Initial commit (a clone of the jsmachines project as of v1.15.3)
This commit is contained in:
jeffpar
commit
a5e3e6a59d
714 changed files with 130602 additions and 0 deletions
32
pubs/pc/reference/intel/80286/README.md
Normal file
32
pubs/pc/reference/intel/80286/README.md
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
Intel 80286 CPU Documentation
|
||||
---
|
||||
|
||||
### 80286 Errata
|
||||
|
||||
* [ARPL Behavior](arpl/)
|
||||
* [Coprocessor Operand Beyond Segment Limit](b2_b3_information/#coprocessor-operand-partially-beyond-limit-of-erc-segment)
|
||||
* [Instructions Longer than 10 Bytes](long_instructions/)
|
||||
* [Loading Null Selector Values Into DS or ES Registers](b2_b3_information/#loading-null-selector-values-into-ds-or-es-registers)
|
||||
* [Non-Restartable Protection Violations](b2_b3_information/#non-restartable-protection-violations)
|
||||
* [POPF Behavior](b2_b3_information/#popf-behavior)
|
||||
* [REP MOVS and REP INS Restartability](rep_restartability/)
|
||||
* [Early 80286 Errata of Interest](exceptions_and_early_errata/#early-80286-errata-of-interest)
|
||||
|
||||
### 80286 Undocumented Opcodes
|
||||
|
||||
* [LOADALL](loadall/)
|
||||
|
||||
### 80286 Real-Mode Emulation Notes
|
||||
|
||||
* [Executing Real Mode Programs in Protected Mode](executing_real_mode_programs_in_protected_mode/)
|
||||
* [Discrepancies from an iAPX 86/88 Using Emulation](executing_real_mode_programs_in_protected_mode/#discrepancies-from-an-iapx-86-88-using-emulation)
|
||||
* [Extending the Address Space of Current iAPX 86 Software](executing_real_mode_programs_in_protected_mode/#extending-the-address-space-of-current-iapx-86-software)
|
||||
* [Mixing Real Mode and Protected Mode](executing_real_mode_programs_in_protected_mode/#mixing-real-mode-and-protected-mode)
|
||||
* [Exceptions from Undefined Opcodes and String Instructions](exceptions_and_early_errata/)
|
||||
|
||||
### Assorted Publications
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
11
pubs/pc/reference/intel/80286/arpl/README.md
Normal file
11
pubs/pc/reference/intel/80286/arpl/README.md
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
ARPL (63H)
|
||||
---
|
||||
|
||||
When the second operand of the ARPL instruction (as described in the iAPX286 Programmer's Reference Manual) is a null
|
||||
selector, the ARPL instruction generates exception 13. This behavior of the ARPL instruction has not been previously described,
|
||||
but will be described in future revisions of the "iAPX286 Programmer's Reference Manual."
|
||||
|
||||
This functionality of the ARPL is not believed not to be a problem, and there are no plans to change this functionality
|
||||
of the ARPL instruction.
|
||||
|
||||
[This information is from an Intel document titled "80286 ARPL and Overlength Instructions, 15 October 1984"]
|
||||
193
pubs/pc/reference/intel/80286/b2_b3_information/README.md
Normal file
193
pubs/pc/reference/intel/80286/b2_b3_information/README.md
Normal file
|
|
@ -0,0 +1,193 @@
|
|||
80286 (B-2/B-3) Information
|
||||
---
|
||||
|
||||
This applies to S-spec #40093 and to S-spec #54012 of the 80286, since they contain a (B-2/B-3) stepping of the 80286.
|
||||
Their complete parametric specifications are given by the datasheet in the 1984 Intel Microsystem Components Handbook,
|
||||
order number 230843.
|
||||
|
||||
### Errata Items
|
||||
|
||||
Below are full descriptions of any problem the 80286(8-2/B-3) is known to have, for your information when using this
|
||||
powerful processor. These items will be corrected in subsequent versions of the 80286:
|
||||
|
||||
#### Pullup Busy and Error Inputs
|
||||
|
||||
> The BUSY and ERROR inputs do not have internal pullup resistors. If these inputs are left unconnected,
|
||||
the 80286 may stop execution or perform interrupt 16 when an ESC or WAIT instruction is executed. This problem
|
||||
is avoided by connecting 20K pullup resistors from Vee to these inputs. These pullup resistors will assure that
|
||||
WAIT and ESC instructions are handled properly when an 80287 is not present. This change is compatible with
|
||||
later versions of the 80286 which will include internal pullups on those two pins.
|
||||
|
||||
#### Coprocessor Operand Partially Beyond Limit of ERC Segment
|
||||
|
||||
> This is a possible minor limit violation involving the 80287 coprocessor that goes undetected by the 80286.
|
||||
If a coprocessor operand is read from an "executable and readable and conforming" (abbreviated ERC) code segment,
|
||||
and the coprocessor operand is sufficiently near the segment's limit that the second or subsequent byte lies outside
|
||||
the limit, no protection exception #9 will be generated. Note that this occurs only when at least the first byte of
|
||||
the coprocessor's operand lies within a valid ERC code segment. If any other type of segment is involved then
|
||||
exception #9 is properly generated. If the operand is entirely outside its segment limit, an exception #13 is
|
||||
properly generated.
|
||||
|
||||
#### CLK Input Requirements
|
||||
|
||||
> CLK rise and fall times are specified as 7ns maximum, and V(ilc) is specified as 0.4V maximum. Note that 82284's
|
||||
produced while this stepping of 80286 was in production were tested to meet these temporary requirements of the 286
|
||||
CLK input.
|
||||
|
||||
#### POPF Behavior
|
||||
|
||||
> This errata has no effect when interrupts are enabled in either Real Mode or Protected Mode. This errata has no
|
||||
effect in Protected Mode when CPL > IOPL.
|
||||
|
||||
> If the 80286 executes a POPF instruction while interrupts are disabled in either Real Address Mode, or Protected
|
||||
Mode with CPL < IOPL, then a pending maskable interrupt (INTR pin active) may be improperly recognized after executing
|
||||
the POPF instruction even if maskable interrupts were disabled before the POPF instruction and the value popped had
|
||||
IF=0. If the interrupt is improperly recognized, the interrupt is still correctly processed.
|
||||
|
||||
> The occurrence of this errata may be slightly affected by the number of wait states during the data-read bus cycle
|
||||
of the POPF, and by even- or odd-address alignment of stack words. Two additional wait states (after memory-read-data
|
||||
is valid) added to memory-data-read bus cycles will eliminate the errata, but will incur a performance penalty.
|
||||
|
||||
#### Don't Remove Interrupt Signal Early
|
||||
|
||||
> When the INTR is activated and external interrupts are enabled, INTR must be held active until the CPU performs the
|
||||
first INTA bus cycle to process the external interrupt, or else unpredictable CPU behavior could occur. See additional
|
||||
information [below](./#background-on-early-intr-signal-removal).
|
||||
|
||||
#### Nested Interrupts
|
||||
|
||||
> When the 80286 is in protected mode, and processes an external interrupt or INT instruction which references an
|
||||
Interrupt Gate in the IDT, an external interrupt activating the INTR input will be processed if the INTR pin remains
|
||||
active or goes active anytime between the fifth and tenth bus cycles after the second INTA bus cycle for the first
|
||||
interrupt. Normally, if an external interrupt references an Interrupt Gate in the IDT, then no further interrupts are
|
||||
processed, until interrupts are re-enabled within the service routine or by the IRET instruction at the end of the
|
||||
service routine. Because of this errata, an interrupt routine in protected mode may be interrupted before its first
|
||||
instruction if the INTR input is active again during the "window" described above.
