diff --git a/386Intel/386INTEL.APA b/386Intel/386INTEL.APA new file mode 100644 index 0000000..8b82a36 --- /dev/null +++ b/386Intel/386INTEL.APA @@ -0,0 +1,283 @@ +Appendix A Opcode Map + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The opcode tables that follow aid in interpreting 80386 object code. Use +the high-order four bits of the opcode as an index to a row of the opcode +table; use the low-order four bits as an index to a column of the table. If +the opcode is 0FH, refer to the two-byte opcode table and use the second +byte of the opcode to index the rows and columns of that table. + + +Key to Abbreviations + +Operands are identified by a two-character code of the form Zz. The first +character, an uppercase letter, specifies the addressing method; the second +character, a lowercase letter, specifies the type of operand. + + +Codes for Addressing Method + +A Direct address; the instruction has no modR/M byte; the address of the + operand is encoded in the instruction; no base register, index register, + or scaling factor can be applied; e.g., far JMP (EA). + +C The reg field of the modR/M byte selects a control register; e.g., MOV + (0F20, 0F22). + +D The reg field of the modR/M byte selects a debug register; e.g., MOV + (0F21,0F23). + +E A modR/M byte follows the opcode and specifies the operand. The operand + is either a general register or a memory address. If it is a memory + address, the address is computed from a segment register and any of the + following values: a base register, an index register, a scaling factor, + a displacement. + +F Flags Register. + +G The reg field of the modR/M byte selects a general register; e.g., ADD + (00). + +I Immediate data. The value of the operand is encoded in subsequent bytes + of the instruction. + +J The instruction contains a relative offset to be added to the + instruction pointer register; e.g., JMP short, LOOP. + +M The modR/M byte may refer only to memory; e.g., BOUND, LES, LDS, LSS, + LFS, LGS. + +O The instruction has no modR/M byte; the offset of the operand is coded as + a word or double word (depending on address size attribute) in the + instruction. No base register, index register, or scaling factor can be + applied; e.g., MOV (A0-A3). + +R The mod field of the modR/M byte may refer only to a general register; + e.g., MOV (0F20-0F24, 0F26). + +S The reg field of the modR/M byte selects a segment register; e.g., MOV + (8C,8E). + +T The reg field of the modR/M byte selects a test register; e.g., MOV + (0F24,0F26). + +X Memory addressed by DS:SI; e.g., MOVS, COMPS, OUTS, LODS, SCAS. + +Y Memory addressed by ES:DI; e.g., MOVS, CMPS, INS, STOS. + + +Codes for Operant Type + +a Two one-word operands in memory or two double-word operands in memory, + depending on operand size attribute (used only by BOUND). + +b Byte (regardless of operand size attribute) + +c Byte or word, depending on operand size attribute. + +d Double word (regardless of operand size attribute) + +p 32-bit or 48-bit pointer, depending on operand size attribute. + +s Six-byte pseudo-descriptor + +v Word or double word, depending on operand size attribute. + +w Word (regardless of operand size attribute) + + +Register Codes + +When an operand is a specific register encoded in the opcode, the register +is identified by its name; e.g., AX, CL, or ESI. The name of the register +indicates whether the register is 32-, 16-, or 8-bits wide. A register +identifier of the form eXX is used when the width of the register depends on +the operand size attribute; for example, eAX indicates that the AX register +is used when the operand size attribute is 16 and the EAX register is used +when the operand size attribute is 32. + + +One-Byte Opcode Map + 0 1 2 3 4 5 6 7 8 9 A B C D E F + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴錮袴袴錮袴袴袴錮袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴錮袴袴袴佶袴袴袴� + � ADD 쿛USH � POP � OR � PUSH �2-byte � + 픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컴� � 쳐컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴� � � +0튓b,Gb 쿐v,Gv 쿒b,Eb쿒v,Ev 쿌L,Ib� eAX,Iv� ES � ES � Eb,Gb쿐v,Gv 쿒b,Eb� Gv,Ev 쿌L,Ib 쿮AX,Iv� CS 쿮scape � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴妄袴袴妄袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴妄袴袴曲袴袴袴攷 + � ADC 쿛USH � POP � SBB � PUSH � POP � +1픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컴� � 쳐컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴� � � + 튓b,Gb 쿐v,Gv 쿒b,Eb쿒v,Ev 쿌L,Ib� eAX,Iv� SS � SS 쿐b,Gb 쿐v,Gv 쿒b,Eb� Gv,Ev 쿌L,Ib 쿮AX,Iv� DS � DS � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴妄袴袴妄袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴妄袴袴曲袴袴袴攷 + � AND � SEG � � SUB � SEG � � +2픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컴� � DAA 쳐컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴� � DAS � + 튓b,Gb 쿐v,Gv 쿒b,Eb쿒v,Ev 쿌L,Ib� eAX,Iv� =ES � � Eb,Gb쿐v,Gv 쿒b,Eb� Gv,Ev 쿌L,Ib 쿮AX,Iv� =CS � � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴妄袴袴妄袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴妄袴袴曲袴袴袴攷 + � XOR � SEG � � CMP � SEG � � +3픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컴� � AAA 쳐컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴� � AAS � + 튓b,Gb 쿐v,Gv 쿒b,Eb쿒v,Ev 쿌L,Ib� eAX,Iv� =SS � � Eb,Gb쿐v,Gv 쿒b,Eb� Gv,Ev 쿌L,Ib 쿮AX,Iv� =CS � � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴鳩袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴攷 + � INC general register � DEC general register � +4픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴쩡컴컴컴탠컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴쩡컴컴컫컴컴컴캘 + � eAX � eCX � eDX � eBX � eSP � eBP � eSI � eDI 쿮AX � eCX � eDX � eBX � eSP � eBP � eSI� eDI � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴鳩袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴攷 + � PUSH general register � POP into general register � +5픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴쩡컴컴컴쩡컴컴컴탠컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴쩡컴컴컫컴컴컴캘 + � eAX � eCX � eDX 쿮BX � eSP� eBP� eSI � eDI 쿮AX � eCX � eDX � eBX � eSP � eBP � eSI � eDI � + 勁袴袴曲袴袴袴曲袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴袴妄袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴攷 + � � 쿍OUND쿌RPL � SEG � SEG 쿚perand쿌ddress� PUSH 쿔MUL 쿛USH 쿔MUL � INSB 쿔NSW/D� OUTSB쿚UTSW/D� +6튡USHA � POPA � � � � � � � � � � � � � � � + � � 쿒v,Ma� Ew,Rw� =FS � =GS � Size � Size � Ib 쿒vEvIv� Ib 쿒vEvIv 쿧b,DX � Yb,DX� Dx,Xb� DX,Xv � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴鳩袴袴袴鳩袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴攷 + � Short displacement jump of condition (Jb) � Short-displacement jump on condition(Jb) � +7픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴쩡컴컴컴탠컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴컫컴컴컫컴컴컴캘 + � JO � JNO � JB 쿕NB � JZ � JNZ � JBE � JNBE � JS � JNS � JP � JNP � JL � JNL � JLE � JNLE � + 勁袴袴賈袴袴袴曲袴袴曲袴袴袴妄袴袴鳩袴袴袴妄袴袴鳩袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴妄袴袴曲袴袴袴曲袴袴曲袴袴袴攷 + 튘mmediate Grpl� 쿒rpl � TEST � XCNG � MOV � MOV � LEA 쿘OV � POP � +8픔컴컴컫컴컴컴캑 � 쳐컴컴쩡컴컴컴탠컴컴쩡컴컴컴탠컴컴컫컴컴컴쩡컴컴쩡컴컴컴� � � � � + 튓b,Ib � Ev,Iv � 쿐v,Iv 쿐b,Gb� Ev,Gv 쿐b,Gb� Ev,Gv쿐b,Gb 쿐v,Gv 쿒b,Eb� Gv,Ev 쿐w,Sw � Gv,M 쿞w,Ew� Ev � + 勁袴袴曲袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴鳩袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴袴妄袴袴曲袴袴袴曲袴袴曲袴袴袴攷 + � � XCHG word or double-word register with eAX � � � CALL� 쿛USHF � POPF � � � +9� NOP 쳐컴컴컴쩡컴컴쩡컴컴컫컴컴컫컴컴컴컫컴컴컫컴컴컴캑 CBW � CWD � � WAIT � � � SAHF� LAHF � + � � eCX � eDX � eBX � eSP � eBP � eSI � eDI � � � Ap � � Fv � Fv � � � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴妄袴袴妄袴袴袴妄袴袴妄袴袴袴妄袴袴賈袴袴袴妄袴袴妄袴袴袴妄袴袴曲袴袴袴曲袴袴曲袴袴袴攷 + � MOV 쿘OVSB쿘OVSW/D쿎MPSB쿎MPSW/D� TEST 쿞TOSB쿞TOSW/D� LODSB쿗ODSW/D쿞CASB쿞CASW/D� +A픔컴컴컫컴컴컴컫컴컴컫컴컴컴� � � � 쳐컴컴컫컴컴컴� � � � � � � + 튍L,Ob 쿮AX,Ov 쿚b,AL쿚v,eAX쿦b,Yb쿦v,Yv 쿦b,Yb� Xv,Yv 쿌L,Ib 쿮AX,Iv쿧b,AL� Yv,eAX� AL,Xb� eAX,Xv쿌L,Xb쿮AX,Xv � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴鳩袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴賈袴袴賈袴袴袴攷 + � MOV immediate byte into byte register 쿘OV immediate word or duble into word or double register� +B픔컴컴컫컴컴컴컫컴컴컫컴컴컴쩡컴컴쩡컴컴컫컴컴컴쩡컴컴컴탠컴컴컫컴컴컴쩡컴컴쩡컴컴컴쩡컴컴컫컴컴컴컫컴컴컫컴컴컴캘 + � AL � CL � DL � BL � AH � CH � DH � BH � eAX � eCX � eDX � eBX � eSP � eBP � eSI � eDI � + 勁袴袴賈袴袴袴曲袴袴賈袴袴袴妄袴袴妄袴袴曲袴袴袴鳩袴袴袴妄袴袴曲袴袴袴妄袴袴鳩袴袴袴妄袴袴曲袴袴袴曲袴袴曲袴袴袴攷 + � Shift Grp2 � RET near � LES � LDS � MOV 쿐NTER � � RET far � INT � INT � � � +C픔컴컴컫컴컴컴컵컴컴컫컴컴컴� � 쳐컴컴컫컴컴컴캑 쿗EAVE 쳐컴컴쩡컴컴컴� � 쿔NTO � IRET � + 튓b,Ib � Ev,Iv � Iw � 쿒v,Mp쿒v,Mp � Eb,Ib� Ev,Iv 쿔w,Ib � � Iw � � 3 � Ib � � � + 勁袴袴賈袴袴袴賈袴袴賈袴袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴袴妄袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴賈袴袴袴賈袴袴賈袴袴袴攷 + � Shift Grp2 � � � � � � +D픔컴컴컫컴컴컴컫컴컴컫컴컴컴� AAM � AAD � � XLAT � ESC(Escape to coprocessor instruction set) � + � Eb,1 � Ev,1 쿐b,CL쿐v,CL � � � � � � + 勁袴袴曲袴袴袴曲袴袴曲袴袴袴妄袴袴鳩袴袴曲袴袴袴鳩袴袴袴妄袴袴錮袴袴袴袴袴袴袴袴袴袴佶袴袴袴袴袴錮袴袴袴袴袴袴袴攷 + 튛OOPNE� LOOPE 쿗OOP � JCXZ � IN � OUT � CALL � JNP � IN � OUT � +E� � � � 쳐컴컴쩡컴컴컵컴컴컴쩡컴컴컴� 쳐컴컴컫컴컴컫컴컴컴컵컴컴컫컴컴컴탠컴컴컴쩡컴컴컴� + � Jb � Jb � Jb � Jb 쿌L,Ib쿮AX,Ib� Ib,AL쿔b,eAX � Av � Jv � Ap � Jb 쿌L,DX쿮AX,DX� DX,AL 쿏X,eAX � + 勁袴袴曲袴袴袴曲袴袴曲袴袴袴妄袴袴妄袴袴曲袴袴袴鳩袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴袴妄袴袴妄袴袴曲袴袴袴曲袴袴袴攷 + � � � � REP � � � Unary Grp3 � � � � � � 쿔NC/DEC쿔ndirct� +F� LOCK � 쿝EPNE� � HLT � CMC 쳐컴컴컫컴컴컴캑 CLC � STC � CLI � STI � CLD � STD � � � + � � � � REPE � � � Eb � Ev � � � � � � � Grp4 � Grp5 � + 훤袴袴賈袴袴袴賈袴袴賈袴袴袴鳩袴袴鳩袴袴賈袴袴袴鳩袴袴袴鳩袴袴賈袴袴袴鳩袴袴鳩袴袴袴鳩袴袴鳩袴袴賈袴袴袴賈袴袴袴暠 + + +Two-Byte Opcode Map (first byte is 0FH) + + + 0 1 2 3 4 5 6 7 8 9 A B C D E F + + �袴袴袴佶袴袴錮袴袴袴佶袴袴錮袴袴袴佶袴袴錮袴袴錮袴袴錮袴袴袴佶袴袴錮袴袴袴佶袴袴錮袴袴袴佶袴袴錮袴袴錮袴袴袴� + � � � LAR � LSL � � � � � � � � � � � � � +0� Grp6 쿒rp7 � � � � � CLTS� � � � � � � � � � + � � � Gw,Ew� Gv,Ew� � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +1� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � MOV � MOV � MOV � MOV � MOV � � MOV � � � � � � � � � � +2� � � � � � � � � � � � � � � � � + � Cd,Rd� Dd,Rd� Rd,Cd� Rd,Dd� Td,Rd� 쿝d,Td� � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +3� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +4� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +5� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +6� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +7� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴鳩袴袴妄袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴鳩袴袴攷 + � Long-displacement jump on condition (Jv) � Long-displacement jump on condition (Jv) � +8픔컴컴컫컴컴컴쩡컴컴컫컴컴컴쩡컴컴컫컴컴컴쩡컴컴쩡컴컴탠컴컴컫컴컴컴쩡컴컴컫컴컴컴쩡컴컴컫컴컴컴쩡컴컴쩡컴컴캘 + � JO � JNO � JB � JNB � JZ � JNZ � JBE � JNBE� JS � JNS � JP � JNP � JL � JNL � JLE 쿕NLE � + 勁袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴鳩袴袴曲袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � Byte Set on condition (Eb) � � � � � � � � � +9픔컴컴컫컴컴컴쩡컴컴컫컴컴컴쩡컴컴컫컴컴컴쩡컴컴쩡컴컴캑 SETS� SETNS� SETP � SETNP� SETL 쿞ETNL 쿞ETLE쿞ETNLE� + � SETO � SETNO� SETB 쿞ETNB � SETZ � SETNZ쿞ETBE쿞ETNBE� � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴曲袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � PUSH � POP � � BT � SHLD � SHLD� � � PUSH � POP � � BTS � SHRD � SHRD � � IMUL � +A� � � � � � � � � � � � � � � � � + � FS � FS � � Ev,Gv쿐vGvIb쿐vGvCL� � � GS � GS � � Ev,Gv쿐vGvIb쿐vGvCL� � Gv,Ev� + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴鳩袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴鳩袴袴攷 + � � � LSS � BTR � LFS � LGS � MOVZX � � � Grp-8� BTC � BSF � BSR � MOVSX � +B� � � � � � 쳐컴컴쩡컴컴� � � � � � 쳐컴컴컴컴컴캘 + � � � Mp � Ev,Gv� Mp � Mp 쿒v,Eb쿒v,Ew� � � Ev,Ib� Ev,Gv쿒v,Ev � Gv,Ev쿒v,Eb Gv,Ew� + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴佶袴袴攷 + � � � � � � � � � � � � � � � � � +C� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +D� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +E� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴曲袴袴袴妄袴袴妄袴袴攷 + � � � � � � � � � � � � � � � � � +F� � � � � � � � � � � � � � � � � + � � � � � � � � � � � � � � � � � + 훤袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴鳩袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴賈袴袴袴鳩袴袴鳩袴袴暠 + + +Opcodes determined by bits 5,4,3 of modR/M byte: + + G 旼컴컴컴쩡컴컴컴쩡컴컴컴� + r � mod � nnn � R/M � + o 읕컴컴컴좔컴컴컴좔컴컴컴� + u + p 000 001 010 011 100 101 110 111 + 旼컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴� + 1� ADD � OR � ADC � SBB � AND � SUB � XOR � CMP � + � � � � � � � � � + 쳐컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴� + 2� ROL � ROR � RCL � RCR � SHL � SHR � � SAR � + � � � � � � � � � + 쳐컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴� + 3� TEST � � NOT � NEG � MUL � IMUL � DIV � IDIV � + � Ib/Iv � � � 쿌L/eAX 쿌L/eAX 쿌L/eAX 쿌L/eAX � + 쳐컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴� + 4� INC � DEC � � � � � � � + � Eb � Eb � � � � � � � + 쳐컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴� + 5� INC � DEC � CALL � CALL � JMP � JMP � PUSH � � + � Ev � Ev � Ev � eP � Ev � Ep � Ev � � + 읕컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴� + + +Opcodes determined by bits 5,4,3 of modR/M byte: + + G 旼컴컴컴쩡컴컴컴쩡컴컴컴� + r � mod � nnn � R/M � + o 읕컴컴컴좔컴컴컴좔컴컴컴� + u + p 000 001 010 011 100 101 110 111 + 旼컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴쩡컴컴컴� + 6� SLDT � STR � LLDT � LTR � VERR � VERW � � � + � Ew � Ew � Ew � Ew � Ew � Ew � � � + 쳐컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴� + 7� SGDT � SIDT � LGDT � LIDT � SMSW � � LMSW � � + � Ms � Ms � Ms � Ms � Ew � � Ew � � + 쳐컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴탠컴컴컴� + 8� � � � � BT � BTS � BTR � BTC � + � � � � � � � � � + 읕컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴좔컴컴컴� diff --git a/386Intel/386INTEL.APB b/386Intel/386INTEL.APB new file mode 100644 index 0000000..43c7cf0 --- /dev/null +++ b/386Intel/386INTEL.APB @@ -0,0 +1,247 @@ +Appendix B Complete Flag Cross-Reference + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +Key to Codes + +T = instruction tests flag + +M = instruction modifies flag + (either sets or resets depending on operands) + +0 = instruction resets flag + +1 = instruction sets flag + +컴 = instruction's effect on flag is undefined + +R = instruction restores prior value of flag + +blank = instruction does not affect flag + + +Instruction OF SF ZF AF PF CF TF IF DF NT RF + +AAA 컴 컴 컴 TM 컴 M +AAD 컴 M M 컴 M 컴 +AAM 컴 M M 컴 M 컴 +AAS 컴 컴 컴 TM 컴 M +ADC M M M M M TM +ADD M M M M M M +AND 0 M M 컴 M 0 +ARPL M +BOUND +BSF/BSR 컴 컴 M 컴 컴 컴 +BT/BTS/BTR/BTC 컴 컴 컴 컴 컴 M +CALL +CBW +CLC 0 +CLD 0 +CLI 0 +CLTS +CMC M +CMP M M M M M M +CMPS M M M M M M T +CWD +DAA 컴 M M TM M TM +DAS 컴 M M TM M TM +DEC M M M M M +DIV 컴 컴 컴 컴 컴 컴 +ENTER +ESC +HLT +IDIV 컴 컴 컴 컴 컴 컴 +IMUL M 컴 컴 컴 컴 M +IN +INC M M M M M +INS T +INT 0 0 +INTO T 0 0 +IRET R R R R R R R R R T +Jcond T T T T T +JCXZ +JMP +LAHF +LAR M +LDS/LES/LSS/LFS/LGS +LEA +LEAVE +LGDT/LIDT/LLDT/LMSW +LOCK +LODS T +LOOP +LOOPE/LOOPNE T +LSL M +LTR +MOV +MOV control, debug 컴 컴 컴 컴 컴 컴 +MOVS T +MOVSX/MOVZX +MUL M 컴 컴 컴 컴 M +NEG M M M M M M +NOP +NOT +OR 0 M M 컴 M 0 +OUT +OUTS T +POP/POPA +POPF R R R R R R R R R R +PUSH/PUSHA/PUSHF +RCL/RCR 1 M TM +RCL/RCR count 컴 TM +REP/REPE/REPNE +RET +ROL/ROR 1 M M +ROL/ROR count 컴 M +SAHF R R R R R +SAL/SAR/SHL/SHR 1 M M M 컴 M M +SAL/SAR/SHL/SHR count 컴 M M 컴 M M +SBB M M M M M TM +SCAS M M M M M M T +SET cond T T T T T +SGDT/SIDT/SLDT/SMSW +SHLD/SHRD 컴 M M 컴 M M +STC 1 +STD 1 +STI 1 +STOS T +STR +SUB M M M M M M +TEST 0 M M 컴 M 0 +VERR/VERRW M +WAIT +XCHG +XLAT +XOR 0 M M 컴 M 0 + + +Appendix C Status Flag Summary + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +Status Flags' Functions + +Bit Name Function + + 0 CF Carry Flag 컴 Set on high-order bit carry or borrow; cleared + otherwise. + 2 PF Parity Flag 컴 Set if low-order eight bits of result contain + an even number of 1 bits; cleared otherwise. + 4 AF Adjust flag 컴 Set on carry from or borrow to the low order + four bits of AL; cleared otherwise. Used for decimal + arithmetic. + 6 ZF Zero Flag 컴 Set if result is zero; cleared otherwise. + 7 SF Sign Flag 컴 Set equal to high-order bit of result (0 is + positive, 1 if negative). +11 OF Overflow Flag 컴 Set if result is too large a positive number + or too small a negative number (excluding sign-bit) to fit in + destination operand; cleared otherwise. + +Key to Codes + +T = instruction tests flag +M = instruction modifies flag + (either sets or resets depending on operands) +0 = instruction resets flag +컴 = instruction's effect on flag is undefined +blank = instruction does not affect flag + + + +Instruction OF SF ZF AF PF CF +AAA 컴 컴 컴 TM 컴 M +AAS 컴 컴 컴 TM 컴 M +AAD 컴 M M 컴 M 컴 +AAM 컴 M M 컴 M 컴 +DAA 컴 M M TM M TM +DAS 컴 M M TM M TM +ADC M M M M M TM +ADD M M M M M M +SBB M M M M M TM +SUB M M M M M M +CMP M M M M M M +CMPS M M M M M M +SCAS M M M M M M +NEG M M M M M M +DEC M M M M M +INC M M M M M +IMUL M 컴 컴 컴 컴 M +MUL M 컴 컴 컴 컴 M +RCL/RCR 1 M TM +RCL/RCR count 컴 TM +ROL/ROR 1 M M +ROL/ROR count 컴 M +SAL/SAR/SHL/SHR 1 M M M 컴 M M +SAL/SAR/SHL/SHR count 컴 M M 컴 M M +SHLD/SHRD 컴 M M 컴 M M +BSF/BSR 컴 컴 M 컴 컴 컴 +BT/BTS/BTR/BTC 컴 컴 컴 컴 컴 M +AND 0 M M 컴 M 0 +OR 0 M M 컴 M 0 +TEST 0 M M 컴 M 0 +XOR 0 M M 컴 M 0 + + +Appendix D Condition Codes + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +Note: + The terms "above" and "below" refer to the relation between two + unsigned values (neither SF nor OF is tested). The terms "greater" and + "less" refer to the relation between two signed values (SF and OF are + tested). +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Definition of Conditions + +(For conditional instructions Jcond, and SETcond) + + + Instruction Condition +Mnemonic Meaning Subcode Tested + +O Overflow 0000 OF = 1 + +NO No overflow 0001 OF = 0 + +B Below +NAE Neither above nor equal 0010 CF = 1 + +NB Not below +AE Above or equal 0011 CF = 0 + +E Equal +Z Zero 0100 ZF = 1 + +NE Not equal +NZ Not zero 0101 ZF = 0 + +BE Below or equal +NA Not above 0110 (CF or ZF) = 1 + +NBE Neither below nor equal +NA Above 0111 (CF or ZF) = 0 + +S Sign 1000 SF = 1 + +NS No sign 1001 SF = 0 + +P Parity +PE Parity even 1010 PF = 1 + +NP No parity +PO Parity odd 1011 PF = 0 + +L Less +NGE Neither greater nor equal 1100 (SF xor OF) = 1 + +NL Not less +GE Greater or equal 1101 (SF xor OF) = 0 + +LE Less or equal +NG Not greater 1110 ((SF xor OF) or ZF) = 1 + +NLE Neither less nor equal +G Greater 1111 ((SF xor OF) or ZF) = 0 diff --git a/386Intel/386INTEL.PT1 b/386Intel/386INTEL.PT1 new file mode 100644 index 0000000..aaed43f --- /dev/null +++ b/386Intel/386INTEL.PT1 @@ -0,0 +1,10429 @@ +INTEL 80386 PROGRAMMER'S REFERENCE MANUAL 1986 + +Intel Corporation makes no warranty for the use of its products and +assumes no responsibility for any errors which may appear in this document +nor does it make a commitment to update the information contained herein. + +Intel retains the right to make changes to these specifications at any +time, without notice. + +Contact your local sales office to obtain the latest specifications before +placing your order. + +The following are trademarks of Intel Corporation and may only be used to +identify Intel Products: + +Above, BITBUS, COMMputer, CREDIT, Data Pipeline, FASTPATH, Genius, i, �, +ICE, iCEL, iCS, iDBP, iDIS, I�ICE, iLBX, im, iMDDX, iMMX, Inboard, +Insite, Intel, intel, intelBOS, Intel Certified, Intelevision, +inteligent Identifier, inteligent Programming, Intellec, Intellink, +iOSP, iPDS, iPSC, iRMK, iRMX, iSBC, iSBX, iSDM, iSXM, KEPROM, Library +Manager, MAPNET, MCS, Megachassis, MICROMAINFRAME, MULTIBUS, MULTICHANNEL, +MULTIMODULE, MultiSERVER, ONCE, OpenNET, OTP, PC BUBBLE, Plug-A-Bubble, +PROMPT, Promware, QUEST, QueX, Quick-Pulse Programming, Ripplemode, RMX/80, +RUPI, Seamless, SLD, SugarCube, SupportNET, UPI, and VLSiCEL, and the +combination of ICE, iCS, iRMX, iSBC, iSBX, iSXM, MCS, or UPI and a numerical +suffix, 4-SITE. + +MDS is an ordering code only and is not used as a product name or +trademark. MDS(R) is a registered trademark of Mohawk Data Sciences +Corporation. + +Additional copies of this manual or other Intel literature may be obtained +from: + +Intel Corporation +Literature Distribution +Mail Stop SC6-59 +3065 Bowers Avenue +Santa Clara, CA 95051 + +(c)INTEL CORPORATION 1987 CG-5/26/87 + + +Customer Support + +컴컴컴컴컴컴컴컴컴컴컴컴컴 + +Customer Support is Intel's complete support service that provides Intel +customers with hardware support, software support, customer training, and +consulting services. For more information contact your local sales offices. + +After a customer purchases any system hardware or software product, +service and support become major factors in determining whether that +product will continue to meet a customer's expectations. Such support +requires an international support organization and a breadth of programs +to meet a variety of customer needs. As you might expect, Intel's customer +support is quite extensive. It includes factory repair services and +worldwide field service offices providing hardware repair services, +software support services, customer training classes, and consulting +services. + +Hardware Support Services + +Intel is committed to providing an international service support package +through a wide variety of service offerings available from Intel Hardware +Support. + +Software Support Services + +Intel's software support consists of two levels of contracts. Standard +support includes TIPS (Technical Information Phone Service), updates and +subscription service (product-specific troubleshooting guides and COMMENTS +Magazine). Basic support includes updates and the subscription service. +Contracts are sold in environments which represent product groupings +(i.e., iRMX environment). + +Consulting Services + +Intel provides field systems engineering services for any phase of your +development or support effort. You can use our systems engineers in a +variety of ways ranging from assistance in using a new product, developing +an application, personalizing training, and customizing or tailoring an +Intel product to providing technical and management consulting. Systems +Engineers are well versed in technical areas such as microcommunications, +real-time applications, embedded microcontrollers, and network services. +You know your application needs; we know our products. Working together we +can help you get a successful product to market in the least possible time. + +Customer Training + +Intel offers a wide range of instructional programs covering various +aspects of system design and implementation. In just three to ten days a +limited number of individuals learn more in a single workshop than in +weeks of self-study. For optimum convenience, workshops are scheduled +regularly at Training Centers woridwide or we can take our workshops to +you for on-site instruction. Covering a wide variety of topics, Intel's +major course categories include: architecture and assembly language, +programming and operating systems, bitbus and LAN applications. + +Training Center Locations + +To obtain a complete catalog of our workshops, call the nearest Training +Center in your area. + +Boston (617) 692-1000 +Chicago (312) 310-5700 +San Francisco (415) 940-7800 +Washington D.C. (301) 474-2878 +Isreal (972) 349-491-099 +Tokyo 03-437-6611 +Osaka (Call Tokyo) 03-437-6611 +Toronto, Canada (416) 675-2105 +London (0793) 696-000 +Munich (089) 5389-1 +Paris (01) 687-22-21 +Stockholm (468) 734-01-00 +Milan 39-2-82-44-071 +Benelux (Rotterdam) (10) 21-23-77 +Copenhagen (1) 198-033 +Hong Kong 5-215311-7 + + +Table of Contents + +Chapter 1 Introduction to the 80386 + +1.1 Organization of This Manual + 1.1.1 Part I 컴 Applications Programming + 1.1.2 Part II 컴 Systems Programming + 1.1.3 Part III 컴 Compatibility + 1.1.4 Part IV 컴 Instruction Set + 1.1.5 Appendices + +1.2 Related Literature +1.3 Notational Conventions + 1.3.1 Data-Structure Formats + 1.3.2 Undefined Bits and Software Compatibility + 1.3.3 Instruction Operands + 1.3.4 Hexadecimal Numbers + 1.3.5 Sub- and Super-Scripts + + PART I APPLICATIONS PROGRAMMING + +Chapter 2 Basic Programming Model + +2.1 Memory Organization and Segmentation + 2.1.1 The"Flat" Model + 2.1.2 The Segmented Model + +2.2 Data Types +2.3 Registers + 2.3.1 General Registers + 2.3.2 Segment Registers + 2.3.3 Stack Implementation + 2.3.4 Flags Register + 2.3.4.1 Status Flags + 2.3.4.2 Control Flag + 2.3.4.3 Instruction Pointer + +2.4 Instruction Format +2.5 Operand Selection + 2.5.1 Immediate Operands + 2.5.2 Register Operands + 2.5.3 Memory Operands + 2.5.3.1 Segment Selection + 2.5.3.2 Effective-Address Computation + +2.6 Interrupts and Exceptions + +Chapter 3 Applications Instruction Set + +3.1 Data Movement Instructions + 3.1.1 General-Purpose Data Movement Instructions + 3.1.2 Stack Manipulation Instructions + 3.1.3 Type Conversion Instructions + +3.2 Binary Arithmetic Instructions + 3.2.1 Addition and Subtraction Instructions + 3.2.2 Comparison and Sign Change Instruction + 3.2.3 Multiplication Instructions + 3.2.4 Division Instructions + +3.3 Decimal Arithmetic Instructions + 3.3.1 Packed BCD Adjustment Instructions + 3.3.2 Unpacked BCD Adjustment Instructions + +3.4 Logical Instructions + 3.4.1 Boolean Operation Instructions + 3.4.2 Bit Test and Modify Instructions + 3.4.3 Bit Scan Instructions + 3.4.4 Shift and Rotate Instructions + 3.4.4.1 Shift Instructions + 3.4.4.2 Double-Shift Instructions + 3.4.4.3 Rotate Instructions + 3.4.4.4 Fast"bit-blt" Using Double Shift + Instructions + 3.4.4.5 Fast Bit-String Insert and Extract + + 3.4.5 Byte-Set-On-Condition Instructions + 3.4.6 Test Instruction + +3.5 Control Transfer Instructions + 3.5.1 Unconditional Transfer Instructions + 3.5.1.1 Jump Instruction + 3.5.1.2 Call Instruction + 3.5.1.3 Return and Return-From-Interrupt Instruction + + 3.5.2 Conditional Transfer Instructions + 3.5.2.1 Conditional Jump Instructions + 3.5.2.2 Loop Instructions + 3.5.2.3 Executing a Loop or Repeat Zero Times + + 3.5.3 Software-Generated Interrupts + +3.6 String and Character Translation Instructions + 3.6.1 Repeat Prefixes + 3.6.2 Indexing and Direction Flag Control + 3.6.3 String Instructions + +3.7 Instructions for Block-Structured Languages +3.8 Flag Control Instructions + 3.8.1 Carry and Direction Flag Control Instructions + 3.8.2 Flag Transfer Instructions + +3.9 Coprocessor Interface Instructions +3.10 Segment Register Instructions + 3.10.1 Segment-Register Transfer Instructions + 3.10.2 Far Control Transfer Instructions + 3.10.3 Data Pointer Instructions + +3.11 Miscellaneous Instructions + 3.11.1 Address Calculation Instruction + 3.11.2 No-Operation Instruction + 3.11.3 Translate Instruction + + PART II SYSTEMS PROGRAMMING + +Chapter 4 Systems Architecture + +4.1 Systems Registers + 4.1.1 Systems Flags + 4.1.2 Memory-Management Registers + 4.1.3 Control Registers + 4.1.4 Debug Register + 4.1.5 Test Registers + +4.2 Systems Instructions + +Chapter 5 Memory Management + +5.1 Segment Translation + 5.1.1 Descriptors + 5.1.2 Descriptor Tables + 5.1.3 Selectors + 5.1.4 Segment Registers + +5.2 Page Translation + 5.2.1 Page Frame + 5.2.2 Linear Address + 5.2.3 Page Tables + 5.2.4 Page-Table Entries + 5.2.4.1 Page Frame Address + 5.2.4.2 Present Bit + 5.2.4.3 Accessed and Dirty Bits + 5.2.4.4 Read/Write and User/Supervisor Bits + + 5.2.5 Page Translation Cache + +5.3 Combining Segment and Page Translation + 5.3.1 "Flat" Architecture + 5.3.2 Segments Spanning Several Pages + 5.3.3 Pages Spanning Several Segments + 5.3.4 Non-Aligned Page and Segment Boundaries + 5.3.5 Aligned Page and Segment Boundaries + 5.3.6 Page-Table per Segment + +Chapter 6 Protection + +6.1 Why Protection? +6.2 Overview of 80386 Protection Mechanisms +6.3 Segment-Level Protection + 6.3.1 Descriptors Store Protection Parameters + 6.3.1.1 Type Checking + 6.3.1.2 Limit Checking + 6.3.1.3 Privilege Levels + + 6.3.2 Restricting Access to Data + 6.3.2.1 Accessing Data in Code Segments + + 6.3.3 Restricting Control Transfers + 6.3.4 Gate Descriptors Guard Procedure Entry Points + 6.3.4.1 Stack Switching + 6.3.4.2 Returning from a Procedure + + 6.3.5 Some Instructions are Reserved for Operating System + 6.3.5.1 Privileged Instructions + 6.3.5.2 Sensitive Instructions + + 6.3.6 Instructions for Pointer Validation + 6.3.6.1 Descriptor Validation + 6.3.6.2 Pointer Integrity and RPL + +6.4 Page-Level Protection + 6.4.1 Page-Table Entries Hold Protection Parameters + 6.4.1.1 Restricting Addressable Domain + 6.4.1.2 Type Checking + + 6.4.2 Combining Protection of Both Levels of Page Tables + 6.4.3 Overrides to Page Protection + +6.5 Combining Page and Segment Protection + +Chapter 7 Multitasking + +7.1 Task State Segment +7.2 TSS Descriptor +7.3 Task Register +7.4 Task Gate Descriptor +7.5 Task Switching +7.6 Task Linking + 7.6.1 Busy Bit Prevents Loops + 7.6.2 Modifying Task Linkages + +7.7 Task Address Space + 7.7.1 Task Linear-to-Physical Space Mapping + 7.7.2 Task Logical Address Space + +Chapter 8 Input/Output + +8.1 I/O Addressing + 8.1.1 I/O Address Space + 8.1.2 Memory-Mapped I/O + +8.2 I/O Instructions + 8.2.1 Register I/O Instructions + 8.2.2 Block I/O Instructions + +8.3 Protection and I/O + 8.3.1 I/O Privilege Level + 8.3.2 I/O Permission Bit Map + +Chapter 9 Exceptions and Interrupts + +9.1 Identifying Interrupts +9.2 Enabling and Disabling Interrupts + 9.2.1 NMI Masks Further NMls + 9.2.2 IF Masks INTR + 9.2.3 RF Masks Debug Faults + 9.2.4 MOV or POP to SS Masks Some Interrupts and Exceptions + +9.3 Priority Among Simultaneous Interrupts and Exceptions +9.4 Interrupt Descriptor Table +9.5 IDT Descriptors +9.6 Interrupt Tasks and Interrupt Procedures + 9.6.1 Interrupt Procedures + 9.6.1.1 Stack of Interrupt Procedure + 9.6.1.2 Returning from an Interrupt Procedure + 9.6.1.3 Flags Usage by Interrupt Procedure + 9.6.1.4 Protection in Interrupt Procedures + + 9.6.2 Interrupt Tasks + +9.7 Error Code +9.8 Exception Conditions + 9.8.1 Interrupt 0 컴 Divide Error + 9.8.2 Interrupt 1 컴 Debug Exceptions + 9.8.3 Interrupt 3 컴 Breakpoint + 9.8.4 Interrupt 4 컴 Overflow + 9.8.5 Interrupt 5 컴 Bounds Check + 9.8.6 Interrupt 6 컴 Invalid Opcode + 9.8.7 Interrupt 7 컴 Coprocessor Not Available + 9.8.8 Interrupt 8 컴 Double Fault + 9.8.9 Interrupt 9 컴 Coprocessor Segment Overrun + 9.8.10 Interrupt 10 컴 Invalid TSS + 9.8.11 Interrupt 11 컴 Segment Not Present + 9.8.12 Interrupt 12 컴 Stack Exception + 9.8.13 Interrupt 13 컴 General Protection Exception + 9.8.14 Interrupt 14 컴 Page Fault + 9.8.14.1 Page Fault during Task Switch + 9.8.14.2 Page Fault with Inconsistent Stack Pointer + + 9.8.15 Interrupt 16 컴 Coprocessor Error + +9.9 Exception Summary + +9.10 Error Code Summary + +Chapter 10 Initialization + +10.1 Processor State after Reset +10.2 Software Initialization for Real-Address Mode + 10.2.1 Stack + 10.2.2 Interrupt Table + 10.2.3 First Instructions + +10.3 Switching to Protected Mode +10.4 Software Initialization for Protected Mode + 10.4.1 Interrupt Descriptor Table + 10.4.2 Stack + 10.4.3 Global Descriptor Table + 10.4.4 Page Tables + 10.4.5 First Task + +10.5 Initialization Example +10.6 TLB Testing + 10.6.1 Structure of the TLB + 10.6.2 Test Registers + 10.6.3 Test Operations + +Chapter 11 Coprocessing and Multiprocessing + +11.1 Coprocessing + 11.1.1 Coprocessor Identification + 11.1.2 ESC and WAIT Instructions + 11.1.3 EM and MP Flags + 11.1.4 The Task-Switched Flag + 11.1.5 Coprocessor Exceptions + 11.1.5.1 Interrupt 7 컴 Coprocessor Not Available + 11.1.5.2 Interrupt 9 컴 Coprocessor Segment Overrun + 11.1.5.3 Interrupt 16 컴 Coprocessor Error + +11.2 General Multiprocessing + 11.2.1 LOCK and the LOCK# Signal + 11.2.2 Automatic Locking + 11.2.3 Cache Considerations + +Chapter 12 Debugging + +12.1 Debugging Features of the Architecture +12.2 Debug Registers + 12.2.1 Debug Address Registers (DRO-DR3) + 12.2.2 Debug Control Register (DR7) + 12.2.3 Debug Status Register (DR6) + 12.2.4 Breakpoint Field Recognition + +12.3 Debug Exceptions + 12.3.1 Interrupt 1 컴 Debug Exceptions + 12.3.1.1 Instruction Address Breakpoint + 12.3.1.2 Data Address Breakpoint + 12.3.1.3 General Detect Fault + 12.3.1.4 Single-Step Trap + 12.3.1.5 Task Switch Breakpoint + + 12.3.2 Interrupt 3 컴 Breakpoint Exception + + PART III COMPATIBILITY + +Chapter 13 Executing 80286 Protected-Mode Code + +13.1 80286 Code Executes as a Subset of the 80386 +13.2 Two Ways to Execute 80286 Tasks +13.3 Differences from 80286 + 13.3.1 Wraparound of 80286 24-Bit Physical Address Space + 13.3.2 Reserved Word of Descriptor + 13.3.3 New Descriptor Type Codes + 13.3.4 Restricted Semantics of LOCK + 13.3.5 Additional Exceptions + +Chapter 14 80386 Real-Address Mode + +14.1 Physical Address Formation +14.2 Registers and Instructions +14.3 Interrupt and Exception Handling +14.4 Entering and Leaving Real-Address Mode + 14.4.1 Switching to Protected Mode + +14.5 Switching Back to Real-Address Mode +14.6 Real-Address Mode Exceptions +14.7 Differences from 8086 +14.8 Differences from 80286 Real-Address Mode + 14.8.1 Bus Lock + 14.8.2 Location of First Instruction + 14.8.3 Initial Values of General Registers + 14.8.4 MSW Initialization + +Chapter 15 Virtual 8088 Mode + +15.1 Executing 8086 Code + 15.1.1 Registers and Instructions + 15.1.2 Linear Address Formation + +15.2 Structure of a V86 Task + 15.2.1 Using Paging for V86 Tasks + 15.2.2 Protection within a V86 Task + +15.3 Entering and Leaving V86 Mode + 15.3.1 Transitions Through Task Switches + 15.3.2 Transitions Through Trap Gates and Interrupt Gates + +15.4 Additional Sensitive Instructions + 15.4.1 Emulating 8086 Operating System Calls + 15.4.2 Virtualizing the Interrupt-Enable Flag + +15.5 Virtual I/O + 15.5.1 I/O-Mapped I/O + 15.5.2 Memory-Mapped I/O + 15.5.3 Special I/O Buffers + +15.6 Differences from 8086 +15.7 Differences from 80286 Real-Address Mode + +Chapter 16 Mixing 16-Bit and 32-Bit Code + +16.1 How the 80386 Implements 16-Bit and 32-Bit Features +16.2 Mixing 32-Bit and 16-Bit Operations +16.3 Sharing Data Segments among Mixed Code Segments +16.4 Transferring Control among Mixed Code Segments + 16.4.1 Size of Code-Segment Pointer + 16.4.2 Stack Management for Control Transfers + 16.4.2.1 Controlling the Operand-Size for a CALL + 16.4.2.2 Changing Size of Call + + 16.4.3 Interrupt Control Transfers + 16.4.4 Parameter Translation + 16.4.5 The Interface Procedure + + PART IV INSTRUCTION SET + +Chapter 17 80386 Instruction Set + +17.1 Operand-Size and Address-Size Attributes + 17.1.1 Default Segment Attribute + 17.1.2 Operand-Size and Address-Size Instruction Prefixes + 17.1.3 Address-Size Attribute for Stack + +17.2 Instruction Format + 17.2.1 ModR/M and SIB Bytes + 17.2.2 How to Read the Instruction Set Pages + 17.2.2.1 Opcode + 17.2.2.2 Instruction + 17.2.2.3 Clocks + 17.2.2.4 Description + 17.2.2.5 Operation + 17.2.2.6 Description + 17.2.2.7 Flags Affected + 17.2.2.8 Protected Mode Exceptions + 17.2.2.9 Real Address Mode Exceptions + 17.2.2.10 Virtual-8086 Mode Exceptions + +Instruction Sets + +AAA +AAD +AAM +AAS +ADC +ADD +AND +ARPL +BOUND +BSF +BSR +BT +BTC +BTR +BTS +CALL +CBW/CWDE +CLC +CLD +CLI +CLTS +CMC +CMP +CMPS/CMPSB/CMPSW/CMPSD +CWD/CDQ +DAA +DAS +DEC +DIV +ENTER +HLT +IDIV +IMUL +IN +INC +INS/INSB/INSW/INSD +INT/INTO +IRET/IRETD +Jcc +JMP +LAHF +LAR +LEA +LEAVE +LGDT/LIDT +LGS/LSS/LDS/LES/LFS +LLDT +LMSW +LOCK +LODS/LODSB/LODSW/LODSD +LOOP/LOOPcond +LSL +LTR +MOV +MOV +MOVS/MOVSB/MOVSW/MOVSD +MOVSX +MOVZX +MUL +NEG +NOP +NOT +OR +OUT +OUTS/OUTSB/OUTSW/OUTSD +POP +POPA/POPAD +POPF/POPFD +PUSH +PUSHA/PUSHAD +PUSHF/PUSHFD +RCL/RCR/ROL/ROR +REP/REPE/REPZ/REPNE/REPNZ +RET +SAHF +SAL/SAR/SHL/SHR +SBB +SCAS/SCASB/SCASW/SCASD +SETcc +SGDT/SIDT +SHLD +SHRD +SLDT +SMSW +STC +STD +STI +STOS/STOSB/STOSW/STOSD +STR +SUB +TEST +VERR,VERW +WAIT +XCHG +XLAT/XLATB +XOR + +Appendix A Opcode Map + +Appendix B Complete Flag Cross-Reference + +Appendix C Status Flag Summary + +Appendix D Condition Codes + + +Figures + +1-1 Example Data Structure + +2-1 Two-Component Pointer +2-2 Fundamental Data Types +2-3 Bytes, Words, and Doublewords in Memory +2-4 80386 Data Types +2-5 80386 Applications Register Set +2-6 Use of Memory Segmentation +2-7 80386 Stack +2-8 EFLAGS Register +2-9 Instruction Pointer Register +2-10 Effective Address Computation + +3-1 PUSH +3-2 PUSHA +3-3 POP +3-4 POPA +3-5 Sign Extension +3-6 SAL and SHL +3-7 SHR +3-8 SAR +3-9 Using SAR to Simulate IDIV +3-10 Shift Left Double +3-11 Shift Right Double +3-12 ROL +3-13 ROR +3-14 RCL +3-15 RCR +3-16 Formal Definition of the ENTER Instruction +3-17 Variable Access in Nested Procedures +3-18 Stack Frame for MAIN at Level 1 +3-19 Stack Frame for Prooedure A +3-20 Stack Frame for Procedure B at Level 3 Called from A +3-21 Stack Frame for Procedure C at Level 3 Called from B +3-22 LAHF and SAHF +3-23 Flag Format for PUSHF and POPF + +4-1 Systems Flags of EFLAGS Register +4-2 Control Registers + +5-1 Address Translation Overview +5-2 Segment Translation +5-3 General Segment-Descriptor Format +5-4 Format of Not-Present Descriptor +5-5 Descriptor Tables +5-6 Format of a Selector +5-7 Segment Registers +5-8 Format of a Linear Address +5-9 Page Translation +5-10 Format of a Page Table Entry +5-11 Invalid Page Table Entry +5-12 80386 Addressing Mechanism +5-13 Descriptor per Page Table + +6-1 Protection Fields of Segment Descriptors +6-2 Levels of Privilege +6-3 Privilege Check for Data Access +6-4 Privilege Check for Control Transfer without Gate +6-5 Format of 80386 Call Gate +6-6 Indirect Transfer via Call Gate +6-7 Privilege Check via Call Gate +6-8 Initial Stack Pointers of TSS +6-9 Stack Contents after an Interievel Call +6-10 Protection Fields of Page Table Entries + +7-1 80386 32-Bit Task State Segment +7-2 TSS Descriptor for 32-Bit TSS +7-3 Task Register +7-4 Task Gate Descriptor +7-5 Task Gate Indirectly Identifies Task +7-6 Partially-Overlapping Linear Spaces + +8-1 Memory-Mapped I/O +8-2 I/O Address Bit Map + +9-1 IDT Register and Table +9-2 Pseudo-Descriptor Format for LIDT and SIDT +9-3 80386 IDT Gate Descriptors +9-4 Interrupt Vectoring for Procedures +9-5 Stack Layout after Exception of Interrupt +9-6 Interrupt Vectoring for Tasks +9-7 Error Code Format +9-8 Page-Fault Error Code Format +9-9 CR2 Format + +10-1 Contents of EDX after RESET +10-2 Initial Contents of CRO +10-3 TLB Structure +10-4 Test Registers + +12-1 Debug Registers + +14-1 Real-Address Mode Address Formation + +15-1 V86 Mode Address Formation +15-2 Entering and Leaving an 8086 Program +15-3 PL 0 Stack after Interrupt in V86 Task + +16-1 Stack after Far 16-Bit and 32-Bit Calls + +17-1 80386 Instruction Format +17-2 ModR/M and SIB Byte Formats +17-3 Bit Offset for BIT[EAX, 21] +17-4 Memory Bit Indexing + + +Tables + +2-1 Default Segment Register Selection Rules +2-2 80386 Reserved Exceptions and Interrupts + +3-1 Bit Test and Modify Instructions +3-2 Interpretation of Conditional Transfers + +6-1 System and Gate Descriptor Types +6-2 Useful Combinations of E, G, and B Bits +6-3 Interievel Return Checks +6-4 Valid Descriptor Types for LSL +6-5 Combining Directory and Page Protection + +7-1 Checks Made during a Task Switch +7-2 Effect of Task Switch on BUSY, NT, and Back-Link + +9-1 Interrupt and Exception ID Assignments +9-2 Priority Among Simultaneous Interrupts and Exceptions +9-3 Double-Fault Detection Classes +9-4 Double-Fault Definition +9-5 Conditions That Invalidate the TSS +9-6 Exception Summary +9-7 Error-Code Summary + +10-1 Meaning of D, U, and W Bit Pairs + +12-1 Breakpeint Field Recognition Examples +12-2 Debug Exception Conditions + +14-1 80386 Real-Address Mode Exceptions +14-2 New 80386 Exceptions + +17-1 Effective Size Attributes +17-2 16-Bit Addressing Forms with the ModR/M Byte +17-3 32-Bit Addressing Forms with the ModR/M Byte +17-4 32-Bit Addressing Forms with the SIB Byte +17-5 Task Switch Times for Exceptions +17-6 80386 Exceptions + + +Chapter 1 Introduction to the 80386 + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The 80386 is an advanced 