 18864 Selector must be non-null ELSE #GP(0); 18865 Selector index must be within its descriptor table limits ELSE 18866 #GP(selector) 18867 Descriptor AR byte must indicate code segment ELSE #GP(selector); 18868 IF non-conforming 18869 THEN code segment DPL must equal return selector RPL 18870 ELSE #GP(selector); 18871 FI; 18872 IF conforming 18873 THEN code segment DPL must be return selector RPL; 18874 ELSE #GP(selector); 18875 FI; 18876 Segment must be present ELSE #NP(selector) 18877 Examine return SS selector and associated descriptor: 18878 Selector must be non-null ELSE #GP(0); 18879 Selector index must be within its descriptor table limits 18880 ELSE #GP(selector); 18881 Selector RPL must equal the RPL of the return CS selector ELSE 18882 #GP(selector); 18883 Descriptor AR byte must indicate a writable data segment ELSE 18884 #GP(selector); 18885 Descriptor DPL must equal the RPL of the return CS selector ELSE 18886 #GP(selector); 18887 Segment must be present ELSE #NP(selector); 18888 IP must be in code segment limit ELSE #GP(0); 18889 Set CPL to the RPL of the return CS selector; 18890 IF OperandMode=32 18891 THEN 18892 Load CS:EIP from stack; 18893 Set CS RPL to CPL; 18894 Increment eSP by 8 plus the immediate offset if it exists; 18895 Load SS:eSP from stack; 18896 ELSE (* OperandMode=16 *) 18897 Load CS:IP from stack; 18898 Set CS RPL to CPL; 18899 Increment eSP by 4 plus the immediate offset if it exists; 18900 Load SS:eSP from stack; 18901 FI; 18902 Load the CS register with the return CS descriptor; 18903 Load the SS register with the return SS descriptor; 18904 For each of ES, FS, GS, and DS 18905 DO 18906 IF the current register setting is not valid for the outer level, 18907 set the register to null (selector AR 0); 18908 To be valid, the register setting must satisfy the following 18909 properties: 18910 Selector index must be within descriptor table limits; 18911 Descriptor AR byte must indicate data or readable code segment; 18912 IF segment is data or non-conforming code, THEN 18913 DPL must be CPL, or DPL must be RPL; 18914 FI; 18915 OD; 18916 18917Description 18918 18919RET transfers control to a return address located on the stack. The 18920address is usually placed on the stack by a CALL instruction, and the 18921return is made to the instruction that follows the CALL. 18922 18923The optional numeric parameter to RET gives the number of stack bytes 18924(OperandMode=16) or words (OperandMode=32) to be released after the return 18925address is popped. These items are typically used as input parameters to the 18926procedure called. 18927 18928For the intrasegment (near) return, the address on the stack is a segment 18929offset, which is popped into the instruction pointer. The CS register is 18930unchanged. For the intersegment (far) return, the address on the stack 18931is a long pointer. The offset is popped first, followed by the selector. 18932 18933In real mode, CS and IP are loaded directly. In Protected Mode, an 18934intersegment return causes the processor to check the descriptor 18935addressed by the return selector. The AR byte of the descriptor must 18936indicate a code segment of equal or lesser privilege (or greater or equal 18937numeric value) than the current privilege level. Returns to a lesser 18938privilege level cause the stack to be reloaded from the value saved beyond 18939the parameter block. 18940 18941The DS, ES, FS, and GS segment registers can be set to 0 by the RET 18942instruction during an interlevel transfer. If these registers refer to 18943segments that cannot be used by the new privilege level, they are set to 189440 to prevent unauthorized access from the new privilege level. 18945 18946Flags Affected 18947 18948None 18949 18950Protected Mode Exceptions 18951 18952#GP, #NP, or #SS, as described under "Operation" above; #PF(fault-code) for 18953a page fault 18954 18955Real Address Mode Exceptions 18956 18957Interrupt 13 if any part of the operand would be outside the effective 18958address space from 0 to 0FFFFH 18959 18960Virtual 8086 Mode Exceptions 18961 18962Same exceptions as in Real Address Mode; #PF(fault-code) for a page 18963fault 18964 18965 18966SAHF Store AH into Flags 18967 18968Opcode Instruction Clocks Description 18969 189709E SAHF 3 Store AH into flags SF ZF xx AF xx PF xx CF 18971 18972 18973Operation 18974 18975SF:ZF:xx:AF:xx:PF:xx:CF AH; 18976 18977Description 18978 18979SAHF loads the flags listed above with values from the AH register, 18980from bits 7, 6, 4, 2, and 0, respectively. 18981 18982Flags Affected 18983 18984SF, ZF, AF, PF, and CF as described above 18985 18986Protected Mode Exceptions 18987 18988None 18989 18990Real Address Mode Exceptions 18991 18992None 18993 18994Virtual 8086 Mode Exceptions 18995 18996None 18997 18998 18999SAL/SAR/SHL/SHR Shift Instructions 19000 19001 19002Opcode Instruction Clocks Description 19003 19004D0 /4 SAL r/m8,1 3/7 Multiply r/m byte by 2, once 19005D2 /4 SAL r/m8,CL 3/7 Multiply r/m byte by 2, CL times 19006C0 /4 ib SAL r/m8,imm8 3/7 Multiply r/m byte by 2, imm8 19007 times 19008D1 /4 SAL r/m16,1 3/7 Multiply r/m word by 2, once 19009D3 /4 SAL r/m16,CL 3/7 Multiply r/m word by 2, CL times 19010C1 /4 ib SAL r/m16,imm8 3/7 Multiply r/m word by 2, imm8 19011 times 19012D1 /4 SAL r/m32,1 3/7 Multiply r/m dword by 2, once 19013D3 /4 SAL r/m32,CL 3/7 Multiply r/m dword by 2, CL 19014 times 19015C1 /4 ib SAL r/m32,imm8 3/7 Multiply r/m dword by 2, imm8 19016 times 19017D0 /7 SAR r/m8,1 3/7 Signed divide^(1) r/m byte by 2, 19018 once 19019D2 /7 SAR r/m8,CL 3/7 Signed divide^(1) r/m byte by 2, 19020 CL times 19021C0 /7 ib SAR r/m8,imm8 3/7 Signed divide^(1) r/m byte by 2, 19022 imm8 times 19023D1 /7 SAR r/m16,1 3/7 Signed divide^(1) r/m word by 2, 19024 once 19025D3 /7 SAR r/m16,CL 3/7 Signed divide^(1) r/m word by 2, 19026 CL times 19027C1 /7 ib SAR r/m16,imm8 3/7 Signed divide^(1) r/m word by 2, 19028 imm8 times 19029D1 /7 SAR r/m32,1 3/7 Signed divide^(1) r/m dword by 2, 19030 once 19031D3 /7 SAR r/m32,CL 3/7 Signed divide^(1) r/m dword by 2, 19032 CL times 19033C1 /7 ib SAR r/m32,imm8 3/7 Signed divide^(1) r/m dword by 2, 19034 imm8 times 19035D0 /4 SHL r/m8,1 3/7 Multiply r/m byte by 2, once 19036D2 /4 SHL r/m8,CL 3/7 Multiply r/m byte by 2, CL times 19037C0 /4 ib SHL r/m8,imm8 3/7 Multiply r/m byte by 2, imm8 19038 times 19039D1 /4 SHL r/m16,1 3/7 Multiply r/m word by 2, once 19040D3 /4 SHL r/m16,CL 3/7 Multiply r/m word by 2, CL times 19041C1 /4 ib SHL r/m16,imm8 3/7 Multiply r/m word by 2, imm8 19042 times 19043D1 /4 SHL r/m32,1 3/7 Multiply r/m dword by 2, once 19044D3 /4 SHL r/m32,CL 3/7 Multiply r/m dword by 2, CL 19045 times 19046C1 /4 ib SHL r/m32,imm8 3/7 Multiply r/m dword by 2, imm8 19047 times 19048D0 /5 SHR r/m8,1 3/7 Unsigned divide r/m byte by 2, 19049 once 19050D2 /5 SHR r/m8,CL 3/7 Unsigned divide r/m byte by 2, 19051 CL times 19052C0 /5 ib SHR r/m8,imm8 3/7 Unsigned divide r/m byte by 2, 19053 imm8 times 19054D1 /5 SHR r/m16,1 3/7 Unsigned divide r/m word by 2, 19055 once 19056D3 /5 SHR r/m16,CL 3/7 Unsigned divide r/m word by 2, 19057 CL times 19058C1 /5 ib SHR r/m16,imm8 3/7 Unsigned divide r/m word by 2, 19059 imm8 times 19060D1 /5 SHR r/m32,1 3/7 Unsigned divide r/m dword by 2, 19061 once 19062D3 /5 SHR r/m32,CL 3/7 Unsigned divide r/m dword by 2, 19063 CL times 19064C1 /5 ib SHR r/m32,imm8 3/7 Unsigned divide r/m dword by 2, 19065 imm8 times 19066 19067 19068Not the same division as IDIV; rounding is toward negative infinity. 