|
||||
|
||||
#### Non-Maskable Interrupt
|
||||
|
||||
> When INTR goes active, and then NMI goes active slightly later, exactly during the last internal clock period of the
|
||||
instruction prior to the INTR being processed, the NMI is not recognized. The probability of this occurring from
|
||||
asynchronous INTR and NMI events is very unlikely. However, if the same event can activate INTR and NMI, ensure the
|
||||
NMI pin is activated 10ns before the INTR.
|
||||
|
||||
#### Non-Restartable Protection Violations
|
||||
|
||||
> The details of this are primarily of interest to an operating system writer.
|
||||
|
||||
> The protection violations involved usually indicate a probable software bug and restart is not desired if one of these
|
||||
violations occurs. In a Protected Mode 80286 system with wait states during any bus cycles, when certain protection
|
||||
violations are detected by the 80286 component, and the component transfers control to the exception handling routine,
|
||||
the contents of the CX register may be unreliable. (Whether CX contents are changed is a function of bus activity at the
|
||||
time internal microcode detects the protection violation.)
|
||||
|
||||
> Note that any "not present" exception when a CS, SS, DS or ES segment is "not present" is entirely restartable, for
|
||||
virtual memory implementation. The protection violations which could lead to unreliable CX contents are below and note
|
||||
again these violations usually indicate a software bug. Therefore restart is not usually desired after these protection
|
||||
violations:
|
||||
|
||||
> 1. exception #GP(O) from attempted access to data segment or extra segment when the corresponding segment register holds a null selector;
|
||||
> 2. exception #GP(O) from attempted data read from code segment when code segment has the "execute-only" attribute;
|
||||
> 3. exception #GP(O) from attempted write to code segment (code segments are not writable), or to data segment or extra segment if the data or extra segment has the "read-only" attribute;
|
||||
> 4. exception #NP(selector) from attempted load of a selector referencing the local descriptor table into CS, DS, or ES, when the LDT is not present (or exception #SS(selector) if SS);
|
||||
> 5. exception #GP(O) from attempted input or output instruction when CPL [?] IOPL;
|
||||
> 6. exception #GP(selector) from attempted access to a descriptor in GDT, LDT, or IDT, beyond the defined limit of the descriptor table;
|
||||
> 7. exception #GP(O) from attempted read or write (except for "PUSH" onto stack) beyond the defined limit of segment.
|
||||
|
||||
> The following protection violation below may also lead to unreliable CX register contents. The following protection violation
|
||||
is designed to be restartable for dynamically growable stacks, but due to the errata, is not restartable on this stepping in a
|
||||
system which has wait states in any bus cycles (for example, refresh cycles in system with dynamic memory):
|
||||
|
||||
> 8. exception #SS(O) from attempted "PUSH" below the defined limit of the stack segment (restart allows dynamically growable stack segments).
|
||||
|
||||
> Notations used above (the value in parentheses indicates the type of error code pushed on exception handler's stack):
|
||||
|
||||
> * exception #NP() = exception #11 = Not-Present Fault
|
||||
> * exception #SS() = exception #12 = Stack Fault
|
||||
> * exception #GP() = exception #13 = General Protection Fault
|
||||
|
||||
#### Loading Null Selector Values Into DS or ES Registers
|
||||
|
||||
> This isn't usually a problem, since any of the 4 null selector values are equivalent in purpose. Just be aware of it:
|
||||
in Protected Mode, when any of the 4 null selector values (the 4 possible null selectors are 0000H, 0001H, 0002H and 0003H)
|
||||
are loaded into DS or ES registers via a MOV or POP instruction or a task switch, note the 80286 always loads the null
|
||||
selector 0000H into the corresponding registers. The 80286 will be improved to load all 4 null selector values literally.
|
||||
In Real Mode all values loaded into DS or ES are of course loaded unaltered.
|
||||
|
||||
> ##### Background
|
||||
|
||||
> In Protected Mode, the null selector is any selector whose Index bits and Table Indicator bit are all zero. Since the
|
||||
2-bit RPL field may be 00, 01, 10 or 11, there are 4 possible null selectors. In hex format, the 4 possible null selectors
|
||||
are 0000H, 0001H, 0002H and 0003H. They all serve as "null" values, and a general protection violation correctly occurs
|
||||
if software attempts to access the data segment or extra segment when a null selector is in the corresponding segment register.
|
||||
|
||||
### Documentation Corrections
|
||||
|
||||
> These items are documentation errors to be corrected as soon as possible. Accurate descriptions below are for your information.
|
||||
|
||||
#### Single-Stepping The "INT n" Instruction
|
||||
|
||||
> To prevent application software from invoking privileged system interrupt routines with the trap flag (single-step flag)
|
||||
set, the "INT n" instruction disables the Trap Flag if it was previously set. This applies to Real Address mode as well as
|
||||
Protected Mode, from the B-2 stepping onward. This prevents applications programs from invoking privileged interrupt routines
|
||||
with the TF set, causing single-stepping of operating system interrupt routines which may be time-critical, for example.
|
||||
The "INT n" instruction pushes the original flag word (before disabling TF), pushes the CS and IP pointing to the next
|
||||
instruction, then disables the Trap Flag before executing the interrupt routine. However, debuggers which single-step through
|
||||
code can still single-step within an interrupt routine called by the "INT n" instruction by recognizing the "INT n" opcode and
|
||||
emulating the "INT n" function (e.g. push Flags, CS, IP, and set CS:IP per the value found in the nth interrupt vector or
|
||||
IDT descriptor). Debuggers which emulate the "INT n" are backward compatible to earlier 80286 steppings, to the 80186, and 8086.
|
||||
|
||||
#### LOCK Signal During INTA Cycles
|
||||
|
||||
> This does not affect the 8259A interrupt controller. From the (B-2) stepping onward, the 286 LOCK signal is active during
|
||||
both INTA cycles of the Interrupt Acknowledge sequence (on earlier steppings, the LOCK signal was active only on the first
|
||||
INTA cycle). Internal circuit design necessitated this correction. LOCK asserted means "lock this cycle TO THE NEXT bus cycle."
|
||||
Therefore the (B-2) and later steppings lock the two INTA cycles to the first stack push of the interrupt processing sequence.
|
||||
Doing so is no problem. However, custom interrupt controllers may be affected if they use the state of LOCK to distinguish
|
||||
the first and second INTA cycles. Custom hardware designers note you can deactivate the INTR signal to the 80286 anytime
|
||||
during either INTA cycle, and the vector may be placed on the data bus during both cycles although the 80286 only reads
|
||||
the vector during the second INTA cycle.
|
||||
|
||||
#### Instructions Longer Than 10 Bytes
|
||||
|
||||
> Instructions longer than 10 bytes occur only by using the assembler to intentionally place multiple redundant prefixes
|
||||
(e.g. multiple lock prefixes and/or segment override prefixes) before valid opcode bytes. On all 80286 components,
|
||||
in Real Address Mode or Protected Mode, when the 80286 detects an instruction that is illegal solely due to being greater
|
||||
than 10 bytes in length, it generates an exception #13 (General Protection Exception) rather than exception #6 (Invalid Opcode)
|
||||
as previously described. Note that undefined opcodes do generate exception #6 (Invalid Opcode) as described.
|
||||
|
||||
#### ARPL Instruction
|
||||
|
||||
> On any 80286 component, when the second operand of the ARPL instruction is a null selector, the instruction generates
|
||||
an exception #13. This is not a problem since the RW operand contains the RPL bits used only as a "standard" for comparison,
|
||||
and the EW operand is the actual selector whose RPL bits are subject to adjustment. Ensure the RW operand does not have all
|
||||
its bits 15-2 equal to "0", since that makes it a null selector value. This is easy to avoid since only RW bits 0 and 1 are
|
||||
used for comparison; bits 15-2 can be anything but all zeroes.