32-bit microprocessor optimized for multitasking +operating systems and designed for applications needing very high +performance. The 32-bit registers and data paths support 32-bit addresses +and data types. The processor can address up to four gigabytes of physical +memory and 64 terabytes (2^(46) bytes) of virtual memory. The on-chip +memory-management facilities include address translation registers, +advanced multitasking hardware, a protection mechanism, and paged virtual +memory. Special debugging registers provide data and code breakpoints even +in ROM-based software. + + +1.1 Organization of This Manual + +This book presents the architecture of the 80386 in five parts: + + Part I 컴 Applications Programming + Part II 컴 Systems Programming + Part III 컴 Compatibility + Part IV 컴 Instruction Set + Appendices + +These divisions are determined in part by the architecture itself and in +part by the different ways the book will be used. As the following table +indicates, the latter two parts are intended as reference material for +programmers actually engaged in the process of developing software for the +80386. The first three parts are explanatory, showing the purpose of +architectural features, developing terminology and concepts, and describing +instructions as they relate to specific purposes or to specific +architectural features. + +Explanation Part I 컴 Applications Programming + Part II 컴 Systems Programming + Part III 컴 Compatibility + +Reference Part IV 컴 Instruction Set + Appendices + +The first three parts follow the execution modes and protection features of +the 80386 CPU. The distinction between applications features and systems +features is determined by the protection mechanism of the 80386. One purpose +of protection is to prevent applications from interfering with the operating +system; therefore, the processor makes certain registers and instructions +inaccessible to applications programs. The features discussed in Part I are +those that are accessible to applications; the features in Part II are +available only to systems software that has been given special privileges or +in unprotected systems. + +The processing mode of the 80386 also determines the features that are +accessible. The 80386 has three processing modes: + + 1. Protected Mode. + 2. Real-Address Mode. + 3. Virtual 8086 Mode. + +Protected mode is the natural 32-bit environment of the 80386 processor. In +this mode all instructions and features are available. + +Real-address mode (often called just "real mode") is the mode of the +processor immediately after RESET. In real mode the 80386 appears to +programmers as a fast 8086 with some new instructions. Most applications of +the 80386 will use real mode for initialization only. + +Virtual 8086 mode (also called V86 mode) is a dynamic mode in the sense +that the processor can switch repeatedly and rapidly between V86 mode and +protected mode. The CPU enters V86 mode from protected mode to execute an +8086 program, then leaves V86 mode and enters protected mode to continue +executing a native 80386 program. + +The features that are available to applications programs in protected mode +and to all programs in V86 mode are the same. These features form the +content of Part I. The additional features that are available to systems +software in protected mode form Part II. Part III explains real-address +mode and V86 mode, as well as how to execute a mix of 32-bit and 16-bit +programs. + +Available in All Modes Part I 컴 Applications Programming + +Available in Protected Part II 컴 Systems Programming +Mode Only + +Compatibility Modes Part III 컴 Compatibility + + +1.1.1 Part I 컴 Applications Programming + +This part presents those aspects of the architecture that are customarily +used by applications programmers. + +Chapter 2 컴 Basic Programming Model: Introduces the models of memory +organization. Defines the data types. Presents the register set used by +applications. Introduces the stack. Explains string operations. Defines the +parts of an instruction. Explains addressing calculations. Introduces +interrupts and exceptions as they may apply to applications programming. + +Chapter 3 컴 Application Instruction Set: Surveys the instructions commonly +used for applications programming. Considers instructions in functionally +related groups; for example, string instructions are considered in one +section, while control-transfer instructions are considered in another. +Explains the concepts behind the instructions. Details of individual +instructions are deferred until Part IV, the instruction-set reference. + + +1.1.2 Part II 컴 Systems Programming + +This part presents those aspects of the architecture that are customarily +used by programmers who write operating systems, device drivers, debuggers, +and other software that supports applications programs in the protected mode +of the 80386. + +Chapter 4 컴 Systems Architecture: Surveys the features of the 80386 that +are used by systems programmers. Introduces the remaining registers and data +structures of the 80386 that were not discussed in Part I. Introduces the +systems-oriented instructions in the context of the registers and data +structures they support. Points to the chapter where each register, data +structure, and instruction is considered in more detail. + +Chapter 5 컴 Memory Management: Presents details of the data structures, +registers, and instructions that support virtual memory and the concepts of +segmentation and paging. Explains how systems designers can choose a model +of memory organization ranging from completely linear ("flat") to fully +paged and segmented. + +Chapter 6 컴 Protection: Expands on the memory management features of the +80386 to include protection as it applies to both segments and pages. +Explains the implementation of privilege rules, stack switching, pointer +validation, user and supervisor modes. Protection aspects of multitasking +are deferred until the following chapter. + +Chapter 7 컴 Multitasking: Explains how the hardware of the 80386 supports +multitasking with context-switching operations and intertask protection. + +Chapter 8 컴 Input/Output: Reveals the I/O features of the 80386, including +I/O instructions, protection as it relates to I/O, and the I/O permission +map. + +Chapter 9 컴 Exceptions and Interrupts: Explains the basic interrupt +mechanisms of the 80386. Shows how interrupts and exceptions relate to +protection. Discusses all possible exceptions, listing causes and including +information needed to handle and recover from the exception. + +Chapter 10 컴 Initialization: Defines the condition of the processor after +RESET or power-up. Explains how to set up registers, flags, and data +structures for either real-address mode or protected mode. Contains an +example of an initialization program. + +Chapter 11 컴 Coprocessing and Multiprocessing: Explains the instructions +and flags that support a numerics coprocessor and multiple CPUs with shared +memory. + +Chapter 12 컴 Debugging: Tells how to use the debugging registers of the +80386. + + +1.1.3 Part III 컴 Compatibility + +Other parts of the book treat the processor primarily as a 32-bit machine, +omitting for simplicity its facilities for 16-bit operations. Indeed, the +80386 is a 32-bit machine, but its design fully supports 16-bit operands and +addressing, too. This part completes the picture of the 80386 by explaining +the features of the architecture that support 16-bit programs and 16-bit +operations in 32-bit programs. All three processor modes are used to +execute 16-bit programs: protected mode can directly execute 16-bit 80286 +protected mode programs, real mode executes 8086 programs and real-mode +80286 programs, and virtual 8086 mode executes 8086 programs in a +multitasking environment with other 80386 protected-mode programs. In +addition, 32-bit and 16-bit modules and individual 32-bit and 16-bit +operations can be mixed in protected mode. + +Chapter 13 컴 Executing 80286 Protected-Mode Code: In its protected mode, +the 80386 can execute complete 80286 protected-mode systems, because 80286 +capabilities are a subset of 80386 capabilities. + +Chapter 14 컴 80386 Real-Address Mode: Explains the real mode of the 80386 +CPU. In this mode the 80386 appears as a fast real-mode 80286 or fast 8086 +enhanced with additional instructions. + +Chapter 15 컴 Virtual 8086 Mode: The 80386 can switch rapidly between its +protected mode and V86 mode, giving it the ability to multiprogram 8086 +programs along with "native mode" 32-bit programs. + +Chapter 16 컴 Mixing 16-Bit and 32-Bit Code: Even within a program or task, +the 80386 can mix 16-bit and 32-bit modules. Furthermore, any given module +can utilize both 16-bit and 32-bit operands and addresses. + + +1.1.4 Part IV 컴 Instruction Set + +Parts I, II, and III present overviews of the instructions as they relate +to specific aspects of the architecture, but this part presents the +instructions in alphabetical order, providing the detail needed by +assembly-language programmers and programmers of debuggers, compilers, +operating systems, etc. Instruction descriptions include algorithmic +description of operation, effect of flag settings, effect on flag settings, +effect of operand- or address-size attributes, effect of processor modes, +and possible exceptions. + + +1.1.5 Appendices + +The appendices present tables of encodings and other details in a format +designed for quick reference by assembly-language and systems programmers. + + +1.2 Related Literature + +The following books contain additional material concerning the 80386 +microprocessor: + + � Introduction to the 80386, order number 231252 + + � 80386 Hardware Reference Manual, order number 231732 + + � 80386 System Software Writer's Guide, order number 231499 + + � 80386 High Performance 32-bit Microprocessor with Integrated Memory + Management (Data Sheet), order number 231630 + + +1.3 Notational Conventions + +This manual uses special notations for data-structure formats, for symbolic +representation of instructions, for hexadecimal numbers, and for super- and +sub-scripts. Subscript characters are surrounded by {curly brackets}, for +example 10{2} = 10 base 2. Superscript characters are preceeded by a caret +and enclosed within (parentheses), for example 10^(3) = 10 to the third +power. A review of these notations will make it easier to read the +manual. + +1.3.1 Data-Structure Formats + +In illustrations of data structures in memory, smaller addresses appear at +the lower-right part of the figure; addresses increase toward the left and +upwards. Bit positions are numbered from right to left. Figure 1-1 +illustrates this convention. + + +1.3.2 Undefined Bits and Software Compatibility + +In many register and memory layout descriptions, certain bits are marked as +undefined. When bits are marked as undefined (as illustrated in Figure +1-1), it is essential for compatibility with future processors that +software treat these bits as undefined. Software should follow these +guidelines in dealing with undefined bits: + + � Do not depend on the states of any undefined bits when testing the + values of registers that contain such bits. Mask out the undefined bits + before testing. + + � Do not depend on the states of any undefined bits when storing them in + memory or in another register. + + � Do not depend on the ability to retain information written into any + undefined bits. + + � When loading a register, always load the undefined bits as zeros or + reload them with values previously stored from the same register. + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 +NOTE + Depending upon the values of undefined register bits will make software + dependent upon the unspecified manner in which the 80386 handles these + bits. Depending upon undefined values risks making software incompatible + with future processors that define usages for these bits. AVOID ANY + SOFTWARE DEPENDENCE UPON THE STATE OF UNDEFINED 80386 REGISTER BITS. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + + +Figure 1-1. Example Data Structure + + GREATEST DATA STRUCTURE + ADDRESS + 31 23 15 7 0 컴BIT + �袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴敲 OFFSET + � �28 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � �24 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � �20 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � �16 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � �12 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � �8 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � UNDEFINED �4 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� SMALLEST + � BYTE 3 BYTE 2 BYTE 1 BYTE 0 �0 ADDRESS + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + BYTE OFFSET컴켸 + + +1.3.3 Instruction Operands + +When instructions are represented symbolically, a subset of the 80386 +Assembly Language is used. In this subset, an instruction has the following +format: + +label: prefix mnemonic argument1, argument2, argument3 + +where: + + � A label is an identifier that is followed by a colon. + + � A prefix is an optional reserved name for one of the instruction + prefixes. + + � A mnemonic is a reserved name for a class of instruction opcodes that + have the same function. + + � The operands argument1, argument2, and argument3 are optional. There + may be from zero to three operands, depending on the opcode. When + present, they take the form of either literals or identifiers for data + items. Operand identifiers are either reserved names of registers or + are assumed to be assigned to data items declared in another part of + the program (which may not be shown in the example). When two operands + are present in an instruction that modifies data, the right operand is + the source and the left operand is the destination. + +For example: + +LOADREG: MOV EAX, SUBTOTAL + +In this example LOADREG is a label, MOV is the mnemonic identifier of an +opcode, EAX is the destination operand, and SUBTOTAL is the source operand. + +1.3.4 Hexadecimal Numbers + +Base 16 numbers are represented by a string of hexadecimal digits followed +by the character H. A hexadecimal digit is a character from the set (0, 1, +2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F). In some cases, especially in +examples of program syntax, a leading zero is added if the number would +otherwise begin with one of the digits A-F. For example, 0FH is equivalent +to the decimal number 15. + +1.3.5 Sub- and Super-Scripts + +This manual uses special notation to represent sub- and super-script +characters. Sub-script characters are surrounded by {curly brackets}, for +example 10{2} = 10 base 2. Super-script characters are preceeded by a +caret and enclosed within (parentheses), for example 10^(3) = 10 to the +third power. + + + PART I APPLICATIONS PROGRAMMING + + +Chapter 2 Basic Programming Model + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +This chapter describes the 80386 application programming environment as +seen by assembly language programmers when the processor is executing in +protected mode. The chapter introduces programmers to those features of the +80386 architecture that directly affect the design and implementation of +80386 applications programs. Other chapters discuss 80386 features that +relate to systems programming or to compatibility with other processors of +the 8086 family. + +The basic programming model consists of these aspects: + + � Memory organization and segmentation + � Data types + � Registers + � Instruction format + � Operand selection + � Interrupts and exceptions + +Note that input/output is not included as part of the basic programming +model. Systems designers may choose to make I/O instructions available to +applications or may choose to reserve these functions for the operating +system. For this reason, the I/O features of the 80386 are discussed in Part +II. + +This chapter contains a section for each aspect of the architecture that is +normally visible to applications. + + +2.1 Memory Organization and Segmentation + +The physical memory of an 80386 system is organized as a sequence of 8-bit +bytes. Each byte is assigned a unique address that ranges from zero to a +maximum of 2^(32) -1 (4 gigabytes). + +80386 programs, however, are independent of the physical address space. +This means that programs can be written without knowledge of how much +physical memory is available and without knowledge of exactly where in +physical memory the instructions and data are located. + +The model of memory organization seen by applications programmers is +determined by systems-software designers. The architecture of the 80386 +gives designers the freedom to choose a model for each task. The model of +memory organization can range between the following extremes: + + � A "flat" address space consisting of a single array of up to 4 + gigabytes. + + � A segmented address space consisting of a collection of up to 16,383 + linear address spaces of up to 4 gigabytes each. + +Both models can provide memory protection. Different tasks may employ +different models of memory organization. The criteria that designers use to +determine a memory organization model and the means that systems programmers +use to implement that model are covered in Part II컴Systems Programming. + + +2.1.1 The "Flat" Model + +In a "flat" model of memory organization, the applications programmer sees +a single array of up to 2^(32) bytes (4 gigabytes). While the physical +memory can contain up to 4 gigabytes, it is usually much smaller; the +processor maps the 4 gigabyte flat space onto the physical address space by +the address translation mechanisms described in Chapter 5. Applications +programmers do not need to know the details of the mapping. + +A pointer into this flat address space is a 32-bit ordinal number that may +range from 0 to 2^(32) -1. Relocation of separately-compiled modules in this +space must be performed by systems software (e.g., linkers, locators, +binders, loaders). + + +2.1.2 The Segmented Model + +In a segmented model of memory organization, the address space as viewed by +an applications program (called the logical address space) is a much larger +space of up to 2^(46) bytes (64 terabytes). The processor maps the 64 +terabyte logical address space onto the physical address space (up to 4 +gigabytes) by the address translation mechanisms described in Chapter 5. +Applications programmers do not need to know the details of this mapping. + +Applications programmers view the logical address space of the 80386 as a +collection of up to 16,383 one-dimensional subspaces, each with a specified +length. Each of these linear subspaces is called a segment. A segment is a +unit of contiguous address space. Segment sizes may range from one byte up +to a maximum of 2^(32) bytes (4 gigabytes). + +A complete pointer in this address space consists of two parts (see Figure +2-1): + + 1. A segment selector, which is a 16-bit field that identifies a + segment. + + 2. An offset, which is a 32-bit ordinal that addresses to the byte level + within a segment. + +During execution of a program, the processor associates with a segment +selector the physical address of the beginning of the segment. Separately +compiled modules can be relocated at run time by changing the base address +of their segments. The size of a segment is variable; therefore, a segment +can be exactly the size of the module it contains. + + +2.2 Data Types + +Bytes, words, and doublewords are the fundamental data types (refer to +Figure 2-2). A byte is eight contiguous bits starting at any logical +address. The bits are numbered 0 through 7; bit zero is the least +significant bit. + +A word is two contiguous bytes starting at any byte address. A word thus +contains 16 bits. The bits of a word are numbered from 0 through 15; bit 0 +is the least significant bit. The byte containing bit 0 of the word is +called the low byte; the byte containing bit 15 is called the high byte. + +Each byte within a word has its own address, and the smaller of the +addresses is the address of the word. The byte at this lower address +contains the eight least significant bits of the word, while the byte at the +higher address contains the eight most significant bits. + +A doubleword is two contiguous words starting at any byte address. A +doubleword thus contains 32 bits. The bits of a doubleword are numbered from +0 through 31; bit 0 is the least significant bit. The word containing bit 0 +of the doubleword is called the low word; the word containing bit 31 is +called the high word. + +Each byte within a doubleword has its own address, and the smallest of the +addresses is the address of the doubleword. The byte at this lowest address +contains the eight least significant bits of the doubleword, while the byte +at the highest address contains the eight most significant bits. Figure 2-3 +illustrates the arrangement of bytes within words anddoublewords. + +Note that words need not be aligned at even-numbered addresses and +doublewords need not be aligned at addresses evenly divisible by four. This +allows maximum flexibility in data structures (e.g., records containing +mixed byte, word, and doubleword items) and efficiency in memory +utilization. When used in a configuration with a 32-bit bus, actual +transfers of data between processor and memory take place in units of +doublewords beginning at addresses evenly divisible by four; however, the +processor converts requests for misaligned words or doublewords into the +appropriate sequences of requests acceptable to the memory interface. Such +misaligned data transfers reduce performance by requiring extra memory +cycles. For maximum performance, data structures (including stacks) should +be designed in such a way that, whenever possible, word operands are aligned +at even addresses and doubleword operands are aligned at addresses evenly +divisible by four. Due to instruction prefetching and queuing within the +CPU, there is no requirement for instructions to be aligned on word or +doubleword boundaries. (However, a slight increase in speed results if the +target addresses of control transfers are evenly divisible by four.) + +Although bytes, words, and doublewords are the fundamental types of +operands, the processor also supports additional interpretations of these +operands. Depending on the instruction referring to the operand, the +following additional data types are recognized: + +Integer: +A signed binary numeric value contained in a 32-bit doubleword,16-bit word, +or 8-bit byte. All operations assume a 2's complement representation. The +sign bit is located in bit 7 in a byte, bit 15 in a word, and bit 31 in a +doubleword. The sign bit has the value zero for positive integers and one +for negative. Since the high-order bit is used for a sign, the range of an +8-bit integer is -128 through +127; 16-bit integers may range from -32,768 +through +32,767; 32-bit integers may range from -2^(31) through +2^(31) -1. +The value zero has a positive sign. + +Ordinal: +An unsigned binary numeric value contained in a 32-bit doubleword, +16-bit word, or 8-bit byte. All bits are considered in determining +magnitude of the number. The value range of an 8-bit ordinal number +is 0-255; 16 bits can represent values from 0 through 65,535; 32 bits +can represent values from 0 through 2^(32) -1. + +Near Pointer: +A 32-bit logical address. A near pointer is an offset within a segment. +Near pointers are used in either a flat or a segmented model of memory +organization. + +Far Pointer: +A 48-bit logical address of two components: a 16-bit segment selector +component and a 32-bit offset component. Far pointers are used by +applications programmers only when systems designers choose a +segmented memory organization. + +String: +A contiguous sequence of bytes, words, or doublewords. A string may +contain from zero bytes to 2^(32) -1 bytes (4 gigabytes). + +Bit field: +A contiguous sequence of bits. A bit field may begin at any bit position +of any byte and may contain up to 32 bits. + +Bit string: +A contiguous sequence of bits. A bit string may begin at any bit position +of any byte and may contain up to 2^(32) -1 bits. + +BCD: +A byte (unpacked) representation of a decimal digit in the range0 through +9. Unpacked decimal numbers are stored as unsigned byte quantities. One +digit is stored in each byte. The magnitude of the number is determined from +the low-order half-byte; hexadecimal values 0-9 are valid and are +interpreted as decimal numbers. The high-order half-byte must be zero for +multiplication and division; it may contain any value for addition and +subtraction. + +Packed BCD: +A byte (packed) representation of two decimal digits, each in the range +0 through 9. One digit is stored in each half-byte. The digit in the +high-order half-byte is the most significant. Values 0-9 are valid in each +half-byte. The range of a packed decimal byte is 0-99. + +Figure 2-4 graphically summarizes the data types supported by the 80386. + + +Figure 2-1. Two-Component Pointer + +   + � � + 勁袴袴袴袴袴袴袴뮬� + 32 0 � � � + �袴袴袴曲袴袴袴敲 �袴敲 勁袴袴袴袴袴袴袴� � + � OFFSET 픔컴� + 픔컴� OPERAND � � + 훤袴袴袴妄袴袴袴� 훤袴� 勁袴袴袴袴袴袴袴� 쳐 SELECTED SEGMENT +  � � � + 16 0 � � � � + �袴袴袴敲 � � � � + 튥EGMENT픔컴컴컴컴蝦컴컴勁袴袴袴袴袴袴袴뮬� + 훤袴袴袴� � � + � � + � � +   + + +Figure 2-2. Fundamental Data Types + + 7 0 + �袴袴袴袴袴袴袴敲 + � BYTE � BYTE + 훤袴袴袴袴袴袴袴� + + 15 7 0 + �袴袴袴袴袴袴袴錮袴袴袴袴袴袴袴敲 + � HIGH BYTE � LOW BYTE � WORD + 훤袴袴袴袴袴袴袴鳩袴袴袴袴袴袴袴� + address n+1 address n + + 31 23 15 7 0 + �袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴� + � HIGH WORD � LOW WORD � DOUBLEWORD + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴暠 + address n+3 address n+2 address n+1 address n + + +Figure 2-3. Bytes, Words, and Doublewords in Memory + + MEMORY + BYTE VALUES +All values in hexadecimal + ADDRESS �袴袴袴袴袴� + E� � + 勁袴袴袴袴攷컴� + D� 7A � 쳐 DOUBLE WORD AT ADDRESS A + 勁袴袴袴袴攷커� CONTAINS 7AFE0636 + C� FE � 납 + 勁袴袴袴袴攷 쳐 WORD AT ADDRESS B + B� 06 � 납 CONTAINS FE06 + 勁袴袴袴袴攷켸� + A� 36 � � + 勁袴袴袴袴攷袴� + 9� 1F � 쳐 WORD AT ADDRESS 9 + 勁袴袴袴袴攷컴� CONTAINS IF + 8� � + 勁袴袴袴袴攷컴� + 7� 23 � � + 勁袴袴袴袴攷 쳐 WORD AT ADDRESS 6 + 6� OB � � CONTAINS 23OB + 勁袴袴袴袴攷컴� + 5� � + 勁袴袴袴袴攷 + 4� � + 勁袴袴袴袴攷컴� + 3� 74 � � + 勁袴袴袴袴攷커쳐 WORD AT ADDRESS 2 + 2� CB � 납 CONTAINS 74CB + 勁袴袴袴袴攷컴� + 1� 31 � 쳐� WORD AT ADDRESS 1 + 勁袴袴袴袴攷켸 CONTAINS CB31 + 0� � + 훤袴袴袴袴暠 + + +Figure 2-4. 80386 Data Types + + +1 0 + 7 0 7 0 15 14 8 7 0 + BYTE �金金金綺 BYTE �金金金綺 WORD �金金金金金金金綺 + INTEGER 볐 � � ORDINAL � � � INTEGER 볐 � � � � + 훰袴袴袴� 훤袴袴袴� 훰袴袴袴鳩袴袴袴� + SIGN BIT牡컴컴컴� 읕컴컴컴� SIGN BIT牡MSB � + MAGNITUDE MAGNITUDE 읕컴컴컴컴컴컴컴� + MAGNITUDE + + + +1 0 +3 +2 +1 0 + 15 0 31 16 15 0 + WORD �金金金金金金金綺 DOUBLEWORD �金金金金金金金金金金金金金金金綺 + ORDINAL 볐 � � � � INTEGER 볐 � � � � � � � � + 훰袴袴袴鳩袴袴袴� 훰袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴� + � � SIGN BIT牡MSB � + 읕컴컴컴컴컴컴컴� 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + MAGNITUDE MAGNITUDE + + + +3 +2 +1 0 + 31 0 + DOUBLEWORD �金金金金金金金金金金金金金金金綺 + ORDINAL � � � � � � � � � + 훤袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴� + 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + MAGNITUDE + + +N +1 0 + 7 0 7 0 7 0 + BINARY CODED �金金金綺 �金金金金金金金綺 + DECIMAL (BCD) � � �  � � � � � + 훤袴袴袴� 훤袴袴袴鳩袴袴袴� + BCD BCD BCD + DIGIT N DIGIT 1 DIGIT 0 + + +N +1 0 + 7 0 7 0 7 0 + PACKED �金金金綺 �金金金金金金金綺 + BCD � � �  � � � � � + 훤袴袴袴� 훤袴袴袴鳩袴袴袴� + 읕컴� 읕컴� + MOST LEAST + SIGNIFICANT SIGNIFICANT + DIGIT DIGIT + + +N +1 0 + 7 0 7 0 7 0 + BYTE �金金金綺 �金金金金金金金綺 + STRING � � �  � � � � � + 훤袴袴袴� 훤袴袴袴鳩袴袴袴� + + -2 GIGABYTES + +2 GIGABYTES 210 + BIT �金金袴袴袴袴袴袴金袴袴袴� 袴袴袴袴袴袴袴袴金金� + STRING 볐납� 납 납납� + 훰龜鳩袴袴袴袴袴賈鳩袴袴袴� 袴袴袴袴袴袴袴賈龜究 + BIT 0 + + +3 +2 +1 0 + 31 0 +NEAR 32-BIT �金金金金金金金金金金金金金金金綺 + POINTER � � � � � � � � � + 훤袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴� + 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + OFFSET + + +5 +4 +3 +2 +1 0 + 48 0 +FAR 48-BIT �金金金金金金金金金金金金金金金金金金金金金金金綺 + POINTER � � � � � � � � � � � � � + 훤袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴� + 읕컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + SELECTOR OFFSET + + +5 +4 +3 +2 +1 0 + 32-BIT �金金金金金金金金金金金金金金金金金金金金金金金綺 + BIT FIELD � � � � � � � � � � � � � + 훤袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴鳩袴袴袴� + �컴컴컴컴� BIT FIELD 컴컴컴컴�� + 1 TO 32 BITS + + +2.3 Registers + +The 80386 contains a total of sixteen registers that are of interest to the +applications programmer. As Figure 2-5 shows, these registers may be +grouped into these basic categories: + + 1. General registers. These eight 32-bit general-purpose registers are + used primarily to contain operands for arithmetic and logical + operations. + + 2. Segment registers. These special-purpose registers permit systems + software designers to choose either a flat or segmented model of + memory organization. These six registers determine, at any given time, + which segments of memory are currently addressable. + + 3. Status and instruction registers. These special-purpose registers are + used to record and alter certain aspects of the 80386 processor state. + + +2.3.1 General Registers + +The general registers of the 80386 are the 32-bit registers EAX, EBX, ECX, +EDX, EBP, ESP, ESI, and EDI. These registers are used interchangeably to +contain the operands of logical and arithmetic operations. They may also be +used interchangeably for operands of address computations (except that ESP +cannot be used as an index operand). + +As Figure 2-5 shows, the low-order word of each of these eight registers +has a separate name and can be treated as a unit. This feature is useful for +handling 16-bit data items and for compatibility with the 8086 and 80286 +processors. The word registers are named AX, BX, CX, DX, BP, SP, SI, and DI. + +Figure 2-5 also illustrates that each byte of the 16-bit registers AX, BX, +CX, and DX has a separate name and can be treated as a unit. This feature is +useful for handling characters and other 8-bit data items. The byte +registers are named AH, BH, CH, and DH (high bytes); and AL, BL, CL, and DL +(low bytes). + +All of the general-purpose registers are available for addressing +calculations and for the results of most arithmetic and logical +calculations; however, a few functions are dedicated to certain registers. +By implicitly choosing registers for these functions, the 80386 architecture +can encode instructions more compactly. The instructions that use specific +registers include: double-precision multiply and divide, I/O, string +instructions, translate, loop, variable shift and rotate, and stack +operations. + + +2.3.2 Segment Registers + +The segment registers of the 80386 give systems software designers the +flexibility to choose among various models of memory organization. +Implementation of memory models is the subject of Part II 컴 Systems +Programming. Designers may choose a model in which applications programs do +not need to modify segment registers, in which case applications programmers +may skip this section. + +Complete programs generally consist of many different modules, each +consisting of instructions and data. However, at any given time during +program execution, only a small subset of a program's modules are actually +in use. The 80386 architecture takes advantage of this by providing +mechanisms to support direct access to the instructions and data of the +current module's environment, with access to additional segments on demand. + +At any given instant, six segments of memory may be immediately accessible +to an executing 80386 program. The segment registers CS, DS, SS, ES, FS, and +GS are used to identify these six current segments. Each of these registers +specifies a particular kind of segment, as characterized by the associated +mnemonics ("code," "data," or "stack") shown in Figure 2-6. Each register +uniquely determines one particular segment, from among the segments that +make up the program, that is to be immediately accessible at highest speed. + +The segment containing the currently executing sequence of instructions is +known as the current code segment; it is specified by means of the CS +register. The 80386 fetches all instructions from this code segment, using +as an offset the contents of the instruction pointer. CS is changed +implicitly as the result of intersegment control-transfer instructions (for +example, CALL and JMP), interrupts, and exceptions. + +Subroutine calls, parameters, and procedure activation records usually +require that a region of memory be allocated for a stack. All stack +operations use the SS register to locate the stack. Unlike CS, the SS +register can be loaded explicitly, thereby permitting programmers to define +stacks dynamically. + +The DS, ES, FS, and GS registers allow the specification of four data +segments, each addressable by the currently executing program. Accessibility +to four separate data areas helps programs efficiently access different +types of data structures; for example, one data segment register can point +to the data structures of the current module, another to the exported data +of a higher-level module, another to a dynamically created data structure, +and another to data shared with another task. An operand within a data +segment is addressed by specifying its offset either directly in an +instruction or indirectly via general registers. + +Depending on the structure of data (e.g., the way data is parceled into one +or more segments), a program may require access to more than four data +segments. To access additional segments, the DS, ES, FS, and GS registers +can be changed under program control during the course of a program's +execution. This simply requires that the program execute an instruction to +load the appropriate segment register prior to executing instructions that +access the data. + +The processor associates a base address with each segment selected by a +segment register. To address an element within a segment, a 32-bit offset is +added to the segment's base address. Once a segment is selected (by loading +the segment selector into a segment register), a data manipulation +instruction only needs to specify the offset. Simple rules define which +segment register is used to form an address when only an offset is +specified. + + +Figure 2-5. 80386 Applications Register Set + + GENERAL REGISTERS + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴袴賈袴袴袴袴袴袴袴袴敲 + � EAX AH AX AL � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴� + � EDX DH DX DL � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴� + � ECX CH CX CL � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴� + � EBX BH BX BL � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴� + � EBP BP � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + � ESI SI � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + � EDI DI � + 勁袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + � ESP SP � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + + 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + � CS (CODE SEGMENT) � + 픔컴컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴컴� + � SS (STACK SEGMENT) � + SEGMENT 픔컴컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴컴� + REGISTERS � DS (DATA SEGMENT) � + 픔컴컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴컴� + � ES (DATA SEGMENT) � + 픔컴컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴컴� + � FS (DATA SEGMENT) � + 픔컴컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴컴� + � GS (DATA SEGMENT) � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + + STATUS AND INSTRUCTION REGISTERS + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + � EFLAGS � + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + � EIP (INSTRUCTION POINTER) � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + +Figure 2-6. Use of Memory Segmentation + + �袴袴袴袴袴袴袴袴� �袴袴袴袴袴袴袴袴� + � MODULE � � MODULE � + � A �컴� 旼�� A � + � CODE � � � � DATA � + 훤袴袴袴袴袴袴袴暠 � �袴袴袴袴袴袴袴袴袴� � 훤袴袴袴袴袴袴袴暠 + 읕캘 CS (CODE) � � + 勁袴袴袴袴袴袴袴袴攷 � + �袴袴袴袴袴袴袴袴� 旼캘 SS (STACK) � � �袴袴袴袴袴袴袴袴� + � � � 勁袴袴袴袴袴袴袴袴攷 � � DATA � + � STACK �컴� � DS (DATA) 픔켸旼� STRUCTURE � + � � 勁袴袴袴袴袴袴袴袴攷 � � 1 � + 훤袴袴袴袴袴袴袴暠 � ES (DATA) 픔컴� 훤袴袴袴袴袴袴袴暠 + 勁袴袴袴袴袴袴袴袴攷 + 旼캘 FS (DATA) � + �袴袴袴袴袴袴袴袴� � 勁袴袴袴袴袴袴袴袴攷 �袴袴袴袴袴袴袴袴� + � DATA � � � GS (DATA) 픔커 � DATA � + � STRUCTURE �컴� 훤袴袴袴袴袴袴袴袴暠 읕�� STRUCTURE � + � 2 � � 3 � + 훤袴袴袴袴袴袴袴暠 훤袴袴袴袴袴袴袴暠 + + +2.3.3 Stack Implementation + +Stack operations are facilitated by three registers: + + 1. The stack segment (SS) register. Stacks are implemented in memory. A + system may have a number of stacks that is limited only by the maximum + number of segments. A stack may be up to 4 gigabytes long, the maximum + length of a segment. One stack is directly addressable at a time컴the + one located by SS. This is the current stack, often referred to simply + as "the" stack. SS is used automatically by the processor for all + stack operations. + + 2. The stack pointer (ESP) register. ESP points to the top of the + push-down stack (TOS). It is referenced implicitly by PUSH and POP + operations, subroutine calls and returns, and interrupt operations. + When an item is pushed onto the stack (see Figure 2-7), the processor + decrements ESP, then writes the item at the new TOS. When an item is + popped off the stack, the processor copies it from TOS, then + increments ESP. In other words, the stack grows down in memory toward + lesser addresses. + + 3. The stack-frame base pointer (EBP) register. The EBP is the best + choice of register for accessing data structures, variables and + dynamically allocated work space within the stack. EBP is often used + to access elements on the stack relative to a fixed point on the stack + rather than relative to the current TOS. It typically identifies the + base address of the current stack frame established for the current + procedure. When EBP is used as the base register in an offset + calculation, the offset is calculated automatically in the current + stack segment (i.e., the segment currently selected by SS). Because + SS does not have to be explicitly specified, instruction encoding in + such cases is more efficient. EBP can also be used to index into + segments addressable via other segment registers. + + +Figure 2-7. 