19069 19070Operation 19071 19072(* COUNT is the second parameter *) 19073(temp) COUNT; 19074WHILE (temp <> 0) 19075DO 19076 IF instruction is SAL or SHL 19077 THEN CF high-order bit of r/m; 19078 FI; 19079 IF instruction is SAR or SHR 19080 THEN CF low-order bit of r/m; 19081 FI; 19082 IF instruction = SAL or SHL 19083 THEN r/m r/m * 2; 19084 FI; 19085 IF instruction = SAR 19086 THEN r/m r/m /2 (*Signed divide, rounding toward negative infinity*); 19087 FI; 19088 IF instruction = SHR 19089 THEN r/m r/m / 2; (* Unsigned divide *); 19090 FI; 19091 temp temp - 1; 19092OD; 19093(* Determine overflow for the various instructions *) 19094IF COUNT = 1 19095THEN 19096 IF instruction is SAL or SHL 19097 THEN OF high-order bit of r/m <> (CF); 19098 FI; 19099 IF instruction is SAR 19100 THEN OF 0; 19101 FI; 19102 IF instruction is SHR 19103 THEN OF high-order bit of operand; 19104 FI; 19105ELSE OF undefined; 19106FI; 19107 19108Description 19109 19110SAL (or its synonym, SHL) shifts the bits of the operand upward. The 19111high-order bit is shifted into the carry flag, and the low-order bit is set 19112to 0. 19113 19114SAR and SHR shift the bits of the operand downward. The low-order 19115bit is shifted into the carry flag. The effect is to divide the operand by 191162. SAR performs a signed divide with rounding toward negative infinity (not 19117the same as IDIV); the high-order bit remains the same. SHR performs an 19118unsigned divide; the high-order bit is set to 0. 19119 19120The shift is repeated the number of times indicated by the second 19121operand, which is either an immediate number or the contents of the CL 19122register. To reduce the maximum execution time, the 80386 does not 19123allow shift counts greater than 31. If a shift count greater than 31 is 19124attempted, only the bottom five bits of the shift count are used. (The 191258086 uses all eight bits of the shift count.) 19126 19127The overflow flag is set only if the single-shift forms of the instructions 19128are used. For left shifts, OF is set to 0 if the high bit of the answer is 19129the same as the result of the carry flag (i.e., the top two bits of the 19130original operand were the same); OF is set to 1 if they are different. For 19131SAR, OF is set to 0 for all single shifts. For SHR, OF is set to the 19132high-order bit of the original operand. 19133 19134Flags Affected 19135 19136OF for single shifts; OF is undefined for multiple shifts; CF, ZF, PF, 19137and SF as described in Appendix C 19138 19139Protected Mode Exceptions 19140 19141#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19142memory operand effective address in the CS, DS, ES, FS, or GS 19143segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 19144for a page fault 19145 19146Real Address Mode Exceptions 19147 19148Interrupt 13 if any part of the operand would lie outside of the effective 19149address space from 0 to 0FFFFH 19150 19151Virtual 8086 Mode Exceptions 19152 19153Same exceptions as in Real Address Mode; #PF(fault-code) for a page 19154fault 19155 19156 19157SBB Integer Subtraction with Borrow 19158 19159 19160Opcode Instruction Clocks Description 19161 191621C ib SBB AL,imm8 2 Subtract with borrow immediate byte 19163 from AL 191641D iw SBB AX,imm16 2 Subtract with borrow immediate word 19165 from AX 191661D id SBB EAX,imm32 2 Subtract with borrow immediate 19167 dword from EAX 1916880 /3 ib SBB r/m8,imm8 2/7 Subtract with borrow immediate byte 19169 from r/m byte 1917081 /3 iw SBB r/m16,imm16 2/7 Subtract with borrow immediate word 19171 from r/m word 1917281 /3 id SBB r/m32,imm32 2/7 Subtract with borrow immediate 19173 dword from r/m dword 1917483 /3 ib SBB r/m16,imm8 2/7 Subtract with borrow sign-extended 19175 immediate byte from r/m word 1917683 /3 ib SBB r/m32,imm8 2/7 Subtract with borrow sign-extended 19177 immediate byte from r/m dword 1917818 /r SBB r/m8,r8 2/6 Subtract with borrow byte register 19179 from r/m byte 1918019 /r SBB r/m16,r16 2/6 Subtract with borrow word register 19181 from r/m word 1918219 /r SBB r/m32,r32 2/6 Subtract with borrow dword register 19183 from r/m dword 191841A /r SBB r8,r/m8 2/7 Subtract with borrow byte register 19185 from r/m byte 191861B /r SBB r16,r/m16 2/7 Subtract with borrow word register 19187 from r/m word 191881B /r SBB r32,r/m32 2/7 Subtract with borrow dword register 19189 from r/m dword 19190 19191 19192Operation 19193 19194IF SRC is a byte and DEST is a word or dword 19195THEN DEST = DEST - (SignExtend(SRC) + CF) 19196ELSE DEST DEST - (SRC + CF); 19197 19198Description 19199 19200SBB adds the second operand (DEST) to the carry flag (CF) and 19201subtracts the result from the first operand (SRC). The result of the 19202subtraction is assigned to the first operand (DEST), and the flags are 19203set accordingly. 19204 19205When an immediate byte value is subtracted from a word operand, the 19206immediate value is first sign-extended. 19207 19208Flags Affected 19209 19210OF, SF, ZF, AF, PF, and CF as described in Appendix C 19211 19212Protected Mode Exceptions 19213 19214#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19215memory operand effective address in the CS, DS, ES, FS, or GS 19216segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 19217for a page fault 19218 19219Real Address Mode Exceptions 19220 19221Interrupt 13 if any part of the operand would lie outside of the effective 19222address space from 0 to 0FFFFH 19223 19224Virtual 8086 Mode Exceptions 19225 19226Same exceptions as in Real Address Mode; #PF(fault-code) for a page 19227fault 19228 19229 19230SCAS/SCASB/SCASW/SCASD Compare String Data 19231 19232Opcode Instruction Clocks Description 19233 19234AE SCAS m8 7 Compare bytes AL-ES:[DI], update (E)DI 19235AF SCAS m16 7 Compare words AX-ES:[DI], update (E)DI 19236AF SCAS m32 7 Compare dwords EAX-ES:[DI], update (E)DI 19237AE SCASB 7 Compare bytes AL-ES:[DI], update (E)DI 19238AF SCASW 7 Compare words AX-ES:[DI], update (E)DI 19239AF SCASD 7 Compare dwords EAX-ES:[DI], update (E)DI 19240 19241 19242Operation 19243 19244IF AddressSize = 16 19245THEN use DI for dest-index; 19246ELSE (* AddressSize = 32 *) use EDI for dest-index; 19247FI; 19248IF byte type of instruction 19249THEN 19250 AL - [dest-index]; (* Compare byte in AL and dest *) 19251 IF DF = 0 THEN IndDec 1 ELSE IncDec -1; FI; 19252ELSE 19253 IF OperandSize = 16 19254 THEN 19255 AX - [dest-index]; (* compare word in AL and dest *) 19256 IF DF = 0 THEN IncDec 2 ELSE IncDec -2; FI; 19257 ELSE (* OperandSize = 32 *) 19258 EAX - [dest-index];(* compare dword in EAX & dest *) 19259 IF DF = 0 THEN IncDec 4 ELSE IncDec -4; FI; 19260 FI; 19261FI; 19262dest-index = dest-index + IncDec 19263 19264Description 19265 19266SCAS subtracts the memory byte or word at the destination register from 19267the AL, AX or EAX register. The result is discarded; only the flags are set. 19268The operand must be addressable from the ES segment; no segment override is 19269possible. 19270 19271If the address-size attribute for this instruction is 16 bits, DI is used 19272as the destination register; otherwise, the address-size attribute is 32 19273bits and EDI is used. 19274 19275The address of the memory data being compared is determined solely by the 19276contents of the destination register, not by the operand to SCAS. The 19277operand validates ES segment addressability and determines the data type. 19278Load the correct index value into DI or EDI before executing SCAS. 19279 19280After the comparison is made, the destination register is automatically 19281updated. If the direction flag is 0 (CLD was executed), the destination 19282register is incremented; if the direction flag is 1 (STD was executed), it 19283is decremented. The increments or decrements are by 1 if bytes are compared, 19284by 2 if words are compared, or by 4 if doublewords are compared. 19285 19286SCASB, SCASW, and SCASD are synonyms for the byte, word and 19287doubleword SCAS instructions that don't require operands. They are 19288simpler to code, but provide no type or segment checking. 