|
||||
|
||||
### Background on Early INTR Signal Removal
|
||||
|
||||
> When the INTR is activated and external interrupts are enabled, INTR must be held active until the CPU performs the first
|
||||
INTA bus cycle to process the external interrupt. Failure to keep the INTR active until the first INTA cycle occurs could
|
||||
cause unpredictable CPU behavior. When this errata is corrected, failure to keep the INTR input active will only possibly
|
||||
prevent the external interrupt from being recognized.
|
||||
|
||||
> Some I/O devices may allow their interrupt output output to go inactive after previously signalling an interrupt.
|
||||
For example, the 8253 or 8254 timer used for real-time clocks can remove the interrupt request if not serviced early enough
|
||||
(even if the 8259A interrupt controller is in edge-triggered mode).
|
||||
|
||||
> When using the 8259A Priority Interrupt controller, below are several cases in which an active 8259A INT output will go
|
||||
inactive, possibly before the 80286 CPU generates its first INTA cycle to process the interrupt. Both cases below can be
|
||||
handled if the 80286 interrupts are always disabled before programming the interrupt controller.
|
||||
|
||||
> 1. The interrupt request seen by the CPU can also be removed by the 8259A interrupt controller even though the interrupt
|
||||
> from the I/O device remains active. For example, system software may mask an 8259A interrupt input just after the I/O device
|
||||
> asserts it. The net effect is an INTR signal at the 80286 that goes active then inactive. (even if the 8259A is in edge-triggered mode);
|
||||
> 2. The 8259A INT output will go inactive for about the duration of the write pulse when the CPU writes an OCW3
|
||||
> (operation control word 3) which selects the IRR (interrupt request register),
|
||||
|
||||
> The default interrupt function of the 8259A will guarantee a proper vector for IR7, the default interrupt, if at the time INTA
|
||||
is performed no unmasked interrupt is active. The interrupt handler for IR7 can read ISR7 of the 8259A to tell if this was a real
|
||||
interrupt on IR7. The ISR7 bit will be 0 if at the time the interrupt was acknowledged, no unmasked IR inputs of the 8259A were
|
||||
active ("phantom" interrupt).
|
||||
|
||||
[This information is from a 7-page Intel document titled "80286(B-2/B-3) Information Sheet, 21 November 1984"]
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
Exceptions from Undefined Opcodes and String Instructions
|
||||
---
|
||||
|
||||
The exception 13 handler will probably use a lookup table for the opcode byte of the instruction causing exception
|
||||
13 to determine the correct action for this instruction. In general, any undefined opcode causes exception 6 and
|
||||
would therefore not invoke exception 13. However, some implementations may emulate some instructions. The following
|
||||
explains the empty entries in the opcode map to aid in determining an emulation strategy.
|
||||
|
||||
The following is a list of exclusions from the general rule of undefined 80286 opcodes causing exception 6.
|
||||
|
||||
* The [LOADALL](../loadall/) instruction (opcode 0F04H) will cause exception 13 in protected mode if executed when
|
||||
CPL is not 0. [LOADALL](../loadall/) may be executed at any time in real address mode.
|
||||
|
||||
* The 0F05H opcode will cause exception 13 in protected mode if executed when CPL is not 0. If 0F05H is executed
|
||||
in real address mode, or in protected mode when CPL=O, the 80286 stops normal execution. RESET must be used to
|
||||
restart the CPU in this case. The 0F05H opcode may be executed at any time in real address mode.
|
||||
|
||||
* The opcode 82H is an alias for opcode 80H.
|
||||
|
||||
* The 0D0H/0D1H opcode with a REG field = 6 is an alias for the SHL instruction (REG = 7).
|
||||
|
||||
* The opcode 0D6H is a proprietary single byte instruction. No restrictions apply to its execution.
|
||||
It can be emulated as a NOP.
|
||||
|
||||
* The 0F1H opcode is a prefix which performs no function. It counts like any other prefix towards the maximum
|
||||
instruction length. No restrictions apply to its execution.
|
||||
|
||||
* The 0F6H/0F7H opcode with a REG field = 1 is an alias for the TEST instruction (REG=0).
|
||||
|
||||
Restarting string instructions which caused exception 12 (if SS override was used) or exception 13 requires updating
|
||||
SI, DI, and CX (if repeat was used). Which registers are updated depends on the instruction and when the exception was
|
||||
detected. The following rules apply:
|
||||
|
||||
* For STOS, the DI register must always be updated by the exception handler to restart tne instruction.
|
||||
The state of the DF bit in the flag word and the operand size determines whether to use +2, +1, -1, or -2 to
|
||||
update DI. If a repeated STOS was used, add 2 to CX to restart the instruction.
|
||||
|
||||
* For INS, the DI register must always be updated by the exception handler to restart the instruction. The state
|
||||
of the DF bit in the flag word and the operand size determines whether to use +2, +1, -1, or -2 to update DI.
|
||||
If a repeated INS was used, increment CX to restart the instruction. If exception 13 was not caused by an invalid
|
||||
IOPL during the first I/O read, then increment CX again if INS was repeated.
|
||||
|
||||
* For SCAS, the SI register must always be updated by the exception handler to restart the instruction.
|
||||
The state of the DF bit in the flag word and the operand size determines whether to use +2, +1, -1, or -2 to
|
||||
update SI. If SCAS was repeated, add 2 to CX to restart it.
|
||||
|
||||
* For OUTS, the SI register must always be updated by the exception handler to restart the instruction. The state
|
||||
of the DF bit in the flag word and the operand size determines whether to use +2, +1, -1, or -2 to update SI.
|
||||
If OUTS was repeated, add 2 to CX to restart it. Note that exception 13 may have been caused by an insufficient IOPL.
|
||||
|
||||
* For MOVS, the SI register must always be updated by the exception handler to restart the instruction. The state
|
||||
of the DF bit in the flag word and the operand size determines whether to use +2, +1, -1, or -2 to update SI.
|
||||
The DI register must also be updated if the source operand (i.e. DS:SI or seg:SI if a segment override prefix was
|
||||
used) did not cause the exception. After updating SI, look at the source operand address to see if exception 13
|
||||
would occur. If not, then DI must also be updated the same as SI. Always increment CX to restart MOVS if it was
|
||||
repeated. IF DI was updated and a repeat prefix was used, then CX must be incremented again for correct instruction
|
||||
restart.
|
||||
|
||||
* For CMPS, the DI register must always be updated by the exception handler to restart the instruction. The state
|
||||
of the DF bit in the flag word and the operand size determines whether to use +2, +1, -1, or -2 to update DI.
|
||||
The SI register must also be updated if the ES:DI operand did not cause the exception. After updating DI, look at
|
||||
ES:DI to see if exception 13 would occur. If not, then SI must also be updated the same as DI. Increment CX if
|
||||
CMPS was repeated to restart it. IF SI was updated and a repeat prefix was used, then CX must be incremented for
|
||||
correct instruction restart.
|
||||
|
||||
Early 80286 Errata of Interest
|
||||
---
|
||||
|
||||
Early versions of the 80286 have several errata items which may effect the implementation of software to emulate an
|
||||
8086/8088 on a protected mode 80286 or expansion of the address space in real mode. These errata are in the A1 and B1
|
||||
steppings of the 80286 and are fixed in later steppings of the 80286.