80386 Stack + + 31 0 + �袴袴袴妄袴袴曲袴袴袴妄袴袴敲 컴컴컴횭OTTOM OF STACK + � � (INITIAL ESP VALUE) + 핏袴袴曲袴袴袴妄袴袴曲袴袴袴� + � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴�  + � � 쿛OP + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴� � + � � � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴� � TOP OF �袴袴袴袴袴袴敲 + � � 컴컴컴탠컴컴컴컴컴컴컴컴� ESP � + 勁袴袴曲袴袴袴妄袴袴曲袴袴袴� � STACK 훤袴袴袴袴袴袴� + � � � + � � � + � � 쿛USH + � �  + + +2.3.4 Flags Register + +The flags register is a 32-bit register named EFLAGS. Figure 2-8 defines +the bits within this register. The flags control certain operations and +indicate the status of the 80386. + +The low-order 16 bits of EFLAGS is named FLAGS and can be treated as a +unit. This feature is useful when executing 8086 and 80286 code, because +this part of EFLAGS is identical to the FLAGS register of the 8086 and the +80286. + +The flags may be considered in three groups: the status flags, the control +flags, and the systems flags. Discussion of the systems flags is delayed +until Part II. + + +Figure 2-8. EFLAGS Register + + 16-BIT FLAGS REGISTER + A + 旼컴컴컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴� + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴錮錮錮錮錮曲錮錮錮錮錮錮錮錮錮錮錮錮敲 + � 쿣쿝� 쿙� IO쿚쿏쿔쿟쿞쿩� 쿌� 쿛� 쿎� + � 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 � � �0� � � � � � � � �0� �0� �1� � + � 쿘쿑� 쿟� PL쿑쿑쿑쿑쿑쿑� 쿑� 쿑� 쿑� + 훤袴袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴局局鳩局鳩妄局局局局局局鳩局鳩局鳩局� + � � � � � � � � � � � � � + VIRTUAL 8086 MODE컴훉컴컴컴컴컴� � � � � � � � � � � � � + RESUME FLAG컴훉컴컴컴컴컴컴� � � � � � � � � � � � + NESTED TASK FLAG컴훉컴컴컴컴컴컴컴컴� � � � � � � � � � � + I/O PRIVILEGE LEVEL컴훉컴컴컴컴컴컴컴컴컴켸 � � � � � � � � � + OVERFLOW컴훁컴컴컴컴컴컴컴컴컴컴컴� � � � � � � � � + DIRECTION FLAG컴횮컴컴컴컴컴컴컴컴컴컴컴컴� � � � � � � � + INTERRUPT ENABLE컴훉컴컴컴컴컴컴컴컴컴컴컴컴컴� � � � � � � + TRAP FLAG컴훁컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � � � � + SIGN FLAG컴훁컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � � � + ZERO FLAG컴훁컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � � + AUXILIARY CARRY컴훁컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � + PARITY FLAG컴훁컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � + CARRY FLAG컴훁컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + S = STATUS FLAG, C = CONTROL FLAG, X = SYSTEM FLAG + + NOTE: 0 OR 1 INDICATES INTEL RESERVED. DO NOT DEFINE + + +2.3.4.1 Status Flags + +The status flags of the EFLAGS register allow the results of one +instruction to influence later instructions. The arithmetic instructions use +OF, SF, ZF, AF, PF, and CF. The SCAS (Scan String), CMPS (Compare String), +and LOOP instructions use ZF to signal that their operations are complete. +There are instructions to set, clear, and complement CF before execution of +an arithmetic instruction. Refer to Appendix C for definition of each +status flag. + + +2.3.4.2 Control Flag + +The control flag DF of the EFLAGS register controls string instructions. + +DF (Direction Flag, bit 10) + + Setting DF causes string instructions to auto-decrement; that is, to + process strings from high addresses to low addresses. Clearing DF causes + string instructions to auto-increment, or to process strings from low + addresses to high addresses. + + +2.3.4.3 Instruction Pointer + +The instruction pointer register (EIP) contains the offset address, +relative to the start of the current code segment, of the next sequential +instruction to be executed. The instruction pointer is not directly visible +to the programmer; it is controlled implicitly by control-transfer +instructions, interrupts, and exceptions. + +As Figure 2-9 shows, the low-order 16 bits of EIP is named IP and can be +used by the processor as a unit. This feature is useful when executing +instructions designed for the 8086 and 80286 processors. + + +Figure 2-9. Instruction Pointer Register + + 16-BIT IP REGISTER + 旼컴컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴컴� + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + � EIP (INSTRUCTION POINTER) � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + +2.4 Instruction Format + +The information encoded in an 80386 instruction includes a specification of +the operation to be performed, the type of the operands to be manipulated, +and the location of these operands. If an operand is located in memory, the +instruction must also select, explicitly or implicitly, which of the +currently addressable segments contains the operand. + +80386 instructions are composed of various elements and have various +formats. The exact format of instructions is shown in Appendix B; the +elements of instructions are described below. Of these instruction elements, +only one, the opcode, is always present. The other elements may or may not +be present, depending on the particular operation involved and on the +location and type of the operands. The elements of an instruction, in order +of occurrence are as follows: + + � Prefixes 컴 one or more bytes preceding an instruction that modify the + operation of the instruction. The following types of prefixes can be + used by applications programs: + + 1. Segment override 컴 explicitly specifies which segment register an + instruction should use, thereby overriding the default + segment-register selection used by the 80386 for that instruction. + + 2. Address size 컴 switches between 32-bit and 16-bit address + generation. + + 3. Operand size 컴 switches between 32-bit and 16-bit operands. + + 4. Repeat 컴 used with a string instruction to cause the instruction + to act on each element of the string. + + � Opcode 컴 specifies the operation performed by the instruction. Some + operations have several different opcodes, each specifying a different + variant of the operation. + + � Register specifier 컴 an instruction may specify one or two register + operands. Register specifiers may occur either in the same byte as the + opcode or in the same byte as the addressing-mode specifier. + + � Addressing-mode specifier 컴 when present, specifies whether an operand + is a register or memory location; if in memory, specifies whether a + displacement, a base register, an index register, and scaling are to be + used. + + � SIB (scale, index, base) byte 컴 when the addressing-mode specifier + indicates that an index register will be used to compute the address of + an operand, an SIB byte is included in the instruction to encode the + base register, the index register, and a scaling factor. + + � Displacement 컴 when the addressing-mode specifier indicates that a + displacement will be used to compute the address of an operand, the + displacement is encoded in the instruction. A displacement is a signed + integer of 32, 16, or eight bits. The eight-bit form is used in the + common case when the displacement is sufficiently small. The processor + extends an eight-bit displacement to 16 or 32 bits, taking into + account the sign. + + � Immediate operand 컴 when present, directly provides the value of an + operand of the instruction. Immediate operands may be 8, 16, or 32 bits + wide. In cases where an eight-bit immediate operand is combined in some + way with a 16- or 32-bit operand, the processor automatically extends + the size of the eight-bit operand, taking into account the sign. + + +2.5 Operand Selection + +An instruction can act on zero or more operands, which are the data +manipulated by the instruction. An example of a zero-operand instruction is +NOP (no operation). An operand can be in any of these locations: + + � In the instruction itself (an immediate operand) + + � In a register (EAX, EBX, ECX, EDX, ESI, EDI, ESP, or EBP in the case + of 32-bit operands; AX, BX, CX, DX, SI, DI, SP, or BP in the case of + 16-bit operands; AH, AL, BH, BL, CH, CL, DH, or DL in the case of 8-bit + operands; the segment registers; or the EFLAGS register for flag + operations) + + � In memory + + � At an I/O port + +Immediate operands and operands in registers can be accessed more rapidly +than operands in memory since memory operands must be fetched from memory. +Register operands are available in the CPU. Immediate operands are also +available in the CPU, because they are prefetched as part of the +instruction. + +Of the instructions that have operands, some specify operands implicitly; +others specify operands explicitly; still others use a combination of +implicit and explicit specification; for example: + +Implicit operand: AAM + + By definition, AAM (ASCII adjust for multiplication) operates on the + contents of the AX register. + +Explicit operand: XCHG EAX, EBX + + The operands to be exchanged are encoded in the instruction after the + opcode. + +Implicit and explicit operands: PUSH COUNTER + + The memory variable COUNTER (the explicit operand) is copied to the top of + the stack (the implicit operand). + +Note that most instructions have implicit operands. All arithmetic +instructions, for example, update the EFLAGS register. + +An 80386 instruction can explicitly reference one or two operands. +Two-operand instructions, such as MOV, ADD, XOR, etc., generally overwrite +one of the two participating operands with the result. A distinction can +thus be made between the source operand (the one unaffected by the +operation) and the destination operand (the one overwritten by the result). + +For most instructions, one of the two explicitly specified operands컴either +the source or the destination컴can be either in a register or in memory. +The other operand must be in a register or be an immediate source operand. +Thus, the explicit two-operand instructions of the 80386 permit operations +of the following kinds: + + � Register-to-register + � Register-to-memory + � Memory-to-register + � Immediate-to-register + � Immediate-to-memory + +Certain string instructions and stack manipulation instructions, however, +transfer data from memory to memory. Both operands of some string +instructions are in memory and are implicitly specified. Push and pop stack +operations allow transfer between memory operands and the memory-based +stack. + + +2.5.1 Immediate Operands + +Certain instructions use data from the instruction itself as one (and +sometimes two) of the operands. Such an operand is called an immediate +operand. The operand may be 32-, 16-, or 8-bits long. For example: + +SHR PATTERN, 2 + +One byte of the instruction holds the value 2, the number of bits by which +to shift the variable PATTERN. + +TEST PATTERN, 0FFFF00FFH + +A doubleword of the instruction holds the mask that is used to test the +variable PATTERN. + + +2.5.2 Register Operands + +Operands may be located in one of the 32-bit general registers (EAX, EBX, +ECX, EDX, ESI, EDI, ESP, or EBP), in one of the 16-bit general registers +(AX, BX, CX, DX, SI, DI, SP, or BP), or in one of the 8-bit general +registers (AH, BH, CH, DH, AL, BL, CL,or DL). + +The 80386 has instructions for referencing the segment registers (CS, DS, +ES, SS, FS, GS). These instructions are used by applications programs only +if systems designers have chosen a segmented memory model. + +The 80386 also has instructions for referring to the flag register. The +flags may be stored on the stack and restored from the stack. Certain +instructions change the commonly modified flags directly in the EFLAGS +register. Other flags that are seldom modified can be modified indirectly +via the flags image in the stack. + + +2.5.3 Memory Operands + +Data-manipulation instructions that address operands in memory must specify +(either directly or indirectly) the segment that contains the operand and +the offset of the operand within the segment. However, for speed and compact +instruction encoding, segment selectors are stored in the high speed segment +registers. Therefore, data-manipulation instructions need to specify only +the desired segment register and an offset in order to address a memory +operand. + +An 80386 data-manipulation instruction that accesses memory uses one of the +following methods for specifying the offset of a memory operand within its +segment: + + 1. Most data-manipulation instructions that access memory contain a byte + that explicitly specifies the addressing method for the operand. A + byte, known as the modR/M byte, follows the opcode and specifies + whether the operand is in a register or in memory. If the operand is + in memory, the address is computed from a segment register and any of + the following values: a base register, an index register, a scaling + factor, a displacement. When an index register is used, the modR/M + byte is also followed by another byte that identifies the index + register and scaling factor. This addressing method is the + mostflexible. + + 2. A few data-manipulation instructions implicitly use specialized + addressing methods: + + � For a few short forms of MOV that implicitly use the EAX register, + the offset of the operand is coded as a doubleword in the + instruction. No base register, index register, or scaling factor + are used. + + � String operations implicitly address memory via DS:ESI, (MOVS, + CMPS, OUTS, LODS, SCAS) or via ES:EDI (MOVS, CMPS, INS, STOS). + + � Stack operations implicitly address operands via SS:ESP + registers; e.g., PUSH, POP, PUSHA, PUSHAD, POPA, POPAD, PUSHF, + PUSHFD, POPF, POPFD, CALL, RET, IRET, IRETD, exceptions, and + interrupts. + + +2.5.3.1 Segment Selection + +Data-manipulation instructions need not explicitly specify which segment +register is used. For all of these instructions, specification of a segment +register is optional. For all memory accesses, if a segment is not +explicitly specified by the instruction, the processor automatically chooses +a segment register according to the rules of Table 2-1. (If systems +designers have chosen a flat model of memory organization, the segment +registers and the rules that the processor uses in choosing them are not +apparent to applications programs.) + +There is a close connection between the kind of memory reference and the +segment in which that operand resides. As a rule, a memory reference implies +the current data segment (i.e., the implicit segment selector is in DS). +However, ESP and EBP are used to access items on the stack; therefore, when +the ESP or EBP register is used as a base register, the current stack +segment is implied (i.e., SS contains the selector). + +Special instruction prefix elements may be used to override the default +segment selection. Segment-override prefixes allow an explicit segment +selection. The 80386 has a segment-override prefix for each of the segment +registers. Only in the following special cases is there an implied segment +selection that a segment prefix cannot override: + + � The use of ES for destination strings in string instructions. + � The use of SS in stack instructions. + � The use of CS for instruction fetches. + + +Table 2-1. Default Segment Register Selection Rules + +Memory Reference Needed Segment Implicit Segment Selection Rule + Register + Used + +Instructions Code (CS) Automatic with instruction prefetch +Stack Stack (SS) All stack pushes and pops. Any + memory reference that uses ESP or + EBP as a base register. +Local Data Data (DS) All data references except when + relative to stack or string + destination. +Destination Strings Extra (ES) Destination of string instructions. + + +2.5.3.2 Effective-Address Computation + +The modR/M byte provides the most flexible of the addressing methods, and +instructions that require a modR/M byte as the second byte of the +instruction are the most common in the 80386 instruction set. For memory +operands defined by modR/M, the offset within the desired segment is +calculated by taking the sum of up to three components: + + � A displacement element in the instruction. + + � A base register. + + � An index register. The index register may be automatically multiplied + by a scaling factor of 2, 4, or 8. + +The offset that results from adding these components is called an effective +address. Each of these components of an effective address may have either a +positive or negative value. If the sum of all the components exceeds 2^(32), +the effective address is truncated to 32 bits.Figure 2-10 illustrates the +full set of possibilities for modR/M addressing. + +The displacement component, because it is encoded in the instruction, is +useful for fixed aspects of addressing; for example: + + � Location of simple scalar operands. + � Beginning of a statically allocated array. + � Offset of an item within a record. + +The base and index components have similar functions. Both utilize the same +set of general registers. Both can be used for aspects of addressing that +are determined dynamically; for example: + + � Location of procedure parameters and local variables in stack. + + � The beginning of one record among several occurrences of the same + record type or in an array of records. + + � The beginning of one dimension of multiple dimension array. + + � The beginning of a dynamically allocated array. + +The uses of general registers as base or index components differ in the +following respects: + + � ESP cannot be used as an index register. + + � When ESP or EBP is used as the base register, the default segment is + the one selected by SS. In all other cases the default segment is DS. + +The scaling factor permits efficient indexing into an array in the common +cases when array elements are 2, 4, or 8 bytes wide. The shifting of the +index register is done by the processor at the time the address is evaluated +with no performance loss. This eliminates the need for a separate shift or +multiply instruction. + +The base, index, and displacement components may be used in any +combination; any of these components may be null. A scale factor can be used +only when an index is also used. Each possible combination is useful for +data structures commonly used by programmers in high-level languages and +assembly languages. Following are possible uses for some of the various +combinations of address components. + +DISPLACEMENT + + The displacement alone indicates the offset of the operand. This + combination is used to directly address a statically allocated scalar + operand. An 8-bit, 16-bit, or 32-bit displacement can be used. + +BASE + + The offset of the operand is specified indirectly in one of the general + registers, as for "based" variables. + +BASE + DISPLACEMENT + + A register and a displacement can be used together for two distinct + purposes: + + 1. Index into static array when element size is not 2, 4, or 8 bytes. + The displacement component encodes the offset of the beginning of + the array. The register holds the results of a calculation to + determine the offset of a specific element within the array. + + 2. Access item of a record. The displacement component locates an + item within record. The base register selects one of several + occurrences of record, thereby providing a compact encoding for + this common function. + + An important special case of this combination, is to access parameters + in the procedure activation record in the stack. In this case, EBP is + the best choice for the base register, because when EBP is used as a + base register, the processor automatically uses the stack segment + register (SS) to locate the operand, thereby providing a compact + encoding for this common function. + +(INDEX * SCALE) + DISPLACEMENT + + This combination provides efficient indexing into a static array when + the element size is 2, 4, or 8 bytes. The displacement addresses the + beginning of the array, the index register holds the subscript of the + desired array element, and the processor automatically converts the + subscript into an index by applying the scaling factor. + +BASE + INDEX + DISPLACEMENT + + Two registers used together support either a two-dimensional array (the + displacement determining the beginning of the array) or one of several + instances of an array of records (the displacement indicating an item + in the record). + +BASE + (INDEX * SCALE) + DISPLACEMENT + + This combination provides efficient indexing of a two-dimensional array + when the elements of the array are 2, 4, or 8 bytes wide. + + +Figure 2-10. Effective Address Computation + + SEGMENT + BASE + (INDEX * SCALE) + DISPLACEMENT + + � � + � --- � � � � � + � � � EAX � � EAX � � 1 � + � CS � � ECX � � ECX � � � � � + � SS � � EDX � � EDX � � 2 � � NO DISPLACEMENT � + 캑 DS 쳐 + 캑 EBX 쳐 + 캑 EBX 쳐 * 캑 쳐 + 캑 8-BIT DISPLACEMENT 쳐 + � ES � � ESP � � --- � � 4 � � 32-BIT DISPLACEMENT � + � FS � � EBP � � EBP � � � � � + � GS � � ESI � � ESI � � 6 � + � � � EDI � � EDI � � � + � � � � + + +2.6 Interrupts and Exceptions + +The 80386 has two mechanisms for interrupting program execution: + + 1. Exceptions are synchronous events that are the responses of the CPU + to certain conditions detected during the execution of an instruction. + + 2. Interrupts are asynchronous events typically triggered by external + devices needing attention. + +Interrupts and exceptions are alike in that both cause the processor to +temporarily suspend its present program execution in order to execute a +program of higher priority. The major distinction between these two kinds of +interrupts is their origin. An exception is always reproducible by +re-executing with the program and data that caused the exception, whereas an +interrupt is generally independent of the currently executing program. + +Application programmers are not normally concerned with servicing +interrupts. More information on interrupts for systems programmers may be +found in Chapter 9. Certain exceptions, however, are of interest to +applications programmers, and many operating systems give applications +programs the opportunity to service these exceptions. However, the operating +system itself defines the interface between the applications programs and +the exception mechanism of the 80386. + +Table 2-2 highlights the exceptions that may be of interest to applications +programmers. + + � A divide error exception results when the instruction DIV or IDIV is + executed with a zero denominator or when the quotient is too large for + the destination operand. (Refer to Chapter 3 for a discussion of DIV + and IDIV.) + + � The debug exception may be reflected back to an applications program + if it results from the trap flag (TF). + + � A breakpoint exception results when the instruction INT 3 is executed. + This instruction is used by some debuggers to stop program execution at + specific points. + + � An overflow exception results when the INTO instruction is executed + and the OF (overflow) flag is set (after an arithmetic operation that + set the OF flag). (Refer to Chapter 3 for a discussion of INTO). + + � A bounds check exception results when the BOUND instruction is + executed and the array index it checks falls outside the bounds of the + array. (Refer to Chapter 3 for a discussion of the BOUND instruction.) + + � Invalid opcodes may be used by some applications to extend the + instruction set. In such a case, the invalid opcode exception presents + an opportunity to emulate the opcode. + + � The "coprocessor not available" exception occurs if the program + contains instructions for a coprocessor, but no coprocessor is present + in the system. + + � A coprocessor error is generated when a coprocessor detects an illegal + operation. + +The instruction INT generates an interrupt whenever it is executed; the +processor treats this interrupt as an exception. The effects of this +interrupt (and the effects of all other exceptions) are determined by +exception handler routines provided by the application program or as part of +the systems software (provided by systems programmers). The INT instruction +itself is discussed in Chapter 3. Refer to Chapter 9 for a more complete +description of exceptions. + + +Table 2-2. 80386 Reserved Exceptions and Interrupts + +Vector Number Description + +0 Divide Error +1 Debug Exceptions +2 NMI Interrupt +3 Breakpoint +4 INTO Detected Overflow +5 BOUND Range Exceeded +6 Invalid Opcode +7 Coprocessor Not Available +8 Double Exception +9 Coprocessor Segment Overrun +10 Invalid Task State Segment +11 Segment Not Present +12 Stack Fault +13 General Protection +14 Page Fault +15 (reserved) +16 Coprocessor Error +17-32 (reserved) + + +Chapter 3 Applications Instruction Set + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +This chapter presents an overview of the instructions which programmers can +use to write application software for the 80386 executing in protected +virtual-address mode. The instructions are grouped by categories of related +functions. + +The instructions not discussed in this chapter are those that are normally +used only by operating-system programmers. Part II describes the operation +of these instructions. + +The descriptions in this chapter assume that the 80386 is operating in +protected mode with 32-bit addressing in effect; however, all instructions +discussed are also available when 16-bit addressing is in effect in +protected mode, real mode, or virtual 8086 mode. For any differences of +operation that exist in the various modes, refer to Chapter 13, +Chapter 14, or Chapter 15. + +The instruction dictionary in Chapter 17 contains more detailed +descriptions of all instructions, including encoding, operation, timing, +effect on flags, and exceptions. + + +3.1 Data Movement Instructions + +These instructions provide convenient methods for moving bytes, words, or +doublewords of data between memory and the registers of the base +architecture. They fall into the following classes: + + 1. General-purpose data movement instructions. + 2. Stack manipulation instructions. + 3. Type-conversion instructions. + + +3.1.1 General-Purpose Data Movement Instructions + +MOV (Move) transfers a byte, word, or doubleword from the source operand to +the destination operand. The MOV instruction is useful for transferring data +along any of these paths +There are also variants of MOV that operate on segment registers. These +are covered in a later section of this chapter.: + + � To a register from memory + � To memory from a register + � Between general registers + � Immediate data to a register + � Immediate data to a memory + +The MOV instruction cannot move from memory to memory or from segment +register to segment register are not allowed. Memory-to-memory moves can be +performed, however, by the string move instruction MOVS. + +XCHG (Exchange) swaps the contents of two operands. This instruction takes +the place of three MOV instructions. It does not require a temporary +location to save the contents of one operand while load the other is being +loaded. XCHG is especially useful for implementing semaphores or similar +data structures for process synchronization. + +The XCHG instruction can swap two byte operands, two word operands, or two +doubleword operands. The operands for the XCHG instruction may be two +register operands, or a register operand with a memory operand. When used +with a memory operand, XCHG automatically activates the LOCK signal. (Refer +to Chapter 11 for more information on the bus lock.) + + +3.1.2 Stack Manipulation Instructions + +PUSH (Push) decrements the stack pointer (ESP), then transfers the source +operand to the top of stack indicated by ESP (see Figure 3-1). PUSH is +often used to place parameters on the stack before calling a procedure; it +is also the basic means of storing temporary variables on the stack. The +PUSH instruction operates on memory operands, immediate operands, and +register operands (including segment registers). + +PUSHA (Push All Registers) saves the contents of the eight general +registers on the stack (see Figure 3-2). This instruction simplifies +procedure calls by reducing the number of instructions required to retain +the contents of the general registers for use in a procedure. The processor +pushes the general registers on the stack in the following order: EAX, ECX, +EDX, EBX, the initial value of ESP before EAX was pushed, EBP, ESI, and +EDI. PUSHA is complemented by the POPA instruction. + +POP (Pop) transfers the word or doubleword at the current top of stack +(indicated by ESP) to the destination operand, and then increments ESP to +point to the new top of stack. See Figure 3-3. POP moves information from +the stack to a general register, or to memory +There are also a variant of POP that operates on segment registers. This +is covered in a later section of this chapter.. + +POPA (Pop All Registers) restores the registers saved on the stack by +PUSHA, except that it ignores the saved value of ESP. See Figure 3-4. + + +Figure 3-1. PUSH + + D O BEFORE PUSH AFTER PUSH + I F  31 0   31 0  + R � � � � + E E 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + C X 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + T P 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + I A 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + O N 勁袴袴袴妄袴袴袴�컴ESP 勁袴袴袴妄袴袴袴� + N S � � � OPERAND � + I 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴�컴ESP + � O � � � � + � N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � � +  勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � +     + + +Figure 3-2. PUSHA + + BEFORE PUSHA AFTER PUSHA +  31 0   31 0  + D O � � � � + I F 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + R 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + E E 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + C X 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + T P 勁袴袴袴妄袴袴袴�컴ESP 勁袴袴袴妄袴袴袴� + I A � � � EAX � + O N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + N S � � � ECX � + I 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � O � � � EDX � + � N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � EBX � +  勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � OLD ESP � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � EBP � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � ESI � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � EDI � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴�컴ESP + � � � � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � +     + + +3.1.3 Type Conversion Instructions + +The type conversion instructions convert bytes into words, words into +doublewords, and doublewords into 64-bit items (quad-words). These +instructions are especially useful for converting signed integers, because +they automatically fill the extra bits of the larger item with the value of +the sign bit of the smaller item. This kind of conversion, illustrated by +Figure 3-5, is called sign extension. + +There are two classes of type conversion instructions: + + 1. The forms CWD, CDQ, CBW, and CWDE which operate only on data in the + EAX register. + + 2. The forms MOVSX and MOVZX, which permit one operand to be in any + general register while permitting the other operand to be in memory or + in a register. + +CWD (Convert Word to Doubleword) and CDQ (Convert Doubleword to Quad-Word) +double the size of the source operand. CWD extends the sign of the +word in register AX throughout register DX. CDQ extends the sign of the +doubleword in EAX throughout EDX. CWD can be used to produce a doubleword +dividend from a word before a word division, and CDQ can be used to produce +a quad-word dividend from a doubleword before doubleword division. + +CBW (Convert Byte to Word) extends the sign of the byte in register AL +throughout AX. + +CWDE (Convert Word to Doubleword Extended) extends the sign of the word in +register AX throughout EAX. + +MOVSX (Move with Sign Extension) sign-extends an 8-bit value to a 16-bit +value and a 8- or 16-bit value to 32-bit value. + +MOVZX (Move with Zero Extension) extends an 8-bit value to a 16-bit value +and an 8- or 16-bit value to 32-bit value by inserting high-order zeros. + + +Figure 3-3. POP + + D O BEFORE POP AFTER POP + I F  31 0   31 0  + R � � � � + E E 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + C X 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + T P 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + I A 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + O N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴�컴ESP + N S � OPERAND � � � + I 勁袴袴袴妄袴袴袴�컴ESP 勁袴袴袴妄袴袴袴� + � O � � � � + � N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � � +  勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � +     + + +Figure 3-4. POPA + + BEFORE POPA AFTER POPA +  31 0   31 0  + D O � � � � + I F 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + R 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + E E 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + C X 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + T P 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴�컴ESP + I A � EAX � � � + O N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + N S � ECX � � � + I 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � O � EDX � � � + � N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � EBX � � � +  勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � ESP � � � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � EPB � � � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � ESI � � � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � EDI � � � + 勁袴袴袴妄袴袴袴�컴ESP 勁袴袴袴妄袴袴袴� + � � � � + 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � +     + + +Figure 3-5. Sign Extension + + 15 7 0 + �藁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴敲 + BEFORE SIGN EXTENSION컴컴컴컴�튥� N N N N N N N N N N N N N N N � + 훤姦袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴� + AFTER SIGN EXTENSION컴컴컴� + � + 31 23  15 7 0 + �藁袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴敲 + 튥튥 S S S S S S S S S S S S S S S N N N N N N N N N N N N N N N� + 훤姦袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + + +3.2 Binary Arithmetic Instructions + +The arithmetic instructions of the 80386 processor simplify the +manipulation of numeric data that is encoded in binary. Operations include +the standard add, subtract, multiply, and divide as well as increment, +decrement, compare, and change sign. Both signed and unsigned binary +integers are supported. The binary arithmetic instructions may also be used +as one step in the process of performing arithmetic on decimal integers. + +Many of the arithmetic instructions operate on both signed and unsigned +integers. These instructions update the flags ZF, CF, SF, and OF in such a +manner that subsequent instructions can interpret the results of the +arithmetic as either signed or unsigned. CF contains information relevant to +unsigned integers; SF and OF contain information relevant to signed +integers. ZF is relevant to both signed and unsigned integers; ZF is set +when all bits of the result are zero. + +If the integer is unsigned, CF may be tested after one of these arithmetic +operations to determine whether the operation required a carry or borrow of +a one-bit in the high-order position of the destination operand. CF is set +if a one-bit was carried out of the high-order position (addition +instructions ADD, ADC, AAA, and DAA) or if a one-bit was carried (i.e. +borrowed) into the high-order bit (subtraction instructions SUB, SBB, AAS, +DAS, CMP, and NEG). + +If the integer is signed, both SF and OF should be tested. SF always has +the same value as the sign bit of the result. The most significant bit (MSB) +of a signed integer is the bit next to the sign컴bit 6 of a byte, bit 14 of +a word, or bit 30 of a doubleword. OF is set in either of these cases: + + � A one-bit was carried out of the MSB into the sign bit but no one bit + was carried out of the sign bit (addition instructions ADD, ADC, INC, + AAA, and DAA). In other words, the result was greater than the greatest + positive number that could be contained in the destination operand. + + � A one-bit was carried from the sign bit into the MSB but no one bit + was carried into the sign bit (subtraction instructions SUB, SBB, DEC, + AAS, DAS, CMP, and NEG). In other words, the result was smaller that + the smallest negative number that could be contained in the destination + operand. + +These status flags are tested by executing one of the two families of +conditional instructions: Jcc (jump on condition cc) or SETcc (byte set on +condition). + + +3.2.1 Addition and Subtraction Instructions + +ADD (Add Integers) replaces the destination operand with the sum of the +source and destination operands. Sets CF if overflow. + +ADC (Add Integers with Carry) sums the operands, adds one if CF is set, and +replaces the destination operand with the result. If CF is cleared, ADC +performs the same operation as the ADD instruction. An ADD followed by +multiple ADC instructions can be used to add numbers longer than 32 bits. + +INC (Increment) adds one to the destination operand. INC does not affect +CF. Use ADD with an immediate value of 1 if an increment that updates carry +(CF) is needed. + +SUB (Subtract Integers) subtracts the source operand from the destination +operand and replaces the destination operand with the result. If a borrow is +required, the CF is set. The operands may be signed or unsigned bytes, +words, or doublewords. + +SBB (Subtract Integers with Borrow) subtracts the source operand from the +destination operand, subtracts 1 if CF is set, and returns the result to the +destination operand. If CF is cleared, SBB performs the same operation as +SUB. SUB followed by multiple SBB instructions may be used to subtract +numbers longer than 32 bits. If CF is cleared, SBB performs the same +operation as SUB. + +DEC (Decrement) subtracts 1 from the destination operand. DEC does not +update CF. Use SUB with an immediate value of 1 to perform a decrement that +affects carry. + + +3.2.2 Comparison and Sign Change Instruction + +CMP (Compare) subtracts the source operand from the destination operand. It +updates OF, SF, ZF, AF, PF, and CF but does not alter the source and +destination operands. A subsequent Jcc or SETcc instruction can test the +appropriate flags. + +NEG (Negate) subtracts a signed integer operand from zero. The effect of +NEG is to reverse the sign of the operand from positive to negative or from +negative to positive. + + +3.2.3 Multiplication Instructions + +The 80386 has separate multiply instructions for unsigned and signed +operands. MUL operates on unsigned numbers, while IMUL operates on signed +integers as well as unsigned. + +MUL (Unsigned Integer Multiply) performs an unsigned multiplication of the +source operand and the accumulator. If the source is a byte, the processor +multiplies it by the contents of AL and returns the double-length result to +AH and AL. If the source operand is a word, the processor multiplies it by +the contents of AX and returns the double-length result to DX and AX. If the +source operand is a doubleword, the processor multiplies it by the contents +of EAX and returns the 64-bit result in EDX and EAX. MUL sets CF and OF +when the upper half of the result is nonzero; otherwise, they are cleared. + +IMUL (Signed Integer Multiply) performs a signed multiplication operation. +IMUL has three variations: + + 1. A one-operand form. The operand may be a byte, word, or doubleword + located in memory or in a general register. This instruction uses EAX + and EDX as implicit operands in the same way as the MUL instruction. + + 2. A two-operand form. One of the source operands may be in any general + register while the other may be either in memory or in a general + register. The product replaces the general-register operand. + + 3. A three-operand form; two are source and one is the destination + operand. One of the source operands is an immediate value stored in + the instruction; the second may be in memory or in any general + register. The product may be stored in any general register. The + immediate operand is treated as signed. If the immediate operand is a + byte, the processor automatically sign-extends it to the size of the + second operand before performing the multiplication. + +The three forms are similar in most respects: + + � The length of the product is calculated to twice the length of the + operands. + + � The CF and OF flags are set when significant bits are carried into the + high-order half of the result. CF and OF are cleared when the + high-order half of the result is the sign-extension of the low-order + half. + +However, forms 2 and 3 differ in that the product is truncated to the +length of the operands before it is stored in the destination register. +Because of this truncation, OF should be tested to ensure that no +significant bits are lost. (For ways to test OF, refer to the INTO and PUSHF +instructions.) + +Forms 2 and 3 of IMUL may also be used with unsigned operands because, +whether the operands are signed or unsigned, the low-order half of the +product is the same. + + +3.2.4 Division Instructions + +The 80386 has separate division instructions for unsigned and signed +operands. DIV operates on unsigned numbers, while IDIV operates on signed +integers as well as unsigned. In either case, an exception (interrupt zero) +occurs if the divisor is zero or if the quotient is too large for AL, AX, or +EAX. + +DIV (Unsigned Integer Divide) performs an unsigned division