19289 19290SCAS can be preceded by the REPE or REPNE prefix for a block search 19291of CX or ECX bytes or words. Refer to the REP instruction for further 19292details. 19293 19294Flags Affected 19295 19296OF, SF, ZF, AF, PF, and CF as described in Appendix C 19297 19298Protected Mode Exceptions 19299 19300#GP(0) for an illegal memory operand effective address in the CS, DS, 19301ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 19302#PF(fault-code) for a page fault 19303 19304Real Address Mode Exceptions 19305 19306Interrupt 13 if any part of the operand would lie outside of the effective 19307address space from 0 to 0FFFFH 19308 19309Virtual 8086 Mode Exceptions 19310 19311Same exceptions as in Real Address Mode; #PF(fault-code) for a page 19312fault 19313 19314 19315SETcc Byte Set on Condition 19316 19317 19318Opcode Instruction Clocks Description 19319 193200F 97 SETA r/m8 4/5 Set byte if above (CF=0 and ZF=0) 193210F 93 SETAE r/m8 4/5 Set byte if above or equal (CF=0) 193220F 92 SETB r/m8 4/5 Set byte if below (CF=1) 193230F 96 SETBE r/m8 4/5 Set byte if below or equal (CF=1 or (ZF=1) 193240F 92 SETC r/m8 4/5 Set if carry (CF=1) 193250F 94 SETE r/m8 4/5 Set byte if equal (ZF=1) 193260F 9F SETG r/m8 4/5 Set byte if greater (ZF=0 or SF=OF) 193270F 9D SETGE r/m8 4/5 Set byte if greater or equal (SF=OF) 193280F 9C SETL r/m8 4/5 Set byte if less (SF<>OF) 193290F 9E SETLE r/m8 4/5 Set byte if less or equal (ZF=1 and 19330 SF<>OF) 193310F 96 SETNA r/m8 4/5 Set byte if not above (CF=1) 193320F 92 SETNAE r/m8 4/5 Set byte if not above or equal (CF=1) 193330F 93 SETNB r/m8 4/5 Set byte if not below (CF=0) 193340F 97 SETNBE r/m8 4/5 Set byte if not below or equal (CF=0 and 19335 ZF=0) 193360F 93 SETNC r/m8 4/5 Set byte if not carry (CF=0) 193370F 95 SETNE r/m8 4/5 Set byte if not equal (ZF=0) 193380F 9E SETNG r/m8 4/5 Set byte if not greater (ZF=1 or SF<>OF) 193390F 9C SETNGE r/m8 4/5 Set if not greater or equal (SF<>OF) 193400F 9D SETNL r/m8 4/5 Set byte if not less (SF=OF) 193410F 9F SETNLE r/m8 4/5 Set byte if not less or equal (ZF=1 and 19342 SF<>OF) 193430F 91 SETNO r/m8 4/5 Set byte if not overflow (OF=0) 193440F 9B SETNP r/m8 4/5 Set byte if not parity (PF=0) 193450F 99 SETNS r/m8 4/5 Set byte if not sign (SF=0) 193460F 95 SETNZ r/m8 4/5 Set byte if not zero (ZF=0) 193470F 90 SETO r/m8 4/5 Set byte if overflow (OF=1) 193480F 9A SETP r/m8 4/5 Set byte if parity (PF=1) 193490F 9A SETPE r/m8 4/5 Set byte if parity even (PF=1) 193500F 9B SETPO r/m8 4/5 Set byte if parity odd (PF=0) 193510F 98 SETS r/m8 4/5 Set byte if sign (SF=1) 193520F 94 SETZ r/m8 4/5 Set byte if zero (ZF=1) 19353 19354 19355Operation 19356 19357IF condition THEN r/m8 1 ELSE r/m8 0; FI; 19358 19359Description 19360 19361SETcc stores a byte at the destination specified by the effective address 19362or register if the condition is met, or a 0 byte if the condition is not 19363met. 19364 19365Flags Affected 19366 19367None 19368 19369Protected Mode Exceptions 19370 19371#GP(0) if the result is in a non-writable segment; #GP(0) for an illegal 19372memory operand effective address in the CS, DS, ES, FS, or GS segments; 19373#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19374fault 19375 19376Real Address Mode Exceptions 19377 19378Interrupt 13 if any part of the operand would lie outside of the effective 19379address space from 0 to 0FFFFH 19380 19381Virtual 8086 Mode Exceptions 19382 19383Same exceptions as in Real Address Mode; #PF(fault-code) for a page 19384fault 19385 19386 19387SGDT/SIDT Store Global/Interrupt Descriptor Table Register 19388 19389Opcode Instruction Clocks Description 19390 193910F 01 /0 SGDT m 9 Store GDTR to m 193920F 01 /1 SIDT m 9 Store IDTR to m 19393 19394 19395Operation 19396 19397DEST 48-bit BASE/LIMIT register contents; 19398 19399Description 19400 19401SGDT/SIDT copies the contents of the descriptor table register the six 19402bytes of memory indicated by the operand. The LIMIT field of the 19403register is assigned to the first word at the effective address. If the 19404operand-size attribute is 32 bits, the next three bytes are assigned the 19405BASE field of the register, and the fourth byte is written with zero. The 19406last byte is undefined. Otherwise, if the operand-size attribute is 16 19407bits, the next four bytes are assigned the 32-bit BASE field of the 19408register. 19409 19410SGDT and SIDT are used only in operating system software; they are 19411not used in application programs. 19412 19413Flags Affected 19414 19415None 19416 19417Protected Mode Exceptions 19418 19419Interrupt 6 if the destination operand is a register; #GP(0) if the 19420destination is in a nonwritable segment; #GP(0) for an illegal memory 19421operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for 19422an illegal address in the SS segment; #PF(fault-code) for a page fault 19423 19424Real Address Mode Exceptions 19425 19426Interrupt 6 if the destination operand is a register; Interrupt 13 if any 19427part of the operand would lie outside of the effective address space from 194280 to 0FFFFH 19429 19430Virtual 8086 Mode Exceptions 19431 19432Same exceptions as in Real Address Mode; #PF(fault-code) for a page 19433fault 19434 19435Compatability Note 19436 19437The 16-bit forms of the SGDT/SIDT instructions are compatible with 19438the 80286, if the value in the upper eight bits is not referenced. The 1943980286 stores 1's in these upper bits, whereas the 80386 stores 0's if the 19440operand-size attribute is 16 bits. These bits were specified as undefined 19441by the SGDT/SIDT instructions in the iAPX 286 Programmer's 19442Reference Manual. 19443 19444 19445SHLD Double Precision Shift Left 19446 19447Opcode Instruction Clocks Description 19448 194490F A4 SHLD r/m16,r16,imm8 3/7 r/m16 gets SHL of r/m16 concatenated 19450 with r16 194510F A4 SHLD r/m32,r32,imm8 3/7 r/m32 gets SHL of r/m32 concatenated 19452 with r32 194530F A5 SHLD r/m16,r16,CL 3/7 r/m16 gets SHL of r/m16 concatenated 19454 with r16 194550F A5 SHLD r/m32,r32,CL 3/7 r/m32 gets SHL of r/m32 concatenated 19456 with r32 19457 19458 19459Operation 19460 19461(* count is an unsigned integer corresponding to the last operand of the 19462instruction, either an immediate byte or the byte in register CL *) 19463ShiftAmt count MOD 32; 19464inBits register; (* Allow overlapped operands *) 19465IF ShiftAmt = 0 19466THEN no operation 19467ELSE 19468 IF ShiftAmt OperandSize 19469 THEN (* Bad parameters *) 19470 r/m UNDEFINED; 19471 CF, OF, SF, ZF, AF, PF UNDEFINED; 19472 ELSE (* Perform the shift *) 19473 CF BIT[Base, OperandSize - ShiftAmt]; 19474 (* Last bit shifted out on exit *) 19475 FOR i OperandSize - 1 DOWNTO ShiftAmt 19476 DO 19477 BIT[Base, i] BIT[Base, i - ShiftAmt]; 19478 OF; 19479 FOR i ShiftAmt - 1 DOWNTO 0 19480 DO 19481 BIT[Base, i] BIT[inBits, i - ShiftAmt + OperandSize]; 19482 OD; 19483 Set SF, ZF, PF (r/m); 19484 (* SF, ZF, PF are set according to the value of the result *) 19485 AF UNDEFINED; 19486 FI; 19487FI; 19488 19489Description 19490 19491SHLD shifts the first operand provided by the r/m field to the left as 19492many bits as specified by the count operand. The second operand (r16 or r32) 19493provides the bits to shift in from the right (starting with bit 0). The 19494result is stored back into the r/m operand. The register remains unaltered. 19495 19496The count operand is provided by either an immediate byte or the contents 19497of the CL register. These operands are taken MODULO 32 to provide a number 19498between 0 and 31 by which to shift. Because the bits to shift are provided 19499by the specified registers, the operation is useful for multiprecision 19500shifts (64 bits or more). The SF, ZF and PF flags are set according to the 19501value of the result. CS is set to the value of the last bit shifted out. OF 19502and AF are left undefined. 