|
||||
|
||||
* If the ES register has a null selector or ES:DI exceeds the segment limit when executing either the non-repeated
|
||||
MOVS or INS instructions, the saved CS:IP value seen by the exception 13 handler will point after the MOVS or
|
||||
INS instruction. The saved CS:IP value in later steppings will point at the failed instruction (including prefixes).
|
||||
|
||||
* If the segment register used for the destination operand in either the POP to memory, FSTSW/FNSTSW, or
|
||||
FSTCW/FNSTCW instructions has a null selector in it or the segment limit is violated, the saved CS:IP value
|
||||
seen by the exception 13 (or 12 if SS override was used) handler will point after the POP/FSTSW/FNSTSW/FSTCW/FNSTCW
|
||||
instruction. The saved CS:IP value in later steppings will point at the failed instruction (including prefixes).
|
||||
|
||||
* If the stack limit is violated by a PUSH from memory instruction, the saved CS:IP value seen by the exception 12
|
||||
handler will point after the PUSH instruction. The saved CS:IP value in later steppings will point at the failed
|
||||
PUSH instruction (including prefixes).
|
||||
|
||||
* If a segment limit violation or IOPL violation occurs in the repeated MOVS, INS, OUTS, CMPS, SCAS, or STOS
|
||||
instructions, the value of CX seen by the exception 12 or 13 handler will be the value used at the start of the
|
||||
instruction. The SI and DI register values will reflect the iterations used by the instruction. Later steppings
|
||||
of the 80286 will assure the saved value of the CX register reflects the number of iterations performed.
|
||||
|
||||
* The [LOADALL](../loadall/) instruction may incorrectly enter protected mode. This only affects systems that use [LOADALL](../loadall/) while
|
||||
in real mode and want to remain in real mode. Two possible workarounds are possible: execute [LOADALL](../loadall/) using
|
||||
0-wait memory for the data values or be sure bit 0 of memory location 804H is zero. HOLD requests and processor
|
||||
extension data transfers should be inhibited while [LOADALL](../loadall/) is running. Later steppings of the 80286 will correctly
|
||||
load the MSW during [LOADALL](../loadall/) with HOLD and processor extension transfers.
|
||||
|
||||
[This information is from an undated 15-page Intel document titled "Undocumented iAPX 286 Test Instruction"]
|
||||
|
|
@ -0,0 +1,296 @@
|
|||
Executing Real Mode Programs in Protected Mode
|
||||
---
|
||||
|
||||
An iAPX 86/88 program using real mode addressing can be executed in protected mode with full protection between
|
||||
it and other programs. All segment register semantics of iAPX 86 real mode can be emulated. The address space
|
||||
of the real mode program can also be limited to less than 1 megabyte and be relocated anywhere in the 16 Megabyte
|
||||
physical address space. The following sections describe several aspects of this emulation.
|
||||
|
||||
### Address space relocation and control ###
|
||||
|
||||
iAPX 86 real mode emulation requires any segment register load instruction cause a protection exception.
|
||||
An error code with bits 1-0 being zero and bits 15-2 being non-zero identify a segment register load exception.
|
||||
Such exceptions are restartable. All instructions that do not load a segment register run at full iAPX 286
|
||||
speed and with full access checks.
|
||||
|
||||
The exception handler must interpret the segment register load instruction to place the iAPX 86 paragraph ID
|
||||
and the associated protected descriptor into the [LOADALL](../loadall/) memory area. [LOADALL](../loadall/) then
|
||||
loads the segment register with the value used by the interrupted instruction, points the descriptor cache entry
|
||||
at the protected physical memory region, and restores the other segment registers.
|
||||
|
||||
Most segment load instructions will cause exception 13 if all LDT and GDT entries are marked with a privilege
|
||||
level less than the CPL of the emulated program. The CPL of the emulated program is defined by the DPL fields
|
||||
of the CS and SS descriptor caches.
|
||||
|
||||
Segment register loads using a selector value of 0000H to 0003H do not cause an exception on loading the
|
||||
segment register. Instead, any memory reference using the segment register will cause exception 13 with an
|
||||
error code of 0. No memory reference will occur. This case can be identified by checking whether DS or ES
|
||||
contain a value of 0-3. These exceptions are also restartable.
|
||||
|
||||
Limits can be enforced on the size of the emulated iAPX 86 address space. An iAPX 86 paragraph ID that is outside
|
||||
the defined memory area can be loaded, but the segment register can be marked invalid for memory addressing. [LOADALL](../loadall/)
|
||||
can be used to load the iAPX 86 paragraph ID into the segment register, but the descriptor cache entry is marked
|
||||
invalid. The paragraph ID can still be read without causing a protection exception.
|
||||
|
||||
If a selector value is loaded whose segment overruns the end of the defined physical memory area, the limit field
|
||||
can be set less than 65535 to prevent accesses outside the defined memory area with that segment register.
|
||||
|
||||
The emulated iAPX 86/88 address space can be relocated anywhere in the 16 Mbyte iAPX 286 physical address space by
|
||||
adding a 24-bit relocation factor to the 20-bit iAPX 86/88 physical address value associated with the iAPX 86
|
||||
paragraph ID.
|
||||
|
||||
### iAPX 86/88 Interrupt Table Simulation ###
|
||||
|
||||
The [LOADALL](../loadall/) instruction allows a protected mode 80286 to provide a simulated iAPX 86/88 interrupt
|
||||
table to iAPX 86/88 programs. The protected mode iAPX 286 interrupt table is different from iAPX 86/88 since it must
|
||||
contain more information and be protected from improper use. The protected mode interrupt table cannot be
|
||||
addressed by the same selector-offset pairs used in iAPX 86 real address mode.
|
||||
|
||||
The iAPX 86/88 interrupt table is simulated by having all INT instructions cause a protection exception.
|
||||
Setting the DPL of all IDT gate entries to less than the CPL of the emulated program will cause exception 13
|
||||
for all INT instructions. The error code will indicate an IDT vector with the EXT bit cleared. External
|
||||
interrupts and program exceptions will continue to use the protected IDT.
|
||||
|
||||
The iAPX 86/88 INT instruction can be simulated by the exception 13 handler. For INT instructions, it looks
|
||||
into the iAPX 86 interrupt vector table for the vector associated with the interrupt vector in the error code.
|
||||
After simulating the machine state save, the iAPX 86/88 program is restarted at the interrupt vector address.
|
||||
|
||||
Interrupt handlers for external interrupts can pass control to an iAPX 86 real mode program. Each external
|
||||
interrupt handler for an iAPX 86 interrupt must determine if the interrupt is for a real mode program; if so,
|
||||
then it emulates a real mode interrupt the same way as for the INT instruction.
|
||||
|
||||
### Allowing writes into a code segment ###
|
||||
|
||||
Code segment writes are possible by using writable data segment descriptors for the CS cache entry.
|
||||
Normally the code segment is write protected. If the code segment descriptor is always marked writable,
|
||||
then writes using the CS prefix will work correctly.
|
||||
|
||||
### Allowing temporaries to be placed into segment registers ###
|
||||
|
||||
A temporary value which does not correspond to a valid segment causes exception 13. It is possible to place
|
||||
that value into the program visible segment register, but mark the descriptor cache entry invalid. The invalid
|
||||
descriptor lets the program reference the numeric value stored in the segment register value, (i.e. MOV AX,ES)
|
||||
but prevents any memory reference instruction from using the segment register to address memory (i.e. MOV AX,ES:[BX]).
|
||||
|
||||
This feature requires an error handler to know that exception 13 with an error code which is an invalid segment
|
||||
selector value indicates a potential temporary value problem. The exception handler must simulate the segment load
|
||||
instruction to place the error code into the appropriate segment register and use [LOADALL](../loadall/) to mark the descriptor
|
||||
cache entry invalid. The program may then be resumed after the segment load instruction.
