Consolidated /docs into /pubs
This commit is contained in:
Jeff Parsons
Jeff Parsons
parent
9d356c582b
commit
71d117fa02
106 changed files with 350 additions and 317 deletions
|
|
@ -1,240 +0,0 @@
|
|||
---
|
||||
layout: page
|
||||
title: "x86 Instructions: LOADALL"
|
||||
permalink: /docs/x86/ops/LOADALL/
|
||||
---
|
||||
|
||||
LOADALL386 (0x070F)
|
||||
---
|
||||
|
||||
### Description
|
||||
|
||||
Excerpt from [http://www.rcollins.org/secrets/opcodes/LOADALL.html](http://www.rcollins.org/secrets/opcodes/LOADALL.html):
|
||||
|
||||
(LOADALL) An undocumented op code used by ICE host software and
|
||||
diagnostics software to test CPU functionality. This instruction
|
||||
has the ability to bypass the entire protection checking mechanism
|
||||
in the CPU, and therefore can be used to test many aspects of CPU
|
||||
behavior that can't be duplicated by any other software means.
|
||||
|
||||
Read LOADALL magazine article and download LOADALL demo source code.
|
||||
|
||||
Undocumented: Available on all 80386 processors.
|
||||
Useful for diagnostics purposes on production
|
||||
CPU's.
|
||||
Useful for ICE BONDOUT CPU's to return the
|
||||
processor to EMUlation state.
|
||||
LOADALL
|
||||
Flags: Loads the entire CPU state
|
||||
All flags set according to +----------+----------+
|
||||
the LOADALL flags image. | 00001111 | 00000111 |
|
||||
+----------+----------+
|
||||
| 0F | 07 |
|
||||
+----------+----------+
|
||||
Input: ES:EDI points to the Clocks: 122
|
||||
LOADALL register image. Bus Cycles: 51
|
||||
|
||||
LOADALL loads the entire CPU state from a table pointed to by
|
||||
ES:EDI. At the completion of LOADALL, the CPU state is defined
|
||||
according to this table. No protection checks are performed
|
||||
against values in the table, and LOADALL can generate no
|
||||
exceptions in real mode, or in protected mode at IOPL 0.
|
||||
Attempting to execute LOADALL at any other privilege level will
|
||||
generate an exception 13.
|
||||
|
||||
There are three types of structures in the LOADALL image:
|
||||
1) 32-bit CPU registers entries;
|
||||
2) 16-bit segment registers (zero-extended to 32-bits);
|
||||
3) 96-bit segment descriptor cache entries.
|
||||
|
||||
The segment register entries have the following format:
|
||||
SREG STRUC
|
||||
REG_VAL DW ? ; low 16-bits defined
|
||||
DW 0 ; high 16-bits=0
|
||||
ENDS
|
||||
|
||||
The segment descriptor cache entires have the following format:
|
||||
DESC_CACHE STRUC
|
||||
DB 0 ; b[00-07] not used
|
||||
S_USE DB ? ; b[14] operand size
|
||||
S_Access DB ? ; b[16-23] Access Rights
|
||||
DB 0 ; b[24-31] not used
|
||||
S_Addr DD ? ; Segment Address in memory
|
||||
S_Limit DD ? ; Segment size limit
|
||||
ENDS
|
||||
|
||||
The LOADALL tables is organized as follows:
|
||||
;----------------------------------------------------------------
|
||||
; LOADALL table pointed to by ES:EDI
|
||||
;----------------------------------------------------------------
|
||||
Offset Description Size Value
|
||||
====== =========== ==== =====
|
||||
[00] CR0 DD ?
|
||||
[04] EFLAGS DD ?
|
||||
[08] EIP DD ?
|
||||
[0C] EDI DD ?
|
||||
[10] ESI DD ?
|
||||
[14] EBP DD ?
|
||||
[18] ESP DD ?
|
||||
[1C] EBX DD ?
|
||||
[20] EDX DD ?
|
||||
[24] ECX DD ?
|
||||
[28] EAX DD ?
|
||||
[2C] DR6 DD ?
|
||||
[30] DR7 DD ?