19503 19504Flags Affected 19505 19506OF, SF, ZF, PF, and CF as described above; AF and OF are undefined 19507 19508Protected Mode Exceptions 19509 19510#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19511memory operand effective address in the CS, DS, ES, FS, or GS segments; 19512#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19513fault 19514 19515Real Address Mode Exceptions 19516 19517Interrupt 13 if any part of the operand would lie outside of the effective 19518address space from 0 to 0FFFFH 19519 19520Virtual 8086 Mode Exceptions 19521 19522Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 19523 19524 19525SHRD Double Precision Shift Right 19526 19527Opcode Instruction Clocks Description 19528 195290F AC SHRD r/m16,r16,imm8 3/7 r/m16 gets SHR of r/m16 concatenated 19530 with r16 195310F AC SHRD r/m32,r32,imm8 3/7 r/m32 gets SHR of r/m32 concatenated 19532 with r32 195330F AD SHRD r/m16,r16,CL 3/7 r/m16 gets SHR of r/m16 concatenated 19534 with r16 195350F AD SHRD r/m32,r32,CL 3/7 r/m32 gets SHR of r/m32 concatenated 19536 with r32 19537 19538 19539Operation 19540 19541(* count is an unsigned integer corresponding to the last operand of the 19542instruction, either an immediate byte or the byte in register CL *) 19543ShiftAmt count MOD 32; 19544inBits register; (* Allow overlapped operands *) 19545IF ShiftAmt = 0 19546THEN no operation 19547ELSE 19548 IF ShiftAmt OperandSize 19549 THEN (* Bad parameters *) 19550 r/m UNDEFINED; 19551 CF, OF, SF, ZF, AF, PF UNDEFINED; 19552 ELSE (* Perform the shift *) 19553 CF BIT[r/m, ShiftAmt - 1]; (* last bit shifted out on exit *) 19554 FOR i 0 TO OperandSize - 1 - ShiftAmt 19555 DO 19556 BIT[r/m, i] BIT[r/m, i - ShiftAmt]; 19557 OD; 19558 FOR i OperandSize - ShiftAmt TO OperandSize - 1 19559 DO 19560 BIT[r/m,i] BIT[inBits,i+ShiftAmt - OperandSize]; 19561 OD; 19562 Set SF, ZF, PF (r/m); 19563 (* SF, ZF, PF are set according to the value of the result *) 19564 Set SF, ZF, PF (r/m); 19565 AF UNDEFINED; 19566 FI; 19567FI; 19568 19569Description 19570 19571SHRD shifts the first operand provided by the r/m field to the right as many 19572bits as specified by the count operand. The second operand (r16 or r32) 19573provides the bits to shift in from the left (starting with bit 31). The 19574result is stored back into the r/m operand. The register remains unaltered. 19575 19576The count operand is provided by either an immediate byte or the contents 19577of the CL register. These operands are taken MODULO 32 to provide a number 19578between 0 and 31 by which to shift. Because the bits to shift are provided 19579by the specified register, the operation is useful for multi-precision 19580shifts (64 bits or more). The SF, ZF and PF flags are set according to the 19581value of the result. CS is set to the value of the last bit shifted out. OF 19582and AF are left undefined. 19583 19584Flags Affected 19585 19586OF, SF, ZF, PF, and CF as described above; AF and OF are undefined 19587 19588Protected Mode Exceptions 19589 19590#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19591memory operand effective address in the CS, DS, ES, FS, or GS 19592segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 19593for a page fault 19594 19595Real Address Mode Exceptions 19596 19597Interrupt 13 if any part of the operand would lie outside of the effective 19598address space from 0 to 0FFFFH 19599 19600Virtual 8086 Mode Exceptions 19601 19602Same exceptions as in Real Address Mode; #PF(fault-code) for a page 19603fault 19604 19605 19606SLDT Store Local Descriptor Table Register 19607 19608Opcode Instruction Clocks Description 19609 196100F 00 /0 SLDT r/m16 pm=2/2 Store LDTR to EA word 19611 19612 19613Operation 19614 19615r/m16 LDTR; 19616 19617Description 19618 19619SLDT stores the Local Descriptor Table Register (LDTR) in the two-byte 19620register or memory location indicated by the effective address operand. 19621This register is a selector that points into the Global Descriptor Table. 19622 19623SLDT is used only in operating system software. It is not used in 19624application programs. 19625 19626Flags Affected 19627 19628None 19629 19630Protected Mode Exceptions 19631 19632#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19633memory operand effective address in the CS, DS, ES, FS, or GS segments; 19634#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19635fault 19636 19637Real Address Mode Exceptions 19638 19639Interrupt 6; SLDT is not recognized in Real Address Mode 19640 19641Virtual 8086 Mode Exceptions 19642 19643Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 19644 19645Notes 19646 19647The operand-size attribute has no effect on the operation of the 19648instruction. 19649 19650 19651SMSW Store Machine Status Word 19652 19653Opcode Instruction Clocks Description 19654 196550F 01 /4 SMSW r/m16 2/3,pm=2/2 Store machine status word to EA 19656 word 19657 19658 19659Operation 19660 19661r/m16 MSW; 19662 19663Description 19664 19665SMSW stores the machine status word (part of CR0) in the two-byte register 19666or memory location indicated by the effective address operand. 19667 19668Flags Affected 19669 19670None 19671 19672Protected Mode Exceptions 19673 19674#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19675memory operand effective address in the CS, DS, ES, FS, or GS segments; 19676#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19677fault 19678 19679Real Address Mode Exceptions 19680 19681Interrupt 13 if any part of the operand would lie outside of the effective 19682address space from 0 to 0FFFFH 19683 19684Virtual 8086 Mode Exceptions 19685 19686Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 19687 19688Notes 19689 19690This instruction is provided for compatibility with the 80286; 80386 19691programs should use MOV ..., CR0. 19692 19693 19694STC Set Carry Flag 19695 19696Opcode Instruction Clocks Description 19697 19698F9 STC 2 Set carry flag 19699 19700 19701Operation 19702 19703CF 1; 19704 19705Description 19706 19707STC sets the carry flag to 1. 19708 19709Flags Affected 19710 19711CF = 1 19712 19713Protected Mode Exceptions 19714 19715None 19716 19717Real Address Mode Exceptions 19718 19719None 19720 19721Virtual 8086 Mode Exceptions 19722 19723None 19724 19725 19726STD Set Direction Flag 19727 19728Opcode Instruction Clocks Description 19729 19730FD STD 2 Set direction flag so (E)SI and/or (E)DI 19731 decrement 19732 19733 19734Operation 19735 19736DF 1; 19737 19738Description 19739 19740STD sets the direction flag to 1, causing all subsequent string operations 19741to decrement the index registers, (E)SI and/or (E)DI, on which they 19742operate. 19743 19744Flags Affected 19745 19746DF = 1 19747 19748Protected Mode Exceptions 19749 19750None 19751 19752Real Address Mode Exceptions 19753 19754None 19755 19756Virtual 8086 Mode Exceptions 19757 19758None 19759 19760 19761STI Set Interrupt Flag 19762 19763Opcode Instruction Clocks Description 19764 19765F13 STI 3 Set interrupt flag; interrupts enabled at the 19766 end of the next instruction 19767 19768 19769Operation 19770 19771IF 1 19772 19773Description 19774 19775STI sets the interrupt flag to 1. The 80386 then responds to external 19776interrupts after executing the next instruction if the next instruction 19777allows the interrupt flag to remain enabled. If external interrupts are 19778disabled and you code STI, RET (such as at the end of a subroutine), 19779the RET is allowed to execute before external interrupts are recognized. 19780Also, if external interrupts are disabled and you code STI, CLI, then 19781external interrupts are not recognized because the CLI instruction clears 19782the interrupt flag during its execution. 