|
||||
|
||||
### Simulating I/O ###
|
||||
|
||||
All I/O instructions of the iAPX 86 program can be simulated. When the IOPL (I/O privilege level) is less than
|
||||
the CPL of the simulated iAPX 86 program, exception 13 will occur, with an error code of 0, on IN, OUT, STI, CLI,
|
||||
and LOCK instructions. The exception handler can identify these instructions and emulate their actions. The
|
||||
iAPX 86 program can then be restarted.
|
||||
|
||||
The LOCK instruction prefix causes exception 13 when CPL is greater than IOPL. For most systems, the LOCK prefix
|
||||
could be ignored. Restarting the program after the LOCK prefix would be acceptable. In special cases, the LOCKED
|
||||
instruction may need to be run with a lower CPL.
|
||||
|
||||
### Mixing emulated real mode software with native protected mode software ###
|
||||
|
||||
A system which emulates a real mode program may also run protected mode software. If the GDT and IDT has all
|
||||
entries marked level 2 or less, the emulated program cannot use them if it runs at level 3. The emulated program
|
||||
can have a task state segment associated with it. An LDT may be present if all entries are marked level 2 or less.
|
||||
Normal protected mode tasks may use an LOT with entries at privilege level 3.
|
||||
|
||||
Interrupt handlers may use either task or interrupt/trap gates. All interrupt handlers using trap/interrupt
|
||||
gates must execute at privilege level 2 or less. Interrupts that use task gates may run at any privilege level.
|
||||
|
||||
The register save operation of the task switch or interrupt handler will work without exceptions. The iAPX 86
|
||||
paragraph IDs in the segment registers can be read without a protection exception. The segment registers can be
|
||||
reloaded with protected selectors without a protection exception. Interrupting from a emulated iAPX 86 program
|
||||
does not affect interrupt latency.
|
||||
|
||||
Returning from an interrupt requires some checks. The return from the interrupt handler must check whether an
|
||||
iAPX 86 real mode program had been executing. If so, the return sequence must use the [LOADALL](../loadall/) instruction to reload
|
||||
all the registers rather than the normal IRET instruction.
|
||||
|
||||
Depending on the iAPX 86 paragraph IDs used, the IRET instruction might not cause a protection exception on
|
||||
returning to an emulated iAPX 86 program. The CS value of an interrupted iAPX 86 program saved on the stack or
|
||||
in the TSS does not correctly identify the privilege level, normally 3, of the emulated iAPX 86 real mode program.
|
||||
The privilege level of the interrupted program is determined by the RPL fields of the saved CS and SS selectors.
|
||||
If these values are the same and refer to a visible code segment, the CPU could attempt to execute the protected
|
||||
code segment at an incorrect address.
|
||||
|
||||
The interrupt handler should test whether an emulated iAPX 86 program was executing. An interrupted protected mode
|
||||
program can be restarted in the normal manner while an emulated program requires [LOADALL](../loadall/).
|
||||
|
||||
### Emulating an 8087 with the 80287 ###
|
||||
|
||||
The instruction and data addresses saved in the protected mode 80287 environment area are in a different format
|
||||
than from the 8087. In real mode, the 80287 environment is in the same format as the 8087. In protected mode,
|
||||
the 80287 environment is changed to store 32-bit virtual pointers rather than 20-bit iAPX 86/88 physical addresses.
|
||||
|
||||
The 80287 can be used by both normal protected mode programs and emulated iAPX 86/88 real mode programs. The 80287
|
||||
operates in either real mode or protected mode. The FSETPM instruction must be executed before starting a normal
|
||||
protected mode program if the 80287 was in real mode. The 80287 must be reset, via the RESET pin, to reenter real
|
||||
mode for an emulated iAPX 86/88 program after being used by a normal protected mode program. External hardware could
|
||||
reset the part to reenter real-mode. The TS bit of the MSW can be used to monitor for the first ESCAPE instruction
|
||||
executed in a program. The exception 7 handler can then determine what mode of operation is required in the 80287.
|
||||
|
||||
The 20-bit physical addresses kept by the 80287 for the instruction and data pointers will reflect the paragraph ID
|
||||
in the program visible segment register and offset used by the ESC instruction to address memory. The descriptor
|
||||
cache base and limit loaded by [LOADALL](../loadall/) is used to generate physical memory addresses for data transfers.
|
||||
|
||||
The WAIT instructions required by the 8087 before ESC instructions can be safely executed by the 80287.
|
||||
|
||||
Discrepancies from an iAPX 86/88 Using Emulation
|
||||
---
|
||||
|
||||
An 80286 cannot exactly emulate an 8086/88 in all possible cases. Most differences are due to the extra protection
|
||||
checks made in the 80286 which are not made in the 8086/88. The discrepancies listed here are minor enough that very
|
||||
few programs will be affected.
|
||||
|
||||
1. The PUSH SP instruction pushes a different value on the iAPX 286 than on the iAPX 86,88,186. The value pushed
|
||||
onto the stack by the 80286 is the value of SP before the push instruction executes. The value pushed onto the
|
||||
stack by the 8086/88/186 is the SP value after the push instruction executes.
|
||||
|
||||
2. Shifts and rotates on the iAPX 286 mask the count to 5 bits. The iAPX 86/88 allows all 8 bits to be used.
|
||||
The iAPX 186/188 also masks the shift count to 5 bits.
|
||||
|
||||
3. Segment wrap-around is not allowed on the 80286. Segment limit violations are not restartable in general on the
|
||||
80286. Programs that rely on reading some special value when referencing non-existent memory may not be correctly
|
||||
run.
|
||||
|
||||
Exceptions 9, 12, or 13 occur during attempts to wrap-around a segment depending on the location and type of
|
||||
operand involved. All exception 12 cases can be emulated and the program restarted. Exception 13 or 12 that
|
||||
occurs for an ESC instruction occurs before the 80286 or 80287 execute the instruction, and are therefore
|
||||
restartable. Exception 9 cannot be restarted.
|
||||
|
||||
Most simple load and store instructions that violate a segment limit are restartable. The current case that
|
||||
cannot be restarted in general is any floating point operand reference where the second or subsequent word
|
||||
exceeded a segment limit. The exception 9 handler __must__ execute FNINIT before __any__ other WAIT or ESC
|
||||
instruction. The internal status of the 80287 cannot be read until it is forced idle by FNINIT. The FNINIT
|
||||
instruction will mark all floating point data registers as empty, set top of stack to 0, and mask all errors.
|
||||
The numeric instruction and data addresses stored in the 80287 will correctly point at the failing instruction.
|
||||
If the 80286 program interrupted by the math address error is not the program that executed the failed ESC
|
||||
instruction, then that program can be restarted.
|
||||
|
||||
4. Memory address space wrap-around is not directly supported. The iAPX 86/88 allow wrap around from the top of
|
||||
the 1 megabyte address space into the bottom of the 1 megabyte address space (i.e. address FC00:4000 is same
|
||||
as 0000:0000). To emulate instructions that address memory with such wrap-around, requires the segment register
|
||||
limit be set to cause a protection exception for addresses beyond simulated physical address 0FFFFFH, or
|
||||
addresses below 00000H using an expand down segment, and software emulation of the instruction to address memory
|
||||
at the bottom of the address space.