of the +accumulator by the source operand. The dividend (the accumulator) is twice +the size of the divisor (the source operand); the quotient and remainder +have the same size as the divisor, as the following table shows. + +Size of Source Operand + (divisor) Dividend Quotient Remainder + +Byte AX AL AH +Word DX:AX AX DX +Doubleword EDX:EAX EAX EDX + +Non-integral quotients are truncated to integers toward 0. The remainder is +always less than the divisor. For unsigned byte division, the largest +quotient is 255. For unsigned word division, the largest quotient is 65,535. +For unsigned doubleword division the largest quotient is 2^(32) -1. + +IDIV (Signed Integer Divide) performs a signed division of the accumulator +by the source operand. IDIV uses the same registers as the DIV instruction. + +For signed byte division, the maximum positive quotient is +127, and the +minimum negative quotient is -128. For signed word division, the maximum +positive quotient is +32,767, and the minimum negative quotient is -32,768. +For signed doubleword division the maximum positive quotient is 2^(31) -1, +the minimum negative quotient is -2^(31). Non-integral results are truncated +towards 0. The remainder always has the same sign as the dividend and is +less than the divisor in magnitude. + + +3.3 Decimal Arithmetic Instructions + +Decimal arithmetic is performed by combining the binary arithmetic +instructions (already discussed in the prior section) with the decimal +arithmetic instructions. The decimal arithmetic instructions are used in one +of the following ways: + + � To adjust the results of a previous binary arithmetic operation to + produce a valid packed or unpacked decimal result. + + � To adjust the inputs to a subsequent binary arithmetic operation so + that the operation will produce a valid packed or unpacked decimal + result. + +These instructions operate only on the AL or AH registers. Most utilize the +AF flag. + + +3.3.1 Packed BCD Adjustment Instructions + +DAA (Decimal Adjust after Addition) adjusts the result of adding two valid +packed decimal operands in AL. DAA must always follow the addition of two +pairs of packed decimal numbers (one digit in each half-byte) to obtain a +pair of valid packed decimal digits as results. The carry flag is set if +carry was needed. + +DAS (Decimal Adjust after Subtraction) adjusts the result of subtracting +two valid packed decimal operands in AL. DAS must always follow the +subtraction of one pair of packed decimal numbers (one digit in each half- +byte) from another to obtain a pair of valid packed decimal digits as +results. The carry flag is set if a borrow was needed. + + +3.3.2 Unpacked BCD Adjustment Instructions + +AAA (ASCII Adjust after Addition) changes the contents of register AL to a +valid unpacked decimal number, and zeros the top 4 bits. AAA must always +follow the addition of two unpacked decimal operands in AL. The carry flag +is set and AH is incremented if a carry is necessary. + +AAS (ASCII Adjust after Subtraction) changes the contents of register AL to +a valid unpacked decimal number, and zeros the top 4 bits. AAS must always +follow the subtraction of one unpacked decimal operand from another in AL. +The carry flag is set and AH decremented if a borrow is necessary. + +AAM (ASCII Adjust after Multiplication) corrects the result of a +multiplication of two valid unpacked decimal numbers. AAM must always follow +the multiplication of two decimal numbers to produce a valid decimal result. +The high order digit is left in AH, the low order digit in AL. + +AAD (ASCII Adjust before Division) modifies the numerator in AH and AL to +prepare for the division of two valid unpacked decimal operands so that the +quotient produced by the division will be a valid unpacked decimal number. +AH should contain the high-order digit and AL the low-order digit. This +instruction adjusts the value and places the result in AL. AH will contain +zero. + + +3.4 Logical Instructions + +The group of logical instructions includes: + + � The Boolean operation instructions + � Bit test and modify instructions + � Bit scan instructions + � Rotate and shift instructions + � Byte set on condition + + +3.4.1 Boolean Operation Instructions + +The logical operations are AND, OR, XOR, and NOT. + +NOT (Not) inverts the bits in the specified operand to form a one's +complement of the operand. The NOT instruction is a unary operation that +uses a single operand in a register or memory. NOT has no effect on the +flags. + +The AND, OR, and XOR instructions perform the standard logical operations +"and", "(inclusive) or", and "exclusive or". These instructions can use the +following combinations of operands: + + � Two register operands + + � A general register operand with a memory operand + + � An immediate operand with either a general register operand or a + memory operand. + +AND, OR, and XOR clear OF and CF, leave AF undefined, and update SF, ZF, +and PF. + + +3.4.2 Bit Test and Modify Instructions + +This group of instructions operates on a single bit which can be in memory +or in a general register. The location of the bit is specified as an offset +from the low-order end of the operand. The value of the offset either may be +given by an immediate byte in the instruction or may be contained in a +general register. + +These instructions first assign the value of the selected bit to CF, the +carry flag. Then a new value is assigned to the selected bit, as determined +by the operation. OF, SF, ZF, AF, PF are left in an undefined state. Table +3-1 defines these instructions. + + +Table 3-1. Bit Test and Modify Instructions + +Instruction Effect on CF Effect on + Selected Bit + +Bit (Bit Test) CF  BIT (none) +BTS (Bit Test and Set) CF  BIT BIT  1 +BTR (Bit Test and Reset) CF  BIT BIT  0 +BTC (Bit Test and Complement) CF  BIT BIT  NOT(BIT) + + +3.4.3 Bit Scan Instructions + +These instructions scan a word or doubleword for a one-bit and store the +index of the first set bit into a register. The bit string being scanned +may be either in a register or in memory. The ZF flag is set if the entire +word is zero (no set bits are found); ZF is cleared if a one-bit is found. +If no set bit is found, the value of the destination register is undefined. + +BSF (Bit Scan Forward) scans from low-order to high-order (starting from +bit index zero). + +BSR (Bit Scan Reverse) scans from high-order to low-order (starting from +bit index 15 of a word or index 31 of a doubleword). + + +3.4.4 Shift and Rotate Instructions + +The shift and rotate instructions reposition the bits within the specified +operand. + +These instructions fall into the following classes: + + � Shift instructions + � Double shift instructions + � Rotate instructions + + +3.4.4.1 Shift Instructions + +The bits in bytes, words, and doublewords may be shifted arithmetically or +logically. Depending on the value of a specified count, bits can be shifted +up to 31 places. + +A shift instruction can specify the count in one of three ways. One form of +shift instruction implicitly specifies the count as a single shift. The +second form specifies the count as an immediate value. The third form +specifies the count as the value contained in CL. This last form allows the +shift count to be a variable that the program supplies during execution. +Only the low order 5 bits of CL are used. + +CF always contains the value of the last bit shifted out of the destination +operand. In a single-bit shift, OF is set if the value of the high-order +(sign) bit was changed by the operation. Otherwise, OF is cleared. Following +a multibit shift, however, the content of OF is always undefined. + +The shift instructions provide a convenient way to accomplish division or +multiplication by binary power. Note however that division of signed numbers +by shifting right is not the same kind of division performed by the IDIV +instruction. + +SAL (Shift Arithmetic Left) shifts the destination byte, word, or +doubleword operand left by one or by the number of bits specified in the +count operand (an immediate value or the value contained in CL). The +processor shifts zeros in from the right (low-order) side of the operand as +bits exit from the left (high-order) side. See Figure 3-6. + +SHL (Shift Logical Left) is a synonym for SAL (refer to SAL). + +SHR (Shift Logical Right) shifts the destination byte, word, or doubleword +operand right by one or by the number of bits specified in the count operand +(an immediate value or the value contained in CL). The processor shifts +zeros in from the left side of the operand as bits exit from the right side. +See Figure 3-7. + +SAR (Shift Arithmetic Right) shifts the destination byte, word, or +doubleword operand to the right by one or by the number of bits specified in +the count operand (an immediate value or the value contained in CL). The +processor preserves the sign of the operand by shifting in zeros on the left +(high-order) side if the value is positive or by shifting by ones if the +value is negative. See Figure 3-8. + +Even though this instruction can be used to divide integers by a power of +two, the type of division is not the same as that produced by the IDIV +instruction. The quotient of IDIV is rounded toward zero, whereas the +"quotient" of SAR is rounded toward negative infinity. This difference is +apparent only for negative numbers. For example, when IDIV is used to divide +-9 by 4, the result is -2 with a remainder of -1. If SAR is used to shift +-9 right by two bits, the result is -3. The "remainder" of this kind of +division is +3; however, the SAR instruction stores only the high-order bit +of the remainder (in CF). + +The code sequence in Figure 3-9 produces the same result as IDIV for any M += 2^(N), where 0 < N < 32. This sequence takes about 12 to 18 clocks, +depending on whether the jump is taken; if ECX contains M, the corresponding +IDIV ECX instruction will take about 43 clocks. + + +Figure 3-6. SAL and SHL + + OF CF OPERAND + + BEFORE SHL X X 10001000100010001000100010001111 + OR SAL + + AFTER SHL 1 1 컴 00010001000100010001000100011110 컴 0 + OR SAL BY 1 + + AFTER SHL X 0 컴 00100010001000100011110000000000 컴 0 + OR SAL BY 10 + +SHL (WHICH HAS THE SYNONYM SAL) SHIFTS THE BITS IN THE REGISTER OR MEMORY +OPERAND TO THE LEFT BY THE SPECIFIED NUMBER OF BIT POSITIONS. CF RECEIVES +THE LAST BIT SHIFTED OUT OF THE LEFT OF THE OPERAND. SHL SHIFTS IN ZEROS +TO FILL THE VACATED BIT LOCATIONS. THESE INSTRUCTIONS OPERATE ON BYTE, +WORD, AND DOUBLEWORD OPERANDS. + + +Figure 3-7. SHR + + OPERAND CF + + BEFORE SHR 10001000100010001000100010001111 X + + AFTER SHR 0컴컴01000100010001000100010001000111컴컴1 + BY 1 + + AFTER SHR 0컴컴00000000001000100010001000100010컴컴O + BY 10 + +SHR SHIFTS THE BITS OF THE REGISTER OR MEMORY OPERAND TO THE RIGHT BY THE +SPECIFIED NUMBER OF BIT POSITIONS. CF RECEIVES THE LAST BIT SHIFTED OUT OF +THE RIGHT OF THE OPERAND. SHR SHIFTS IN ZEROS TO FILL THE VACATED BIT +LOCATIONS. + + +Figure 3-8. SAR + + POSITIVE OPERAND CF + + BEFORE SAR 01000100010001000100010001000111 X + + AFTER SAR 0컴컴00100010001000100010001000100011컴컴1 + BY 1 + + NEGATIVE OPERAND CF + + BEFORE SAR 11000100010001000100010001000111 X + + AFTER SAR 0컴컴11100010001000100010001000100011컴컴1 + BY 1 + +SAR PRESERVES THE SIGN OF THE REGISTER OR MEMORY OPERAND AS IT SHIFTS THE +OPERAND TO THE RIGHT BY THE SPECIFIED NUMBER OF BIT POSITIONS. CF RECIEVES +THE LAST BIT SHIFTED OUT OF THE RIGHT OF THE OPERAND. + + +Figure 3-9. Using SAR to Simulate IDIV + + ; assuming N is in ECX, and the dividend is in EAX + ; CLOCKS + CMP EAX, 0 ; to set sign flag 2 + JGE NoAdjust ; jump if sign is zero 3 or 9 + ADD EAX, ECX ; 2 + DEC EAX ; EAX := EAX + (N-1) 2 +NoAdjust: + SAR EAX, CL ; 3 + ; TOTAL CLOCKS 12 or 18] + + +3.4.4.2 Double-Shift Instructions + +These instructions provide the basic operations needed to implement +operations on long unaligned bit strings. The double shifts operate either +on word or doubleword operands, as follows: + + 1. Taking two word operands as input and producing a one-word output. + + 2. Taking two doubleword operands as input and producing a doubleword + output. + +Of the two input operands, one may either be in a general register or in +memory, while the other may only be in a general register. The results +replace the memory or register operand. The number of bits to be shifted is +specified either in the CL register or in an immediate byte of the +instruction. + +Bits are shifted from the register operand into the memory or register +operand. CF is set to the value of the last bit shifted out of the +destination operand. SF, ZF, and PF are set according to the value of the +result. OF and AF are left undefined. + +SHLD (Shift Left Double) shifts bits of the R/M field to the left, while +shifting high-order bits from the Reg field into the R/M field on the right +(see Figure 3-10). The result is stored back into the R/M operand. The Reg +field is not modified. + +SHRD (Shift Right Double) shifts bits of the R/M field to the right, while +shifting low-order bits from the Reg field into the R/M field on the left +(see Figure 3-11). The result is stored back into the R/M operand. The Reg +field is not modified. + + +3.4.4.3 Rotate Instructions + +Rotate instructions allow bits in bytes, words, and doublewords to be +rotated. Bits rotated out of an operand are not lost as in a shift, but are +"circled" back into the other "end" of the operand. + +Rotates affect only the carry and overflow flags. CF may act as an +extension of the operand in two of the rotate instructions, allowing a bit +to be isolated and then tested by a conditional jump instruction (JC or +JNC). CF always contains the value of the last bit rotated out, even if the +instruction does not use this bit as an extension of the rotated operand. + +In single-bit rotates, OF is set if the operation changes the high-order +(sign) bit of the destination operand. If the sign bit retains its original +value, OF is cleared. On multibit rotates, the value of OF is always +undefined. + +ROL (Rotate Left) rotates the byte, word, or doubleword destination operand +left by one or by the number of bits specified in the count operand (an +immediate value or the value contained in CL). For each rotation specified, +the high-order bit that exits from the left of the operand returns at the +right to become the new low-order bit of the operand. See Figure 3-12. + +ROR (Rotate Right) rotates the byte, word, or doubleword destination +operand right by one or by the number of bits specified in the count operand +(an immediate value or the value contained in CL). For each rotation +specified, the low-order bit that exits from the right of the operand +returns at the left to become the new high-order bit of the operand. +See Figure 3-13. + +RCL (Rotate Through Carry Left) rotates bits in the byte, word, or +doubleword destination operand left by one or by the number of bits +specified in the count operand (an immediate value or the value contained in +CL). + +This instruction differs from ROL in that it treats CF as a high-order +one-bit extension of the destination operand. Each high-order bit that exits +from the left side of the operand moves to CF before it returns to the +operand as the low-order bit on the next rotation cycle. See Figure 3-14. + +RCR (Rotate Through Carry Right) rotates bits in the byte, word, or +doubleword destination operand right by one or by the number of bits +specified in the count operand (an immediate value or the value contained in +CL). + +This instruction differs from ROR in that it treats CF as a low-order +one-bit extension of the destination operand. Each low-order bit that exits +from the right side of the operand moves to CF before it returns to the +operand as the high-order bit on the next rotation cycle. See Figure 3-15. + + +Figure 3-10. Shift Left Double + + 31 DESTINATION 0 + �袴袴� �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + � CF �컴컴컴� MEMORY OF REGISTER �컴커 + 훤袴暠 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � + 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + � 31 SOURCE 0 + � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + 읕컴� REGISTER � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 + + +Figure 3-11. Shift Right Double + + 31 SOURCE 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + � REGISTER 픔컴� + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � + 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸 + � 31 DESTINATION 0 + � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� �袴袴� + 읕�� MEMORY OF REGISTER 픔컴컴컴� CF � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 훤袴暠 + + +Figure 3-12. ROL + + 31 DESTINATION 0 + �袴袴� �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + � CF �컴컫컴� MEMORY OF REGISTER �컴� + 훤袴暠 � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � + 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + +Figure 3-13. ROR + + 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 + � 31 DESTINATION 0 � + � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � �袴袴� + 읕�� MEMORY OF REGISTER 픔컴좔컴� CF � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 훤袴暠 + + +Figure 3-14. RCL + + 31 DESTINATION 0 + �袴袴� �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + 旼� CF �컴컴컴� MEMORY OF REGISTER �컴� + � 훤袴暠 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � + 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + +Figure 3-15. RCR + + 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 + � 31 DESTINATION 0 � + � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� �袴袴� � + 읕�� MEMORY OF REGISTER 픔컴컴컴� CF 픔� + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 훤袴暠 + + +3.4.4.4 Fast "BIT BLT" Using Double Shift Instructions + +One purpose of the double shifts is to implement a bit string move, with +arbitrary misalignment of the bit strings. This is called a "bit blt" (BIT +BLock Transfer.) A simple example is to move a bit string from an arbitrary +offset into a doubleword-aligned byte string. A left-to-right string is +moved 32 bits at a time if a double shift is used inside the move loop. + + MOV ESI,ScrAddr + MOV EDI,DestAddr + MOV EBX,WordCnt + MOV CL,RelOffset ; relative offset Dest-Src + MOV EDX,[ESI] ; load first word of source + ADD ESI,4 ; bump source address +BltLoop: + LODS ; new low order part + SHLD EDX,EAX,CL ; EDX overwritten with aligned stuff + XCHG EDX,EAS ; Swap high/low order parts + STOS ; Write out next aligned chunk + DEC EBX + JA BltLoop + +This loop is simple yet allows the data to be moved in 32-bit pieces for +the highest possible performance. Without a double shift, the best that can +be achieved is 16 bits per loop iteration by using a 32-bit shift and +replacing the XCHG with a ROR by 16 to swap high and low order parts of +registers. A more general loop than shown above would require some extra +masking on the first doubleword moved (before the main loop), and on the +last doubleword moved (after the main loop), but would have the same basic +32-bits per loop iteration as the code above. + + +3.4.4.5 Fast Bit-String Insert and Extract + +The double shift instructions also enable: + + � Fast insertion of a bit string from a register into an arbitrary bit + location in a larger bit string in memory without disturbing the bits + on either side of the inserted bits. + + � Fast extraction of a bits string into a register from an arbitrary bit + location in a larger bit string in memory without disturbing the bits + on either side of the extracted bits. + +The following coded examples illustrate bit insertion and extraction under +variousconditions: + + 1. Bit String Insert into Memory (when bit string is 1-25 bits long, + i.e., spans four bytes or less): + + ; Insert a right-justified bit string from register into + ; memory bit string. + ; + ; Assumptions: + ; 1) The base of the string array is dword aligned, and + ; 2) the length of the bit string is an immediate value + ; but the bit offset is held in a register. + ; + ; Register ESI holds the right-justified bit string + ; to be inserted. + ; Register EDI holds the bit offset of the start of the + ; substring. + ; Registers EAX and ECX are also used by this + ; "insert" operation. + ; + MOV ECX,EDI ; preserve original offset for later use + SHR EDI,3 ; signed divide offset by 8 (byte address) + AND CL,7H ; isolate low three bits of offset in CL + MOV EAX,[EDI]strg_base ; move string dword into EAX + ROR EAX,CL ; right justify old bit field + SHRD EAX,ESI,length ; bring in new bits + ROL EAX,length ; right justify new bit field + ROL EAX,CL ; bring to final position + MOV [EDI]strg_base,EAX ; replace dword in memory + + 2. Bit String Insert into Memory (when bit string is 1-31 bits long, i.e. + spans five bytes or less): + + ; Insert a right-justified bit string from register into + ; memory bit string. + ; + ; Assumptions: + ; 1) The base of the string array is dword aligned, and + ; 2) the length of the bit string is an immediate value + ; but the bit offset is held in a register. + ; + ; Register ESI holds the right-justified bit string + ; to be inserted. + ; Register EDI holds the bit offset of the start of the + ; substring. + ; Registers EAX, EBX, ECX, and EDI are also used by + ; this "insert" operation. + ; + MOV ECX,EDI ; temp storage for offset + SHR EDI,5 ; signed divide offset by 32 (dword address) + SHL EDI,2 ; multiply by 4 (in byte address format) + AND CL,1FH ; isolate low five bits of offset in CL + MOV EAX,[EDI]strg_base ; move low string dword into EAX + MOV EDX,[EDI]strg_base+4 ; other string dword into EDX + MOV EBX,EAX ; temp storage for part of string � rotate + SHRD EAX,EDX,CL ; double shift by offset within dword � EDX:EAX + SHRD EAX,EBX,CL ; double shift by offset within dword � right + SHRD EAX,ESI,length ; bring in new bits + ROL EAX,length ; right justify new bit field + MOV EBX,EAX ; temp storage for part of string � rotate + SHLD EAX,EDX,CL ; double shift back by offset within word � EDX:EAX + SHLD EDX,EBX,CL ; double shift back by offset within word � left + MOV [EDI]strg_base,EAX ; replace dword in memory + MOV [EDI]strg_base+4,EDX ; replace dword in memory + + 3. Bit String Insert into Memory (when bit string is exactly 32 bits + long, i.e., spans five or four types of memory): + + ; Insert right-justified bit string from register into + ; memory bit string. + ; + ; Assumptions: + ; 1) The base of the string array is dword aligned, and + ; 2) the length of the bit string is 32 + ; but the bit offset is held in a register. + ; + ; Register ESI holds the 32-bit string to be inserted. + ; Register EDI holds the bit offset of the start of the + ; substring. + ; Registers EAX, EBX, ECX, and EDI are also used by + ; this "insert" operation. + ; + MOV EDX,EDI ; preserve original offset for later use + SHR EDI,5 ; signed divide offset by 32 (dword address) + SHL EDI,2 ; multiply by 4 (in byte address format) + AND CL,1FH ; isolate low five bits of offset in CL + MOV EAX,[EDI]strg_base ; move low string dword into EAX + MOV EDX,[EDI]strg_base+4 ; other string dword into EDX + MOV EBX,EAX ; temp storage for part of string � rotate + SHRD EAX,EDX ; double shift by offset within dword � EDX:EAX + SHRD EDX,EBX ; double shift by offset within dword � right + MOV EAX,ESI ; move 32-bit bit field into position + MOV EBX,EAX ; temp storage for part of string � rotate + SHLD EAX,EDX ; double shift back by offset within word � EDX:EAX + SHLD EDX,EBX ; double shift back by offset within word � left + MOV [EDI]strg_base,EAX ; replace dword in memory + MOV [EDI]strg_base,+4,EDX ; replace dword in memory + + 4. Bit String Extract from Memory (when bit string is 1-25 bits long, + i.e., spans four bytes or less): + + ; Extract a right-justified bit string from memory bit + ; string into register + ; + ; Assumptions: + ; 1) The base of the string array is dword aligned, and + ; 2) the length of the bit string is an immediate value + ; but the bit offset is held in a register. + ; + ; Register EAX holds the right-justified, zero-padded + ; bit string that was extracted. + ; Register EDI holds the bit offset of the start of the + ; substring. + ; Registers EDI, and ECX are also used by this "extract." + ; + MOV ECX,EDI ; temp storage for offset + SHR EDI,3 ; signed divide offset by 8 (byte address) + AND CL,7H ; isolate low three bits of offset + MOV EAX,[EDI]strg_base ; move string dword into EAX + SHR EAX,CL ; shift by offset within dword + AND EAX,mask ; extracted bit field in EAX + + 5. Bit String Extract from Memory (when bit string is 1-32 bits long, + i.e., spans five bytes or less): + + ; Extract a right-justified bit string from memory bit + ; string into register. + ; + ; Assumptions: + ; 1) The base of the string array is dword aligned, and + ; 2) the length of the bit string is an immediate + ; value but the bit offset is held in a register. + ; + ; Register EAX holds the right-justified, zero-padded + ; bit string that was extracted. + ; Register EDI holds the bit offset of the start of the + ; substring. + ; Registers EAX, EBX, and ECX are also used by this "extract." + MOV ECX,EDI ; temp storage for offset + SHR EDI,5 ; signed divide offset by 32 (dword address) + SHL EDI,2 ; multiply by 4 (in byte address format) + AND CL,1FH ; isolate low five bits of offset in CL + MOV EAX,[EDI]strg_base ; move low string dword into EAX + MOV EDX,[EDI]strg_base+4 ; other string dword into EDX + SHRD EAX,EDX,CL ; double shift right by offset within dword + AND EAX,mask ; extracted bit field in EAX + + +3.4.5 Byte-Set-On-Condition Instructions + +This group of instructions sets a byte to zero or one depending on any of +the 16 conditions defined by the status flags. The byte may be in memory or +may be a one-byte general register. These instructions are especially useful +for implementing Boolean expressions in high-level languages such as Pascal. + +SETcc (Set Byte on Condition cc) set a byte to one if condition cc is true; +sets the byte to zero otherwise. Refer to Appendix D for a definition of +the possible conditions. + + +3.4.6 Test Instruction + +TEST (Test) performs the logical "and" of the two operands, clears OF and +CF, leaves AF undefined, and updates SF, ZF, and PF. The flags can be tested +by conditional control transfer instructions or by the byte-set-on-condition +instructions. The operands may be doublewords, words, or bytes. + +The difference between TEST and AND is that TEST does not alter the +destination operand. TEST differs from BT in that TEST is useful for testing +the value of multiple bits in one operations, whereas BT tests a single bit. + + +3.5 Control Transfer Instructions + +The 80386 provides both conditional and unconditional control transfer +instructions to direct the flow of execution. Conditional control transfers +depend on the results of operations that affect the flag register. +Unconditional control transfers are always executed. + + +3.5.1 Unconditional Transfer Instructions + +JMP, CALL, RET, INT and IRET instructions transfer control from one code +segment location to another. These locations can be within the same code +segment (near control transfers) or in different code segments (far control +transfers). The variants of these instructions that transfer control to +other segments are discussed in a later section of this chapter. If the +model of memory organization used in a particular 80386 application does +not make segments visible to applications programmers, intersegment control +transfers will not be used. + + +3.5.1.1 Jump Instruction + +JMP (Jump) unconditionally transfers control to the target location. JMP is +a one-way transfer of execution; it does not save a return address on the +stack. + +The JMP instruction always performs the same basic function of transferring +control from the current location to a new location. Its implementation +varies depending on whether the address is specified directly within the +instruction or indirectly through a register or memory. + +A direct JMP instruction includes the destination address as part of the +instruction. An indirect JMP instruction obtains the destination address +indirectly through a register or a pointer variable. + +Direct near JMP. A direct JMP uses a relative displacement value contained +in the instruction. The displacement is signed and the size of the +displacement may be a byte, word, or doubleword. The processor forms an +effective address by adding this relative displacement to the address +contained in EIP. When the additions have been performed, EIP refers to the +next instruction to be executed. + +Indirect near JMP. Indirect JMP instructions specify an absolute address in +one of several ways: + + 1. The program can JMP to a location specified by a general register + (any of EAX, EDX, ECX, EBX, EBP, ESI, or EDI). The processor moves + this 32-bit value into EIP and resumes execution. + + 2. The processor can obtain the destination address from a memory + operand specified in the instruction. + + 3. A register can modify the address of the memory pointer to select a + destination address. + + +3.5.1.2 Call Instruction + +CALL (Call Procedure) activates an out-of-line procedure, saving on the +stack the address of the instruction following the CALL for later use by a +RET (Return) instruction. CALL places the current value of EIP on the stack. +The RET instruction in the called procedure uses this address to transfer +control back to the calling program. + +CALL instructions, like JMP instructions have relative, direct, and +indirect versions. + +Indirect CALL instructions specify an absolute address in one of these +ways: + + 1. The program can CALL a location specified by a general register (any + of EAX, EDX, ECX, EBX, EBP, ESI, or EDI). The processor moves this + 32-bit value into EIP. + + 2. The processor can obtain the destination address from a memory + operand specified in the instruction. + + +3.5.1.3 Return and Return-From-Interrupt Instruction + +RET (Return From Procedure) terminates the execution of a procedure and +transfers control through a back-link on the stack to the program that +originally invoked the procedure. RET restores the value of EIP that was +saved on the stack by the previous CALL instruction. + +RET instructions may optionally specify an immediate operand. By adding +this constant to the new top-of-stack pointer, RET effectively removes any +arguments that the calling program pushed on the stack before the execution +of the CALL instruction. + +IRET (Return From Interrupt) returns control to an interrupted procedure. +IRET differs from RET in that it also pops the flags from the stack into the +flags register. The flags are stored on the stack by the interrupt +mechanism. + + +3.5.2 Conditional Transfer Instructions + +The conditional transfer instructions are jumps that may or may not +transfer control, depending on the state of the CPU flags when the +instruction executes. + + +3.5.2.1 Conditional Jump Instructions + +Table 3-2 shows the conditional transfer mnemonics and their +interpretations. The conditional jumps that are listed as pairs are actually +the same instruction. The assembler provides the alternate mnemonics for +greater clarity within a program listing. + +Conditional jump instructions contain a displacement which is added to the +EIP register if the condition is true. The displacement may be a byte, a +word, or a doubleword. The displacement is signed; therefore, it can be used +to jump forward or backward. + + +Table 3-2. Interpretation of Conditional Transfers + +Unsigned Conditional Transfers + +Mnemonic Condition Tested "Jump If..." + +JA/JNBE (CF or ZF) = 0 above/not below nor equal +JAE/JNB CF = 0 above or equal/not below +JB/JNAE CF = 1 below/not above nor equal +JBE/JNA (CF or ZF) = 1 below or equal/not above +JC CF = 1 carry +JE/JZ ZF = 1 equal/zero +JNC CF = 0 not carry +JNE/JNZ ZF = 0 not equal/not zero +JNP/JPO PF = 0 not parity/parity odd +JP/JPE PF = 1 parity/parity even + +Signed Conditional Transfers + +Mnemonic Condition Tested "Jump If..." +JG/JNLE ((SF xor OF) or ZF) = 0 greater/not less nor equal +JGE/JNL (SF xor OF) = 0 greater or equal/not less +JL/JNGE (SF xor OF) = 1 less/not greater nor equal +JLE/JNG ((SF xor OF) or ZF) = 1 less or equal/not greater +JNO OF = 0 not overflow +JNS SF = 0 not sign (positive, including 0) +JO OF = 1 overflow +JS SF = 1 sign (negative) + + +3.5.2.2 Loop Instructions + +The loop instructions are conditional jumps that use a value placed in ECX +to specify the number of repetitions of a software loop. All loop +instructions automatically decrement ECX and terminate the loop when ECX=0. +Four of the five loop instructions specify a condition involving ZF that +terminates the loop before ECX reaches zero. + +LOOP (Loop While ECX Not Zero) is a conditional transfer that automatically +decrements the ECX register before testing ECX for the branch condition. If +ECX is non-zero, the program branches to the target label specified in the +instruction. The LOOP instruction causes the repetition of a code section +until the operation of the LOOP instruction decrements ECX to a value of +zero. If LOOP finds ECX=0, control transfers to the instruction immediately +following the LOOP instruction. If the value of ECX is initially zero, then +the LOOP executes 2^(32) times. + +LOOPE (Loop While Equal) and LOOPZ (Loop While Zero) are synonyms for the +same instruction. These instructions automatically decrement the ECX +register before testing ECX and ZF for the branch conditions. If ECX is +non-zero and ZF=1, the program branches to the target label specified in the +instruction. If LOOPE or LOOPZ finds that ECX=0 or ZF=0, control transfers +to the instruction immediately following the LOOPE or LOOPZ instruction. + +LOOPNE (Loop While Not Equal) and LOOPNZ (Loop While Not Zero) are synonyms +for the same instruction. These instructions automatically decrement the ECX +register before testing ECX and ZF for the branch conditions. If ECX is +non-zero and ZF=0, the program branches to the target label specified in the +instruction. If LOOPNE or LOOPNZ finds that ECX=0 or ZF=1, control transfers +to the instruction immediately following the LOOPNE or LOOPNZ instruction. + + +3.5.2.3 Executing a Loop or Repeat Zero Times + +JCXZ (Jump if ECX Zero) branches to the label specified in the instruction +if it finds a value of zero in ECX. JCXZ is useful in combination with the +LOOP instruction and with the string scan and compare instructions, all of +which decrement ECX. Sometimes, it is desirable to design a loop that +executes zero times if the count variable in ECX is initialized to zero. +Because the LOOP instructions (and repeat prefixes) decrement ECX before +they test it, a loop will execute 2^(32) times if the program enters the +loop with a zero value in ECX. A programmer may conveniently overcome this +problem with JCXZ, which enables the program to branch around the code +within the loop if ECX is zero when JCXZ executes. When used with repeated +string scan and compare instructions, JCXZ can determine whether the +repetitions terminated due to zero in ECX or due to satisfaction of the +scan or compare conditions. + + +3.5.3 Software-Generated Interrupts + +The INT n, INTO, and BOUND instructions allow the programmer to specify a +transfer to an interrupt service routine from within a program. + +INT n (Software Interrupt) activates the interrupt service routine that +corresponds to the number coded within the instruction. The INT instruction +may specify any interrupt type. Programmers may use this flexibility to +implement multiple types of internal interrupts or to test the operation of +interrupt service routines. (Interrupts 0-31 are reserved by Intel.) The +interrupt service routine terminates with an IRET instruction that returns +control to the instruction that follows INT. + +INTO (Interrupt on Overflow) invokes interrupt 4 if OF is set. Interrupt 4 +is reserved for this purpose. OF is set by several arithmetic, logical, and +string instructions. + +BOUND (Detect Value Out of Range) verifies that the signed value contained +in the specified register lies within specified limits. An interrupt (INT 5) +occurs if the value contained in the register is less than the lower bound +or greater than the upper bound. + +The BOUND instruction includes two operands. The first operand specifies +the register being tested. The second operand contains the effective +relative address of the two signed BOUND limit values. The BOUND instruction +assumes that the upper limit and lower limit are in adjacent memory +locations. These limit values cannot be register operands; if they are, an +invalid opcode exception occurs. + +BOUND is useful for checking array bounds before using a new index value to +access an element within the array. BOUND provides a simple way to check the +value of an index register before the program overwrites information in a +location beyond the limit of the array. + +The block of memory that specifies the lower and upper limits of an array +might typically reside just before the array itself. This makes the array +bounds accessible at a constant offset from the beginning of the array. +Because the address of the array will already be present in a register, this +practice avoids extra calculations to obtain the effective address of the +array bounds. + +The upper and lower limit values may each be a word or a doubleword. + + +3.6 String and Character Translation Instructions + +The instructions in this category operate on strings rather than on logical +or numeric values. Refer also to the section on I/O for information about +the string I/O instructions (also known as block I/O). + +The power of 80386 string operations derives from the following features of +the architecture: + +1. A set of primitive string operations + + MOVS 컴 Move String + CMPS 컴 Compare string + SCAS 컴 Scan string + LODS 컴 Load string + STOS 컴 Store string + +2. Indirect, indexed addressing, with automatic incrementing or + decrementing of the indexes. + + Indexes: + + ESI 컴 Source index register + EDI 컴 Destination index register + + Control flag: + + DF 컴 Direction flag + + Control flag instructions: + + CLD 컴 Clear direction flag instruction + STD 컴 Set direction flag instruction + +3. Repeat prefixes + + REP 컴 Repeat while ECX not xero + REPE/REPZ 컴 Repeat while equal or zero + REPNE/REPNZ 컴 Repeat while not equal or not zero + +The primitive string operations operate on one element of a string. A +string element may be a byte, a word, or a doubleword. The string elements +are addressed by the registers ESI and EDI. After every primitive operation +ESI and/or EDI are automatically updated to point to the next element of the +string. If the direction flag is zero, the index registers are incremented; +if one, they are decremented. The amount of the increment or decrement is +1, 2, or 4 depending on the size of the string element. + + +3.6.1 Repeat Prefixes + +The repeat prefixes REP (Repeat While ECX Not Zero), REPE/REPZ (Repeat +While Equal/Zero), and REPNE/REPNZ (Repeat While Not Equal/Not Zero) specify +repeated operation of a string primitive. This form of iteration allows the +CPU to process strings much faster than would be possible with a regular +software loop. + +When a primitive string operation has a repeat prefix, the operation is +executed repeatedly, each time using a different element of the string. The +repetition terminates when one of the conditions specified by the prefix is +satisfied. + +At each repetition of the primitive instruction, the string operation may +be suspended temporarily in order to handle an exception or