19783 19784Flags Affected 19785 19786IF = 1 19787 19788Protected Mode Exceptions 19789 19790#GP(0) if the current privilege level is greater (has less privilege) than 19791the I/O privilege level 19792 19793Real Address Mode Exceptions 19794 19795None 19796 19797Virtual 8086 Mode Exceptions 19798 19799None 19800 19801 19802STOS/STOSB/STOSW/STOSD Store String Data 19803 19804Opcode Instruction Clocks Description 19805 19806AA STOS m8 4 Store AL in byte ES:[(E)DI], update (E)DI 19807AB STOS m16 4 Store AX in word ES:[(E)DI], update (E)DI 19808AB STOS m32 4 Store EAX in dword ES:[(E)DI], update (E)DI 19809AA STOSB 4 Store AL in byte ES:[(E)DI], update (E)DI 19810AB STOSW 4 Store AX in word ES:[(E)DI], update (E)DI 19811AB STOSD 4 Store EAX in dword ES:[(E)DI], update (E)DI 19812 19813 19814Operation 19815 19816IF AddressSize = 16 19817THEN use ES:DI for DestReg 19818ELSE (* AddressSize = 32 *) use ES:EDI for DestReg; 19819FI; 19820IF byte type of instruction 19821THEN 19822 (ES:DestReg) AL; 19823 IF DF = 0 19824 THEN DestReg DestReg + 1; 19825 ELSE DestReg DestReg - 1; 19826 FI; 19827ELSE IF OperandSize = 16 19828 THEN 19829 (ES:DestReg) AX; 19830 IF DF = 0 19831 THEN DestReg DestReg + 2; 19832 ELSE DestReg DestReg - 2; 19833 FI; 19834 ELSE (* OperandSize = 32 *) 19835 (ES:DestReg) EAX; 19836 IF DF = 0 19837 THEN DestReg DestReg + 4; 19838 ELSE DestReg DestReg - 4; 19839 FI; 19840 FI; 19841FI; 19842 19843Description 19844 19845STOS transfers the contents of all AL, AX, or EAX register to the memory 19846byte or word given by the destination register relative to the ES segment. 19847The destination register is DI for an address-size attribute of 16 bits or 19848EDI for an address-size attribute of 32 bits. 19849 19850The destination operand must be addressable from the ES register. A segment 19851override is not possible. 19852 19853The address of the destination is determined by the contents of the 19854destination register, not by the explicit operand of STOS. This operand is 19855used only to validate ES segment addressability and to determine the data 19856type. Load the correct index value into the destination register before 19857executing STOS. 19858 19859After the transfer is made, DI is automatically updated. If the direction 19860flag is 0 (CLD was executed), DI is incremented; if the direction flag is 198611 (STD was executed), DI is decremented. DI is incremented or decremented by 198621 if a byte is stored, by 2 if a word is stored, or by 4 if a doubleword is 19863stored. 19864 19865STOSB, STOSW, and STOSD are synonyms for the byte, word, and doubleword STOS 19866instructions, that do not require an operand. They are simpler to use, but 19867provide no type or segment checking. 19868 19869STOS can be preceded by the REP prefix for a block fill of CX or ECX bytes, 19870words, or doublewords. Refer to the REP instruction for further details. 19871 19872Flags Affected 19873 19874None 19875 19876Protected Mode Exceptions 19877 19878#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19879memory operand effective address in the CS, DS, ES, FS, or GS segments; 19880#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19881fault 19882 19883Real Address Mode Exceptions 19884 19885Interrupt 13 if any part of the operand would lie outside of the effective 19886address space from 0 to 0FFFFH 19887 19888Virtual 8086 Mode Exceptions 19889 19890Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 19891 19892 19893STR Store Task Register 19894 19895Opcode Instruction Clocks Description 19896 198970F 00 /1 STR r/m16 pm=23/27 Load EA word into task register 19898 19899 19900Operation 19901 19902r/m task register; 19903 19904Description 19905 19906The contents of the task register are copied to the two-byte register or 19907memory location indicated by the effective address operand. 19908 19909STR is used only in operating system software. It is not used in application 19910programs. 19911 19912Flags Affected 19913 19914None 19915 19916Protected Mode Exceptions 19917 19918#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19919memory operand effective address in the CS, DS, ES, FS, or GS segments; 19920#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19921fault 19922 19923Real Address Mode Exceptions 19924 19925Interrupt 6; STR is not recognized in Real Address Mode 19926 19927Virtual 8086 Mode Exceptions 19928 19929Same exceptions as in Real Address Mode 19930 19931Notes 19932 19933The operand-size attribute has no effect on this instruction. 19934 19935 19936SUB Integer Subtraction 19937 19938Opcode Instruction Clocks Description 19939 199402C ib SUB AL,imm8 2 Subtract immediate byte from AL 199412D iw SUB AX,imm16 2 Subtract immediate word from AX 199422D id SUB EAX,imm32 2 Subtract immediate dword from EAX 1994380 /5 ib SUB r/m8,imm8 2/7 Subtract immediate byte from r/m byte 1994481 /5 iw SUB r/m16,imm16 2/7 Subtract immediate word from r/m word 1994581 /5 id SUB r/m32,imm32 2/7 Subtract immediate dword from r/m 19946 dword 1994783 /5 ib SUB r/m16,imm8 2/7 Subtract sign-extended immediate byte 19948 from r/m word 1994983 /5 ib SUB r/m32,imm8 2/7 Subtract sign-extended immediate byte 19950 from r/m dword 1995128 /r SUB r/m8,r8 2/6 Subtract byte register from r/m byte 1995229 /r SUB r/m16,r16 2/6 Subtract word register from r/m word 1995329 /r SUB r/m32,r32 2/6 Subtract dword register from r/m 19954 dword 199552A /r SUB r8,r/m8 2/7 Subtract byte register from r/m byte 199562B /r SUB r16,r/m16 2/7 Subtract word register from r/m word 199572B /r SUB r32,r/m32 2/7 Subtract dword register from r/m 19958 dword 19959 19960 19961Operation 19962 19963IF SRC is a byte and DEST is a word or dword 19964THEN DEST = DEST - SignExtend(SRC); 19965ELSE DEST DEST - SRC; 19966FI; 19967 19968Description 19969 19970SUB subtracts the second operand (SRC) from the first operand (DEST). The 19971first operand is assigned the result of the subtraction, and the flags are 19972set accordingly. 19973 19974When an immediate byte value is subtracted from a word operand, the 19975immediate value is first sign-extended to the size of the destination 19976operand. 19977 19978Flags Affected 19979 19980OF, SF, ZF, AF, PF, and CF as described in Appendix C 19981 19982Protected Mode Exceptions 19983 19984#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 19985memory operand effective address in the CS, DS, ES, FS, or GS segments; 19986#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 19987fault 19988 19989Real Address Mode Exceptions 19990 19991Interrupt 13 if any part of the operand would lie outside of the effective 19992address space from 0 to 0FFFFH 19993 19994Virtual 8086 Mode Exceptions 19995 19996Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 19997 19998 19999TEST Logical Compare 20000 20001Opcode Instruction Clocks Description 20002 20003A8 ib TEST AL,imm8 2 AND immediate byte with AL 20004A9 iw TEST AX,imm16 2 AND immediate word with AX 20005A9 id TEST EAX,imm32 2 AND immediate dword with EAX 20006F6 /0 ib TEST r/m8,imm8 2/5 AND immediate byte with r/m byte 20007F7 /0 iw TEST r/m16,imm16 2/5 AND immediate word with r/m word 20008F7 /0 id TEST r/m32,imm32 2/5 AND immediate dword with r/m dword 2000984 /r TEST r/m8,r8 2/5 AND byte register with r/m byte 2001085 /r TEST r/m16,r16 2/5 AND word register with r/m word 2001185 /r TEST r/m32,r32 2/5 AND dword register with r/m dword 20012 20013 20014Operation 20015 20016DEST : = LeftSRC AND RightSRC; 20017CF 0; 20018OF 0; 20019 20020Description 20021 20022TEST computes the bit-wise logical AND of its two operands. Each bit 20023of the result is 1 if both of the corresponding bits of the operands are 1; 20024otherwise, each bit is 0. The result of the operation is discarded and only 20025the flags are modified. 