|
||||
|
||||
5. An 8086/88/186 program will require different amounts of time to execute instructions on the 80286. Most
|
||||
instructions will run faster on the 80286. Instructions which do not modify a segment register, and do not
|
||||
use a segment register with a zero in it will run faster on the 80286. Instructions that first access memory
|
||||
with a segment register containing a zero will run slower on the 80286. Instructions that load a segment register
|
||||
with a non-zero selector value will run slower on the 80286.
|
||||
|
||||
6. The iAPX 286 and iAPX 186 can generate the most negative number as a quotient for the IDIV instruction.
|
||||
The iAPX 86/88 will generate the divide error exception instead.
|
||||
|
||||
7. The iAPX 286 divide error return address will point at the divide instruction including prefixes. The registers
|
||||
will appear as if the instruction had not executed. The iAPX 86/88/186/188 return address will point after the
|
||||
divide instruction and the DX:AX or AH:AL registers may have been changed.
|
||||
|
||||
8. The numeric instruction address stored in the 80287 includes all leading prefixes before the ESC opcode.
|
||||
The 8087 numeric instruction address always points at the ESC opcode.
|
||||
|
||||
9. An iAPX 286/20 system does not require an interrupt controller for the ERROR signal. iAPX 86/20 systems use an
|
||||
interrupt controller to prioritize simultaneous interrupts and mask errors from the 8087 if servicing them must
|
||||
be delayed.
|
||||
|
||||
If the same interrupt controller is provided as in the iAPX 86 system, the input used for the 8087 ERROR signal
|
||||
can be grounded. Instructions that control that input of the interrupt controller become NOPs. Watch out for
|
||||
non-specific EOI instructions inside an 8087 error handler which may affect other interrupt inputs.
|
||||
|
||||
80287 errors do not normally affect an interrupt handler. As long as any program does not execute WAIT or ESC
|
||||
instructions, it cannot be interrupted by the 80287.
|
||||
|
||||
If a different interrupt system is used in the iAPX 286 system than in the iAPX 86 system, any I/O instructions
|
||||
to the interrupt controller may have to be emulated.
|
||||
|
||||
10. Numeric error interrupts use interrupt vector 16. Since an external interrupt controller may be used in
|
||||
iAPX 86,88,186 systems, another interrupt vector may have been used for numeric interrupts.
|
||||
|
||||
11. Do not perform port I/O to ports 00F8H to 00FFH. The 80287 may not operate properly if this is allowed.
|
||||
These I/O locations are reserved by Intel.
|
||||
|
||||
12. The interrupt enable bit of the flag word may not change when a POPF or IRET instruction attempts to change it.
|
||||
The IOPL field of the flag word controls whether IF can be changed. Subsequent PUSHF and INT instructions will
|
||||
save a value of IF which differs from the value in an 8086/8088 program.
|
||||
|
||||
13. If STI and CLI are emulated as NOPs then they will fail to change IF. Subsequent PUSHF and INT instructions
|
||||
will save a value of IF which differs from the value in an 8086/8088 program.
|
||||
|
||||
14. The flag word has two new fields: IOPL and NT. IOPL can not change except at level 0, but NT can be changed by
|
||||
IRET and POPF instructions. The IRET instruction attempts a task switch when NT is set. The back link field of
|
||||
the current TSS should have a 0 in it to cause exception 13, with an error code of 0, if the iAPX 86 program
|
||||
attempts an IRET after setting NT. The exception 13 handler may then simulate an iAPX 86 !RET operation.
|
||||
|
||||
15. The iAPX 86 address space may be limited. Programs may use some form of memory space scanner to see how much
|
||||
memory is available. Accesses to illegal locations are expected. The program emulator must decide what to do
|
||||
about illegal accesses.
|
||||
|
||||
16. The 80286 defines new instructions for undefined opcodes in the 8086/88. An 8086/88 program with an unknown
|
||||
bug in it that executes these undefined opcodes will work differently on an 80286.
|
||||
|
||||
17. Programs with self-modifying code may work differently on an 80286. The 80286 prefetcher can fetch more bytes
|
||||
ahead of the current instruction than the 8086 or 8088. A program that modifies an instruction that has already
|
||||
been prefetched will not see the changed instruction. Any program which jumps after modifying an instruction
|
||||
before executing it will correctly execute the modified instruction.
|
||||
|
||||
18. Regions of the emulated iAPX 86,88,186 address space can not be write protected. The XCHG, ADC, SBB, RCL, and
|
||||
RCR instructions are not restartable if their memory-based operand is in a write-protected segment.
|
||||
|
||||
Extending the Address Space of Current iAPX 86 Software
|
||||
---
|
||||
|
||||
Current iAPX 86 real mode programs can use the extended address space of the iAPX 286 in a limited manner.
|
||||
To address the extended memory, [LOADALL](../loadall/) must be used to load the descriptor cache with an base address beyond
|
||||
the normal 1 Mbyte address range. That segment register must not be changed by software, else the segment register
|
||||
will point back into the 1 Mbyte address space.
|
||||
|
||||
Two types of systems are examined: accessing a single large database in a limited manner, or splitting software
|
||||
into normal and extended areas. The first is the easiest to implement, while the second is more general.
|
||||
|
||||
Access to a large data area outside the 1 Mbyte address space could be provided by a subroutine. The subroutine
|
||||
scans the large data structure to locate the necessary item, then copy all data between the normal address space
|
||||
and the extended address space.
|
||||
|
||||
Interrupts must be disabled while the subroutine uses segment registers that have been set by [LOADALL](../loadall/). The reload
|
||||
of segment registers inside an interrupt routine would change the actual physical address from that loaded by [LOADALL](../loadall/)
|
||||
before the interrupt. After all accesses in the extended area are done, interrupts may be enabled.
|
||||
|
||||
Returning the address of an extended data structure requires passing data through a segment register. For example,
|
||||
the ES register could have been changed by [LOADALL](../loadall/) to point at a data area outside the bottom megabyte of physical
|
||||
memory. The subroutine must not reload ES while it runs. The value stored in ES is not important since it is not
|
||||
related to the physical address. Interrupts must not be allowed since the interrupt routine may reload ES.
|
||||
|
||||
A second technique uses special paragraph IDs (i.e. FFFFH) to signal that a piece of software is running in extended
|
||||
mode. All interrupt handlers in the system must look when they return to the interrupted program to see if any of the
|
||||
segment registers contain FFFFH. If so, then that segment register points at extended memory. [LOADALL](../loadall/) must be used
|
||||
to load all the registers and the segment base address used last. The [LOADALL](../loadall/) memory area should contain that value
|
||||
left there from the previous usage. Descriptors for the other segment registers with normal paragraph IDs must be
|
||||
constructed before executing [LOADALL](../loadall/).
|
||||
|
||||
A semaphore must be placed around software that writes into the [LOADALL](../loadall/) area such that once written into, the software
|
||||
can execute [LOADALL](../loadall/) without interruption.
|
||||
|
||||
Mixing Real Mode and Protected Mode
|
||||
---
|
||||
|
||||
The 80286 can alternate between real mode and protected mode. Some programs could be executed in real mode in the
|
||||
bottom megabyte of memory, while others execute in protected mode in the upper 15 Mbytes of memory. An external OR
|
||||
gate could RESET the 80286, independent of the rest of the system, to force it to enter real mode. A short routine
|
||||
at the power up address could redirect the software to the correct real mode program.
|
||||
|
||||
After executing the real mode program, [LOADALL](../loadall/) could then quickly restart the protected mode software. [LOADALL](../loadall/) can
|
||||
be used as a form of task switch from real mode to a protected mode task.
|
||||
|
||||
One operating system could service both the real and protected mode software. Any operating system call from the real
|
||||
mode program would cause a switch to protected mode. The protected mode software could then construct descriptors that
|
||||
refer to the same physical memory addresses used by the real mode paragraph IDs. After conversion, the operating system
|
||||
could then perform all work in protected mode.