external +interrupt. After the interruption, the string operation can be restarted +again where it left off. This method of handling strings allows operations +on strings of arbitrary length, without affecting interrupt response. + +All three prefixes causes the hardware to automatically repeat the +associated string primitive until ECX=0. The differences among the repeat +prefixes have to do with the second termination condition. REPE/REPZ and +REPNE/REPNZ are used exclusively with the SCAS (Scan String) and CMPS +(Compare String) primitives. When these prefixes are used, repetition of the +next instruction depends on the zero flag (ZF) as well as the ECX register. +ZF does not require initialization before execution of a repeated string +instruction, because both SCAS and CMPS set ZF according to the results of +the comparisons they make. The differences are summarized in the +accompanying table. + +Prefix Termination Termination + Condition 1 Condition 2 + +REP ECX = 0 (none) +REPE/REPZ ECX = 0 ZF = 0 +REPNE/REPNZ ECX = 0 ZF = 1 + + +3.6.2 Indexing and Direction Flag Control + +The addresses of the operands of string primitives are determined by the +ESI and EDI registers. ESI points to source operands. By default, ESI refers +to a location in the segment indicated by the DS segment register. A +segment-override prefix may be used, however, to cause ESI to refer to CS, +SS, ES, FS, or GS. EDI points to destination operands in the segment +indicated by ES; no segment override is possible. The use of two different +segment registers in one instruction allows movement of strings between +different segments. + +This use of ESI and DSI has led to the descriptive names source index and +destination index for the ESI and EDI registers, respectively. In all +cases other than string instructions, however, the ESI and EDI registers may +be used as general-purpose registers. + +When ESI and EDI are used in string primitives, they are automatically +incremented or decremented after to operation. The direction flag determines +whether they are incremented or decremented. The instruction CLD puts zero +in DF, causing the index registers to be incremented; the instruction STD +puts one in DF, causing the index registers to be decremented. Programmers +should always put a known value in DF before using string instructions in a +procedure. + + +3.6.3 String Instructions + +MOVS (Move String) moves the string element pointed to by ESI to the +location pointed to by EDI. MOVSB operates on byte elements, MOVSW operates +on word elements, and MOVSD operates on doublewords. The destination segment +register cannot be overridden by a segment override prefix, but the source +segment register can be overridden. + +The MOVS instruction, when accompanied by the REP prefix, operates as a +memory-to-memory block transfer. To set up for this operation, the program +must initialize ECX and the register pairs ESI and EDI. ECX specifies the +number of bytes, words, or doublewords in the block. + +If DF=0, the program must point ESI to the first element of the source +string and point EDI to the destination address for the first element. If +DF=1, the program must point these two registers to the last element of the +source string and to the destination address for the last element, +respectively. + +CMPS (Compare Strings) subtracts the destination string element (at ES:EDI) +from the source string element (at ESI) and updates the flags AF, SF, PF, CF +and OF. If the string elements are equal, ZF=1; otherwise, ZF=0. If DF=0, +the processor increments the memory pointers (ESI and EDI) for the two +strings. CMPSB compares bytes, CMPSW compares words, and CMPSD compares +doublewords. The segment register used for the source address can be changed +with a segment override prefix while the destination segment register +cannot be overridden. + +SCAS (Scan String) subtracts the destination string element at ES:EDI from +EAX, AX, or AL and updates the flags AF, SF, ZF, PF, CF and OF. If the +values are equal, ZF=1; otherwise, ZF=0. If DF=0, the processor increments +the memory pointer (EDI) for the string. SCASB scans bytes; SCASW scans +words; SCASD scans doublewords. The destination segment register (ES) cannot +be overridden. + +When either the REPE or REPNE prefix modifies either the SCAS or CMPS +primitives, the processor compares the value of the current string element +with the value in EAX for doubleword elements, in AX for word elements, or +in AL for byte elements. Termination of the repeated operation depends on +the resulting state of ZF as well as on the value in ECX. + +LODS (Load String) places the source string element at ESI into EAX for +doubleword strings, into AX for word strings, or into AL for byte strings. +LODS increments or decrements ESI according to DF. + +STOS (Store String) places the source string element from EAX, AX, or AL +into the string at ES:DSI. STOS increments or decrements EDI according to +DF. + + +3.7 Instructions for Block-Structured Languages + +The instructions in this section provide machine-language support for +functions normally found in high-level languages. These instructions include +ENTER and LEAVE, which simplify the programming of procedures. + +ENTER (Enter Procedure) creates a stack frame that may be used to implement +the scope rules of block-structured high-level languages. A LEAVE +instruction at the end of a procedure complements an ENTER at the beginning +of the procedure to simplify stack management and to control access to +variables for nested procedures. + +The ENTER instruction includes two parameters. The first parameter +specifies the number of bytes of dynamic storage to be allocated on the +stack for the routine being entered. The second parameter corresponds to the +lexical nesting level (0-31) of the routine. (Note that the lexical level +has no relationship to either the protection privilege levels or to the I/O +privilege level.) + +The specified lexical level determines how many sets of stack frame +pointers the CPU copies into the new stack frame from the preceding frame. +This list of stack frame pointers is sometimes called the display. The first +word of the display is a pointer to the last stack frame. This pointer +enables a LEAVE instruction to reverse the action of the previous ENTER +instruction by effectively discarding the last stack frame. + + Example: ENTER 2048,3 + + Allocates 2048 bytes of dynamic storage on the stack and sets up pointers + to two previous stack frames in the stack frame that ENTER creates for + this procedure. + +After ENTER creates the new display for a procedure, it allocates the +dynamic storage space for that procedure by decrementing ESP by the number +of bytes specified in the first parameter. This new value of ESP serves as a +starting point for all PUSH and POP operations within that procedure. + +To enable a procedure to address its display, ENTER leaves EBP pointing to +the beginning of the new stack frame. Data manipulation instructions that +specify EBP as a base register implicitly address locations within the stack +segment instead of the data segment. + +The ENTER instruction can be used in two ways: nested and non-nested. If +the lexical level is 0, the non-nested form is used. Since the second +operand is 0, ENTER pushes EBP, copies ESP to EBP and then subtracts the +first operand from ESP. The nested form of ENTER occurs when the second +parameter (lexical level) is not 0. + +Figure 3-16 gives the formal definition of ENTER. + +The main procedure (with other procedures nested within) operates at the +highest lexical level, level 1. The first procedure it calls operates at the +next deeper lexical level, level 2. A level 2 procedure can access the +variables of the main program which are at fixed locations specified by the +compiler. In the case of level 1, ENTER allocates only the requested +dynamic storage on the stack because there is no previous display to copy. + +A program operating at a higher lexical level calling a program at a lower +lexical level requires that the called procedure should have access to the +variables of the calling program. ENTER provides this access through a +display that provides addressability to the calling program's stack frame. + +A procedure calling another procedure at the same lexical level implies +that they are parallel procedures and that the called procedure should not +have access to the variables of the calling procedure. In this case, ENTER +copies only that portion of the display from the calling procedure which +refers to previously nested procedures operating at higher lexical levels. +The new stack frame does not include the pointer for addressing the calling +procedure's stack frame. + +ENTER treats a reentrant procedure as a procedure calling another procedure +at the same lexical level. In this case, each succeeding iteration of the +reentrant procedure can address only its own variables and the variables of +the calling procedures at higher lexical levels. A reentrant procedure can +always address its own variables; it does not require pointers to the stack +frames of previous iterations. + +By copying only the stack frame pointers of procedures at higher lexical +levels, ENTER makes sure that procedures access only those variables of +higher lexical levels, not those at parallel lexical levels (see Figure +3-17). Figures 3-18 through 3-21 demonstrate the actions of the ENTER +instruction if the modules shown in Figure 3-17 were to call one another in +alphabetic order. + +Block-structured high-level languages can use the lexical levels defined by +ENTER to control access to the variables of previously nested procedures. +Referring to Figure 3-17 for example, if PROCEDURE A calls PROCEDURE B +which, in turn, calls PROCEDURE C, then PROCEDURE C will have access to the +variables of MAIN and PROCEDURE A, but not PROCEDURE B because they operate +at the same lexical level. Following is the complete definition of access to +variables for Figure 3-17. + + 1. MAIN PROGRAM has variables at fixed locations. + + 2. PROCEDURE A can access only the fixed variables of MAIN. + + 3. PROCEDURE B can access only the variables of PROCEDURE A and MAIN. + PROCEDURE B cannot access the variables of PROCEDURE C or PROCEDURE D. + + 4. PROCEDURE C can access only the variables of PROCEDURE A and MAIN. + PROCEDURE C cannot access the variables of PROCEDURE B or PROCEDURE D. + + 5. PROCEDURE D can access the variables of PROCEDURE C, PROCEDURE A, and + MAIN. PROCEDURE D cannot access the variables of PROCEDURE B. + +ENTER at the beginning of the MAIN PROGRAM creates dynamic storage space +for MAIN but copies no pointers. The first and only word in the display +points to itself because there is no previous value for LEAVE to return to +EBP. See Figure 3-18. + +After MAIN calls PROCEDURE A, ENTER creates a new display for PROCEDURE A +with the first word pointing to the previous value of EBP (BPM for LEAVE to +return to the MAIN stack frame) and the second word pointing to the current +value of EBP. Procedure A can access variables in MAIN since MAIN is at +level 1. Therefore the base for the dynamic storage for MAIN is at [EBP-2]. +All dynamic variables for MAIN are at a fixed offset from this value. See +Figure 3-19. + +After PROCEDURE A calls PROCEDURE B, ENTER creates a new display for +PROCEDURE B with the first word pointing to the previous value of EBP, the +second word pointing to the value of EBP for MAIN, and the third word +pointing to the value of EBP for A and the last word pointing to the current +EBP. B can access variables in A and MAIN by fetching from the display the +base addresses of the respective dynamic storage areas. See Figure 3-20. + +After PROCEDURE B calls PROCEDURE C, ENTER creates a new display for +PROCEDURE C with the first word pointing to the previous value of EBP, the +second word pointing to the value of EBP for MAIN, and the third word +pointing to the EBP value for A and the third word pointing to the current +value of EBP. Because PROCEDURE B and PROCEDURE C have the same lexical +level, PROCEDURE C is not allowed access to variables in B and therefore +does not receive a pointer to the beginning of PROCEDURE B's stack frame. +See Figure 3-21. + +LEAVE (Leave Procedure) reverses the action of the previous ENTER +instruction. The LEAVE instruction does not include any operands. LEAVE +copies EBP to ESP to release all stack space allocated to the procedure by +the most recent ENTER instruction. Then LEAVE pops the old value of EBP from +the stack. A subsequent RET instruction can then remove any arguments that +were pushed on the stack by the calling program for use by the called +procedure. + + +Figure 3-16. Formal Definition of the ENTER Instruction + +The formal definition of the ENTER instruction for all cases is given by the +following listing. LEVEL denotes the value of the second operand. + +Push EBP +Set a temporary value FRAME_PTR := ESP +If LEVEL > 0 then + Repeat (LEVEL-1) times: + EBP :=EBP - 4 + Push the doubleword pointed to by EBP + End repeat + Push FRAME_PTR +End if +EBP := FRAME_PTR +ESP := ESP - first operand. + + +Figure 3-17. Variable Access in Nested Procedures + + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + � MAIN PROCEDURE (LEXICAL LEVEL 1) � + � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � + � � PROCEDURE A (LEXICAL LEVEL 2) � � + � � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � � + � � � PROCEDURE B (LEXICAL LEVEL 3) � � � + � � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � � + � � � � + � � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � � + � � � PROCEDURE C (LEXICAL LEVEL 3) � � � + � � � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � � � + � � � � PROCEDURE D (LEXICAL LEVEL 4) � � � � + � � � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � � � + � � � � � � + � � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � � + � � � � + � 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 � + � � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 + + +Figure 3-18. Stack Frame for MAIN at Level 1 + +  31 0  + D O � � + I F 旼 勁袴袴袴妄袴袴袴� + R � � OLD ESP � + E E DISPLAY 캑 勁袴袴袴妄袴袴袴�컴EBP FOR + C X � � EBPM +EBPM = EBP VALUE FOR MAIN � MAIN + T P 팠 勁袴袴袴妄袴袴袴� + I A � � � + O N � 勁袴袴袴妄袴袴袴� + N S DYNAMIC 캑 � � + I STORAGE � 勁袴袴袴妄袴袴袴� + � O � � � + � N 읕 勁袴袴袴妄袴袴袴�컴ESP + � � � +    + + +Figure 3-19. Stack Frame for Procedure A + +  31 0  + D O � � + I F 勁袴袴袴妄袴袴袴� + R � OLD ESP � + E E 勁袴袴袴妄袴袴袴� + C X � EBPM +EBPM = EBP VALUE FOR MAIN � + T P 勁袴袴袴妄袴袴袴� + I A � � + O N 勁袴袴袴妄袴袴袴� + N S � � + I 勁袴袴袴妄袴袴袴� + � O � � + � N 旼 勁袴袴袴妄袴袴袴� + � � � EBPM � +  � 勁袴袴袴妄袴袴袴�컴EBP FOR A + DISPLAY 캑 � EBPM � + � 勁袴袴袴妄袴袴袴� + � � EBPA +EBPA = EBP VALUE FOR PROCEDURE A � + 팠 勁袴袴袴妄袴袴袴� + � � � + � 勁袴袴袴妄袴袴袴� + DYNAMIC 캑 � � + STORAGE � 勁袴袴袴妄袴袴袴� + � � � + 읕 勁袴袴袴妄袴袴袴�컴ESP + � � +   + + +Figure 3-20. Stack Frame for Procedure B at Level 3 Called from A + +  31 0  + D O � � + I F 勁袴袴袴妄袴袴袴� + R � OLD ESP � + E E 勁袴袴袴妄袴袴袴� + C X � EBPM +EBPM = EBP VALUE FOR MAIN � + T P 勁袴袴袴妄袴袴袴� + I A � � + O N 勁袴袴袴妄袴袴袴� + N S � � + I 勁袴袴袴妄袴袴袴� + � O � � + � N 勁袴袴袴妄袴袴袴� + � � EBPM � +  勁袴袴袴妄袴袴袴� + � EBPM � + 勁袴袴袴妄袴袴袴� + � EBPA � + 勁袴袴袴妄袴袴袴� + � � + 勁袴袴袴妄袴袴袴� + � � + 勁袴袴袴妄袴袴袴� + � � + 旼 勁袴袴袴妄袴袴袴� + � � EBPA � + � 勁袴袴袴妄袴袴袴�컴EBP + � � EBPM � + DISPLAY 캑 勁袴袴袴妄袴袴袴� + � � EBPA � + � 勁袴袴袴妄袴袴袴� + � � EBPB +EBPB = EBP VALUE FOR PROCEDURE B � + 팠 勁袴袴袴妄袴袴袴� + � � � + � 勁袴袴袴妄袴袴袴� + DYNAMIC 캑 � � + STORAGE � 勁袴袴袴妄袴袴袴� + � � � + 읕 勁袴袴袴妄袴袴袴�컴ESP + � � +   + + +Figure 3-21. Stack Frame for Procedure C at Level 3 Called from B + +  31 0  + D O � � + I F 勁袴袴袴妄袴袴袴� + R � OLD ESP � + E E 勁袴袴袴妄袴袴袴� + C X � EBPM +EBPM = EBP VALUE FOR MAIN � + T P 勁袴袴袴妄袴袴袴� + I A � � + O N 勁袴袴袴妄袴袴袴� + N S � � + I 勁袴袴袴妄袴袴袴� + � O � � + � N 勁袴袴袴妄袴袴袴� + � � EBPM � +  勁袴袴袴妄袴袴袴� + � EBPM � + 勁袴袴袴妄袴袴袴� + � EBPA +EBPA = EBP VALUE FOR PROCEDURE A � + 勁袴袴袴妄袴袴袴� + � � + 勁袴袴袴妄袴袴袴� + � � + 勁袴袴袴妄袴袴袴� + � � + 旼 勁袴袴袴妄袴袴袴� + � � EBPA � + � 勁袴袴袴妄袴袴袴�컴EBP + � � EBPM � + DISPLAY 캑 勁袴袴袴妄袴袴袴� + � � EBPA � + � 勁袴袴袴妄袴袴袴� + � � EBPB +EBPB = EBP VALUE FOR PROCEDURE B � + 팠 勁袴袴袴妄袴袴袴� + � � � + � 勁袴袴袴妄袴袴袴� + DYNAMIC 캑 � � + STORAGE � 勁袴袴袴妄袴袴袴� + � � � + 읕 勁袴袴袴妄袴袴袴�컴ESP + � � +   + + +3.8 Flag Control Instructions + +The flag control instructions provide a method for directly changing the +state of bits in the flag register. + + +3.8.1 Carry and Direction Flag Control Instructions + +The carry flag instructions are useful in conjunction with +rotate-with-carry instructions RCL and RCR. They can initialize the carry +flag, CF, to a known state before execution of a rotate that moves the carry +bit into one end of the rotated operand. + +The direction flag control instructions are specifically included to set or +clear the direction flag, DF, which controls the left-to-right or +right-to-left direction of string processing. If DF=0, the processor +automatically increments the string index registers, ESI and EDI, after each +execution of a string primitive. If DF=1, the processor decrements these +index registers. Programmers should use one of these instructions before any +procedure that uses string instructions to insure that DF is set properly. + +Flag Control Instruction Effect + +STC (Set Carry Flag) CF  1 +CLC (Clear Carry Flag) CF  0 +CMC (Complement Carry Flag) CF  NOT (CF) +CLD (Clear Direction Flag) DF  0 +STD (Set Direction Flag) DF  1 + + +3.8.2 Flag Transfer Instructions + +Though specific instructions exist to alter CF and DF, there is no direct +method of altering the other applications-oriented flags. The flag transfer +instructions allow a program to alter the other flag bits with the bit +manipulation instructions after transferring these flags to the stack or the +AH register. + +The instructions LAHF and SAHF deal with five of the status flags, which +are used primarily by the arithmetic and logical instructions. + +LAHF (Load AH from Flags) copies SF, ZF, AF, PF, and CF to AH bits 7, 6, 4, +2, and 0, respectively (see Figure 3-22). The contents of the remaining bits +(5, 3, and 1) are undefined. The flags remain unaffected. + +SAHF (Store AH into Flags) transfers bits 7, 6, 4, 2, and 0 from AH into +SF, ZF, AF, PF, and CF, respectively (see Figure 3-22). + +The PUSHF and POPF instructions are not only useful for storing the flags +in memory where they can be examined and modified but are also useful for +preserving the state of the flags register while executing a procedure. + +PUSHF (Push Flags) decrements ESP by two and then transfers the low-order +word of the flags register to the word at the top of stack pointed to by ESP +(see Figure 3-23). The variant PUSHFD decrements ESP by four, then +transfers both words of the extended flags register to the top of the stack +pointed to by ESP (the VM and RF flags are not moved, however). + +POPF (Pop Flags) transfers specific bits from the word at the top of stack +into the low-order byte of the flag register (see Figure 3-23), then +increments ESP by two. The variant POPFD transfers specific bits from the +doubleword at the top of the stack into the extended flags register (the RF +and VM flags are not changed, however), then increments ESP by four. + + +Figure 3-22. LAHF and SAHF + + 7 6 5 4 3 2 1 0 + �袴袴箇袴藁袴袴箇袴藁袴袴箇袴藁袴袴箇袴敲 + � SF � ZF � UU � AF � UU � PF � UU � CF � + 훤袴菰袴袴姦袴菰袴袴姦袴菰袴袴姦袴菰袴袴� + + LAHF LOADS FIVE FLAGS FROM THE FLAG REGISTER INTO REGISTER AH. SAHF + STORES THESE SAME FIVE FLAGS FROM AH INTO THE FLAG REGISTER. THE BIT + POSITION OF EACH FLAG IS THE SAME IN AH AS IT IS IN THE FLAG REGISTER. + THE REMAINING BITS (MARKED UU) ARE RESERVED; DO NOT DEFINE. + + +3.9 Coprocessor Interface Instructions + +A numerics coprocessor (e.g., the 80387 or 80287) provides an extension to +the instruction set of the base architecture. The coprocessor extends the +instruction set of the base architecture to support high-precision integer +and floating-point calculations. This extended instruction set includes +arithmetic, comparison, transcendental, and data transfer instructions. The +coprocessor also contains a set of useful constants to enhance the speed of +numeric calculations. + +A program contains instructions for the coprocessor in line with the +instructions for the CPU. The system executes these instructions in the same +order as they appear in the instruction stream. The coprocessor operates +concurrently with the CPU to provide maximum throughput for numeric +calculations. + +The 80386 also has features to support emulation of the numerics +coprocessor when the coprocessor is absent. The software emulation of the +coprocessor is transparent to application software but requires more time +for execution. Refer to Chapter 11 for more information on coprocessor +emulation. + +ESC (Escape) is a 5-bit sequence that begins the opcodes that identify +floating point numeric instructions. The ESC pattern tells the 80386 to send +the opcode and addresses of operands to the numerics coprocessor. The +numerics coprocessor uses the escape instructions to perform +high-performance, high-precision floating point arithmetic that conforms to +the IEEE floating point standard 754. + +WAIT (Wait) is an 80386 instruction that suspends program execution until +the 80386 CPU detects that the BUSY pin is inactive. This condition +indicates that the coprocessor has completed its processing task and that +the CPU may obtain the results. + + +Figure 3-23. Flag Format for PUSHF and POPF + + PUSHFD/POPFD + 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴좔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 + PUSHF/POPF + 旼컴컴컴컴컴컴컴컨컴컴컴컴컴컴컴커 + 31 23 15 7 0 + �袴袴袴袴袴袴袴曲袴袴袴袴袴錮錮錮錮錮袴袴佶佶佶佶佶佶佶佶佶佶佶佶� + � 쿣쿝� 쿙쿔D 쿚쿏쿔쿟쿞쿩� 쿌� 쿛� 쿎� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0� � �0� � � � � � � � �0� �0� �1� � + � 쿘쿑� 쿟� PL쿑쿑쿑쿑쿑쿑� 쿑� 쿑� 쿑� + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴鳩鳩鳩鳩鳩袴賈賈賈賈賈賈賈賈賈賈賈賈暠 + + BITS MARKED 0 AND 1 ARE RESERVED BY INTEL. DO NOT DEFINE. + + SYSTEMS FLAGS (INCLUDING THE IOPL FIELD, AND THE VM, RF, AND IF FLAGS) + ARE PUSHED AND ARE VISIBLE TO APPLICATIONS PROGRAMS. HOWEVER, WHEN AN + APPLICATIONS PROGRAM POPS THE FLAGS, THESE ITEMS ARE NOT CHANGED, + REGARDLESS OF THE VALUES POPPED INTO THEM. + + +3.10 Segment Register Instructions + +This category actually includes several distinct types of instructions. +These various types are grouped together here because, if systems designers +choose an unsegmented model of memory organization, none of these +instructions is used by applications programmers. The instructions that deal +with segment registers are: + +1. Segment-register transfer instructions. + + MOV SegReg, ... + MOV ..., SegReg + PUSH SegReg + POP SegReg + +2. Control transfers to another executable segment. + + JMP far ; direct and indirect + CALL far + RET far + +3. Data pointer instructions. + + LDS + LES + LFS + LGS + LSS + +Note that the following interrupt-related instructions are different; all +are capable of transferring control to another segment, but the use of +segmentation is not apparent to the applications programmer. + +INT n +INTO +BOUND +IRET + + +3.10.1 Segment-Register Transfer Instructions + +The MOV, POP, and PUSH instructions also serve to load and store segment +registers. These variants operate similarly to their general-register +counterparts except that one operand can be a segment register. MOV cannot +move segment register to a segment register. Neither POP nor MOV can place a +value in the code-segment register CS; only the far control-transfer +instructions can change CS. + + +3.10.2 Far Control Transfer Instructions + +The far control-transfer instructions transfer control to a location in +another segment by changing the content of the CS register. + +Direct far JMP. Direct JMP instructions that specify a target location +outside the current code segment contain a far pointer. This pointer +consists of a selector for the new code segment and an offset within the new +segment. + +Indirect far JMP. Indirect JMP instructions that specify a target location +outside the current code segment use a 48-bit variable to specify the far +pointer. + +Far CALL. An intersegment CALL places both the value of EIP and CS on the +stack. + +Far RET. An intersegment RET restores the values of both CS and EIP which +were saved on the stack by the previous intersegment CALL instruction. + + +3.10.3 Data Pointer Instructions + +The data pointer instructions load a pointer (consisting of a segment +selector and an offset) to a segment register and a general register. + +LDS (Load Pointer Using DS) transfers a pointer variable from the source +operand to DS and the destination register. The source operand must be a +memory operand, and the destination operand must be a general register. DS +receives the segment-selector of the pointer. The destination register +receives the offset part of the pointer, which points to a specific location +within the segment. + +Example: LDS ESI, STRING_X + +Loads DS with the selector identifying the segment pointed to by a +STRING_X, and loads the offset of STRING_X into ESI. Specifying ESI as the +destination operand is a convenient way to prepare for a string operation on +a source string that is not in the current data segment. + +LES (Load Pointer Using ES) operates identically to LDS except that ES +receives the segment selector rather than DS. + +Example: LES EDI, DESTINATION_X + +Loads ES with the selector identifying the segment pointed to by +DESTINATION_X, and loads the offset of DESTINATION_X into EDI. This +instruction provides a convenient way to select a destination for a string +operation if the desired location is not in the current extra segment. + +LFS (Load Pointer Using FS) operates identically to LDS except that FS +receives the segment selector rather than DS. + +LGS (Load Pointer Using GS) operates identically to LDS except that GS +receives the segment selector rather than DS. + +LSS (Load Pointer Using SS) operates identically to LDS except that SS +receives the segment selector rather than DS. This instruction is +especially important, because it allows the two registers that identify the +stack (SS:ESP) to be changed in one uninterruptible operation. Unlike the +other instructions which load SS, interrupts are not inhibited at the end +of the LSS instruction. The other instructions (e.g., POP SS) inhibit +interrupts to permit the following instruction to load ESP, thereby forming +an indivisible load of SS:ESP. Since both SS and ESP can be loaded by LSS, +there is no need to inhibit interrupts. + + +3.11 Miscellaneous Instructions + +The following instructions do not fit in any of the previous categories, +but are nonetheless useful. + + +3.11.1 Address Calculation Instruction + +LEA (Load Effective Address) transfers the offset of the source operand +(rather than its value) to the destination operand. The source operand must +be a memory operand, and the destination operand must be a general register. +This instruction is especially useful for initializing registers before the +execution of the string primitives (ESI, EDI) or the XLAT instruction (EBX). +The LEA can perform any indexing or scaling that may be needed. + +Example: LEA EBX, EBCDIC_TABLE + +Causes the processor to place the address of the starting location of the +table labeled EBCDIC_TABLE into EBX. + + +3.11.2 No-Operation Instruction + +NOP (No Operation) occupies a byte of storage but affects nothing but the +instruction pointer, EIP. + + +3.11.3 Translate Instruction + +XLAT (Translate) replaced a byte in the AL register with a byte from a +user-coded translation table. When XLAT is executed, AL should have the +unsigned index to the table addressed by EBX. XLAT changes the contents of +AL from table index to table entry. EBX is unchanged. The XLAT instruction +is useful for translating from one coding system to another such as from +ASCII to EBCDIC. The translate table may be up to 256 bytes long. The +value placed in the AL register serves as an index to the location of the +corresponding translation value. + + + PART II SYSTEMS PROGRAMMING + + +Chapter 4 Systems Architecture + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +Many of the architectural features of the 80386 are used only by systems +programmers. This chapter presents an overview of these aspects of the +architecture. + +The systems-level features of the 80386 architecture include: + + Memory Management + Protection + Multitasking + Input/Output + Exceptions and Interrupts + Initialization + Coprocessing and Multiprocessing + Debugging + +These features are implemented by registers and instructions, all of which +are introduced in the following sections. The purpose of this chapter is not +to explain each feature in detail, but rather to place the remaining +chapters of Part II in perspective. Each mention in this chapter of a +register or instruction is either accompanied by an explanation or a +reference to a following chapter where detailed information can be obtained. + + +4.1 Systems Registers + +The registers designed for use by systems programmers fall into these +classes: + + EFLAGS + Memory-Management Registers + Control Registers + Debug Registers + Test Registers + + +4.1.1 Systems Flags + +The systems flags of the EFLAGS register control I/O, maskable interrupts, +debugging, task switching, and enabling of virtual 8086 execution in a +protected, multitasking environment. These flags are highlighted in Figure +4-1. + +IF (Interrupt-Enable Flag, bit 9) + + Setting IF allows the CPU to recognize external (maskable) interrupt + requests. Clearing IF disables these interrupts. IF has no effect on + either exceptions or nonmaskable external interrupts. Refer to Chapter + 9 for more details about interrupts. + +NT (Nested Task, bit 14) + + The processor uses the nested task flag to control chaining of + interrupted and called tasks. NT influences the operation of the IRET + instruction. Refer to Chapter 7 and Chapter 9 for more information on + nested tasks. + +RF (Resume Flag, bit 16) + + The RF flag temporarily disables debug exceptions so that an instruction + can be restarted after a debug exception without immediately causing + another debug exception. Refer to Chapter 12 for details. + +TF (Trap Flag, bit 8) + + Setting TF puts the processor into single-step mode for debugging. In + this mode, the CPU automatically generates an exception after each + instruction, allowing a program to be inspected as it executes each + instruction. Single-stepping is just one of several debugging features of + the 80386. Refer to Chapter 12 for additional information. + +VM (Virtual 8086 Mode, bit 17) + + When set, the VM flag indicates that the task is executing an 8086 + program. Refer to Chapter 14 for a detailed discussion of how the 80386 + executes 8086 tasks in a protected, multitasking environment. + + +Figure 4-1. System Flags of EFLAGS Register + + 31 23 15 7 0 + �袴袴袴袴袴袴袴曲袴袴袴袴袴錮錮錮網錮袴袴佶佶佶佶懶佶佶佶佶佶佶佶� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇쿣쿝낢쿙쿔D 쿚쿏쿔쿟쿞쿩낢쿌낢쿛낢쿎� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0� � �0� � 낢낢� 낢낢낢�0낢�0낢�1낢� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇쿘쿑낢쿟� PL쿑쿑쿑쿑쿑쿑낢쿑낢쿑낢쿑� + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴局局群局鳩佶賈賈賈拮賈忙賈賈賈賈賈賈暠 + � � � � � + VIRTUAL 8086 MODE컴컴� � � � � + RESUME FLAG컴컴컴� � � � + NESTED TASK FLAG컴컴컴컴컴� � � + I/O PRIVILEGE LEVEL컴컴컴컴컴컴켸 � + INTERRUPT ENABLE컴컴컴컴컴컴컴컴컴컴켸 + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 +NOTE + 0 OR 1 INDICATES INTEL RESERVED. DO NOT DEFINE. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + + +4.1.2 Memory-Management Registers + +Four registers of the 80386 locate the data structures that control +segmented memory management: + +GDTR Global Descriptor Table Register +LDTR Local Descriptor Table Register + + These registers point to the segment descriptor tables GDT and LDT. + Refer to Chapter 5 for an explanation of addressing via descriptor + tables. + +IDTR Interrupt Descriptor Table Register + + This register points to a table of entry points for interrupt handlers + (the IDT). Refer to Chapter 9 for details of the interrupt mechanism. + +TR Task Register + + This register points to the information needed by the processor to define + the current task. Refer to Chapter 7 for a description of the + multitasking features of the 80386. + + +4.1.3 Control Registers + +Figure 4-2 shows the format of the 80386 control registers CR0, CR2, and +CR3. These registers are accessible to systems programmers only via variants +of the MOV instruction, which allow them to be loaded from or stored in +general registers; for example: + +MOV EAX, CR0 +MOV CR3, EBX + +CR0 contains system control flags, which control or indicate conditions +that apply to the system as a whole, not to an individual task. + +EM (Emulation, bit 2) + + EM indicates whether coprocessor functions are to be emulated. Refer to + Chapter 11 for details. + +ET (Extension Type, bit 4) + + ET indicates the type of coprocessor present in the system (80287 or + 80387). Refer to Chapter 11 and Chapter 10 for details. + +MP (Math Present, bit 1) + + MP controls the function of the WAIT instruction, which is used to + coordinate a coprocessor. Refer to Chapter 11 for details. + +PE (Protection Enable, bit 0) + + Setting PE causes the processor to begin executing in protected mode. + Resetting PE returns to real-address mode. Refer to Chapter 14 and + Chapter 10 for more information on changing processor modes. + +PG (Paging, bit 31) + + PG indicates whether the processor uses page tables to translate linear + addresses into physical addresses. Refer to Chapter 5 for a description + of page translation; refer to Chapter 10 for a discussion of how to set + PG. + +TS (Task Switched, bit 3) + + The processor sets TS with every task switch and tests TS when + interpreting coprocessor instructions. Refer to Chapter 11 for details. + +CR2 is used for handling page faults when PG is set. The processor stores +in CR2 the linear address that triggers the fault. Refer to Chapter 9 for a +description of page-fault handling. + +CR3 is used when PG is set. CR3 enables the processor to locate the page +table directory for the current task. Refer to Chapter 5 for a description +of page tables and page translation. + + +Figure 4-2. Control Registers + + 31 23 15 7 0 +�袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴箇袴袴袴曲袴袴袴袴袴袴袴袴敲 +� � � +� PAGE DIRECTORY BASE REGISTER (PDBR) � RESERVED 튏R3 +픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켕컴컴컴컴컴컴컴컴컴컴컴컴컴� +� � +� PAGE FAULT LINEAR ADDRESS 튏R2 +픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +� � +� RESERVED 튏R1 +픔쩡컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴쩡쩡쩡쩡쩡� +튡� 쿐쿟쿐쿘쿛� +튖� RESERVED 쿟쿞쿘쿛쿐튏R0 +훤鳩袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴鳩鳩鳩鳩鳩� + + +4.1.4 Debug Register + +The debug registers bring advanced debugging abilities to the 80386, +including data breakpoints and the ability to set instruction breakpoints +without modifying code segments. Refer to Chapter 12 for a complete +description of formats and usage. + + +4.1.5 Test Registers + +The test registers are not a standard part of the 80386 architecture. They +are provided solely to enable confidence testing of the translation +lookaside buffer (TLB), the cache used for storing information from page +tables. Chapter 12 explains how to use these registers. + + +4.2 Systems Instructions + +Systems instructions deal with such functions as: + + 1. Verification of pointer parameters (refer to Chapter 6): + + ARPL 컴 Adjust RPL + LAR 컴 Load Access Rights + LSL 컴 Load Segment Limit + VERR 컴 Verify for Reading + VERW 컴 Verify for Writing + + 2. Addressing descriptor tables (refer to Chaper 5): + + LLDT 컴 Load LDT Register + SLDT 컴 Store LDT Register + LGDT 컴 Load GDT Register + SGDT 컴 Store GDT Register + + 3. Multitasking (refer to Chapter 7): + + LTR 컴 Load Task Register + STR 컴 Store Task Register + + 4. Coprocessing and Multiprocessing (refer to Chapter 11): + + CLTS 컴 Clear Task-Switched Flag + ESC 컴 Escape instructions + WAIT 컴 Wait until Coprocessor not Busy + LOCK 컴 Assert Bus-Lock Signal + + 5. Input and Output (refer to Chapter 8): + + IN 컴 Input + OUT 컴 Output + INS 컴 Input String + OUTS 컴 Output String + + 6. Interrupt control (refer to Chapter 9): + + CLI 컴 Clear Interrupt-Enable Flag + STI 컴 Set Interrupt-Enable Flag + LIDT 컴 Load IDT Register + SIDT 컴 Store IDT Register + + 7. Debugging (refer to Chapter 12): + + MOV 컴 Move to and from debug registers + + 8. TLB testing (refer to Chapter 10): + + MOV 컴 Move to and from test registers + + 9. System Control: + + SMSW 컴 Set MSW + LMSW 컴 Load MSW + HLT 컴 Halt Processor + MOV 컴 Move to and from control registers + +The instructions SMSW and LMSW are provided for compatibility with the +80286 processor. 80386 programs access the MSW in CR0 via variants of the +MOV instruction. HLT stops the processor until receipt of an INTR or RESET +signal. + +In addition to the chapters cited above, detailed information about each of +these instructions can be found in the instruction reference chapter, +Chapter 17. + + +Chapter 5 Memory Management + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The 80386 transforms logical addresses (i.e., addresses as viewed by +programmers) into physical address (i.e., actual addresses in physical +memory) in two steps: + + � Segment translation, in which a logical address (consisting of a + segment selector and segment offset) are converted to a linear address. + + � Page translation, in which a linear address is converted to a physical + address. This step is optional, at the discretion of systems-software + designers. + +These translations are performed in a way that is not visible to +applications programmers. Figure 5-1 illustrates the two translations at a +high level of abstraction. + +Figure 5-1 and the remainder of this chapter present a simplified view of +the 80386 addressing mechanism. In reality, the addressing mechanism also +includes memory protection features. For the sake of simplicity, however, +the subject of protection is taken up in another chapter, Chapter 6. + + +Figure 5-1. Address Translation Overview + + 15 0 31 0 + LOGICAL �袴袴袴袴袴袴袴敲 �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + ADDRESS � SELECTOR � � OFFSET � + 훤袴袴袴袴袴袴袴� 훤袴佶袴袴袴袴袴袴袴袴袴袴袴袴暠 +  + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + � SEGMENT TRANSLATION � + 훤袴袴袴袴袴袴錮袴袴袴袴袴袴袴暠 + �袴鳩� PAGING ENABLED + 튡G ?