20026 20027Flags Affected 20028 20029OF = 0, CF = 0; SF, ZF, and PF as described in Appendix C 20030 20031Protected Mode Exceptions 20032 20033#GP(0) for an illegal memory operand effective address in the CS, DS, 20034ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 20035#PF(fault-code) for a page fault 20036 20037Real Address Mode Exceptions 20038 20039Interrupt 13 if any part of the operand would lie outside of the effective 20040address space from 0 to 0FFFFH 20041 20042Virtual 8086 Mode Exceptions 20043 20044Same exceptions as in Real Address Mode; #PF(fault-code) for a page 20045fault 20046 20047 20048VERR, VERW Verify a Segment for Reading or Writing 20049 20050Opcode Instruction Clocks Description 20051 200520F 00 /4 VERR r/m16 pm=10/11 Set ZF=1 if segment can be read, 20053 selector in r/m16 200540F 00 /5 VERW r/m16 pm=15/16 Set ZF=1 if segment can be written, 20055 selector in r/m16 20056 20057 20058Operation 20059 20060IF segment with selector at (r/m) is accessible 20061 with current protection level 20062 AND ((segment is readable for VERR) OR 20063 (segment is writable for VERW)) 20064THEN ZF 0; 20065ELSE ZF 1; 20066FI; 20067 20068Description 20069 20070The two-byte register or memory operand of VERR and VERW contains 20071the value of a selector. VERR and VERW determine whether the 20072segment denoted by the selector is reachable from the current privilege 20073level and whether the segment is readable (VERR) or writable (VERW). 20074If the segment is accessible, the zero flag is set to 1; if the segment is 20075not accessible, the zero flag is set to 0. To set ZF, the following 20076conditions must be met: 20077 20078 The selector must denote a descriptor within the bounds of the table 20079 (GDT or LDT); the selector must be "defined." 20080 20081 The selector must denote the descriptor of a code or data segment 20082 (not that of a task state segment, LDT, or a gate). 20083 20084 For VERR, the segment must be readable. For VERW, the segment 20085 must be a writable data segment. 20086 20087 If the code segment is readable and conforming, the descriptor 20088 privilege level (DPL) can be any value for VERR. Otherwise, the 20089 DPL must be greater than or equal to (have less or the same 20090 privilege as) both the current privilege level and the selector's RPL. 20091 20092The validation performed is the same as if the segment were loaded into 20093DS, ES, FS, or GS, and the indicated access (read or write) were 20094performed. The zero flag receives the result of the validation. The 20095selector's value cannot result in a protection exception, enabling the 20096software to anticipate possible segment access problems. 20097 20098Flags Affected 20099 20100ZF as described above 20101 20102Protected Mode Exceptions 20103 20104Faults generated by illegal addressing of the memory operand that 20105contains the selector, the selector is not loaded into any segment 20106register, and no faults attributable to the selector operand are generated 20107 20108#GP(0) for an illegal memory operand effective address in the CS, DS, 20109ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; 20110#PF(fault-code) for a page fault 20111 20112Real Address Mode Exceptions 20113 20114Interrupt 6; VERR and VERW are not recognized in Real Address Mode 20115 20116Virtual 8086 Mode Exceptions 20117 20118Same exceptions as in Real Address Mode; #PF(fault-code) for a page 20119fault 20120 20121 20122WAIT Wait until BUSY# Pin is Inactive (HIGH) 20123 20124Opcode Instruction Clocks Description 20125 201269B WAIT 6 min. Wait until BUSY pin is inactive (HIGH) 20127 20128 20129Description 20130 20131WAIT suspends execution of 80386 instructions until the BUSY# pin is 20132inactive (high). The BUSY# pin is driven by the 80287 numeric processor 20133extension. 20134 20135Flags Affected 20136 20137None 20138 20139Protected Mode Exceptions 20140 20141#NM if the task-switched flag in the machine status word (the lower 16 bits 20142of register CR0) is set; #MF if the ERROR# input pin is asserted (i.e., the 2014380287 has detected an unmasked numeric error) 20144 20145Real Address Mode Exceptions 20146 20147Same exceptions as in Protected Mode 20148 20149Virtual 8086 Mode Exceptions 20150 20151Same exceptions as in Protected Mode 20152 20153 20154XCHG Exchange Register/Memory with Register 20155 20156Opcode Instruction Clocks Description 20157 2015890 + r XCHG AX,r16 3 Exchange word register with AX 2015990 + r XCHG r16,AX 3 Exchange word register with AX 2016090 + r XCHG EAX,r32 3 Exchange dword register with EAX 2016190 + r XCHG r32,EAX 3 Exchange dword register with EAX 2016286 /r XCHG r/m8,r8 3 Exchange byte register with EA byte 2016386 /r XCHG r8,r/m8 3/5 Exchange byte register with EA byte 2016487 /r XCHG r/m16,r16 3 Exchange word register with EA word 2016587 /r XCHG r16,r/m16 3/5 Exchange word register with EA word 2016687 /r XCHG r/m32,r32 3 Exchange dword register with EA dword 2016787 /r XCHG r32,r/m32 3/5 Exchange dword register with EA dword 20168 20169 20170Operation 20171 20172temp DEST 20173DEST SRC 20174SRC temp 20175 20176Description 20177 20178XCHG exchanges two operands. The operands can be in either order. If a 20179memory operand is involved, BUS LOCK is asserted for the duration of the 20180exchange, regardless of the presence or absence of the LOCK prefix or of the 20181value of the IOPL. 20182 20183Flags Affected 20184 20185None 20186 20187Protected Mode Exceptions 20188 20189#GP(0) if either operand is in a nonwritable segment; #GP(0) for an 20190illegal memory operand effective address in the CS, DS, ES, FS, or GS 20191segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) 20192for a page fault 20193 20194Real Address Mode Exceptions 20195 20196Interrupt 13 if any part of the operand would lie outside of the effective 20197address space from 0 to 0FFFFH 20198 20199Virtual 8086 Mode Exceptions 20200 20201Same exceptions as in Real Address Mode; #PF(fault-code) for a page 20202fault 20203 20204 20205XLAT/XLATB Table Look-up Translation 20206 20207D7 XLAT m8 5 Set AL to memory byte DS:[(E)BX + unsigned AL] 20208D7 XLATB 5 Set AL to memory byte DS:[(E)BX + unsigned AL] 20209 20210 20211Operation 20212 20213IF AddressSize = 16 20214THEN 20215 AL (BX + ZeroExtend(AL)) 20216ELSE (* AddressSize = 32 *) 20217 AL (EBX + ZeroExtend(AL)); 20218FI; 20219 20220Description 20221 20222XLAT changes the AL register from the table index to the table entry. AL 20223should be the unsigned index into a table addressed by DS:BX (for an 20224address-size attribute of 16 bits) or DS:EBX (for an address-size attribute 20225of 32 bits). 20226 20227The operand to XLAT allows for the possibility of a segment override. XLAT 20228uses the contents of BX even if they differ from the offset of the operand. 20229The offset of the operand should have been moved intoBX/EBX with a previous 20230instruction. 20231 20232The no-operand form, XLATB, can be used if the BX/EBX table will always 20233reside in the DS segment. 