|
||||
[34] TR_REG SREG <?>
|
||||
[38] LDT_REG SREG <?>
|
||||
[3C] GS_REG SREG <?>
|
||||
[40] FS_REG SREG <?>
|
||||
[44] DS_REG SREG <?>
|
||||
[48] SS_REG SREG <?>
|
||||
[4C] CS_REG SREG <?>
|
||||
[50] ES_REG SREG <?>
|
||||
[54] TSS_DESC DESC_CACHE <?,?,?>
|
||||
[60] IDT_DESC DESC_CACHE <0,?,?>
|
||||
[6C] GDT_DESC DESC_CACHE <0,?,?>
|
||||
[78] LDT_DESC DESC_CACHE <?,?,?>
|
||||
[84] GS_DESC DESC_CACHE <?,?,?>
|
||||
[90] FS_DESC DESC_CACHE <?,?,?>
|
||||
[9C] DS_DESC DESC_CACHE <?,?,?>
|
||||
[A8] SS_DESC DESC_CACHE <?,?,?>
|
||||
[B4] CS_DESC DESC_CACHE <?,?,?>
|
||||
[C0] ES_DESC DESC_CACHE <?,?,?>
|
||||
[CC] LENGTH OF TABLE
|
||||
The following two diagrams take a closer look at fields within
|
||||
the LOADALL table:
|
||||
1) the descriptor cache register;
|
||||
2) the access rights within the descriptor cache register.
|
||||
;---------------------------------------------------------------------
|
||||
; Segment descriptor cache register
|
||||
;
|
||||
; 9 6 3 2 1 1 0 0
|
||||
; 5 3 1 3 5 3 7 0
|
||||
; +--------------+---------------------+---+---------------+---+---+
|
||||
; | 32-bit limit | 32-bit base address | 0 | Access Rights | 0 | 0 |
|
||||
; +--------------+---------------------+---+---------------+---+---+
|
||||
;
|
||||
;---------------------------------------------------------------------
|
||||
; 386 Descriptor Cache Access Rights
|
||||
;
|
||||
; ++++++++----------------------------- 0=Undefined
|
||||
; |||||||| +--------------------------- Present 0=No 1=Yes
|
||||
; |||||||| |++------------------------- Descriptor privelege level
|
||||
; |||||||| |||+------------------------ System Desc. 0=Sys 1=Code/Data
|
||||
; |||||||| ||||+++--------------------- Type(*)
|
||||
; |||||||| ||||||+-----------------------Read/Write 0=R/O 1=R/W
|
||||
; |||||||| |||||+|-----------------------Expansion 0=Up 1=Dwn
|
||||
; |||||||| ||||+||-----------------------Executable 0=No 1=Yes*
|
||||
; |||||||| ||||||| 000=Read Only
|
||||
; |||||||| ||||||| 001=Read/Write
|
||||
; |||||||| ||||||| 010=Read Only, Expand down
|
||||
; |||||||| ||||||| 011=Read/Write, Expand down
|
||||
; |||||||| ||||||| 100=Execute only
|
||||
; |||||||| ||||||| 101=Execute/Read
|
||||
; |||||||| ||||||| 110=Execute only, conforming
|
||||
; |||||||| ||||||| 111=Execute/Read, conforming
|
||||
; |||||||| |||||||+-------------------- Accessed
|
||||
; |||||||| |||||||| +------------------ 0=Undefined (was G bit)
|
||||
; |||||||| |||||||| |+----------------- Default operand size(+)
|
||||
; |||||||| |||||||| || 0=16-bit operands
|
||||
; |||||||| |||||||| || 1=32-bit operands
|
||||
; |||||||| |||||||| ||
|
||||
; |||||||| |||||||| ||++++++-++++++++-- 0=Undefined
|
||||
; |||||||| |||||||| |||||||| ||||||||
|
||||
; |||||||| |||||||| |||||||| ||||||||
|
||||
; 3||||||||2||||||||1||||||||0||||||||0 Bit
|
||||
; 1||||||||3||||||||5||||||||7||||||||0 Offset
|
||||
; +++++++++++++++++++++++++++++++++++++
|
||||
; | Intel |22221111|11|Intel| Intel | (*) = CS can be marked as a R/W
|
||||
; |Reserved|32109876|54|Rsvd.|Reserved| data segment if LOADALL
|
||||
; +++++++++++++++++++++++++++++++++++++ is used to load register.
|
||||
; (+) = Only applicable for CS
|
||||
;
|
||||
;---------------------------------------------------------------------
|
||||
;---------------------------------------------------------------------
|
||||
; A closer look at the access rights field definitions:
|
||||
;
|
||||
; 2 2 2 2 1 1 1 1 1 1 1 Bit 2 2 2 2 1 1 1 1 1 1
|
||||
; 3 2 1 0 9 8 7 6 5 4 3 Offset 3 2 1 0 9 8 7 6 5 4
|
||||
; +-+---+-+-----+-+-+-+-+ +-+---+-+-----+-+-+-+
|
||||
; |P|DPL|S|Type |A|0|G|D| |P|DPL|S| Type |G|D|
|
||||
; | | | |0| | | | | | | | | | | |1| | | | | | |
|
||||
; +-+---+-+-----+-+-+-+-+ +-+---+-+-----+-+-+-+
|
||||
; Bit:
|
||||
; P Present bit. 1=Present, 0=Not present.