픔컴컴컴컴컴컴컴컴컴커 + 훤錮暠 � + 31 PAGING  DISABLED 0 � + LINEAR �袴袴袴袴袴藁袴袴袴袴袴藁袴袴袴袴袴敲 � + ADDRESS � DIR � PAGE � OFFSET � � + 훤袴袴袴袴袴姦袴袴佶袴袴姦袴袴袴袴袴� � +  � + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� � + � PAGE TRANSLATION � � + 훤袴袴袴袴袴袴錮袴袴袴袴袴袴袴暠 � + �컴컴컴컴컴컴컴컴컴컴켸 + 31  0 + PHYSICAL �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + ADDRESS � � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 + + +5.1 Segment Translation + +Figure 5-2 shows in more detail how the processor converts a logical +address into a linear address. + +To perform this translation, the processor uses the following data +structures: + + � Descriptors + � Descriptor tables + � Selectors + � Segment Registers + + +5.1.1 Descriptors + +The segment descriptor provides the processor with the data it needs to map +a logical address into a linear address. Descriptors are created by +compilers, linkers, loaders, or the operating system, not by applications +programmers. Figure 5-3 illustrates the two general descriptor formats. All +types of segment descriptors take one of these formats. Segment-descriptor +fields are: + +BASE: Defines the location of the segment within the 4 gigabyte linear +address space. The processor concatenates the three fragments of the base +address to form a single 32-bit value. + +LIMIT: Defines the size of the segment. When the processor concatenates the +two parts of the limit field, a 20-bit value results. The processor +interprets the limit field in one of two ways, depending on the setting of +the granularity bit: + + 1. In units of one byte, to define a limit of up to 1 megabyte. + + 2. In units of 4 Kilobytes, to define a limit of up to 4 gigabytes. The + limit is shifted left by 12 bits when loaded, and low-order one-bits + are inserted. + +Granularity bit: Specifies the units with which the LIMIT field is +interpreted. When thebit is clear, the limit is interpreted in units of one +byte; when set, the limit is interpreted in units of 4 Kilobytes. + +TYPE: Distinguishes between various kinds of descriptors. + +DPL (Descriptor Privilege Level): Used by the protection mechanism (refer +to Chapter 6). + +Segment-Present bit: If this bit is zero, the descriptor is not valid for +use in address transformation; the processor will signal an exception when a +selector for the descriptor is loaded into a segment register. Figure 5-4 +shows the format of a descriptor when the present-bit is zero. The operating +system is free to use the locations marked AVAILABLE. Operating systems that +implement segment-based virtual memory clear the present bit in either of +these cases: + + � When the linear space spanned by the segment is not mapped by the + paging mechanism. + + � When the segment is not present in memory. + +Accessed bit: The processor sets this bit when the segment is accessed; +i.e., a selector for the descriptor is loaded into a segment register or +used by a selector test instruction. Operating systems that implement +virtual memory at the segment level may, by periodically testing and +clearing this bit, monitor frequency of segment usage. + +Creation and maintenance of descriptors is the responsibility of systems +software, usually requiring the cooperation of compilers, program loaders or +system builders, and therating system. + + +Figure 5-2. Segment Translation + + 15 0 31 0 + LOGICAL �袴袴袴袴袴袴袴袴� �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + ADDRESS � SELECTOR � � OFFSET � + 훤袴佶袴袴袴袴佶暠 훤袴袴袴袴袴袴袴袴袴佶袴袴袴袴袴袴袴袴� + 旼컴컴켸  � + � DESCRIPTOR TABLE � + � �袴袴袴袴袴袴� � + � � � � + � � � � + � � � � + � � � � + � 勁袴袴袴袴袴攷 � + � � SEGMENT � BASE �袴敲 � + 읕� DESCRIPTOR 픔컴컴컴컴컴컴�� + �컴컴컴� + 勁袴袴袴袴袴攷 ADDRESS 훤佶� + � � � + 훤袴袴袴袴袴暠 � +  + LINEAR �袴袴袴袴袴袴箇袴袴袴袴袴箇袴袴袴袴袴袴敲 + ADDRESS � DIR � PAGE � OFFSET � + 훤袴袴袴袴袴菰袴袴袴袴袴菰袴袴袴袴袴袴袴� + + +Figure 5-3. General Segment-Descriptor Format + + DESCRIPTORS USED FOR APPLICATIONS CODE AND DATA SEGMENTS + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴袴錮錮袴袴錮曲袴袴袴袴袴袴袴袴敲 + � � � � 쿌� � � � � � � � + � BASE 31..24 쿒쿦쿚쿣� LIMIT 쿛� DPL �1� TYPE쿌� BASE 23..16 � 4 + � � � � 쿗� 19..16 � � � � � � � + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔컴컴좔좔컴컴컴컴컴컴컴컴� + � � � + � SEGMENT BASE 15..0 � SEGMENT LIMIT 15..0 � 0 + � � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + DESCRIPTORS USED FOR SPECIAL SYSTEM SEGMENTS + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴袴錮錮袴袴袴曲袴袴袴袴袴袴袴袴敲 + � � � � 쿌� � � � � � � + � BASE 31..24 쿒쿦쿚쿣� LIMIT 쿛� DPL �0� TYPE � BASE 23..16 � 4 + � � � � 쿗� 19..16 � � � � � � + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔컴컴컴좔컴컴컴컴컴컴컴컴� + � � � + � SEGMENT BASE 15..0 � SEGMENT LIMIT 15..0 � 0 + � � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + A - ACCESSED + AVL - AVAILABLE FOR USE BY SYSTEMS PROGRAMMERS + DPL - DESCRIPTOR PRIVILEGE LEVEL + G - GRANULARITY + P - SEGMENT PRESENT + + +5.1.2 Descriptor Tables + +Segment descriptors are stored in either of two kinds of descriptor table: + + � The global descriptor table (GDT) + � A local descriptor table (LDT) + +A descriptor table is simply a memory array of 8-byte entries that contain +descriptors, as Figure 5-5 shows. A descriptor table is variable in length +and may contain up to 8192 (2^(13)) descriptors. The first entry of the GDT +(INDEX=0) is not used by the processor, however. + +The processor locates the GDT and the current LDT in memory by means of the +GDTR and LDTR registers. These registers store the base addresses of the +tables in the linear address space and store the segment limits. The +instructions LGDT and SGDT give access to the GDTR; the instructions LLDT +and SLDT give access to the LDTR. + + +Figure 5-4. Format of Not-Present Descriptor + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲錮袴袴錮錮袴袴袴曲袴袴袴袴袴袴袴袴敲 + � � � � � � � + � AVAILABLE 쿚� DPL 쿞� TYPE � AVAILABLE � 4 + � � � � � � � + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴좔좔컴컴좔좔컴컴컴좔컴컴컴컴컴컴컴컴� + � � + � AVAILABLE � 0 + � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + +Figure 5-5. Descriptor Tables + + GLOBAL DESCRIPTOR TABLE LOCAL DESCRIPTOR TABLE + �袴袴袴佶袴袴佶袴袴佶袴袴敲 �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � M � � � M + 훤袴袴袴袴袴賈袴袴袴袴袴袴� 훤袴袴袴袴袴賈袴袴袴袴袴袴� + | | | | + | | | | + �袴袴袴佶袴袴佶袴袴佶袴袴敲 �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � N + 3 � � � N + 3 + 勁袴袴錮袴袴曲袴袴錮袴袴袴� 勁袴袴錮袴袴曲袴袴錮袴袴袴� + � � � � � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � N + 2 � � � N + 2 + 勁袴袴錮袴袴曲袴袴錮袴袴袴� 勁袴袴錮袴袴曲袴袴錮袴袴袴� + � � � � � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � N + 1 � � � N + 1 + 勁袴袴錮袴袴曲袴袴錮袴袴袴� 勁袴袴錮袴袴曲袴袴錮袴袴袴� + � � � � � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � N � � � N + 훤袴袴袴袴袴賈袴袴袴袴袴袴� 훤袴袴袴袴袴賈袴袴袴袴袴袴� + | | | | + | | | | + �袴袴袴佶袴袴佶袴袴佶袴袴敲 �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � � � � � � + 픔컴컴컨컴(UNUSED)컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � � � � + 훤袴袴袴袴袴賈袴袴袴袴袴袴� 훤袴袴袴袴袴賈袴袴袴袴袴袴� +   + �袴袴袴袴袴袴袴袴袴袴敲 � �袴袴袴袴袴袴袴袴袴袴敲 � + � GDTR 픔켸 � LDTR 픔켸 + 훤袴袴袴袴袴袴袴袴袴袴� 훤袴袴袴袴袴袴袴袴袴袴� + + +5.1.3 Selectors + +The selector portion of a logical address identifies a descriptor by +specifying a descriptor table and indexing a descriptor within that table. +Selectors may be visible to applications programs as a field within a +pointer variable, but the values of selectors are usually assigned (fixed +up) by linkers or linking loaders. Figure 5-6 shows the format of a +selector. + +Index: Selects one of 8192 descriptors in a descriptor table. The processor +simply multiplies this index value by 8 (the length of a descriptor), and +adds the result to the base address of the descriptor table in order to +access the appropriate segment descriptor in the table. + +Table Indicator: Specifies to which descriptor table the selector refers. A +zero indicates the GDT; a one indicates the current LDT. + +Requested Privilege Level: Used by the protection mechanism. (Refer to +Chapter 6.) + +Because the first entry of the GDT is not used by the processor, a selector +that has an index of zero and a table indicator of zero (i.e., a selector +that points to the first entry of the GDT), can be used as a null selector. +The processor does not cause an exception when a segment register (other +than CS or SS) is loaded with a null selector. It will, however, cause an +exception when the segment register is used to access memory. This feature +is useful for initializing unused segment registers so as to trap accidental +references. + + +Figure 5-6. Format of a Selector + + 15 4 3 0 + �袴袴袴袴袴袴袴袴袴袴袴袴錮錮袴敲 + � 쿟� � + � INDEX � 쿝PL� + � 쿔� � + 훤袴袴袴袴袴袴袴袴袴袴袴袴鳩鳩袴� + + TI - TABLE INDICATOR + RPL - REQUESTOR'S PRIVILEGE LEVEL + + +Figure 5-7. Segment Registers + + 16-BIT VISIBLE + SELECTOR HIDDEN DESCRIPTOR + �袴袴袴袴袴袴袴袴箇袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + CS � � � + 픔컴컴컴컴컴컴컴켰컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + SS � � � + 픔컴컴컴컴컴컴컴켰컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + DS � � � + 픔컴컴컴컴컴컴컴켰컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + ES � � � + 픔컴컴컴컴컴컴컴켰컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + FS � � � + 픔컴컴컴컴컴컴컴켰컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + GS � � � + 훤袴袴袴袴袴袴袴菰袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + +5.1.4 Segment Registers + +The 80386 stores information from descriptors in segment registers, thereby +avoiding the need to consult a descriptor table every time it accesses +memory. + +Every segment register has a "visible" portion and an "invisible" portion, +as Figure 5-7 illustrates. The visible portions of these segment address +registers are manipulated by programs as if they were simply 16-bit +registers. The invisible portions are manipulated by the processor. + +The operations that load these registers are normal program instructions +(previously described in Chapter 3). These instructions are of two classes: + + 1. Direct load instructions; for example, MOV, POP, LDS, LSS, LGS, LFS. + These instructions explicitly reference the segment registers. + + 2. Implied load instructions; for example, far CALL and JMP. These + instructions implicitly reference the CS register, and load it with a + new value. + +Using these instructions, a program loads the visible part of the segment +register with a 16-bit selector. The processor automatically fetches the +base address, limit, type, and other information from a descriptor table and +loads them into the invisible part of the segment register. + +Because most instructions refer to data in segments whose selectors have +already been loaded into segment registers, the processor can add the +segment-relative offset supplied by the instruction to the segment base +address with no additional overhead. + + +5.2 Page Translation + +In the second phase of address transformation, the 80386 transforms a +linear address into a physical address. This phase of address transformation +implements the basic features needed for page-oriented virtual-memory +systems and page-level protection. + +The page-translation step is optional. Page translation is in effect only +when the PG bit of CR0 is set. This bit is typically set by the operating +system during software initialization. The PG bit must be set if the +operating system is to implement multiple virtual 8086 tasks, page-oriented +protection, or page-oriented virtual memory. + + +5.2.1 Page Frame + +A page frame is a 4K-byte unit of contiguous addresses of physical memory. +Pages begin onbyte boundaries and are fixed in size. + + +5.2.2 Linear Address + +A linear address refers indirectly to a physical address by specifying a +page table, a page within that table, and an offset within that page. Figure +5-8 shows the format of a linear address. + +Figure 5-9 shows how the processor converts the DIR, PAGE, and OFFSET +fields of a linear address into the physical address by consulting two +levels of page tables. The addressing mechanism uses the DIR field as an +index into a page directory, uses the PAGE field as an index into the page +table determined by the page directory, and uses the OFFSET field to address +a byte within the page determined by the page table. + + +Figure 5-8. Format of a Linear Address + + 31 22 21 12 11 0 + �袴袴袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴袴� + � � � � + � DIR � PAGE � OFFSET � + � � � � + 훤袴袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴暠 + + +Figure 5-9. Page Translation + + PAGE FRAME + �袴袴袴袴袴藁袴袴袴袴袴藁袴袴袴袴袴� �袴袴袴袴袴袴袴敲 + � DIR � PAGE � OFFSET � � � + 훤袴袴佶袴袴姦袴袴佶袴袴姦袴袴佶袴暠 � � + � � � � � + 旼컴컴컴컴컴컴� � 읕컴컴컴컴컴컴� PHYSICAL � + � � � ADDRESS � + � PAGE DIRECTORY � PAGE TABLE � � + � �袴袴袴袴袴袴袴敲 � �袴袴袴袴袴袴袴敲 � � + � � � � � � 훤袴袴袴袴袴袴袴� + � � � � 勁袴袴袴袴袴袴袴�  + � � � 읕�� PG TBL ENTRY 픔컴컴컴컴컴컴켸 + � 勁袴袴袴袴袴袴袴� 勁袴袴袴袴袴袴袴� + 읕� DIR ENTRY 픔커 � � + 勁袴袴袴袴袴袴袴� � � � + � � � � � + 훤袴袴袴袴袴袴袴� � 훤袴袴袴袴袴袴袴� +  �  +�袴袴袴敲 � 읕컴컴컴컴컴컴컴� +� CR3 픔컴컴컴켸 +훤袴袴袴� + + +5.2.3 Page Tables + +A page table is simply an array of 32-bit page specifiers. A page table is +itself a page, and therefore contains 4 Kilobytes of memory or at most 1K +32-bit entries. + +Two levels of tables are used to address a page of memory. At the higher +level is a page directory. The page directory addresses up to 1K page tables +of the second level. A page table of the second level addresses up to 1K +pages. All the tables addressed by one page directory, therefore, can +address 1M pages (2^(20)). Because each page contains 4K bytes 2^(12) +bytes), the tables of one page directory can span the entire physical +address space of the 80386 (2^(20) times 2^(12) = 2^(32)). + +The physical address of the current page directory is stored in the CPU +register CR3, also called the page directory base register (PDBR). Memory +management software has the option of using one page directory for all +tasks, one page directory for each task, or some combination of the two. +Refer to Chapter 10 for information on initialization of CR3. Refer to +Chapter 7 to see how CR3 can change for each task. + + +5.2.4 Page-Table Entries + +Entries in either level of page tables have the same format. Figure 5-10 +illustrates this format. + + +5.2.4.1 Page Frame Address + +The page frame address specifies the physical starting address of a page. +Because pages are located on 4K boundaries, the low-order 12 bits are always +zero. In a page directory, the page frame address is the address of a page +table. In a second-level page table, the page frame address is the address +of the page frame that contains the desired memory operand. + + +5.2.4.2 Present Bit + +The Present bit indicates whether a page table entry can be used in address +translation. P=1 indicates that the entry can be used. + +When P=0 in either level of page tables, the entry is not valid for address +translation, and the rest of the entry is available for software use; none +of the other bits in the entry is tested by the hardware. Figure 5-11 +illustrates the format of a page-table entry when P=0. + +If P=0 in either level of page tables when an attempt is made to use a +page-table entry for address translation, the processor signals a page +exception. In software systems that support paged virtual memory, the +page-not-present exception handler can bring the required page into physical +memory. The instruction that caused the exception can then be reexecuted. +Refer to Chapter 9 for more information on exception handlers. + +Note that there is no present bit for the page directory itself. The page +directory may be not-present while the associated task is suspended, but the +operating system must ensure that the page directory indicated by the CR3 +image in the TSS is present in physical memory before the task is +dispatched. Refer to Chapter 7 for an explanation of the TSS and task +dispatching. + + +Figure 5-10. Format of a Page Table Entry + + 31 12 11 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴佶袴袴袴佶袴佶佶佶袴佶佶佶� + � � � � � � 쿢쿝� � + � PAGE FRAME ADDRESS 31..12 � AVAIL �0 0쿏쿌�0 0�/�/쿛� + � � � � � � 쿞쿥� � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴賈袴袴袴賈袴賈賈賈袴賈賈賈暠 + + P - PRESENT + R/W - READ/WRITE + U/S - USER/SUPERVISOR + D - DIRTY + AVAIL - AVAILABLE FOR SYSTEMS PROGRAMMER USE + + NOTE: 0 INDICATES INTEL RESERVED. DO NOT DEFINE. + + +Figure 5-11. Invalid Page Table Entry + + 31 1 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴佶� + � � � + � AVAILABLE �0� + � � � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴賈暠 + + +5.2.4.3 Accessed and Dirty Bits + +These bits provide data about page usage in both levels of the page tables. +With the exception of the dirty bit in a page directory entry, these bits +are set by the hardware; however, the processor does not clear any of these +bits. + +The processor sets the corresponding accessed bits in both levels of page +tables to one before a read or write operation to a page. + +The processor sets the dirty bit in the second-level page table to one +before a write to an address covered by that page table entry. The dirty bit +in directory entries is undefined. + +An operating system that supports paged virtual memory can use these bits +to determine what pages to eliminate from physical memory when the demand +for memory exceeds the physical memory available. The operating system is +responsible for testing and clearing these bits. + +Refer to Chapter 11 for how the 80386 coordinates updates to the accessed +and dirty bits in multiprocessor systems. + + +5.2.4.4 Read/Write and User/Supervisor Bits + +These bits are not used for address translation, but are used for +page-level protection, which the processor performs at the same time as +address translation. Refer to Chapter 6 where protection is discussed in +detail. + + +5.2.5 Page Translation Cache + +For greatest efficiency in address translation, the processor stores the +most recently used page-table data in an on-chip cache. Only if the +necessary paging information is not in the cache must both levels of page +tables be referenced. + +The existence of the page-translation cache is invisible to applications +programmers but not to systems programmers; operating-system programmers +must flush the cache whenever the page tables are changed. The +page-translation cache can be flushed by either of two methods: + + 1. By reloading CR3 with a MOV instruction; for example: + + MOV CR3, EAX + + 2. By performing a task switch to a TSS that has a different CR3 image + than the current TSS. (Refer to Chapter 7 for more information on + task switching.) + + +5.3 Combining Segment and Page Translation + +Figure 5-12 combines Figure 5-2 and Figure 5-9 to summarize both phases +of the transformation from a logical address to a physical address when +paging is enabled. By appropriate choice of options and parameters to both +phases, memory-management software can implement several different styles of +memory management. + + +5.3.1 "Flat" Architecture + +When the 80386 is used to execute software designed for architectures that +don't have segments, it may be expedient to effectively "turn off" the +segmentation features of the 80386. The 80386 does not have a mode that +disables segmentation, but the same effect can be achieved by initially +loading the segment registers with selectors for descriptors that encompass +the entire 32-bit linear address space. Once loaded, the segment registers +don't need to be changed. The 32-bit offsets used by 80386 instructions are +adequate to address the entire linear-address space. + + +5.3.2 Segments Spanning Several Pages + +The architecture of the 80386 permits segments to be larger or smaller than +the size of a page (4 Kilobytes). For example, suppose a segment is used to +address and protect a large data structure that spans 132 Kilobytes. In a +software system that supports paged virtual memory, it is not necessary for +the entire structure to be in physical memory at once. The structure is +divided into 33 pages, any number of which may not be present. The +applications programmer does not need to be aware that the virtual memory +subsystem is paging the structure in this manner. + + +Figure 5-12. 80306 Addressing Machanism + + 16 0 32 0 + �袴袴袴袴袴袴袴袴袴袴箇袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� LOGICAL + � SELECTOR � OFFSET � ADDRESS + 훤袴錮袴袴袴袴袴佶袴菰袴袴袴袴袴袴袴袴袴袴佶袴袴袴袴袴袴袴暠 + 旼컴컴컴�  � + � DESCRIPTOR TABLE � + � �袴袴袴袴袴袴袴敲 � + � � � � + � � � � + � � � � + � � � � + � 勁袴袴袴袴袴袴袴� � + � � SEGMENT � �袴敲 � + 읕� DESCRIPTOR 픔컴컴컴�� + �컴컴컴컴컴� + 勁袴袴袴袴袴袴袴� 훤佶� + � � � + 훤袴袴袴袴袴袴袴� � +  PAGE FRAME + LINEAR �袴袴袴袴袴藁袴袴袴袴袴藁袴袴袴袴袴� �袴袴袴袴袴袴袴敲 + ADDRESS � DIR � PAGE � OFFSET � � � + 훤袴袴佶袴袴姦袴袴佶袴袴姦袴袴佶袴暠 � � + � � � � � + 旼컴컴컴컴컴컴� � 읕컴컴컴컴컴컴� PHYSICAL � + � � � ADDRESS � + � PAGE DIRECTORY � PAGE TABLE � � + � �袴袴袴袴袴袴袴敲 � �袴袴袴袴袴袴袴敲 � � + � � � � � � � � + � � � � � � 훤袴袴袴袴袴袴袴� + � � � � 勁袴袴袴袴袴袴袴�  + � � � 읕�� PG TBL ENTRY 픔컴컴컴컴컴컴켸 + � 勁袴袴袴袴袴袴袴� 勁袴袴袴袴袴袴袴� + 읕� DIR ENTRY 픔커 � � + 勁袴袴袴袴袴袴袴� � � � + � � � � � + 훤袴袴袴袴袴袴袴� � 훤袴袴袴袴袴袴袴� +  �  +�袴袴袴敲 � 읕컴컴컴컴컴컴컴� +� CR3 픔컴컴컴켸 +훤袴袴袴� + + +5.3.3 Pages Spanning Several Segments + +On the other hand, segments may be smaller than the size of a page. For +example, consider a small data structure such as a semaphore. Because of the +protection and sharing provided by segments (refer to Chapter 6), it may be +useful to create a separate segment for each semaphore. But, because a +system may need many semaphores, it is not efficient to allocate a page for +each. Therefore, it may be useful to cluster many related segments within a +page. + + +5.3.4 Non-Aligned Page and Segment Boundaries + +The architecture of the 80386 does not enforce any correspondence between +the boundaries of pages and segments. It is perfectly permissible for a page +to contain the end of one segment and the beginning of another. Likewise, a +segment may contain the end of one page and the beginning of another. + + +5.3.5 Aligned Page and Segment Boundaries + +Memory-management software may be simpler, however, if it enforces some +correspondence between page and segment boundaries. For example, if segments +are allocated only in units of one page, the logic for segment and page +allocation can be combined. There is no need for logic to account for +partially used pages. + + +5.3.6 Page-Table per Segment + +An approach to space management that provides even further simplification +of space-management software is to maintain a one-to-one correspondence +between segment descriptors and page-directory entries, as Figure 5-13 +illustrates. Each descriptor has a base address in which the low-order 22 +bits are zero; in other words, the base address is mapped by the first entry +of a page table. A segment may have any limit from 1 to 4 megabytes. +Depending on the limit, the segment is contained in from 1 to 1K page +frames. A task is thus limited to 1K segments (a sufficient number for many +applications), each containing up to 4 Mbytes. The descriptor, the +corresponding page-directory entry, and the corresponding page table can be +allocated and deallocated simultaneously. + + +Figure 5-13. Descriptor per Page Table + + PAGE FRAMES + �袴袴袴袴袴敲 + LDT PAGE DIRECTORY PAGE TABLES � � + �袴袴袴袴袴� �袴袴袴袴袴� �袴袴袴袴袴� � � + � � � � � � 旼훤袴袴袴袴袴� + 勁袴袴袴袴攷 勁袴袴袴袴攷 勁袴袴袴袴攷 � + � � � � � PTE 픔컴� �袴袴袴袴袴敲 + 勁袴袴袴袴攷 勁袴袴袴袴攷 勁袴袴袴袴攷 � � + � � � � � PTE 픔컴� � � + 勁袴袴袴袴攷 勁袴袴袴袴攷 勁袴袴袴袴攷 읕훤袴袴袴袴袴� + � � � � � PTE 픔컴� + 勁袴袴袴袴攷 勁袴袴袴袴攷 旼컴훤袴袴袴袴暠 � �袴袴袴袴袴敲 + 튒ESCRIPTOR픔컴컴�� PDE 픔컴� � � � + 勁袴袴袴袴攷 勁袴袴袴袴攷 � � � + 튒ESCRIPTOR픔컴컴�� PDE 픔컴� 읕훤袴袴袴袴袴� + 勁袴袴袴袴攷 勁袴袴袴袴攷 � �袴袴袴袴袴� + � � � � � � � �袴袴袴袴袴敲 + 勁袴袴袴袴攷 勁袴袴袴袴攷 � 勁袴袴袴袴攷 � � + � � � � � � � � � + 勁袴袴袴袴攷 勁袴袴袴袴攷 � 勁袴袴袴袴攷 旼훤袴袴袴袴袴� + � � � � � � PTE 픔컴� + 勁袴袴袴袴攷 勁袴袴袴袴攷 � 勁袴袴袴袴攷 �袴袴袴袴袴敲 + � � � � � � PTE 픔컴� � � + 훤袴袴袴袴暠 훤袴袴袴袴暠 읕컴훤袴袴袴袴暠 � � � + LDT PAGE DIRECTORY PAGE TABLES 읕훤袴袴袴袴袴� + PAGE FRAMES + + +Chapter 6 Protection + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +6.1 Why Protection? + +The purpose of the protection features of the 80386 is to help detect and +identify bugs. The 80386 supports sophisticated applications that may +consist of hundreds or thousands of program modules. In such applications, +the question is how bugs can be found and eliminated as quickly as possible +and how their damage can be tightly confined. To help debug applications +faster and make them more robust in production, the 80386 contains +mechanisms to verify memory accesses and instruction execution for +conformance to protection criteria. These mechanisms may be used or ignored, +according to system design objectives. + + +6.2 Overview of 80386 Protection Mechanisms + +Protection in the 80386 has five aspects: + + 1. Type checking + 2. Limit checking + 3. Restriction of addressable domain + 4. Restriction of procedure entry points + 5. Restriction of instruction set + +The protection hardware of the 80386 is an integral part of the memory +management hardware. Protection applies both to segment translation and to +page translation. + +Each reference to memory is checked by the hardware to verify that it +satisfies the protection criteria. All these checks are made before the +memory cycle is started; any violation prevents that cycle from starting and +results in an exception. Since the checks are performed concurrently with +address formation, there is no performance penalty. + +Invalid attempts to access memory result in an exception. Refer to +Chapter 9 for an explanation of the exception mechanism. The present +chapter defines the protection violations that lead to exceptions. + +The concept of "privilege" is central to several aspects of protection +(numbers 3, 4, and 5 in the preceeding list). Applied to procedures, +privilege is the degree to which the procedure can be trusted not to make a +mistake that might affect other procedures or data. Applied to data, +privilege is the degree of protection that a data structure should have +from less trusted procedures. + +The concept of privilege applies both to segment protection and to page +protection. + + +6.3 Segment-Level Protection + +All five aspects of protection apply to segment translation: + + 1. Type checking + 2. Limit checking + 3. Restriction of addressable domain + 4. Restriction of procedure entry points + 5. Restriction of instruction set + +The segment is the unit of protection, and segment descriptors store +protection parameters. Protection checks are performed automatically by the +CPU when the selector of a segment descriptor is loaded into a segment +register and with every segment access. Segment registers hold the +protection parameters of the currently addressable segments. + + +6.3.1 Descriptors Store Protection Parameters + +Figure 6-1 highlights the protection-related fields of segment descriptors. + +The protection parameters are placed in the descriptor by systems software +at the time a descriptor is created. In general, applications programmers do +not need to be concerned about protection parameters. + +When a program loads a selector into a segment register, the processor +loads not only the base address of the segment but also protection +information. Each segment register has bits in the invisible portion for +storing base, limit, type, and privilege level; therefore, subsequent +protection checks on the same segment do not consume additional clock +cycles. + + +Figure 6-1. Protection Fields of Segment Descriptors + + DATA SEGMENT DESCRIPTOR + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴袴錮袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + 볍굇굇굇굇굇굇굇굇낢낢낢쿌� LIMIT 낢� � TYPE 낢굇굇굇굇굇굇굇굇� + 볍굇BASE 31..24굇교G쿍�0쿣� 19..16 쿛� DPL � 낢굇BASE 23..16굇군 4 + 볍굇굇굇굇굇굇굇굇낢낢낢쿗� 낢� �1�0쿐쿥쿌낢굇굇굇굇굇굇굇굇� + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔좔좔좔좔컴컴컴컴컴컴컴컴� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� � + 볍굇굇굇켚EGMENT BASE 15..0굇굇굇굇교 SEGMENT LIMIT 15..0 � 0 + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + EXECUTABLE SEGMENT DESCRIPTOR + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴袴錮袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + 볍굇굇굇굇굇굇굇굇낢낢낢쿌� LIMIT 낢� � TYPE 낢굇굇굇굇굇굇굇굇� + 볍굇BASE 31..24굇교G쿏�0쿣� 19..16 쿛� DPL � 낢굇BASE 23..16굇군 4 + 볍굇굇굇굇굇굇굇굇낢낢낢쿗� 낢� �1�0쿎쿝쿌낢굇굇굇굇굇굇굇굇� + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔좔좔좔좔컴컴컴컴컴컴컴컴� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� � + 볍굇굇굇켚EGMENT BASE 15..0굇굇굇굇교 SEGMENT LIMIT 15..0 � 0 + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + SYSTEM SEGMENT DESCRIPTOR + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴袴錮錮袴袴袴曲袴袴袴袴袴袴袴袴敲 + 볍굇굇굇굇굇굇굇굇낢낢낢쿌� LIMIT 낢� � � 낢굇굇굇굇굇굇굇굇� + 볍굇BASE 31..24굇교G쿦�0쿣� 19..16 쿛� DPL �0� TYPE 낢굇BASE 23..16굇군 4 + 볍굇굇굇굇굇굇굇굇낢낢낢쿗� 낢� � � 낢굇굇굇굇굇굇굇굇� + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔컴컴컴좔컴컴컴컴컴컴컴컴� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� � + 볍굇굇굇켚EGMENT BASE 15..0굇굇굇굇교 SEGMENT LIMIT 15..0 � 0 + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + + A - ACCESSED E - EXPAND-DOWN + AVL - AVAILABLE FOR PROGRAMMERS USE G - GRANULARITY + B - BIG P - SEGMENT PRESENT + C - CONFORMING R - READABLE + D - DEFAULT W - WRITABLE + DPL - DESCRIPTOR PRIVILEGE LEVEL + + +6.3.1.1 Type Checking + +The TYPE field of a descriptor has two functions: + + 1. It distinguishes among different descriptor formats. + 2. It specifies the intended usage of a segment. + +Besides the descriptors for data and executable segments commonly used by +applications programs, the 80386 has descriptors for special segments used +by the operating system and for gates. Table 6-1 lists all the types defined +for system segments and gates. Note that not all descriptors define +segments; gate descriptors have a different purpose that is discussed later +in this chapter. + +The type fields of data and executable segment descriptors include bits +which further define the purpose of the segment (refer to Figure 6-1): + + � The writable bit in a data-segment descriptor specifies whether + instructions can write into the segment. + + � The readable bit in an executable-segment descriptor specifies + whether instructions are allowed to read from the segment (for example, + to access constants that are stored with instructions). A readable, + executable segment may be read in two ways: + + 1. Via the CS register, by using a CS override prefix. + + 2. By loading a selector of the descriptor into a data-segment register + (DS, ES, FS,or GS). + +Type checking can be used to detect programming errors that would attempt +to use segments in ways not intended by the programmer. The processor +examines type information on two kinds of occasions: + + 1. When a selector of a descriptor is loaded into a segment register. + Certain segment registers can contain only certain descriptor types; + for example: + + � The CS register can be loaded only with a selector of an executable + segment. + + � Selectors of executable segments that are not readable cannot be + loaded into data-segment registers. + + � Only selectors of writable data segments can be loaded into SS. + + 2. When an instruction refers (implicitly or explicitly) to a segment + register. Certain segments can be used by instructions only in certain + predefined ways; for example: + + � No instruction may write into an executable segment. + + � No instruction may write into a data segment if the writable bit is + not set. + + � No instruction may read an executable segment unless the readable bit + is set. + + +Table 6-1. System and Gate Descriptor Types + +Code Type of Segment or Gate + + 0 -reserved + 1 Available 286 TSS + 2 LDT + 3 Busy 286 TSS + 4 Call Gate + 5 Task Gate + 6 286 Interrupt Gate + 7 286 Trap Gate + 8 -reserved + 9 Available 386 TSS + A -reserved + B Busy 386 TSS + C 386 Call Gate + D -reserved + E 386 Interrupt Gate + F 386 Trap Gate + + +6.3.1.2 Limit Checking + +The limit field of a segment descriptor is used by the processor to prevent +programs from addressing outside the segment. The processor's interpretation +of the limit depends on the setting of the G (granularity) bit. For data +segments, the processor's interpretation of the limit depends also on the +E-bit (expansion-direction bit) and the B-bit (big bit) (refer to Table +6-2). + +When G=0, the actual limit is the value of the 20-bit limit field as it +appears in the descriptor. In this case, the limit may range from 0 to +0FFFFFH (2^(20) - 1 or 1 megabyte). When G=1, the processor appends 12 +low-order one-bits to the value in the limit field. In this case the actual +limit may range from 0FFFH (2^(12) - 1 or 4 kilobytes) to 0FFFFFFFFH(2^(32) +- 1 or 4 gigabytes). + +For all types of segments except expand-down data segments, the value of +the limit is one less than the size (expressed in bytes) of the segment. The +processor causes a general-protection exception in any of these cases: + + � Attempt to access a memory byte at an address > limit. + � Attempt to access a memory word at an address �limit. + � Attempt to access a memory doubleword at an address �(limit-2). + +For expand-down data segments, the limit has the same function but is +interpreted differently. In these cases the range of valid addresses is from +limit + 1 to either 64K or 2^(32) - 1 (4 Gbytes) depending on the B-bit. An +expand-down segment has maximum size when the limit is zero. + +The expand-down feature makes it possible to expand the size of a stack by +copying it to a larger segment without needing also to update intrastack +pointers. + +The limit field of descriptors for descriptor tables is used by the +processor to prevent programs from selecting a table entry outside the +descriptor table. The limit of a descriptor table identifies the last valid +byte of the last descriptor in the table. Since each descriptor is eight +bytes long, the limit value is N * 8 - 1 for a table that can contain up to +N descriptors. + +Limit checking catches programming errors such as runaway subscripts and +invalid pointer calculations. Such errors are detected when they occur, so +that identification of the cause is easier. Without limit checking, such +errors could corrupt other modules; the existence of such errors would not +be discovered until later, when the corrupted module behaves incorrectly, +and when identification of the cause is difficult. + + +Table 6-2. Useful Combinations of E, G, and B Bits + + +Case: 1 2 3 4 + +Expansion Direction U U D D +G-bit 0 1 0 1 +B-bit X X 0 1 + +Lower bound is: + 0 X X + LIMIT+1 X +shl(LIMIT,12,1)+1 X + +Upper bound is: + LIMIT X + shl(LIMIT,12,1) X + 64K-1 X + 4G-1 X + +Max seg size is: + 64K X + 64K-1 X + 4G-4K X + 4G X + +Min seg size is: + 0 X X + 4K X X + +shl (X, 12, 1) = shift X left by 12 bits inserting one-bits on the right + + +6.3.1.3 Privilege Levels + +The concept of privilege is implemented by assigning a value from zero to +three to key objects recognized by the processor. This value is called the +privilege level. The value zero represents the greatest privilege, the +value three represents the least privilege. The following +processor-recognized objects contain privilege levels: + + � Descriptors contain a field called the descriptor privilege level + (DPL). + + � Selectors contain a field called the requestor's privilege level + (RPL). The RPL is intended to represent the privilege level of + the procedure that originates a selector. + + � An internal processor register records the current privilege level + (CPL). Normally the CPL is equal to the DPL of the segment that + the processor is currently executing. CPL changes as control is + transferred to segments with differing DPLs. + +The processor automatically evaluates the right of a procedure to access +another segment by comparing the CPL to one or more other privilege levels. +The evaluation is performed at the time the selector of a descriptor is +loaded into a segment register. The criteria used for evaluating access to +data differs from that for evaluating transfers of control to executable +segments; therefore, the two types of access are considered separately in +the following sections. + +Figure 6-2 shows how these levels of privilege can be interpreted as rings +of protection. The center is for the segments containing the most critical +software, usually the kernel of the operating system. Outer rings are for +the segments of less critical software. + +It is not necessary to use all four privilege levels. Existing software +that was designed to use only one or two levels of privilege can simply +ignore the other levels offered by the 80386. A one-level system should use +privilege level zero; a two-level system should use privilege levels zero +and three. + + +Figure 6-2. Levels of Privilege + + TASK C + 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 � + � � APPLICATIONS � � + � � �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 � � + � � � CUSTOM EXTENSIONS � � � + � � � �袴袴袴袴袴袴袴袴袴袴袴敲 � � � + � � � � SYSTEM SERVICES � � � � + � � � � �袴袴袴袴袴敲 � � � � + � � � � � KERNAL � � � � � + 팠픔컴컴崙컴컴崙컴컴崙컴컴쩡컴컴崙컴컴崙컴컴崙컴컴똴� + � � � � � 쿗EVEL튛EVEL튛EVEL튛EVEL� � + � � � � � � 0 � 1 � 2 � 3 � � + � � � � 훤袴袴妄袴袴� � � � � + � � � � � � � � � + � � � 훤袴袴袴袴袴妄袴袴袴袴袴� � � � + � � � � � � � + � � 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� � � + � � � � � + TASK B� 훤袴袴袴袴袴袴袴袴袴袴袴鳩袴袴袴袴袴袴袴袴袴袴袴� 홚ASK A + 읕컴컴컴컴컴컴컴컴컴컴컴켸 읕컴컴컴컴컴컴컴컴컴컴컴켸 + + +6.3.2 Restricting Access to Data + +To address operands in memory, an 80386 program must load the selector of a +data segment into a data-segment register (DS, ES, FS, GS, SS). The +processor automatically evaluates access to a data segment by comparing +privilege levels. The evaluation is performed at the time a selector for the +descriptor of the target segment is loaded into the data-segment register. +As Figure 6-3 shows, three different privilege levels enter into this type +of privilege check: + + 1. The CPL (current privilege level). + + 2. The RPL (requestor's privilege level) of the selector used to specify + the target segment. + + 3. The DPL of the descriptor of the target segment. + +Instructions may load a data-segment register (and subsequently use the +target segment) only if the DPL of the target segment is numerically greater +than or equal to the maximum of the CPL and the selector's RPL. In other +words, a procedure can only access data that is at the same or less +privileged level. + +The addressable domain of a task varies as CPL changes. When CPL is zero, +data segments at all privilege levels are accessible; when CPL is one, only +data segments at privilege levels one through three are accessible; when CPL +is three, only data segments at privilege level three are accessible. This +property of the 80386 can be used, for example, to prevent applications +procedures from reading or changing tables of the operating system. + + +Figure 6-3. Privilege Check for Data Access + + 16-BIT VISIBLE + SELECTOR INVISIBLE DESCRIPTOR + �袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴藁袴藁袴袴袴袴袴敲 + CS � � 튏PL� � + 훤袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴姦佶姦袴袴袴袴袴� + � + TARGET SEGMENT SELECTOR � �袴袴袴袴袴敲 + �袴袴袴袴袴袴袴袴袴袴袴藁藁袴敲 읕컴컴컴� PRIVILEGE � + � INDEX � 튣PL픔컴컴컴컴컴컴컴컴컴컴�� CHECK � + 훤袴袴袴袴袴袴袴袴袴袴袴姦姦袴� 旼컴컴컴� BY CPU � + � 훤袴袴袴袴袴� + DATA SEGMENT DESCRIPTOR 旼컴� + � + 31 23 15 � 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴鳩錮袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + � � � � 쿌� LIMIT � � � TYPE � � + � BASE 31..24 쿒쿍�0쿣� 쿛� DPL � � BASE 23..16 � 4 + � � � � 쿗� 19..16 � � �1�0쿐쿥쿌� � + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔좔좔좔좔컴컴컴컴컴컴컴컴� + � � � + � SEGMENT BASE 15..0 � SEGMENT LIMIT 15..0 � 0 + � � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + + CPL - CURRENT PRIVILEGE LEVEL + RPL - REQUESTOR'S PRIVILEGE LEVEL + DPL - DESCRIPTOR PRIVILEGE LEVEL + + +6.3.2.1 Accessing Data in Code Segments + +Less common than the use of data segments is the use of code segments to +store data. Code segments may legitimately hold constants; it is not +possible to write to a segment described as a code segment. The following +methods of accessing data in code segments are possible: + + 1. Load a data-segment register with a selector of a nonconforming, + readable, executable segment. + + 2. Load a data-segment register with a selector of a conforming, + readable, executable segment. + + 3. Use a CS override prefix to read a readable, executable segment whose + selector is already loaded in the CS register. + +The same rules as for access to data segments apply to case 1. Case 2 is +always valid because the privilege level of a segment whose conforming bit +is set is effectively the same as CPL regardless of its DPL. Case 3 always +valid because the DPL of the code segment in CS is, by definition, equal to +CPL. + + +6.3.3 Restricting Control Transfers + +With the 80386, control transfers are accomplished by the instructions JMP, +CALL, RET, INT, and IRET, as well as by the exception and interrupt +mechanisms. Exceptions and interrupts are special cases that Chapter 9 +covers. This chapter discusses only JMP, CALL, and RET instructions. + +The "near" forms of JMP, CALL, and RET transfer within the current code +segment, and therefore are subject only to limit