|
||||
|
||||
Interrupts must be handled specially. Interrupt handlers for both real mode and protected mode must be present at all
|
||||
times. If an interrupt handler needs to access a data area, that data area must be addressable from both real and
|
||||
protected mode. The real mode interrupt table would be would be kept at location 000000H. The protected mode IDT could
|
||||
be anywhere. [LOADALL](../loadall/) will switch to the protected interrupt table.
|
||||
|
||||
[This information is from an undated 15-page Intel document titled "Undocumented iAPX 286 Test Instruction"]
|
||||
150
pubs/pc/reference/intel/80286/loadall/README.md
Normal file
150
pubs/pc/reference/intel/80286/loadall/README.md
Normal file
|
|
@ -0,0 +1,150 @@
|
|||
LOADALL (0F05H)
|
||||
---
|
||||
|
||||
The iAPX 286 microprocessor (part number 80286) has an undocumented instruction used by Intel test programs to
|
||||
allow direct access to internal registers for fast initialization. The instruction is called LOADALL. Each 80286
|
||||
is tested with the LOADALL instruction. LOADALL is guaranteed to work on each 80286.
|
||||
|
||||
LOADALL allows explicit control of the descriptor cache register associated with each segment register independent
|
||||
of the segment register value and descriptor tables. LOADALL can be used to extend either real mode or protected mode.
|
||||
The protected mode 80286 can be extended to emulate iAPX 86 real mode programs with LOADALL. In real mode, LOADALL
|
||||
can provide addressability to the other 15 Mbytes of the 286 physical address space.
|
||||
|
||||
The operation of LOADALL is closely tied to the internal hardware of the 80286. The iAPX 386 will not have the
|
||||
same internal hardware. LOADALL will not work on an iAPX 386. The iAPX 386 has an alternative means of emulating
|
||||
iAPX 86 real mode programs.
|
||||
|
||||
### Description
|
||||
|
||||
All CPU registers (including LDTR, TR, GDTR, IDTR, and MSW) are loaded from memory by this instruction.
|
||||
The normally hidden descriptor cache registers for the ES, DS, SS, CS, TR, and LDT registers are also loaded.
|
||||
LOADALL may be executed in either real address mode or protected mode (CPL must be 0). Any attempt to execute
|
||||
LOADALL at any privilege level other than 0 in protected rode causes exception 13 with an error code of 0.
|
||||
|
||||
LOADALL allows direct control over the base, limit, and access rights associated with each segment register.
|
||||
These values are kept in the descriptor cache registers which are normally hidden from programs. In protected mode,
|
||||
LOADALL can set the selector, base address, limit, and access rights for a segment register without a descriptor
|
||||
table entry corresponding to the program visible selector value. The normal protected mode protection rules can
|
||||
also be changed. In real address mode, the physical address, limit, and access rights for a paragraph ID can also
|
||||
be changed from the normal real mode definition.
|
||||
|
||||
The standard protected mode segment register loading checks (for privilege and access rights) are not performed
|
||||
by LOADALL on the values loaded into the descriptor caches. Using LOADALL in iAPX 86 real mode also does not involve
|
||||
any checks. Once loaded, the 80286 hardware will perform physical address calculation within the segment, offset
|
||||
checks against the limit, and access rights checks for all memory accesses using that segment register in either
|
||||
operating mode.
|
||||
|
||||
To retain protected mode system integrity, the policies used to define descriptor table contents must also be
|
||||
applied to the dynamically created descriptors loaded into the descriptor cache registers with LOADALL. Once defined,
|
||||
the 80286 segment access hardware will limit segment usage to the physical memory region defined.
|
||||
|
||||
The LOADALL instruction is encoded in two consecutive bytes as 00001111 00000101, with 00001111 at the lowest
|
||||
memory address. LOADALL executes in 195 clocks and performs 51 bus cycles.
|
||||
|
||||
LOADALL cannot switch the 80286 from protected mode to real mode. Once in protected mode, the MSW value loaded by
|
||||
LOADALL must have a one in bit position 0. The RESET input is the only way to reenter real mode.
|
||||
|
||||
LOADALL reads a 102 byte area of physical memory starting at physical memory location 000800H (2048). The entire
|
||||
execution state of the 80286 (consisting of 24 registers) is defined upon completion of this instruction. The
|
||||
descriptor cache registers for the ES, DS, SS, CS, TR, and LDT are directly loaded from this area. The instruction
|
||||
requires 190 clocks with no wait states.
|
||||
|
||||
### LOADALL Memory Area Format ###
|
||||
|
||||
Physical Address (Hex) Associated CPU Register
|
||||
800-805 None
|
||||
806-807 MSW
|
||||
808-815 None
|
||||
816-817 TR
|
||||
818-819 Flag word
|
||||
81A-81B IP
|
||||
81C-81D LDT
|
||||
81E-81F DS
|
||||
820-821 SS
|
||||
822-823 CS
|
||||
824-825 ES
|
||||
826-827 DI
|
||||
828-829 SI
|
||||
82A-82B BP
|
||||
82C-82D SP
|
||||
82E-82F BX
|
||||
830-831 DX
|
||||
832-833 CX
|
||||
834-835 AX
|
||||
836-83B ES descriptor cache
|
||||
83C-841 CS descriptor cache
|
||||
842-847 SS descriptor cache
|
||||
848-84D DS descriptor cache
|
||||
84E-853 GDTR
|
||||
854-859 LDT descriptor cache
|
||||
85A-85F IDTR
|
||||
860-865 TSS descriptor cache
|
||||
|
||||
No checks are made between the program visible selector values and the associated descriptor table entry.
|
||||
LOADALL does not perform any descriptor table accesses. No checks are made regarding the type or access rights
|
||||
defined by the descriptor. Any new descriptors defined by this instruction will be automatically used by subsequent
|
||||
processor extension memory references.
|
||||
|
||||
Any subsequent segment register load instruction will reload the associated descriptor cache register in the
|
||||
normal manner according to the operating mode of the CPU. In real mode, the low 4 bits and high 4 bits of the
|
||||
base address are set to zero. The paragraph ID is inserted into bits 19-4 of the base address. The segment limit
|
||||
is reset to FFFFH and access rights is changed to a writable segment. In protected mode, the base address, limit,
|
||||
and access rights are loaded from the descriptor.
|
||||
|
||||
The descriptor cache entries are in the following format:
|
||||
|
||||
* bytes 0-2
|
||||
|
||||
24-bit physical base address of the segment. The bytes are stored in ascending order with the
|
||||
least significant byte at lowest memory address.
|
||||
|
||||
* byte 3
|
||||
|
||||
Access rights byte is in the format of the access byte in a descriptor. The only difference is that
|
||||
the present bit becomes a valid bit. If zero, the descriptor is considered invalid and any memory reference
|
||||
using the descriptor will cause exception 13 with an error code of zero. Loading a descriptor cache register
|
||||
with an invalid descriptor does not cause an immediate exception. Any attempted use of the descriptor to
|
||||
reference memory causes the exception. Such an exception is restartable and the saved machine state appears
|
||||
as if the instruction had not been attempted. The value loaded by LOADALL can be read without any exceptions.
|
||||
The DPL fields of the SS and CS descriptor caches determine the CPL. The DPL fields of the DS and ES descriptor
|
||||
caches should be 3. The CS descriptor may be loaded with a writable data segment descriptor.