|
||||
; This bit signals the CPU if the segment addressed by the
|
||||
; segment base address is actually present in memory.
|
||||
; DPL Descriptor Privilege Level: 0=highest, 3=lowest
|
||||
; S System descriptor: 0=Code, Data; 1=System descriptor
|
||||
; Type Segment Type: (S=0)
|
||||
; +-+-+-+
|
||||
; |X|Y|Z|
|
||||
; +-+-+-+
|
||||
; | | |
|
||||
; | | +-- Read/Write 0=Read-only 1=Read/Write
|
||||
; | +---- Expansion direction. 0=Expand up 1=Expand down
|
||||
; +------ Executable 0=Data Seg 1=Code Seg
|
||||
; Type Segment Type: (S=1)
|
||||
; 0000 = Reserved
|
||||
; 0001 = Available 286 TSS
|
||||
; 0010 = LDT
|
||||
; 0011 = Busy 286 TSS
|
||||
; 0100 = 286 Call Gate
|
||||
; 0101 = Task Gate
|
||||
; 0110 = 286 Interrupt Gate
|
||||
; 0111 = 286 Trap Gate
|
||||
; 1000 = Reserved
|
||||
; 1001 = Available 386, 486 TSS
|
||||
; 1010 = Reserved
|
||||
; 1011 = Busy 386, 486 TSS
|
||||
; 1100 = 386, 486 Call Gate
|
||||
; 1101 = Reserved
|
||||
; 1110 = 386, 486 Interrupt Gate
|
||||
; 1111 = 386, 486 Trap Gate
|
||||
; A Accessed (S=0) 0=Not Accessed 1=Accessed
|
||||
; The processor sets this bit when the descriptor is
|
||||
; accessed.
|
||||
; G Granularity 0=Byte 1=4k
|
||||
; When set, upon loading the limit field of the descriptor
|
||||
; cache register, the CPU shifts the limit by 12, and fills
|
||||
; in the 1st 12 bits with 1's as follows:
|
||||
; SHL LIMIT,12
|
||||
; OR LIMIT,0FFFh
|
||||
; D Default operand size 0=16-bit 1=32-bit
|
||||
; When set, the CPU interprets all operands, and effective
|
||||
; addresses as 32-bit values. When clear, all operands
|
||||
; and effective addresses are 16-bit values. This bit
|
||||
; is only applicable to the CS descriptor cache.
|
||||
;---------------------------------------------------------------------
|
||||
;---------------------------------------------------------------------
|
||||
; The definition of these bits is exactly as that of the access
|
||||
; rights in the descriptor table, with the following exceptions:
|
||||
; 1) The "PRESENT" bit becomes a valid bit. Using LOADALL, you
|
||||
; may load a descriptor cache register whose P bit is marked
|
||||
; not present (P=0). During normal CPU operaion, simply
|
||||
; loading the segment selector with a descriptor table entry
|
||||
; whose P=0 will cause an exception-11. This is different
|
||||
; that operating with LOADALL. LOADALL will let you load the
|
||||
; descriptor cache register with P=0. But any memory
|
||||
; reference using that segment selector will cause exception-
|
||||
; 13.
|
||||
; 2) The DPL field for SS & CS descriptors determine the CPL.
|
||||
; 3) The DPL field for DS, ES, FS, & GS should be 3.
|
||||
; 4) The Granularity (G) bit has no effect on the limit field
|
||||
; in the descriptor cache register
|
||||
; 5) A Code segment (CS) may be Read/Write/Executable by setting
|
||||
; the access rights as a Read/Write/Data segment. This will
|
||||
; even work in protected mode.
|
||||
;---------------------------------------------------------------------
|
||||
|
||||
The following related files were saved on February 16, 2015 from [http://www.rcollins.org](http://www.rcollins.org/):
|
||||
|
||||
* [The LOADALL Instruction](tspec_a3_doc.html)
|
||||
* [286LOAD.ASM](286load.asm)
|
||||
* [386LOAD.ASM](386load.asm)
|
||||
* [CPU_TYPE.ASM](cpu_type.asm)
|
||||
* [EMULOAD.ASM](emuload.asm)
|
||||
* [LOADFNS.286](loadfns.286.asm)
|
||||
* [LOADFNS.386](loadfns.386.asm)
|
||||
* [MACROS.286](macros.286.asm)
|
||||
* [MACROS.386](macros.386.asm)
|
||||
Loading…
Reference in a new issue