20234 20235Flags Affected 20236 20237None 20238 20239Protected Mode Exceptions 20240 20241#GP(0) for an illegal memory operand effective address in the CS, DS, ES, 20242FS, or GS segments; #SS(0) for an illegal address in the SS segment; 20243#PF(fault-code) for a page fault 20244 20245Real Address Mode Exceptions 20246 20247Interrupt 13 if any part of the operand would lie outside of the effective 20248address space from 0 to 0FFFFH 20249 20250Virtual 8086 Mode Exceptions 20251 20252Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault 20253 20254 20255XOR Logical Exclusive OR 20256 20257 20258Opcode Instruction Clocks Description 20259 2026034 ib XOR AL,imm8 2 Exclusive-OR immediate byte to AL 2026135 iw XOR AX,imm16 2 Exclusive-OR immediate word to AX 2026235 id XOR EAX,imm32 2 Exclusive-OR immediate dword to EAX 2026380 /6 ib XOR r/m8,imm8 2/7 Exclusive-OR immediate byte to r/m 20264 byte 2026581 /6 iw XOR r/m16,imm16 2/7 Exclusive-OR immediate word to r/m 20266 word 2026781 /6 id XOR r/m32,imm32 2/7 Exclusive-OR immediate dword to r/m 20268 dword 2026983 /6 ib XOR r/m16,imm8 2/7 XOR sign-extended immediate byte 20270 with r/m word 2027183 /6 ib XOR r/m32,imm8 2/7 XOR sign-extended immediate byte 20272 with r/m dword 2027330 /r XOR r/m8,r8 2/6 Exclusive-OR byte register to r/m 20274 byte 2027531 /r XOR r/m16,r16 2/6 Exclusive-OR word register to r/m 20276 word 2027731 /r XOR r/m32,r32 2/6 Exclusive-OR dword register to r/m 20278 dword 2027932 /r XOR r8,r/m8 2/7 Exclusive-OR byte register to r/m 20280 byte 2028133 /r XOR r16,r/m16 2/7 Exclusive-OR word register to r/m 20282 word 2028333 /r XOR r32,r/m32 2/7 Exclusive-OR dword register to r/m 20284 dword 20285 20286 20287Operation 20288 20289DEST LeftSRC XOR RightSRC 20290CF 0 20291OF 0 20292 20293Description 20294 20295XOR computes the exclusive OR of the two operands. Each bit of the result 20296is 1 if the corresponding bits of the operands are different; each bit is 0 20297if the corresponding bits are the same. The answer replaces the first 20298operand. 20299 20300Flags Affected 20301 20302CF = 0, OF = 0; SF, ZF, and PF as described in Appendix C; AF is undefined 20303 20304Protected Mode Exceptions 20305 20306#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal 20307memory operand effective address in the CS, DS, ES, FS, or GS segments; 20308#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page 20309fault 20310 20311Real Address Mode Exceptions 20312 20313Interrupt 13 if any part of the operand would lie outside of the effective 20314address space from 0 to 0FFFFH 20315 20316Virtual 8086 Mode Exceptions 20317 20318Same exceptions as in Real Address Mode; #PF(fault-code) for a page 20319fault 20320 20321 20322Appendix A Opcode Map 20323 20324 20325 20326The opcode tables that follow aid in interpreting 80386 object code. Use 20327the high-order four bits of the opcode as an index to a row of the opcode 20328table; use the low-order four bits as an index to a column of the table. If 20329the opcode is 0FH, refer to the two-byte opcode table and use the second 20330byte of the opcode to index the rows and columns of that table. 20331 20332 20333Key to Abbreviations 20334 20335Operands are identified by a two-character code of the form Zz. The first 20336character, an uppercase letter, specifies the addressing method; the second 20337character, a lowercase letter, specifies the type of operand. 20338 20339 20340Codes for Addressing Method 20341 20342A Direct address; the instruction has no modR/M byte; the address of the 20343 operand is encoded in the instruction; no base register, index register, 20344 or scaling factor can be applied; e.g., far JMP (EA). 20345 20346C The reg field of the modR/M byte selects a control register; e.g., MOV 20347 (0F20, 0F22). 20348 20349D The reg field of the modR/M byte selects a debug register; e.g., MOV 20350 (0F21,0F23). 20351 20352E A modR/M byte follows the opcode and specifies the operand. The operand 20353 is either a general register or a memory address. If it is a memory 20354 address, the address is computed from a segment register and any of the 20355 following values: a base register, an index register, a scaling factor, 20356 a displacement. 20357 20358F Flags Register. 20359 20360G The reg field of the modR/M byte selects a general register; e.g., ADD 20361 (00). 20362 20363I Immediate data. The value of the operand is encoded in subsequent bytes 20364 of the instruction. 20365 20366J The instruction contains a relative offset to be added to the 20367 instruction pointer register; e.g., JMP short, LOOP. 20368 20369M The modR/M byte may refer only to memory; e.g., BOUND, LES, LDS, LSS, 20370 LFS, LGS. 20371 20372O The instruction has no modR/M byte; the offset of the operand is coded as 20373 a word or double word (depending on address size attribute) in the 20374 instruction. No base register, index register, or scaling factor can be 20375 applied; e.g., MOV (A0-A3). 20376 20377R The mod field of the modR/M byte may refer only to a general register; 20378 e.g., MOV (0F20-0F24, 0F26). 20379 20380S The reg field of the modR/M byte selects a segment register; e.g., MOV 20381 (8C,8E). 20382 20383T The reg field of the modR/M byte selects a test register; e.g., MOV 20384 (0F24,0F26). 20385 20386X Memory addressed by DS:SI; e.g., MOVS, COMPS, OUTS, LODS, SCAS. 20387 20388Y Memory addressed by ES:DI; e.g., MOVS, CMPS, INS, STOS. 20389 20390 20391Codes for Operant Type 20392 20393a Two one-word operands in memory or two double-word operands in memory, 20394 depending on operand size attribute (used only by BOUND). 20395 20396b Byte (regardless of operand size attribute) 20397 20398c Byte or word, depending on operand size attribute. 20399 20400d Double word (regardless of operand size attribute) 20401 20402p 32-bit or 48-bit pointer, depending on operand size attribute. 20403 20404s Six-byte pseudo-descriptor 20405 20406v Word or double word, depending on operand size attribute. 20407 20408w Word (regardless of operand size attribute) 20409 20410 20411Register Codes 20412 20413When an operand is a specific register encoded in the opcode, the register 20414is identified by its name; e.g., AX, CL, or ESI. The name of the register 20415indicates whether the register is 32-, 16-, or 8-bits wide. A register 20416identifier of the form eXX is used when the width of the register depends on 20417the operand size attribute; for example, eAX indicates that the AX register 20418is used when the operand size attribute is 16 and the EAX register is used 20419when the operand size attribute is 32. 20420 20421 20422One-Byte Opcode Map 20423 20424 20425 0 1 2 3 4 5 6 7 8 9 A B C D E F 20426 ͻ 20427 ADD PUSH POP OR PUSH 2-byte 204280Ĵ Ĵ 20429 Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv ES ES Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv CS escape 20430 20431 ADC PUSH POP SBB PUSH POP 204321Ĵ Ĵ 20433 Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv SS SS Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv DS DS 20434 20435 AND SEG SUB SEG 204362Ĵ DAA Ĵ DAS 20437 Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv =ES Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv =CS 20438 20439 XOR SEG CMP SEG 204403Ĵ AAA Ĵ AAS 20441 Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv =SS Eb,Gb Ev,Gv Gb,Eb Gv,Ev AL,Ib eAX,Iv =CS 20442 20443 INC general register DEC general register 204444Ķ 20445 eAX eCX eDX eBX eSP eBP eSI eDI eAX eCX eDX eBX eSP eBP eSI eDI 20446 20447 PUSH general register POP into general register 204485Ķ 20449 eAX eCX eDX eBX eSP eBP eSI eDI eAX eCX eDX eBX eSP eBP eSI eDI 20450 20451 BOUND ARPL SEG SEG Operand Address PUSH IMUL PUSH IMUL INSB INSW/D OUTSB OUTSW/D 204526 PUSHA POPA 20453 Gv,Ma Ew,Rw =FS =GS Size Size Ib GvEvIv Ib GvEvIv Yb,DX Yb,DX Dx,Xb DX,Xv 20454 20455 Short displacement jump of condition (Jb) Short-displacement jump on condition(Jb) 204567Ķ 20457 JO JNO JB JNB JZ JNZ JBE JNBE JS JNS JP JNP JL JNL JLE JNLE 20458 20459 Immediate Grpl Grpl TEST XCNG MOV MOV LEA MOV POP 204608Ĵ Ĵ 20461 Eb,Ib Ev,Iv Ev,Iv Eb,Gb Ev,Gv Eb,Gb Ev,Gv Eb,Gb Ev,Gv Gb,Eb Gv,Ev Ew,Sw Gv,M Sw,Ew Ev 20462 20463 XCHG word or double-word register with eAX CALL PUSHF POPF 204649 NOP Ĵ CBW CWD WAIT SAHF LAHF 20465 eCX eDX eBX eSP eBP eSI eDI Ap Fv Fv 20466 20467 MOV MOVSB MOVSW/D CMPSB CMPSW/D TEST STOSB STOSW/D LODSB LODSW/D SCASB SCASW/D 20468AĴ Ĵ 20469 AL,Ob eAX,Ov Ob,AL Ov,eAX Xb,Yb Xv,Yv Xb,Yb Xv,Yv AL,Ib eAX,Iv Yb,AL Yv,eAX AL,Xb eAX,Xv