|
||||
|
||||
* bytes 4-5
|
||||
|
||||
16-bit limit of the segment. The word is stored in two bytes in normal word format. The interpretation of
|
||||
this field is determined by the type of segment identified by byte 3. Grow-down data segments are a special
|
||||
case of how to interpret the limit field. The data sheet describes how this field works.
|
||||
|
||||
The GDTR and IDTR are in the following format:
|
||||
|
||||
* bytes 0-2
|
||||
|
||||
24-bit physical base address of segment. The bytes are stored in ascending order with the least significant
|
||||
byte at the lowest memory address.
|
||||
|
||||
* byte 3
|
||||
|
||||
Should be zeroes.
|
||||
|
||||
* bytes 4-5
|
||||
|
||||
16-bit limit of the segment. The word is stored as two bytes in normal word format.
|
||||
|
||||
After properly executing LOADALL, the following is required of the descriptor cache register contents:
|
||||
|
||||
1. The stack segment is a writable, valid data segment.
|
||||
|
||||
2. The code segment can be of three types: execute-only, read/execute-only, or read/write/execute.
|
||||
To be execute-only, use an execute-only code segment access rights byte value. To be execute/read-only,
|
||||
use a execute/read code segment access rights byte value. To be read/write/execute, use a writable,
|
||||
expand-up data segment access rights byte value.
|
||||
|
||||
For proper protected mode operation, the following is required:
|
||||
|
||||
3. The DPL field of the CS descriptor cache access-rights byte must equal the DPL field of the SS descriptor
|
||||
cache access rights byte. These DPL fields are the CPL of the processor.
|
||||
|
||||
4. The DPL fields of the ES and DS descriptors should be 3 to prevent their being zeroed by RET or IRET
|
||||
instructions.
|
||||
|
||||
[This information is from an undated 15-page Intel document titled "Undocumented iAPX 286 Test Instruction"]
|
||||
12
pubs/pc/reference/intel/80286/long_instructions/README.md
Normal file
12
pubs/pc/reference/intel/80286/long_instructions/README.md
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
Instructions Longer than 10 Bytes
|
||||
---
|
||||
|
||||
When the CPU detects an instruction that is illegal due to being greater than 10 bytes in length, it generates an
|
||||
exception #13 (General Protection Violation) instead of exception #6 (Invalid Opcode). The only way an instruction
|
||||
greater than ten bytes can occur is by using the assembler to intentionally place multiple redundant prefix bytes
|
||||
(e.g. multiple lock prefixes and/or segment override prefixes) before the opcode bytes.
|
||||
|
||||
There are no plans to change this functionality of the 80286 and future editions of the "iAPX286 Programmer's Reference
|
||||
Manual" and 80286 datasheet will accurately describe how 80286 reacts to instructions greater than 10 bytes in length.
|
||||
|
||||
[This information is from an Intel document titled "80286 ARPL and Overlength Instructions, 15 October 1984"]
|
||||
10
pubs/pc/reference/intel/80286/manifest.xml
Normal file
10
pubs/pc/reference/intel/80286/manifest.xml
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<?xml-stylesheet type="text/xsl" href="/versions/pcjs/1.15.3/manifest.xsl"?>
|
||||
<manifest type="document">
|
||||
<title>Intel 80286 References</title>
|
||||
<document href="https://archive.org/download/bitsavers_intel80286287ProgrammersReferenceManual1987_27505703/210498-005_80286_and_80287_Programmers_Reference_Manual_1987.pdf">
|
||||
<name>80286 and 80287 Programmers Reference Manual (1987)</name>
|
||||
<cover href="../static/80286/progref/thumbs/80286_and_80287_Programmers_Reference_Manual_1987 1.jpeg"/>
|
||||
<page href="#page=27">Memory Organization and Segmentation</page>
|
||||
</document>
|
||||
</manifest>
|
||||
520
pubs/pc/reference/intel/80286/progref/README.md
Normal file
520
pubs/pc/reference/intel/80286/progref/README.md
Normal file
|
|
@ -0,0 +1,520 @@
|
|||
80286 and 80287 Programmer's Reference Manual
|
||||
---
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
[[Full PDF](../../static/80286/progref/80286/progref.pdf)]
|
||||
42
pubs/pc/reference/intel/80286/rep_restartability/README.md
Normal file
42
pubs/pc/reference/intel/80286/rep_restartability/README.md
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
80286 REP MOVS and REP INS Restartability
|
||||
---
|
||||
|
||||
The repeated string instructions on 80286 were made restartable after protection violations on the (B-2/B-3) and
|
||||
later 80286 steppings. Should a protection violation occur when using these instructions in protected mode, it is
|
||||
possible for the Exception 13 (General Protection Violation) handler to adjust the SI register and/or the DI register
|
||||
and/or the CX register to allow proper restart of these instructions after it has corrected the protection violation.
|
||||
[Note that when an external interrupt {from the INTR pin) interrupts a repeated string instruction, the repeated
|
||||
string instructions on any stepping of 80286 all restart properly just by returning from the interrupt procedure.]
|
||||
|
||||
When a protection violation occurs, the exact rules for the exception 13 handler to use when restarting the repeated
|
||||
string instructions were given in the Intel technical memo "iAPX 286 LOADALL Instruction." However, there is an
|
||||
errata in the 80286 (B-2/B-3) and (C-2) steppings which prevent the restart rules given in "iAPX 286 LOADALL Instruction"
|
||||
from properly restarting the REP MOVS and REP INS and REP OUTS instructions after a protection violation under all
|
||||
conditions. Specifically, there is an inconsistency if a violation occurs on the last word or byte to be transferred by
|
||||
REP MOVS or REP INS instructions, or a if an IOPL violation occurs from the REP OUTS instruction when the CX register
|
||||
is initially 0001H.
|
||||
|
||||
Case of REP MOVSW or REP MOVSB:
|
||||
|
||||
> If the destination of the last word (REP MOVSW) or byte (REP MOVSB) to be moved causes a protection violation,
|
||||
then the value in the CX register is 0000H. However, for the restart rule covering REP MOVS destination violations
|
||||
to work properly at all times, the value in CX under this condition should be 0ffffH.
|
||||
|
||||
Case of REP INSW or REP INSB:
|
||||
|
||||
> If the memory destination of the last word (REP INSW) or byte (REP INSB) to be inputted causes a protection-violation,
|
||||
then the value in the CX register is 0000H. However, for the restart rule covering REP INS destination violations to work
|
||||
properly at all times, the value in CX under this condition should be 0ffffH.
|
||||
|
||||
Case of REP OUTSW or REP OUTSB:
|
||||
|
||||
> If the CX register is initially 0001H and a REP OUTSW or REP OUTSB causes an IOPL violation, then the value in the CX
|
||||
register will be 0000H. However, for the rule covering REP OUTS restartability after IOPL violations to work properly
|
||||
at all times, the value in CX (after the CPU detects the violation) under this condition should be 0ffffH.
|
||||
|
||||
The above three problems are being corrected in all future steppings of the 80286. When the corrections are made, the CX
|
||||
register will hold 0ffffH when the CPU detects a violation due to the conditions above. Note that even when REP MOVS and
|
||||
REP INS restartability is corrected, CX will correctly continue to be 0000H when these instructions complete without generating
|
||||
a protection violation.
|
||||
|
||||
[This information is from an Intel document titled "80286 REP MOVS and REP INS Restartability, 15 October 1984"]
|
||||
12
pubs/pc/reference/intel/README.md
Normal file
12
pubs/pc/reference/intel/README.md
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
Intel CPU Documentation
|
||||
---
|
||||
|
||||
**NEW**: Historical information on the [Intel 80286 CPU](80286/).
|
||||
|
||||
### Assorted Publications
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in a new issue