AL,Xb eAX,Xv 20470 20471 MOV immediate byte into byte register MOV immediate word or double into word or double register 20472BĶ 20473 AL CL DL BL AH CH DH BH eAX eCX eDX eBX eSP eBP eSI eDI 20474 20475 Shift Grp2 RET near LES LDS MOV ENTER RET far INT INT 20476CĴ Ĵ LEAVE Ĵ INTO IRET 20477 Eb,Ib Ev,Iv Iw Gv,Mp Gv,Mp Eb,Ib Ev,Iv Iw,Ib Iw 3 Ib 20478 20479 Shift Grp2 20480DĴ AAM AAD XLAT ESC(Escape to coprocessor instruction set) 20481 Eb,1 Ev,1 Eb,CL Ev,CL 20482 20483 LOOPNE LOOPE LOOP JCXZ IN OUT CALL JNP IN OUT 20484E Ĵ Ķ 20485 Jb Jb Jb Jb AL,Ib eAX,Ib Ib,AL Ib,eAX Av Jv Ap Jb AL,DX eAX,DX DX,AL DX,eAX 20486 20487 REP Unary Grp3 INC/DEC Indirct 20488F LOCK REPNE HLT CMC Ĵ CLC STC CLI STI CLD STD 20489 REPE Eb Ev Grp4 Grp5 20490 ͼ 20491 20492 20493Two-Byte Opcode Map (first byte is 0FH) 20494 20495 20496 0 1 2 3 4 5 6 7 8 9 A B C D E F 20497 ͻ 20498 LAR LSL 204990 Grp6 Grp7 CLTS 20500 Gw,Ew Gv,Ew 20501 20502 205031 20504 20505 20506 MOV MOV MOV MOV MOV MOV 205072 20508 Cd,Rd Dd,Rd Rd,Cd Rd,Dd Td,Rd Rd,Td 20509 20510 205113 20512 20513 20514 205154 20516 20517 20518 205195 20520 20521 20522 205236 20524 20525 20526 205277 20528 20529 20530 Long-displacement jump on condition (Jv) Long-displacement jump on condition (Jv) 205318Ķ 20532 JO JNO JB JNB JZ JNZ JBE JNBE JS JNS JP JNP JL JNL JLE JNLE 20533 20534 Byte Set on condition (Eb) 205359Ĵ SETS SETNS SETP SETNP SETL SETNL SETLE SETNLE 20536 SETO SETNO SETB SETNB SETZ SETNZ SETBE SETNBE 20537 20538 PUSH POP BT SHLD SHLD PUSH POP BTS SHRD SHRD IMUL 20539A 20540 FS FS Ev,Gv EvGvIb EvGvCL GS GS Ev,Gv EvGvIb EvGvCL Gv,Ev 20541 20542 LSS BTR LFS LGS MOVZX Grp-8 BTC BSF BSR MOVSX 20543B Ĵ Ķ 20544 Mp Ev,Gv Mp Mp Gv,Eb Gv,Ew Ev,Ib Ev,Gv Gv,Ev Gv,Ev Gv,Eb Gv,Ew 20545 20546 20547C 20548 20549 20550 20551D 20552 20553 20554 20555E 20556 20557 20558 20559F 20560 20561 ͼ 20562 20563 20564Opcodes determined by bits 5,4,3 of modR/M byte: 20565 20566 G Ŀ 20567 r mod nnn R/M 20568 o 20569 u 20570 p 000 001 010 011 100 101 110 111 20571 Ŀ 20572 1 ADD OR ADC SBB AND SUB XOR CMP 20573 20574 Ĵ 20575 2 ROL ROR RCL RCR SHL SHR SAR 20576 20577 Ĵ 20578 3 TEST NOT NEG MUL IMUL DIV IDIV 20579 Ib/Iv AL/eAX AL/eAX AL/eAX AL/eAX 20580 Ĵ 20581 4 INC DEC 20582 Eb Eb 20583 Ĵ 20584 5 INC DEC CALL CALL JMP JMP PUSH 20585 Ev Ev Ev eP Ev Ep Ev 20586 20587 20588 20589Opcodes determined by bits 5,4,3 of modR/M byte: 20590 20591 G Ŀ 20592 r mod nnn R/M 20593 o 20594 u 20595 p 000 001 010 011 100 101 110 111 20596 Ŀ 20597 6 SLDT STR LLDT LTR VERR VERW 20598 Ew Ew Ew Ew Ew Ew 20599 Ĵ 20600 7 SGDT SIDT LGDT LIDT SMSW LMSW 20601 Ms Ms Ms Ms Ew Ew 20602 Ĵ 20603 8 BT BTS BTR BTC 20604 20605 20606 20607 20608Appendix B Complete Flag Cross-Reference 20609 20610 20611 20612Key to Codes 20613 20614T = instruction tests flag 20615 20616M = instruction modifies flag 20617 (either sets or resets depending on operands) 20618 206190 = instruction resets flag 20620 206211 = instruction sets flag 20622 20623 = instruction's effect on flag is undefined 20624 20625R = instruction restores prior value of flag 20626 20627blank = instruction does not affect flag 20628 20629 20630Instruction OF SF ZF AF PF CF TF IF DF NT RF 20631 20632AAA TM M 20633AAD M M M 20634AAM M M M 20635AAS TM M 20636ADC M M M M M TM 20637ADD M M M M M M 20638AND 0 M M M 0 20639ARPL M 20640BOUND 20641BSF/BSR M 20642BT/BTS/BTR/BTC M 20643CALL 20644CBW 20645CLC 0 20646CLD 0 20647CLI 0 20648CLTS 20649CMC M 20650CMP M M M M M M 20651CMPS M M M M M M T 20652CWD 20653DAA M M TM M TM 20654DAS M M TM M TM 20655DEC M M M M M 20656DIV 20657ENTER 20658ESC 20659HLT 20660IDIV 20661IMUL M M 20662IN 20663INC M M M M M 20664INS T 20665INT 0 0 20666INTO T 0 0 20667IRET R R R R R R R R R T 20668Jcond T T T T T 20669JCXZ 20670JMP 20671LAHF 20672LAR M 20673LDS/LES/LSS/LFS/LGS 20674LEA 20675LEAVE 20676LGDT/LIDT/LLDT/LMSW 20677LOCK 20678LODS T 20679LOOP 20680LOOPE/LOOPNE T 20681LSL M 20682LTR 20683MOV 20684MOV control, debug 20685MOVS T 20686MOVSX/MOVZX 20687MUL M M 20688NEG M M M M M M 20689NOP 20690NOT 20691OR 0 M M M 0 20692OUT 20693OUTS T 20694POP/POPA 20695POPF R R R R R R R R R R 20696PUSH/PUSHA/PUSHF 20697RCL/RCR 1 M TM 20698RCL/RCR count TM 20699REP/REPE/REPNE 20700RET 20701ROL/ROR 1 M M 20702ROL/ROR count M 20703SAHF R R R R R 20704SAL/SAR/SHL/SHR 1 M M M M M 20705SAL/SAR/SHL/SHR count M M M M 20706SBB M M M M M TM 20707SCAS M M M M M M T 20708SET cond T T T T T 20709SGDT/SIDT/SLDT/SMSW 20710SHLD/SHRD M M M M 20711STC 1 20712STD 1 20713STI 1 20714STOS T 20715STR 20716SUB M M M M M M 20717TEST 0 M M M 0 20718VERR/VERRW M 20719WAIT 20720XCHG 20721XLAT 20722XOR 0 M M M 0 20723 20724 20725Appendix C Status Flag Summary 20726 20727 20728 20729Status Flags' Functions 20730 20731Bit Name Function 20732 20733 0 CF Carry Flag Set on high-order bit carry or borrow; cleared 20734 otherwise. 20735 2 PF Parity Flag Set if low-order eight bits of result contain 20736 an even number of 1 bits; cleared otherwise. 20737 4 AF Adjust flag Set on carry from or borrow to the low order 20738 four bits of AL; cleared otherwise. Used for decimal 20739 arithmetic. 20740 6 ZF Zero Flag Set if result is zero; cleared otherwise. 20741 7 SF Sign Flag Set equal to high-order bit of result (0 is 20742 positive, 1 if negative). 2074311 OF Overflow Flag Set if result is too large a positive number 20744 or too small a negative number (excluding sign-bit) to fit in 20745 destination operand; cleared otherwise. 20746 20747Key to Codes 20748 20749T = instruction tests flag 20750M = instruction modifies flag 20751 (either sets or resets depending on operands) 207520 = instruction resets flag 20753 = instruction's effect on flag is undefined 20754blank = instruction does not affect flag 20755 20756 20757 20758Instruction OF SF ZF AF PF CF 20759AAA TM M 20760AAS TM M 20761AAD M M M 20762AAM M M M 20763DAA M M TM M TM 20764DAS M M TM M TM 20765ADC M M M M M TM 20766ADD M M M M M M 20767SBB M M M M M TM 20768SUB M M M M M M 20769CMP M M M M M M 20770CMPS M M M M M M 20771SCAS M M M M M M 20772NEG M M M M M M 20773DEC M M M M M 20774INC M M M M M 20775IMUL M M 20776MUL M M 20777RCL/RCR 1 M TM 20778RCL/RCR count TM 20779ROL/ROR 1 M M 20780ROL/ROR count M 20781SAL/SAR/SHL/SHR 1 M M M M M 20782SAL/SAR/SHL/SHR count M M M M 20783SHLD/SHRD M M M M 20784BSF/BSR M 20785BT/BTS/BTR/BTC M 20786AND 0 M M M 0 20787OR 0 M M M 0 20788TEST 0 M M M 0 20789XOR 0 M M M 0 20790 20791 20792Appendix D Condition Codes 20793 20794 20795 20796 20797Note: 20798 The terms "above" and "below" refer to the relation between two 20799 unsigned values (neither SF nor OF is tested). The terms "greater" and 20800 "less" refer to the relation between two signed values (SF and OF are 20801 tested). 20802 20803 20804Definition of Conditions 20805 20806(For conditional instructions Jcond, and SETcond) 20807 20808 20809 Instruction Condition 20810Mnemonic Meaning Subcode Tested 20811 20812O Overflow 0000 OF = 1 20813 20814NO No overflow 0001 OF = 0 20815 20816B Below 20817NAE Neither above nor equal 0010 CF = 1 20818 20819NB Not below 20820AE Above or equal 0011 CF = 0 20821 20822E Equal 20823Z Zero 0100 ZF = 1 20824 20825NE Not equal 20826NZ Not zero 0101 ZF = 0 20827 20828BE Below or equal 20829NA Not above 0110 (CF or ZF) = 1 20830 20831NBE Neither below nor equal 20832NA Above 0111 (CF or ZF) = 0 20833 20834S Sign 1000 SF = 1 20835 20836NS No sign 1001 SF = 0 20837 20838P Parity 20839PE Parity even 1010 PF = 1 20840 20841NP No parity 20842PO Parity odd 1011 PF = 0 20843 20844L Less 20845NGE Neither greater nor equal 1100 (SF xor OF) = 1 20846 20847NL Not less 20848GE Greater or equal 1101 (SF xor OF) = 0 20849 20850LE Less or equal 20851NG Not greater 1110 ((SF xor OF) or ZF) = 1 20852 20853NLE Neither less nor equal 20854G Greater 1111 ((SF xor OF) or ZF) = 0 20855