checking. The processor +ensures that the destination of the JMP, CALL, or RET instruction does not +exceed the limit of the current executable segment. This limit is cached in +the CS register; therefore, protection checks for near transfers require no +extra clock cycles. + +The operands of the "far" forms of JMP and CALL refer to other segments; +therefore, the processor performs privilege checking. There are two ways a +JMP or CALL can refer to another segment: + + 1. The operand selects the descriptor of another executable segment. + + 2. The operand selects a call gate descriptor. This gated form of + transfer is discussed in a later section on call gates. + +As Figure 6-4 shows, two different privilege levels enter into a privilege +check for a control transfer that does not use a call gate: + + 1. The CPL (current privilege level). + 2. The DPL of the descriptor of the target segment. + +Normally the CPL is equal to the DPL of the segment that the processor is +currently executing. CPL may, however, be greater than DPL if the conforming +bit is set in the descriptor of the current executable segment. The +processor keeps a record of the CPL cached in the CS register; this value +can be different from the DPL in the descriptor of the code segment. + +The processor permits a JMP or CALL directly to another segment only if one +of the following privilege rules is satisfied: + + � DPL of the target is equal to CPL. + + � The conforming bit of the target code-segment descriptor is set, and + the DPL of the target is less than or equal to CPL. + +An executable segment whose descriptor has the conforming bit set is called +a conforming segment. The conforming-segment mechanism permits sharing of +procedures that may be called from various privilege levels but should +execute at the privilege level of the calling procedure. Examples of such +procedures include math libraries and some exception handlers. When control +is transferred to a conforming segment, the CPL does not change. This is +the only case when CPL may be unequal to the DPL of the current executable +segment. + +Most code segments are not conforming. The basic rules of privilege above +mean that, for nonconforming segments, control can be transferred without a +gate only to executable segments at the same level of privilege. There is a +need, however, to transfer control to (numerically) smaller privilege +levels; this need is met by the CALL instruction when used with call-gate +descriptors, which are explained in the next section. The JMP instruction +may never transfer control to a nonconforming segment whose DPL does not +equal CPL. + + +Figure 6-4. Privilege Check for Control Transfer without Gate + + 16-BIT VISIBLE + SELECTOR INVISIBLE PART + �袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴藁袴藁袴袴袴袴袴敲 + � � 튏PL� � CS + 훤袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴姦佶姦袴袴袴袴袴� + � + � �袴袴袴袴袴敲 + 읕컴컴컴� PRIVILEGE � + 旼컴컴컴컴컴� CHECK � + � 旼컴� BY CPU � + CODE-SEGMENT DESCRIPTOR � � 훤袴袴袴袴袴� + � � + 31 23 15 � � 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴鳩錮袴袴妄袴曲袴袴袴袴袴袴袴袴敲 + � � � � 쿌� LIMIT � � � � � � + � BASE 31..24 쿒쿏�0쿣� 쿛� DPL � � � BASE 23..16 � 4 + � � � � 쿗� 19..16 � � �1�1쿎쿝쿌� � + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔좔좔좔좔컴컴컴컴컴컴컴컴� + � � � + � SEGMENT BASE 15..0 � SEGMENT LIMIT 15..0 � 0 + � � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + CPL - CURRENT PRIVILEGE LEVEL + DPL - DESCRIPTOR PRIVILEGE LEVEL + C - CONFORMING BIT + + +6.3.4 Gate Descriptors Guard Procedure Entry Points + +To provide protection for control transfers among executable segments +at different privilege levels, the 80386 uses gate descriptors. There are +four kinds of gate descriptors: + + � Call gates + � Trap gates + � Interrupt gates + � Task gates + +This chapter is concerned only with call gates. Task gates are used for +task switching, and therefore are discussed in Chapter 7. Chapter 9 +explains how trap gates and interrupt gates are used by exceptions and +interrupts. Figure 6-5 illustrates the format of a call gate. A call gate +descriptor may reside in the GDT or in an LDT, but not in the IDT. + +A call gate has two primary functions: + + 1. To define an entry point of a procedure. + 2. To specify the privilege level of the entry point. + +Call gate descriptors are used by call and jump instructions in the same +manner as code segment descriptors. When the hardware recognizes that the +destination selector refers to a gate descriptor, the operation of the +instruction is expanded as determined by the contents of the call gate. + +The selector and offset fields of a gate form a pointer to the entry point +of a procedure. A call gate guarantees that all transitions to another +segment go to a valid entry point, rather than possibly into the middle of a +procedure (or worse, into the middle of an instruction). The far pointer +operand of the control transfer instruction does not point to the segment +and offset of the target instruction; rather, the selector part of the +pointer selects a gate, and the offset is not used. Figure 6-6 illustrates +this style of addressing. + +As Figure 6-7 shows, four different privilege levels are used to check the +validity of a control transfer via a call gate: + + 1. The CPL (current privilege level). + + 2. The RPL (requestor's privilege level) of the selector used to specify + the call gate. + + 3. The DPL of the gate descriptor. + + 4. The DPL of the descriptor of the target executable segment. + +The DPL field of the gate descriptor determines what privilege levels can +use the gate. One code segment can have several procedures that are intended +for use by different privilege levels. For example, an operating system may +have some services that are intended to be used by applications, whereas +others may be intended only for use by other systems software. + +Gates can be used for control transfers to numerically smaller privilege +levels or to the same privilege level (though they are not necessary for +transfers to the same level). Only CALL instructions can use gates to +transfer to smaller privilege levels. A gate may be used by a JMP +instruction only to transfer to an executable segment with the same +privilege level or to a conforming segment. + +For a JMP instruction to a nonconforming segment, both of the following +privilege rules must be satisfied; otherwise, a general protection exception +results. + + MAX (CPL,RPL) � gate DPL + target segment DPL = CPL + +For a CALL instruction (or for a JMP instruction to a conforming segment), +both of the following privilege rules must be satisfied; otherwise, a +general protection exception results. + + MAX (CPL,RPL) � gate DPL + target segment DPL � CPL + + +Figure 6-5. Format of 80386 Call Gate + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲錮袴袴錮袴袴袴袴曲袴袴錮袴袴袴袴敲 + � � � � TYPE � � DWORD � + � OFFSET 31..16 쿛� DPL � �0 0 0� � 4 + � � � �0 1 1 0 0� � COUNT � + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴탠좔컴컴좔컴컴컴컴좔컴컴좔컴컴컴컴� + � � � + � SELECTOR � OFFSET 15..0 � 0 + � � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + + +Figure 6-6. Indirect Transfer via Call Gate + + OPCODE OFFSET SELECTOR + �袴袴袴袴藁袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴箇袴袴袴箇箇袴� + � CALL � (NOT USED) � INDEX � 튣PL� + 훤袴袴袴袴姦袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴菰袴錮袴菰菰袴暠 + � + DESCRIPTOR TABLE � + �袴袴袴佶袴袴佶袴袴佶袴袴敲 � + � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� � + � � � � + 훤袴袴袴袴袴賈袴袴袴袴袴袴� � +   � +   � +   � + �袴袴袴袴袴袴佶袴袴佶袴袴敲 � + GATE � OFFSET � DPL 쿎OUNT �컴컴컴컴컴컴켸 EXECUTABLE + DESCRIPTOR 픔컴컴컴컴컴컵컴컴컨컴컴컴� SEGMENT + 旼컴컴캘 SELECTOR � OFFSET 픔컴컴� �袴袴袴袴袴袴袴� + � 勁袴袴錮袴袴曲袴袴錮袴袴袴� � � � + � � � � � � � � � + � 픔컴컴컨컴컴컵컴컴컨컴컴컴� � � � + � � � � � � � + � 勁袴袴錮袴袴曲袴袴錮袴袴袴� � � � + � � � � � � 읕컴컴컴컴� PROCEDURE � + � 픔컴컴컨컴컴컵컴컴컨컴컴컴� � � + � � � � � � +  勁袴袴錮袴袴曲袴袴錮袴袴袴� � � + EXECUTABLE � BASE � � DPL � BASE � � � + SEGMENT 픔컴컴컨컴컴컵컴컴컨컴컴컴� 旼컴컴컴컴훤袴袴袴袴袴袴暠 + DESCRIPTOR � BASE � 픔컴컴� + 훤袴袴袴袴袴賈袴袴袴袴袴袴� +   +   +   + �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� + � � � + 훤袴袴袴袴袴賈袴袴袴袴袴袴� + + +Figure 6-7. Privilege Check via Call Gate + + 16-BIT VISIBLE + SELECTOR INVISIBLE DESCRIPTOR + �袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴袴藁袴藁袴袴袴袴袴敲 + CS � � 튏PL� � + 훤袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴姦佶姦袴袴袴袴袴� + � + TARGET SELECTOR � �袴袴袴袴袴敲 + �袴袴袴袴袴袴袴袴袴袴袴藁藁袴敲 읕컴컴컴� PRIVILEGE � + � INDEX � 튣PL픔컴컴컴컴컴컴컴컴컴컴�� CHECK � + 훤袴袴袴袴袴袴袴袴袴袴袴姦姦袴� 旼컴컴컴컴컴컴컴컴�� BY � + � 旼�� CPU � + 旼컴컴켸 � 훤袴袴袴袴袴� + � � + GATE DESCRIPTOR  � + �袴袴袴袴袴袴袴袴袴袴袴藁袴袴袴袴袴箇袴袴袴袴袴� � + � OFFSET � DPL � COUNT � � + 勁袴袴袴袴袴袴袴袴袴袴袴胱袴袴袴袴菰袴袴袴袴袴攷 � + � SELECTOR � OFFSET � � + 훤袴袴袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴袴暠 � + � + � + �袴袴袴袴袴藁袴袴袴袴袴藁袴袴賈袴袴箇袴袴袴袴袴� + EXECUTABLE � BASE � LIMIT � DPL � BASE � + SEGMENT 勁袴袴袴袴袴姦袴袴袴袴袴胱袴袴袴袴菰袴袴袴袴袴攷 + DESCRIPTOR � BASE � LIMIT � + 훤袴袴袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴袴暠 + + CPL - CURRENT PRIVILEGE LEVEL + RPL - REQUESTOR'S PRIVILEGE LEVEL + DPL - DESCRIPTOR PRIVILEGE LEVEL + + +6.3.4.1 Stack Switching + +If the destination code segment of the call gate is at a different +privilege level than the CPL, an interlevel transfer is being requested. + +To maintain system integrity, each privilege level has a separate stack. +These stacks assure sufficient stack space to process calls from less +privileged levels. Without them, a trusted procedure would not work +correctly if the calling procedure did not provide sufficient space on the +caller's stack. + +The processor locates these stacks via the task state segment (see Figure +6-8). Each task has a separate TSS, thereby permitting tasks to have +separate stacks. Systems software is responsible for creating TSSs and +placing correct stack pointers in them. The initial stack pointers in the +TSS are strictly read-only values. The processor never changes them during +the course of execution. + +When a call gate is used to change privilege levels, a new stack is +selected by loading a pointer value from the Task State Segment (TSS). The +processor uses the DPL of the target code segment (the new CPL) to index the +initial stack pointer for PL 0, PL 1, or PL 2. + +The DPL of the new stack data segment must equal the new CPL; if it does +not, a stack exception occurs. It is the responsibility of systems software +to create stacks and stack-segment descriptors for all privilege levels that +are used. Each stack must contain enough space to hold the old SS:ESP, the +return address, and all parameters and local variables that may be required +to process a call. + +As with intralevel calls, parameters for the subroutine are placed on the +stack. To make privilege transitions transparent to the called procedure, +the processor copies the parameters to the new stack. The count field of a +call gate tells the processor how many doublewords (up to 31) to copy from +the caller's stack to the new stack. If the count is zero, no parameters are +copied. + +The processor performs the following stack-related steps in executing an +interlevel CALL. + + 1. The new stack is checked to assure that it is large enough to hold + the parameters and linkages; if it is not, a stack fault occurs with + an error code of 0. + + 2. The old value of the stack registers SS:ESP is pushed onto the new + stack as two doublewords. + + 3. The parameters are copied. + + 4. A pointer to the instruction after the CALL instruction (the former + value of CS:EIP) is pushed onto the new stack. The final value of + SS:ESP points to this return pointer on the new stack. + +Figure 6-9 illustrates the stack contents after a successful interlevel +call. + +The TSS does not have a stack pointer for a privilege level 3 stack, +because privilege level 3 cannot be called by any procedure at any other +privilege level. + +Procedures that may be called from another privilege level and that require +more than the 31 doublewords for parameters must use the saved SS:ESP link +to access all parameters beyond the last doubleword copied. + +A call via a call gate does not check the values of the words copied onto +the new stack. The called procedure should check each parameter for +validity. A later section discusses how the ARPL, VERR, VERW, LSL, and LAR +instructions can be used to check pointer values. + + +Figure 6-8. Initial Stack Pointers of TSS + + 31 23 15 7 0 + �袴袴袴袴妄袴袴袴曲袴袴袴袴妄袴袴袴敲64 +   +   +   + � � + 勁袴袴袴曲袴袴袴袴妄袴袴袴曲袴袴袴袴� + � EFLAGS �24 + 勁袴袴袴曲袴袴袴袴妄袴袴袴曲袴袴袴袴� + � INSTRUCTION POINTER (EIP) �20 + 勁袴袴袴曲袴袴袴袴妄袴袴袴曲袴袴袴袴� + � CR3 (PDBR) �1C + 勁袴袴袴曲袴袴袴袴箇袴袴袴曲袴袴藁袴� 커 + �00000000 00000000� SS2 �10�18 � + 勁袴袴袴曲袴袴袴袴姦袴袴袴曲袴袴菰袴� � + � ESP2 �14 � + 勁袴袴袴曲袴袴袴袴箇袴袴袴曲袴袴藁袴� � + �00000000 00000000� SS1 �01�10 � INITIAL + 勁袴袴袴曲袴袴袴袴姦袴袴袴曲袴袴菰袴� 쳐 STACK + � ESP1 �0C � POINTERS + 勁袴袴袴曲袴袴袴袴箇袴袴袴曲袴袴藁袴� � + �00000000 00000000� SS0 �00�8 � + 勁袴袴袴曲袴袴袴袴姦袴袴袴曲袴袴菰袴� � + � ESP0 �4 � + 勁袴袴袴曲袴袴袴袴箇袴袴袴曲袴袴袴袴� 켸 + �00000000 00000000� TSS BACK LINK �0 + 훤袴袴袴曲袴袴袴袴姦袴袴袴曲袴袴袴袴� + + +Figure 6-9. Stack Contents after an Interlevel Call + + 31 0 SS:ESP + �袴袴袴曲袴袴袴敲컴FROM TSS + 31 0 볍굇굇굇쿚LD SS � + �袴袴袴曲袴袴袴敲 勁袴袴袴妄袴袴袴� + D O � � � OLD ESP � + I F � � 勁袴袴袴妄袴袴袴� + R � � � PARM 3 � + E E � � 勁袴袴袴妄袴袴袴� + C X � � � PARM 2 � + T P 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + I A � PARM 3 � � PARM 1 � + O N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + N S � PARM 2 � 볍굇굇굇쿚LD CS � NEW + I 勁袴袴袴妄袴袴袴� OLD 勁袴袴袴妄袴袴袴� SS:ESP + � O � PARM 1 � SS:ESP � OLD EIP � � + � N 勁袴袴袴妄袴袴袴�컴켸 勁袴袴袴妄袴袴袴�컴컴켸 + � � � � � +  � � � � + 훤袴袴袴妄袴袴袴� 훤袴袴袴妄袴袴袴� + OLD STACK NEW STACK + + +6.3.4.2 Returning from a Procedure + +The "near" forms of the RET instruction transfer control within the current +code segment and therefore are subject only to limit checking. The offset of +the instruction following the corresponding CALL, is popped from the stack. +The processor ensures that this offset does not exceed the limit of the +current executable segment. + +The "far" form of the RET instruction pops the return pointer that was +pushed onto the stack by a prior far CALL instruction. Under normal +conditions, the return pointer is valid, because of its relation to the +prior CALL or INT. Nevertheless, the processor performs privilege checking +because of the possibility that the current procedure altered the pointer or +failed to properly maintain the stack. The RPL of the CS selector popped +off the stack by the return instruction identifies the privilege level of +the calling procedure. + +An intersegment return instruction can change privilege levels, but only +toward procedures of lesser privilege. When the RET instruction encounters a +saved CS value whose RPL is numerically greater than the CPL, an interlevel +return occurs. Such a return follows these steps: + + 1. The checks shown in Table 6-3 are made, and CS:EIP and SS:ESP are + loaded with their former values that were saved on the stack. + + 2. The old SS:ESP (from the top of the current stack) value is adjusted + by the number of bytes indicated in the RET instruction. The resulting + ESP value is not compared to the limit of the stack segment. If ESP is + beyond the limit, that fact is not recognized until the next stack + operation. (The SS:ESP value of the returning procedure is not + preserved; normally, this value is the same as that contained in the + TSS.) + + 3. The contents of the DS, ES, FS, and GS segment registers are checked. + If any of these registers refer to segments whose DPL is greater than + the new CPL (excluding conforming code segments), the segment register + is loaded with the null selector (INDEX = 0, TI = 0). The RET + instruction itself does not signal exceptions in these cases; + however, any subsequent memory reference that attempts to use a + segment register that contains the null selector will cause a general + protection exception. This prevents less privileged code from + accessing more privileged segments using selectors left in the + segment registers by the more privileged procedure. + + +6.3.5 Some Instructions are Reserved for Operating System + +Instructions that have the power to affect the protection mechanism or to +influence general system performance can only be executed by trusted +procedures. The 80386 has two classes of such instructions: + + 1. Privileged instructions 컴 those used for system control. + + 2. Sensitive instructions 컴 those used for I/O and I/O related + activities. + + +Table 6-3. Interlevel Return Checks + + +Type of Check Exception +SF Stack Fault +GP General Protection Exception +NP Segment-Not-Present Exception Error Code + +ESP is within current SS segment SF 0 +ESP + 7 is within current SS segment SF 0 +RPL of return CS is greater than CPL GP Return CS +Return CS selector is not null GP Return CS +Return CS segment is within descriptor +table limit GP Return CS +Return CS descriptor is a code segment GP Return CS +Return CS segment is present NP Return CS +DPL of return nonconforming code +segment = RPL of return CS, or DPL of +return conforming code segment � RPL +of return CS GP Return CS +ESP + N + 15 is within SS segment +N Immediate Operand of RET N Instruction SF Return SS +SS selector at ESP + N + 12 is not null GP Return SS +SS selector at ESP + N + 12 is within +descriptor table limit GP Return SS +SS descriptor is writable data segment GP Return SS +SS segment is present SF Return SS +Saved SS segment DPL = RPL of saved +CS GP Return SS +Saved SS selector RPL = Saved SS +segment DPL GP Return SS + + +6.3.5.1 Privileged Instructions + +The instructions that affect system data structures can only be executed +when CPL is zero. If the CPU encounters one of these instructions when CPL +is greater than zero, it signals a general protection exception. These +instructions include: + + CLTS 컴 Clear Task훁witched Flag + HLT 컴 Halt Processor + LGDT 컴 Load GDL Register + LIDT 컴 Load IDT Register + LLDT 컴 Load LDT Register + LMSW 컴 Load Machine Status Word + LTR 컴 Load Task Register + MOV to/from CRn 컴 Move to Control Register n + MOV to /from DRn 컴 Move to Debug Register n + MOV to/from TRn 컴 Move to Test Register n + + +6.3.5.2 Sensitive Instructions + +Instructions that deal with I/O need to be restricted but also need to be +executed by procedures executing at privilege levels other than zero. The +mechanisms for restriction of I/O operations are covered in detail in +Chapter 8, "Input/Output". + + +6.3.6 Instructions for Pointer Validation + +Pointer validation is an important part of locating programming errors. +Pointer validation is necessary for maintaining isolation between the +privilege levels. Pointer validation consists of the following steps: + + 1. Check if the supplier of the pointer is entitled to access the + segment. + + 2. Check if the segment type is appropriate to its intended use. + + 3. Check if the pointer violates the segment limit. + +Although the 80386 processor automatically performs checks 2 and 3 during +instruction execution, software must assist in performing the first check. +The unprivileged instruction ARPL is provided for this purpose. Software can +also explicitly perform steps 2 and 3 to check for potential violations +(rather than waiting for an exception). The unprivileged instructions LAR, +LSL, VERR, and VERW are provided for this purpose. + +LAR (Load Access Rights) is used to verify that a pointer refers to a +segment of the proper privilege level and type. LAR has one operand컴a +selector for a descriptor whose access rights are to be examined. The +descriptor must be visible at the privilege level which is the maximum of +the CPL and the selector's RPL. If the descriptor is visible, LAR obtains a +masked form of the second doubleword of the descriptor, masks this value +with 00FxFF00H, stores the result into the specified 32-bit destination +register, and sets the zero flag. (The x indicates that the corresponding +four bits of the stored value are undefined.) Once loaded, the access-rights +bits can be tested. All valid descriptor types can be tested by the LAR +instruction. If the RPL or CPL is greater than DPL, or if the selector is +outside the table limit, no access-rights value is returned, and the zero +flag is cleared. Conforming code segments may be accessed from any privilege +level. + +LSL (Load Segment Limit) allows software to test the limit of a descriptor. +If the descriptor denoted by the given selector (in memory or a register) is +visible at the CPL, LSL loads the specified 32-bit register with a 32-bit, +byte granular, unscrambled limit that is calculated from fragmented limit +fields and the G-bit of that descriptor. This can only be done for segments +(data, code, task state, and local descriptor tables); gate descriptors are +inaccessible. (Table 6-4 lists in detail which types are valid and which +are not.) Interpreting the limit is a function of the segment type. For +example, downward expandable data segments treat the limit differently than +code segments do. For both LAR and LSL, the zero flag (ZF) is set if the +loading was performed; otherwise, the ZF is cleared. + + +Table 6-4. Valid Descriptor Types for LSL + + Type Descriptor Type Valid? + Code + + 0 (invalid) NO + 1 Available 286 TSS YES + 2 LDT YES + 3 Busy 286 TSS YES + 4 286 Call Gate NO + 5 Task Gate NO + 6 286 Trap Gate NO + 7 286 Interrupt Gate NO + 8 (invalid) NO + 9 Available 386 TSS YES + A (invalid) NO + B Busy 386 TSS YES + C 386 Call Gate NO + D (invalid) NO + E 386 Trap Gate NO + F 386 Interrupt Gate NO + + +6.3.6.1 Descriptor Validation + +The 80386 has two instructions, VERR and VERW, which determine whether a +selector points to a segment that can be read or written at the current +privilege level. Neither instruction causes a protection fault if the result +is negative. + +VERR (Verify for Reading) verifies a segment for reading and loads ZF with +1 if that segment is readable from the current privilege level. VERR checks +that: + + � The selector points to a descriptor within the bounds of the GDT or + LDT. + + � It denotes a code or data segment descriptor. + + � The segment is readable and of appropriate privilege level. + +The privilege check for data segments and nonconforming code segments is +that the DPL must be numerically greater than or equal to both the CPL and +the selector's RPL. Conforming segments are not checked for privilege level. + +VERW (Verify for Writing) provides the same capability as VERR for +verifying writability. Like the VERR instruction, VERW loads ZF if the +result of the writability check is positive. The instruction checks that the +descriptor is within bounds, is a segment descriptor, is writable, and that +its DPL is numerically greater or equal to both the CPL and the selector's +RPL. Code segments are never writable, conforming or not. + + +6.3.6.2 Pointer Integrity and RPL + +The Requestor's Privilege Level (RPL) feature can prevent inappropriate use +of pointers that could corrupt the operation of more privileged code or data +from a less privileged level. + +A common example is a file system procedure, FREAD (file_id, n_bytes, +buffer_ptr). This hypothetical procedure reads data from a file into a +buffer, overwriting whatever is there. Normally, FREAD would be available at +the user level, supplying only pointers to the file system procedures and +data located and operating at a privileged level. Normally, such a procedure +prevents user-level procedures from directly changing the file tables. +However, in the absence of a standard protocol for checking pointer +validity, a user-level procedure could supply a pointer into the file tables +in place of its buffer pointer, causing the FREAD procedure to corrupt them +unwittingly. + +Use of RPL can avoid such problems. The RPL field allows a privilege +attribute to be assigned to a selector. This privilege attribute would +normally indicate the privilege level of the code which generated the +selector. The 80386 processor automatically checks the RPL of any selector +loaded into a segment register to determine whether the RPL allows access. + +To take advantage of the processor's checking of RPL, the called procedure +need only ensure that all selectors passed to it have an RPL at least as +high (numerically) as the original caller's CPL. This action guarantees that +selectors are not more trusted than their supplier. If one of the selectors +is used to access a segment that the caller would not be able to access +directly, i.e., the RPL is numerically greater than the DPL, then a +protection fault will result when that selector is loaded into a segment +register. + +ARPL (Adjust Requestor's Privilege Level) adjusts the RPL field of a +selector to become the larger of its original value and the value of the RPL +field in a specified register. The latter is normally loaded from the image +of the caller's CS register which is on the stack. If the adjustment changes +the selector's RPL, ZF (the zero flag) is set; otherwise, ZF is cleared. + + +6.4 Page-Level Protection + +Two kinds of protection are related to pages: + + 1. Restriction of addressable domain. + 2. Type checking. + + +6.4.1 Page-Table Entries Hold Protection Parameters + +Figure 6-10 highlights the fields of PDEs and PTEs that control access to +pages. + + +Figure 6-10. Protection Fields of Page Table Entries + + 31 12 11 7 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴妄袴袴袴佶袴佶佶佶袴佶佶佶� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교굇굇굇교굇교교교굇교U쿝낢� + 볍굇굇켗AGE FRAME ADDRESS 31..12굇굇굇교켂VAIL교0�0쿏쿌�0�0�/�/쿛� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교굇굇굇교굇교교교굇교S쿥낢� + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴曲袴袴袴賈袴賈賈賈袴賈賈賈暠 + R/W - READ/WRITE + U/S - USER/SUPERVISOR + + +6.4.1.1 Restricting Addressable Domain + +The concept of privilege for pages is implemented by assigning each page to +one of two levels: + + 1. Supervisor level (U/S=0) 컴 for the operating system and other systems + software and related data. + + 2. User level (U/S=1) 컴 for applications procedures and data. + +The current level (U or S) is related to CPL. If CPL is 0, 1, or 2, the +processor is executing at supervisor level. If CPL is 3, the processor is +executing at user level. + +When the processor is executing at supervisor level, all pages are +addressable, but, when the processor is executing at user level, only pages +that belong to the user level are addressable. + + +6.4.1.2 Type Checking + +At the level of page addressing, two types are defined: + + 1. Read-only access (R/W=0) + 2. Read/write access (R/W=1) + +When the processor is executing at supervisor level, all pages are both +readable and writable. When the processor is executing at user level, only +pages that belong to user level and are marked for read/write access are +writable; pages that belong to supervisor level are neither readable nor +writable from user level. + + +6.4.2 Combining Protection of Both Levels of Page Tables + +For any one page, the protection attributes of its page directory entry may +differ from those of its page table entry. The 80386 computes the effective +protection attributes for a page by examining the protection attributes in +both the directory and the page table. Table 6-5 shows the effective +protection provided by the possible combinations of protection attributes. + + +6.4.3 Overrides to Page Protection + +Certain accesses are checked as if they are privilege-level 0 references, +even if CPL = 3: + + � LDT, GDT, TSS, IDT references. + � Access to inner stack during ring-crossing CALL/INT. + + +6.5 Combining Page and Segment Protection + +When paging is enabled, the 80386 first evaluates segment protection, then +evaluates page protection. If the processor detects a protection violation +at either the segment or the page level, the requested operation cannot +proceed; a protection exception occurs instead. + +For example, it is possible to define a large data segment which has some +subunits that are read-only and other subunits that are read-write. In this +case, the page directory (or page table) entries for the read-only subunits +would have the U/S and R/W bits set to x0, indicating no write rights for +all the pages described by that directory entry (or for individual pages). +This technique might be used, for example, in a UNIX-like system to define +a large data segment, part of which is read only (for shared data or ROMmed +constants). This enables UNIX-like systems to define a "flat" data space as +one large segment, use "flat" pointers to address within this "flat" space, +yet be able to protect shared data, shared files mapped into the virtual +space, and supervisor areas. + + +Table 6-5. Combining Directory and Page Protection + +Page Directory Entry Page Table Entry Combined Protection + U/S R/W U/S R/W U/S R/W + + S-0 R-0 S-0 R-0 S x + S-0 R-0 S-0 W-1 S x + S-0 R-0 U-1 R-0 S x + S-0 R-0 U-1 W-1 S x + S-0 W-1 S-0 R-0 S x + S-0 W-1 S-0 W-1 S x + S-0 W-1 U-1 R-0 S x + S-0 W-1 U-1 W-1 S x + U-1 R-0 S-0 R-0 S x + U-1 R-0 S-0 W-1 S x + U-1 R-0 U-1 R-0 U R + U-1 R-0 U-1 W-1 U R + U-1 W-1 S-0 R-0 S x + U-1 W-1 S-0 W-1 S x + U-1 W-1 U-1 R-0 U R + U-1 W-1 U-1 W-1 U W + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE + S 컴 Supervisor + R 컴 Read only + U 컴 User + W 컴 Read and Write + x indicates that when the combined U/S attribute is S, the R/W attribute + is not checked. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + +Chapter 7 Multitasking + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +To provide efficient, protected multitasking, the 80386 employs several +special data structures. It does not, however, use special instructions to +control multitasking; instead, it interprets ordinary control-transfer +instructions differently when they refer to the special data structures. The +registers and data structures that support multitasking are: + + � Task state segment + � Task state segment descriptor + � Task register + � Task gate descriptor + +With these structures the 80386 can rapidly switch execution from one task +to another, saving the context of the original task so that the task can be +restarted later. In addition to the simple task switch, the 80386 offers two +other task-management features: + + 1. Interrupts and exceptions can cause task switches (if needed in the + system design). The processor not only switches automatically to the + task that handles the interrupt or exception, but it automatically + switches back to the interrupted task when the interrupt or exception + has been serviced. Interrupt tasks may interrupt lower-priority + interrupt tasks to any depth. + + 2. With each switch to another task, the 80386 can also switch to + another LDT and to another page directory. Thus each task can have a + different logical-to-linear mapping and a different linear-to-physical + mapping. This is yet another protection feature, because tasks can be + isolated and prevented from interfering with one another. + + +7.1 Task State Segment + +All the information the processor needs in order to manage a task is stored +in a special type of segment, a task state segment (TSS). Figure 7-1 shows +the format of a TSS for executing 80386 tasks. (Another format is used for +executing 80286 tasks; refer to Chapter 13.) + +The fields of a TSS belong to two classes: + + 1. A dynamic set that the processor updates with each switch from the + task. This set includes the fields that store: + + � The general registers (EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI). + + � The segment registers (ES, CS, SS, DS, FS, GS). + + � The flags register (EFLAGS). + + � The instruction pointer (EIP). + + � The selector of the TSS of the previously executing task (updated + only when a return is expected). + + 2. A static set that the processor reads but does not change. This set + includes the fields that store: + + � The selector of the task's LDT. + + � The register (PDBR) that contains the base address of the task's + page directory (read only when paging is enabled). + + � Pointers to the stacks for privilege levels 0-2. + + � The T-bit (debug trap bit) which causes the processor to raise a + debug exception when a task switch occurs. (Refer to Chapter 12 + for more information on debugging.) + + � The I/O map base (refer to Chapter 8 for more information on the + use of the I/O map). + +Task state segments may reside anywhere in the linear space. The only case +that requires caution is when the TSS spans a page boundary and the +higher-addressed page is not present. In this case, the processor raises an +exception if it encounters the not-present page while reading the TSS during +a task switch. Such an exception can be avoided by either of two strategies: + + 1. By allocating the TSS so that it does not cross a page boundary. + + 2. By ensuring that both pages are either both present or both + not-present at the time of a task switch. If both pages are + not-present, then the page-fault handler must make both pages present + before restarting the instruction that caused the task switch. + + +Figure 7-1. 80386 32-Bit Task State Segment + + 31 23 15 7 0 + �袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴誥袴袴袴袴袴袴袴曲袴袴袴袴袴袴藁敲 + � I/O MAP BASE � 0 0 0 0 0 0 0 0 0 0 0 0 0 튦�64 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴懃� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� LDT �60 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� GS �5C + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� FS �58 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� DS �54 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� SS �50 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� CS �4C + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� ES �48 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � EDI �44 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � ESI �40 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � EBP �3C + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � ESP �38 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � EBX �34 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � EDX �30 + 勁袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + � ECX �2C + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � EAX �28 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � EFLAGS �24 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � INSTRUCTION POINTER (EIP) �20 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � CR3 (PDPR) �1C + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� SS2 �18 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � ESP2 �14 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� SS1 �10 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � ESP1 �0C + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� SS0 �8 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � ESP0 �4 + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴崙컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� BACK LINK TO PREVIOUS TSS �0 + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴� + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 +NOTE + 0 MEANS INTEL RESERVED. DO NOT DEFINE. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + + +7.2 TSS Descriptor + +The task state segment, like all other segments, is defined by a +descriptor. Figure 7-2 shows the format of a TSS descriptor. + +The B-bit in the type field indicates whether the task is busy. A type code +of 9 indicates a non-busy task; a type code of 11 indicates a busy task. +Tasks are not reentrant. The B-bit allows the processor to detect an attempt +to switch to a task that is already busy. + +The BASE, LIMIT, and DPL fields and the G-bit and P-bit have functions +similar to their counterparts in data-segment descriptors. The LIMIT field, +however, must have a value equal to or greater than 103. An attempt to +switch to a task whose TSS descriptor has a limit less that 103 causes an +exception. A larger limit is permissible, and a larger limit is required if +an I/O permission map is present. A larger limit may also be convenient for +systems software if additional data is stored in the same segment as the +TSS. + +A procedure that has access to a TSS descriptor can cause a task switch. In +most systems the DPL fields of TSS descriptors should be set to zero, so +that only trusted software has the right to perform task switching. + +Having access to a TSS-descriptor does not give a procedure the right to +read or modify a TSS. Reading and modification can be accomplished only with +another descriptor that redefines the TSS as a data segment. An attempt to +load a TSS descriptor into any of the segment registers (CS, SS, DS, ES, FS, +GS) causes an exception. + +TSS descriptors may reside only in the GDT. An attempt to identify a TSS +with a selector that has TI=1 (indicating the current LDT) results in an +exception. + + +Figure 7-2. TSS Descriptor for 32-bit TSS + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲錮錮錮錮袴袴袴袴曲錮袴袴錮袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + � � � � 쿌� LIMIT � � � TYPE � � + � BASE 31..24 쿒�0�0쿣� 쿛� DPL � � BASE 23..16 � 4 + � � � � 쿗� 19..16 � � �0�1�0쿍�1� � + 픔컴컴컴컴컴컴컴컴좔좔좔좔좔컴컴컴컴탠좔컴컴좔좔좔좔좔좔컴컴컴컴컴컴컴컴� + � � � + � BASE 15..0 � LIMIT 15..0 � 0 + � � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + +7.3 Task Register + +The task register (TR) identifies the currently executing task by pointing +to the TSS. Figure 7-3 shows the path by which the processor accesses the +current TSS. + +The task register has both a "visible" portion (i.e., can be read and +changed by instructions) and an "invisible" portion (maintained by the +processor to correspond to the visible portion; cannot be read by any +instruction). The selector in the visible portion selects a TSS descriptor +in the GDT. The processor uses the invisible portion to cache the base and +limit values from the TSS descriptor. Holding the base and limit in a +register makes execution of the task more efficient, because the processor +does not need to repeatedly fetch these values from memory when it +references the TSS of the current task. + +The instructions LTR and STR are used to modify and read the visible +portion of the task register. Both instructions take one operand, a 16-bit +selector located in memory or in a general register. + +LTR (Load task register) loads the visible portion of the task register +with the selector operand, which must select a TSS descriptor in the GDT. +LTR also loads the invisible portion with information from the TSS +descriptor selected by the operand. LTR is a privileged instruction; it may +be executed only when CPL is zero. LTR is generally used during system +initialization to give an initial value to the task register; thereafter, +the contents of TR are changed by task switch operations. + +STR (Store task register) stores the visible portion of the task register +in a general register or memory word. STR is not privileged. + + +Figure 7-3. Task Register + + �袴袴袴袴袴袴袴袴袴袴袴袴敲 + � � + � � + � TASK STATE � + � SEGMENT �컴컴컴컴커 + � � � + � � � + 훤袴袴袴袴袴袴袴袴袴袴袴袴� � + 16-BIT VISIBLE  � + REGISTER � HIDDEN REGISTER � + �袴袴袴袴袴袴袴袴袴袴箇袴袴袴袴鳩袴袴袴袴藁袴袴袴袴袴袴賈袴袴袴� + TR � SELECTOR � (BASE) � (LIMT) � + 훤袴袴袴袴佶袴袴袴袴菰袴袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴袴袴暠 + �   + � 읕컴컴컴컴컴컴컴컴� � + � GLOBAL DESCRIPTOR TABLE � � + � 郞袴袴袴袴袴袴袴袴袴袴袴袴� � � + � | TSS DESCRIPTOR | � � + � �袴袴袴箇袴袴箇袴袴箇袴袴敲 � � + � � � � � 픔컴� � + � 勁袴袴菰袴袴誥袴袴菰袴袴袴� � + 읕컴컴컴� � 픔컴컴컴� + 훤袴袴袴袴袴菰袴袴袴袴袴袴� + | | + 突袴袴袴袴袴袴袴袴袴袴袴袴� + + +7.4 Task Gate Descriptor + +A task gate descriptor provides an indirect, protected reference to a TSS. +Figure 7-4 illustrates the format of a task gate. + +The SELECTOR field of a task gate must refer to a TSS descriptor. The value +of the RPL in this selector is not used by the processor. + +The DPL field of a task gate controls the right to use the descriptor to +cause a task switch. A procedure may not select a task gate descriptor +unless the maximum of the selector's RPL and the CPL of the procedure is +numerically less than or equal to the DPL of the descriptor. This constraint +prevents untrusted procedures from causing a task switch. (Note that when a +task gate is used, the DPL of the target TSS descriptor is not used for +privilege checking.) + +A procedure that has access to a task gate has the power to cause a task +switch, just as a procedure that has access to a TSS descriptor. The 80386 +has task gates in addition to TSS descriptors to satisfy three needs: + + 1. The need for a task to have a single busy bit. Because the busy-bit + is stored in the TSS descriptor, each task should have only one such + descriptor. There may, however, be several task gates that select the + single TSS descriptor. + + 2. The need to provide selective access to tasks. Task gates fulfill + this need, because they can reside in LDTs and can have a DPL that is + different from the TSS descriptor's DPL. A procedure that does not + have sufficient privilege to use the TSS descriptor in the GDT (which + usually has a DPL of 0) can still switch to another task if it has + access to a task gate for that task in its LDT. With task gates, + systems software can limit the right to cause task switches to + specific tasks. + + 3. The need for an interrupt or exception to cause a task switch. Task + gates may also reside in the IDT, making it possible for interrupts + and exceptions to cause task switching. When interrupt or exception + vectors to an IDT entry that contains a task gate, the 80386 switches + to the indicated task. Thus, all tasks in the system can benefit from + the protection afforded by isolation from interrupt tasks. + +Figure 7-5 illustrates how both a task gate in an LDT and a task gate in +the IDT can identify the same task. + + +Figure 7-4. Task Gate Descriptor + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴妄佶袴袴佶袴袴袴袴妄袴袴袴袴袴袴袴袴� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교 � � 낢굇굇굇굇굇굇굇굇� + 볍굇굇굇굇굇�(NOT USED)굇굇굇굇굇굇쿛� DPL �0 0 1 0 1낢굇(NOT USED)굇굇� 4 + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교 � � 낢굇굇굇굇굇굇굇굇� + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컨컴컴컨컴컴컴컴컨컴컴컴컴컴컴컴컴캘 + � 낢굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� + � SELECTOR 낢굇굇굇굇굇�(NOT USED)굇굇굇굇굇굇군 0 + � 낢굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴暠 + + +Figure 7-5. Task Gate Indirectly Identifies Task + + LOCAL DESCRIPTOR TABLE INTERRUPT DESCRIPTOR TABLE + 郞袴袴袴袴袴袴袴袴袴袴袴袴� 郞袴袴袴袴袴袴袴袴袴袴袴袴� + | | | | + | TASK GATE | | TASK GATE | + �袴袴袴佶袴袴佶袴袴佶袴袴敲 �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � � � � � � + 픔컴컴컨컴컴컵컴컴컨컴컴컴� 픔컴컴컨컴컴컵컴컴컨컴컴컴� + 旼캘 � � 旼캘 � � + � 훤袴袴袴袴袴賈袴袴袴袴袴袴� � 훤袴袴袴袴袴賈袴袴袴袴袴袴� + � | | � | | + � | | � | | + � 突袴袴袴袴袴袴袴袴袴袴袴袴� � 突袴袴袴袴袴袴袴袴袴袴袴袴� + 읕컴컴컴컴컴컴컴커 旼컴컴컴컴컴컴컴컴� + � � GLOBAL DESCRIPTOR TABLE + � � 郞袴袴袴袴袴袴袴袴袴袴袴袴� + � � | | + � � | TASK DESCRIPTOR | + � � �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � � � + � 읕픔컴컴컨컴컴컵컴컴컨컴컴컴� + 읕컴�� � 픔커 + 훤袴袴袴袴袴賈袴袴袴袴袴袴� � + | | � + | | � + 突袴袴袴袴袴袴袴袴袴袴袴袴� � + � + �袴袴袴袴袴袴袴袴袴袴袴袴敲 � + � � � + � � � + � � � + � TASK STATE � � + � SEGMENT � � + � � � + � � � + � � � + 훤袴袴袴袴袴袴袴袴袴袴袴袴�켸 + + +7.5 Task Switching + +The 80386 switches execution to another task in any of four cases: + + 1. The current task executes a JMP or CALL that refers to a TSS + descriptor. + + 2. The current task executes a JMP or CALL that refers to a task gate. + + 3. An interrupt or exception vectors to a task gate in the IDT. + + 4. The current task executes an IRET when the NT flag is set. + +JMP, CALL, IRET, interrupts, and exceptions are all ordinary mechanisms of +the 80386 that can be used in circumstances that do not require a task +switch. Either the type of descriptor referenced or the NT (nested task) bit +in the flag word distinguishes between the standard mechanism and the +variant that causes a task switch. + +To cause a task switch, a JMP or CALL instruction can refer either to a TSS +descriptor or to a task gate. The effect is the same in either case: the +80386 switches to the indicated task. + +An exception or interrupt causes a task switch when it vectors to a task +gate in the IDT. If it vectors to an interrupt or trap gate in the IDT, a +task switch does not occur. Refer to Chapter 9 for more information on the +interrupt mechanism. + +Whether invoked as a task or as a procedure of the interrupted task, an +interrupt handler always returns control to the interrupted procedure in the +interrupted task. If the NT flag is set, however, the handler is an +interrupt task, and the IRET switches back to the interrupted task. + +A task switching operation involves these steps: + + 1. Checking that the current task is allowed to switch to the designated + task. Data-access privilege rules apply in the case of JMP or CALL + instructions. The DPL of the TSS descriptor or task gate must be less + than or equal to the maximum of CPL and the RPL of the gate selector. + Exceptions, interrupts, and IRETs are permitted to switch tasks + regardless of the DPL of the target task gate or TSS descriptor. + + 2. Checking that the TSS descriptor of the new task is marked present + and has a valid limit. Any errors up to this point occur in the + context of the outgoing task. Errors are restartable and can be + handled in a way that is transparent to applications procedures. + + 3. Saving the state of the current task. The processor finds the base + address of the current TSS cached in the task register. It copies the + registers into the current TSS (EAX, ECX, EDX, EBX, ESP, EBP, ESI, + EDI, ES, CS, SS, DS, FS, GS, and the flag register). The EIP field of + the TSS points to the instruction after the one that caused the task + switch. + + 4. Loading the task register with the selector of the incoming task's + TSS descriptor, marking the incoming task's TSS descriptor as busy, + and setting the TS (task switched) bit of the MSW. The selector is + either the operand of a control transfer instruction or is taken from + a task gate. + + 5. Loading the incoming task's state from its TSS and resuming + execution. The registers loaded are the LDT register; the flag + register; the general registers EIP, EAX, ECX, EDX, EBX, ESP, EBP, + ESI, EDI; the segment registers ES, CS, SS, DS, FS, and GS; and PDBR. + Any errors detected in this step occur in the context of the incoming + task. To an exception handler, it appears that the first instruction + of the new task has not yet executed. + +Note that the state of the outgoing task is always saved when a task switch +occurs. If execution of that task is resumed, it starts after the +instruction that caused the task switch. The registers are restored to the +values they held when the task stopped executing. + +Every task switch sets the TS (task switched) bit in the MSW (machine +status word). The TS flag is useful to systems software when a coprocessor +(such as a numerics coprocessor) is present. The TS bit signals that the +context of the coprocessor may not correspond to the current 80386 task. +Chapter 11 discusses the TS bit and coprocessors in more detail. + +Exception handlers that field task-switch exceptions in the incoming task +(exceptions due to tests 4 thru 16 of Table 7-1) should be cautious about +taking any action that might load the selector that caused the exception. +Such an action will probably cause another exception, unless the exception +handler first examines the selector and fixes any potential problem. + +The privilege level at which execution resumes in the incoming task is +neither restricted nor affected by the privilege level at which the outgoing +task was executing. Because the tasks are isolated by their separate address +spaces and TSSs and because privilege rules can be used to prevent improper +access to a TSS, no privilege rules are needed to constrain the relation +between the CPLs of the tasks. The new task begins executing at the +privilege level indicated by the RPL of the CS selector value that is loaded +from the TSS. + + +Table 7-1. Checks Made during a Task Switch + + +Test Test Description Exception +NP = Segment-not-present exception, GP = General protection fault, TS = +Invalid TSS, SF = Stack fault Error Code Selects + + 1 Incoming TSS descriptor is NP Incoming TSS + present + 2 Incoming TSS descriptor is GP Incoming TSS + marked not-busy + 3 Limit of incoming TSS is TS Incoming TSS + greater than or equal to 103 + + 컴 All register and selector values are loaded 컴 + + 4 LDT selector of incoming TS Incoming TSS + task is valid + 5 LDT of incoming task is TS Incoming TSS + present + 6 CS selector is valid +Validity tests of a selector check that the selector is in the proper +table (eg., the LDT selector refers to the GDT), lies within the bounds of +the table, and refers to the proper type of descriptor (e.g., the LDT +selector refers to an LDT descriptor). TS Code segment + 7 Code segment is present NP Code segment + 8 Code segment DPL matches TS Code segment + CS RPL + 9 Stack segment is valid +Validity tests of a selector check that the selector is in the proper +table (eg., the LDT selector refers to the GDT), lies within the bounds of +the table, and refers to the proper type of descriptor (e.g., the LDT +selector refers to an LDT descriptor). GP Stack segment + 10 Stack segment is present SF Stack segment + 11 Stack segment DPL = CPL SF Stack segment + 12 Stack-selector RPL = CPL GP Stack segment + 13 DS, ES, FS, GS selectors are GP Segment + valid +Validity tests of a selector check that the selector is in the proper +table (eg., the LDT selector refers to the GDT), lies within the bounds of +the table, and refers to the proper type of descriptor (e.g., the LDT +selector refers to an LDT descriptor). + + + 14 DS, ES, FS, GS segments GP Segment + are readable + 15 DS, ES, FS, GS segments NP Segment + are present + 16 DS, ES, FS, GS segment DPL GP Segment + � CPL (unless these are + conforming segments) + + +7.6 Task Linking + +The back-link field of the TSS and the NT (nested task) bit of the flag +word together allow the 80386 to automatically return to a task that CALLed +another task or was interrupted by another task. When a CALL instruction, an +interrupt instruction, an external interrupt, or an exception causes a +switch to a new task, the 80386 automatically fills the back-link of the new +TSS with the selector of the outgoing task's TSS and, at the same time, +sets the NT bit in the new task's flag register. The NT flag indicates +whether the back-link field is valid. The new task releases control by +executing an IRET instruction. When interpreting an IRET, the 80386 examines +the NT flag. If NT is set, the 80386 switches back to the task selected by +the back-link field. Table 7-2 summarizes the uses of these fields. + + +Table 7-2. Effect of Task Switch on BUSY, NT, and Back-Link + +Affected Field Effect of JMP Effect of Effect of + Instruction CALL Instruction IRET Instruction + +Busy bit of Set, must be Set, must be 0 Unchanged, +incoming task 0 before before must be set + +Busy bit of Cleared Unchanged Cleared +outgoing task (already set) + +NT bit of Cleared Set Unchanged +incoming task + +NT bit of Unchanged Unchanged Cleared +outgoing task + +Back-link of Unchanged Set to outgoing Unchanged +incoming task TSS selector + +Back-link of Unchanged Unchanged Unchanged +outgoing task + + +7.6.1 Busy Bit Prevents Loops + +The B-bit (busy bit) of the TSS descriptor ensures the integrity of the +back-link. A chain of back-links may grow to any length as interrupt tasks +interrupt other interrupt tasks or as called tasks call other tasks. The +busy bit ensures that the CPU can detect any attempt to create a loop. A +loop would indicate an attempt to reenter a task that is already busy; +however, the TSS is not a reentrable resource. + +The processor uses the busy bit as follows: + + 1. When switching to a task, the processor automatically sets the busy + bit of the new task. + + 2. When switching from a task, the processor automatically clears the + busy bit of the old task if that task is not to be placed on the + back-link chain (i.e., the instruction causing the task switch is JMP + or IRET). If the task is placed on the back-link chain, its busy bit + remains set. + + 3. When switching to a task, the processor signals an exception if the + busy bit of the new task is already set. + +By these actions, the processor prevents a task from switching to itself or +to any task that is on a back-link chain, thereby preventing invalid reentry +into a task. + +The busy bit is effective even in multiprocessor configurations, because +the processor automatically asserts a bus lock when it sets or clears the +busy bit. This action ensures that two processors do not invoke the same +task at the same time. (Refer to Chapter 11 for more on multiprocessing.) + + +7.6.2 Modifying Task Linkages + +Any modification of the linkage order of tasks should be accomplished only +by software that can be trusted to correctly update the back-link and the +busy-bit. Such changes may be needed to resume an interrupted task before +the task that interrupted it. Trusted software that removes a task from the +back-link chain must follow one of the following policies: + + 1. First change the back-link field in the TSS of the interrupting task, + then clear the busy-bit in the TSS descriptor of the task removed from + the list. + + 2. Ensure that no interrupts occur between updating the back-link chain + and the busy bit. + + +7.7 Task Address Space + +The LDT selector and PDBR fields of the TSS give software systems designers +flexibility in utilization of segment and page mapping features of the +80386. By appropriate choice of the segment and page mappings for each task, +tasks may share address spaces, may have address spaces that are largely +distinct from one another, or may have any degree of sharing between these +two extremes. + +The ability for tasks to have distinct address spaces is an important +aspect of 80386 protection. A module in one task cannot interfere with a +module in another task if the modules do not have access to the same address +spaces. The flexible memory management features of the 80386 allow systems +designers to assign areas of shared address space to those modules of +different tasks that are designed to cooperate with each other. + + +7.7.1 Task Linear-to-Physical Space Mapping + +The choices for arranging the linear-to-physical mappings of tasks fall +into two general classes: + + 1. One linear-to-physical mapping shared among all tasks. + + When paging is not enabled, this is the only possibility. Without page + tables, all linear addresses map to the same physical addresses. + + When paging is enabled, this style of linear-to-physical mapping + results from using one page directory for all tasks. The linear space + utilized may exceed the physical space available if the operating + system also implements page-level virtual memory. + + 2. Several partially overlapping linear-to-physical mappings. + + This style is implemented by using a different page directory for each + task. Because the PDBR (page directory base register) is loaded from + the TSS with each task switch, each task may have a different page + directory. + +In theory, the linear address spaces of different tasks may map to +completely distinct physical addresses. If the entries of different page +directories point to different page tables and the page tables point to +different pages of physical memory, then the tasks do not share any physical +addresses. + +In practice, some portion of the linear address spaces of all tasks must +map to the same physical addresses. The task state segments must lie in a +common space so that the mapping of TSS addresses does not change while the +processor is reading and updating the TSSs during a task switch. The linear +space mapped by the GDT should also be mapped to a common physical space; +otherwise, the purpose of the GDT is defeated. Figure 7-6 shows how the +linear spaces of two tasks can overlap in the physical space by sharing +page tables. + + +7.7.2 Task Logical Address Space + +By itself, a common linear-to-physical space mapping does not enable +sharing of data among tasks. To share data, tasks must also have a common +logical-to-linear space mapping; i.e., they must also have access to +descriptors that point into a shared linear address space. There are three +ways to create common logical-to-physical address-space mappings: + + 1. Via the GDT. All tasks have access to the descriptors in the GDT. If + those descriptors point into a linear-address space that is mapped to + a common physical-address space for all tasks, then the tasks can + share data and instructions. + + 2. By sharing LDTs. Two or more tasks can use the same LDT if the LDT + selectors in their TSSs select the same LDT segment. Those + LDT-resident descriptors that point into a linear space that is mapped + to a common physical space permit the tasks to share physical memory. + This method of sharing is more selective than sharing by the GDT; the + sharing can be limited to specific tasks. Other tasks in the system + may have different LDTs that do not give them access to the shared + areas. + + 3. By descriptor aliases in LDTs. It is possible for certain descriptors + of different LDTs to point to the same linear address space. If that + linear address space is mapped to the same physical space by the page + mapping of the tasks involved, these descriptors permit the tasks to + share the common space. Such descriptors are commonly called + "aliases". This method of sharing is even more selective than the + prior two; other descriptors in the LDTs may point to distinct linear + addresses or to linear addresses that are not shared. + + +Figure 7-6. Partially-Overlapping Linear Spaces + + TSSs PAGE FRAMES + �袴袴袴袴袴� + TASK A TSS PAGE DIRECTORIES PAGE TABLES � TASK A � + �袴袴袴袴袴� �袴袴袴袴袴敲 �袴袴袴袴袴敲 旼� PAGE � + � � � � � � � 훤袴袴袴袴暠 + � � 勁袴袴袴袴袴� 勁袴袴袴袴袴� � �袴袴袴袴袴� + � � � � � PTE 픔켸 � TASK A � + � � 勁袴袴袴袴袴� 勁袴袴袴袴袴� 旼� PAGE � + � � � � � PTE 픔켸 훤袴袴袴袴暠 + 勁袴袴袴袴攷 勁袴袴袴袴袴� 勁袴袴袴袴袴� �袴袴袴袴袴� + � PDBR 픔컴�� PDE 픔컴�� PTE 픔커 � TASK A � + 勁袴袴袴袴攷 勁袴袴袴袴袴� 훤袴袴袴袴袴� 읕� PAGE � + � � � PDE 픔커 SHARED PT 훤袴袴袴袴暠 + 훤袴袴袴袴暠 훤袴袴袴袴袴� � �袴袴袴袴袴敲 �袴袴袴袴袴� + � � � � SHARED � + � 勁袴袴袴袴袴� 旼� PAGE � + � � � � 훤袴袴袴袴暠 + � 勁袴袴袴袴袴� � �袴袴袴袴袴� + � � PTE 픔켸 � SHARED � + � 勁袴袴袴袴袴� 旼� PAGE � + 쳐� PTE 픔켸 훤袴袴袴袴暠 + TASK B TSS � 훤袴袴袴袴袴� �袴袴袴袴袴� + �袴袴袴袴袴� �袴袴袴袴袴敲 � � TASK B � + � � � � � 旼�� PAGE � + � � 勁袴袴袴袴袴� � �袴袴袴袴袴敲 � 훤袴袴袴袴暠 + � � � � � � � � �袴袴袴袴袴� + � � 勁袴袴袴袴袴� � 勁袴袴袴袴袴� � � TASK B � + � � � � � � � � �� PAGE � + 勁袴袴袴袴攷 勁袴袴袴袴袴� � 勁袴袴袴袴袴� � � 훤袴袴袴袴暠 + � PDBR 픔컴�� PDE 픔켸 � PTE 픔� � PAGE FRAMES + 勁袴袴袴袴攷 勁袴袴袴袴袴� 勁袴袴袴袴袴� � + � � � PDE 픔컴�� PTE 픔컴� + 훤袴袴袴袴暠 훤袴袴袴袴袴� 훤袴袴袴袴袴� + TSSs PAGE DIRECTORIES PAGE TABLES + + +Chapter 8 Input/Output + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +This chapter presents the I/O features of the 80386 from the following +perspectives: + + � Methods of addressing I/O ports + + � Instructions that cause I/O operations + + � Protection as it applies to the use of I/O instructions and I/O port + addresses. + + +8.1 I/O Addressing + +The 80386 allows input/output to be performed in either of two ways: + + � By means of a separate I/O address space (using specific I/O + instructions) + + � By means of memory-mapped I/O (using general-purpose operand + manipulationinstructions). + + +8.1.1 I/O Address Space + +The 80386 provides a separate I/O address space, distinct from physical +memory, that can be used to address the input/output ports that are used for +external 16 devices. The I/O address space consists of 2^(16) (64K) +individually addressable 8-bit ports; any two consecutive 8-bit ports can be +treated as a 16-bit port; and four consecutive 8-bit ports can be treated +as a 32-bit port. Thus, the I/O address space can accommodate up to 64K +8-bit ports, up to 32K 16-bit ports, or up to 16K 32-bit ports. + +The program can specify the address of the port in two ways. Using an +immediate byte constant, the program can specify: + + � 256 8-bit ports numbered 0 through 255. + � 128 16-bit ports numbered 0, 2, 4, . . . , 252, 254. + � 64 32-bit ports numbered 0, 4, 8, . . . , 248, 252. + +Using a value in DX, the program can specify: + + � 8-bit ports numbered 0 through 65535 + � 16-bit ports numbered 0, 2, 4, . . . , 65532, 65534 + � 32-bit ports numbered 0, 4, 8, . . . , 65528, 65532 + +The 80386 can transfer 32, 16, or 8 bits at a time to a device located in +the I/O space. Like doublewords in memory, 32-bit ports should be aligned at +addresses evenly divisible by four so that the 32 bits can be transferred in +a single bus access. Like words in memory, 16-bit ports should be aligned at +even-numbered addresses so that the 16 bits can be transferred in a single +bus access. An 8-bit port may be located at either an even or odd address. + +The instructions IN and OUT move data between a register and a port in the +I/O address space. The instructions INS and OUTS move strings of data +between the memory address space and ports in the I/O address space. + + +8.1.2 Memory-Mapped I/O + +I/O devices also may be placed in the 80386 memory address space. As long +as the devices respond like memory components, they are indistinguishable to +the processor. + +Memory-mapped I/O provides additional programming flexibility. Any +instruction that references memory may be used to access an I/O port located +in the memory space. For example, the MOV instruction can transfer data +between any register and a port; and the AND, OR, and TEST instructions may +be used to manipulate bits in the internal registers of a device (see Figure +8-1). Memory-mapped I/O performed via the full instruction set maintains +the full complement of addressing modes for selecting the desired I/O +device (e.g., direct address, indirect address, base register, index +register, scaling). + +Memory-mapped I/O, like any other memory reference, is subject to access +protection and control when executing in protected mode. Refer to Chapter 6 +for a discussion of memory protection. + + +8.2 I/O Instructions + +The I/O instructions of the 80386 provide access to the processor's I/O +ports for the transfer of data to and from peripheral devices. These +instructions have as one operand the address of a port in the I/O address +space. There are two classes of I/O instruction: + + 1. Those that transfer a single item (byte, word, or doubleword) located + in a register. + + 2. Those that transfer strings of items (strings of bytes, words, or + doublewords) located in memory. These are known as "string I/O + instructions" or "block I/O instructions". + + +8.2.1 Register I/O Instructions + +The I/O instructions IN and OUT are provided to move data between I/O ports +and the EAX (32-bit I/O), the AX (16-bit I/O), or AL (8-bit I/O) general +registers. IN and OUT instructions address I/O ports either directly, with +the address of one of up to 256 port addresses coded in the instruction, or +indirectly via the DX register to one of up to 64K port addresses. + +IN (Input from Port) transfers a byte, word, or doubleword from an input +port to AL, AX, or EAX. If a program specifies AL with the IN instruction, +the processor transfers 8 bits from the selected port to AL. If a program +specifies AX with the IN instruction, the processor transfers 16 bits from +the port to AX. If a program specifies EAX with the IN instruction, the +processor transfers 32 bits from the port to EAX. + +OUT (Output to Port) transfers a byte, word, or doubleword to an output +port from AL, AX, or EAX. The program can specify the number of the port +using the same methods as the IN instruction. + + +Figure 8-1. Memory-Mapped I/O + + MEMORY + ADDRESS SPACE I/O DEVICE 1 + �袴袴袴袴袴袴袴敲 �袴袴袴袴袴袴袴袴袴敲 + � � � INTERNAL REGISTER � + 픔컴컴컴컴컴컴컴� � � � � � � � � 캤케袴袴袴袴袴袴袴敲 � + � � � � � � + 픔컴컴컴컴컴컴컴� � � � � � � � � 캤컹袴袴袴袴袴袴袴暠 � + � � 훤袴袴袴袴袴袴袴袴袴� + � � + � � + � � + � � I/O DEVICE 2 + � � �袴袴袴袴袴袴袴袴袴敲 + � � � INTERNAL REGISTER � + 픔컴컴컴컴컴컴컴� � � � � � � � � 캤케袴袴袴袴袴袴袴敲 � + � � � � � � + 픔컴컴컴컴컴컴컴� � � � � � � � � 캤컹袴袴袴袴袴袴袴暠 � + � � 훤袴袴袴袴袴袴袴袴袴� + 훤袴袴袴袴袴袴袴� + + +8.2.2 Block I/O Instructions + +The block (or string) I/O instructions INS and OUTS move blocks of data +between I/O ports and memory space. Block I/O instructions use the DX +register to specify the address of a port in the I/O address space. INS and +OUTS use DX to specify: + + � 8-bit ports numbered 0 through 65535 + � 16-bit ports numbered 0, 2, 4, . . . , 65532, 65534 + � 32-bit ports numbered 0, 4, 8, . . . , 65528, 65532 + +Block I/O instructions use either SI or DI to designate the source or +destination memory address. For each transfer, SI or DI are automatically +either incremented or decremented as specified by the direction bit in the +flags register. + +INS and OUTS, when used with repeat prefixes, cause block input or output +operations. REP, the repeat prefix, modifies INS and OUTS to provide a means +of transferring blocks of data between an I/O port and memory. These block +I/O instructions are string primitives (refer also to Chapter 3 for more on +string primitives). They simplify programming and increase the speed of data +transfer by eliminating the need to use a separate LOOP instruction or an +intermediate register to hold the data. + +The string I/O primitives can operate on byte strings, word strings, or +doubleword strings. After each transfer, the memory address in ESI or EDI is +updated by 1 for byte operands, by 2 for word operands, or by 4 for +doubleword operands. The value in the direction flag (DF) determines whether +the processor automatically increments ESI or EDI (DF=0) or whether it +automatically decrements these registers (DF=1). + +INS (Input String from Port) transfers a byte or a word string element from +an input port to memory. The mnemonics INSB, INSW, and INSD are variants +that explicitly specify the size of the operand. If a program specifies +INSB, the processor transfers 8 bits from the selected port to the memory +location indicated by ES:EDI. If a program specifies INSW, the processor +transfers 16 bits from the port to the memory location indicated by ES:EDI. +If a program specifies INSD, the processor transfers 32 bits from the port +to the memory location indicated by ES:EDI. The destination segment register +choice (ES) cannot be changed for the INS instruction. Combined with the REP +prefix, INS moves a block of information from an input port to a series of +consecutive memory locations. + +OUTS (Output String to Port) transfers a byte, word, or doubleword string +element to an output port from memory. The mnemonics OUTSB, OUTSW, and OUTSD +are variants that explicitly specify the size of the operand. If a program +specifies OUTSB, the processor transfers 8 bits from the memory location +indicated by ES:EDI to the the selected port. If a program specifies OUTSW, +the processor transfers 16 bits from the memory location indicated by ES:EDI +to the the selected port. If a program specifies OUTSD, the processor +transfers 32 bits from the memory location indicated by ES:EDI to the the +selected port. Combined with the REP prefix, OUTS moves a block of +information from a series of consecutive memory locations indicated by +DS:ESI to an output port. + + +8.3 Protection and I/O + +Two mechanisms provide protection for I/O functions: + + 1. The IOPL field in the EFLAGS register defines the right to use + I/O-related instructions. + + 2. The I/O permission bit map of a 80386 TSS segment defines the right + to use ports in the I/O address space. + +These mechanisms operate only in protected mode, including virtual 8086 +mode; they do not operate in real mode. In real mode, there is no protection +of the I/O space; any procedure can execute I/O instructions, and any I/O +port can be addressed by the I/O instructions. + + +8.3.1 I/O Privilege Level + +Instructions that deal with I/O need to be restricted but also need to be +executed by procedures executing at privilege levels other than zero. For +this reason, the processor uses two bits of the flags register to store the +I/O privilege level (IOPL). The IOPL defines the privilege level +needed to execute I/O-related instructions. + +The following instructions can be executed only if CPL � IOPL: + +IN 컴 Input +INS 컴 Input String +OUT 컴 Output +OUTS 컴 Output String +CLI 컴 Clear Interrupt-Enable Flag +STI 컴 Set Interrupt-Enable + +These instructions are called "sensitive" instructions, because they are +sensitive to IOPL. + +To use sensitive instructions, a procedure must execute at a privilege +level at least as privileged as that specified by the IOPL (CPL � IOPL). Any +attempt by a less privileged procedure to use a sensitive instruction +results in a general protection exception. + +Because each task has its own unique copy of the flags register, each task +can have a different IOPL. A task whose primary function is to perform I/O +(a device driver) can benefit from having an IOPL of three, thereby +permitting all procedures of the task to performI/O. Other tasks typically +have IOPL set to zero or one, reserving the right to perform I/O +instructions for the most privileged procedures. + +A task can change IOPL only with the POPF instruction; however, such +changes are privileged. No procedure may alter IOPL (the I/O privilege level +in the flag register) unless the procedure is executing at privilege level +0. An attempt by a less privileged procedure to alter IOPL does not result +in an exception; IOPL simply remains unaltered. + +The POPF instruction may be used in addition to CLI and STI to alter the +interrupt-enable flag (IF); however, changes to IF by POPF are +IOPL-sensitive. A procedure may alter IF with a POPF instruction only when +executing at a level that is at least as privileged as IOPL. An attempt by a +less privileged procedure to alter IF in this manner does not result in an +exception; IF simply remains unaltered. + + +8.3.2 I/O Permission Bit Map + +The I/O instructions that directly refer to addresses in the processor's +I/O space are IN, INS, OUT, OUTS. The 80386 has the ability to selectively +trap references to specific I/O addresses. The structure that enables +selective trapping is the I/O Permission Bit Map in the TSS segment (see +Figure 8-2). The I/O permission map is a bit vector. The size of the map +and its location in the TSS segment are variable. The processor locates the +I/O permission map by means of the I/O map base field in the fixed portion +of the TSS. The I/O map base field is 16 bits wide and contains the offset +of the beginning of the I/O permission map. The upper limit of the I/O +permission map is the same as the limit of the TSS segment. + +In protected mode, when it encounters an I/O instruction (IN, INS, OUT, or +OUTS), the processor first checks whether CPL � IOPL. If this condition is +true, the I/O operation may proceed. If not true, the processor checks the +I/O permission map. (In virtual 8086 mode, the processor consults the map +without regard for IOPL. Refer to Chapter 15.) + +Each bit in the map corresponds to an I/O port byte address; for example, +the bit for port 41 is found at I/O map base + 5, bit offset 1. The +processor tests all the bits that correspond to the I/O addresses spanned by +an I/O operation; for example, a doubleword operation tests four bits +corresponding to four adjacent byte addresses. If any tested bit is set, +the processor signals a general protection exception. If all the tested bits +are zero, the I/O operation may proceed. + +It is not necessary for the I/O permission map to represent all the I/O +addresses. I/O addresses not spanned by the map are treated as if they had +one bits in the map. For example, if TSS limit is equal to I/O map base + +31, the first 256 I/O ports are mapped; I/O operations on any port greater +than 255 cause an exception. + +If I/O map base is greater than or equal to TSS limit, the TSS segment has +no I/O permission map, and all I/O instructions in the 80386 program cause +exceptions when CPL > IOPL. + +Because the I/O permission map is in the TSS segment, different tasks can +have different maps. Thus, the operating system can allocate ports to a task +by changing the I/O permission map in the task's TSS. + + +Figure 8-2. I/O Address Bit Map + + TSS SEGMEMT + + 31 23 15 7 0 + �袴袴袴袴妄袴袴袴曲袴袴袴袴妄袴袴袴敲 + LIMIT컴�� � + � � � � � � � � � � � � � � � � � � � +   +  I/O PERMISSION BIT MAP  +   + � � � � � � � � � � � � � � � � � � � + 旼컴�� � + � 픔컴컴컴컵컴컴컴컴탠컴컴컴컵컴컴컴컴� + �   + �   + �   + � 픔컴컴컴컵컴컴컴컴탠컴컴컴컵컴컴컴컴� + 읕컴컴� I/O MAP BASE 퀅uuuuuuu uuuuuuuT�64 + 픔컴컴컴컵컴컴컴컴탠컴컴컴컵컴컴컴컴� + �00000000 00000000� LOT �60 + 픔컴컴컴컵컴컴컴컴탠컴컴컴컵컴컴컴컴� + �00000000 00000000� GS �5C + 픔컴컴컴컵컴컴컴컴탠컴컴컴컵컴컴컴컴� + � �58 +   +   +   + � �4 + 픔컴컴컴컵컴컴컴컴탠컴컴컴컵컴컴컴컴� + �00000000 00000000� TSS BACK LINK �0 + 훤袴袴袴曲袴袴袴袴妄袴袴袴曲袴袴袴袴� + + +Chapter 9 Exceptions and Interrupts + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +Interrupts and exceptions are special kinds of control transfer; they work +somewhat like unprogrammed CALLs. They alter the normal program flow to +handle external events or to report errors or exceptional conditions. The +difference between interrupts and exceptions is that interrupts are used to +handle asynchronous events external to the processor, but exceptions handle +conditions detected by the processor itself in the course of executing +instructions. + +There are two sources for external interrupts and two sources for +exceptions: + + 1. Interrupts + + � Maskable interrupts, which are signalled via the INTR pin. + + � Nonmaskable interrupts, which are signalled via the NMI + (Non-Maskable Interrupt) pin. + + 2. Exceptions + + � Processor detected. These are further classified as faults, traps, + and aborts. + + � Programmed. The instructions INTO, INT 3, INT n, and BOUND can + trigger exceptions. These instructions are often called "software + interrupts", but the processor handles them as exceptions. + +This chapter explains the features that the 80386 offers for controlling +and responding to interrupts when it is executing in protected mode. + + +9.1 Identifying Interrupts + +The processor associates an identifying number with each different type of +interrupt or exception. + +The NMI and the exceptions recognized by the processor are assigned +predetermined identifiers in the range 0 through 31. Not all of these +numbers are currently used by the 80386; unassigned identifiers in this +range are reserved by Intel for possible future expansion. + +The identifiers of the maskable interrupts are determined by external +interrupt controllers (such as Intel's 8259A Programmable Interrupt +Controller) and communicated to the processor during the processor's +interrupt-acknowledge sequence. The numbers assigned by an 8259A PIC can be +specified by software. Any numbers in the range 32 through 255 can be used. +Table 9-1 shows the assignment of interrupt and exception identifiers. + +Exceptions are classified as faults, traps, or aborts depending on the way +they are reported and whether restart of the instruction that caused the +exception is supported. + +Faults Faults are exceptions that are reported "before" the + instruction causingthe exception. Faults are either detected before + the instruction begins to execute, or during execution of the + instruction. If detected during the instruction, the fault is + reported with the machine restored to a state that permits the + instruction to be restarted. + +Traps A trap is an exception that is reported at the instruction + boundary immediately after the instruction in which the + exception was detected. + +Aborts An abort is an exception that permits neither precise location + of the instruction causing the exception nor restart of the program + that caused the exception. Aborts are used to report severe errors, + such as hardware errors and inconsistent or illegal values in system + tables. + + +Table 9-1. Interrupt and Exception ID Assignments + +Identifier Description + +0 Divide error +1 Debug exceptions +2 Nonmaskable interrupt +3 Breakpoint (one-byte INT 3 instruction) +4 Overflow (INTO instruction) +5 Bounds check (BOUND instruction) +6 Invalid opcode +7 Coprocessor not available +8 Double fault +9 (reserved) +10 Invalid TSS +11 Segment not present +12 Stack exception +13 General protection +14 Page fault +15 (reserved) +16 Coprecessor error +17-31 (reserved) +32-255 Available for external interrupts via INTR pin + + +9.2 Enabling and Disabling Interrupts + +The processor services interrupts and exceptions only between the end of +one instruction and the beginning of the next. When the repeat prefix is +used to repeat a string instruction, interrupts and exceptions may occur +between repetitions. Thus, operations on long strings do not delay interrupt +response. + +Certain conditions and flag settings cause the processor to inhibit certain +interrupts and exceptions at instruction boundaries. + + +9.2.1 NMI Masks Further NMIs + +While an NMI handler is executing, the processor ignores further interrupt +signals at the NMI pin until the next IRET instruction is executed. + + +9.2.2 IF Masks INTR + +The IF (interrupt-enable flag) controls the acceptance of external +interrupts signalled via the INTR pin. When IF=0, INTR interrupts are +inhibited; when IF=1, INTR interrupts are enabled. As with the other flag +bits, the processor clears IF in response to a RESET signal. The +instructions CLI and STI alter the setting of IF. + +CLI (Clear Interrupt-Enable Flag) and STI (Set Interrupt-Enable Flag) +explicitly alter IF (bit 9 in the flag register). These instructions may be +executed only if CPL � IOPL. A protection exception occurs if they are +executed when CPL > IOPL. + +The IF is also affected implicitly by the following operations: + + � The instruction PUSHF stores all flags, including IF, in the stack + where they can be examined. + + � Task switches and the instructions POPF and IRET load the flags + register; therefore, they can be used to modify IF. + + � Interrupts through interrupt gates automatically reset IF, disabling + interrupts. (Interrupt gates are explained later in this chapter.) + + +9.2.3 RF Masks Debug Faults + +The RF bit in EFLAGS controls the recognition of debug faults. This permits +debug faults to be raised for a given instruction at most once, no matter +how many times the instruction is restarted. (Refer to Chapter 12 for more +information on debugging.) + + +9.2.4 MOV or POP to SS Masks Some Interrupts and Exceptions + +Software that needs to change stack segments often uses a pair of +instructions; for example: + + MOV SS, AX + MOV ESP, StackTop + +If an interrupt or exception is processed after SS has been changed but +before ESP has received the corresponding change, the two parts of the stack +pointer SS:ESP are inconsistent for the duration of the interrupt handler or +exception handler. + +To prevent this situation, the 80386, after both a MOV to SS and a POP to +SS instruction, inhibits NMI, INTR, debug exceptions, and single-step traps +at the instruction boundary following the instruction that changes SS. Some +exceptions may still occur; namely, page fault and general protection fault. +Always use the 80386 LSS instruction, and the problem will not occur. + + +9.3 Priority Among Simultaneous Interrupts and Exceptions + +If more than one interrupt or exception is pending at an instruction +boundary, the processor services one of them at a time. The priority among +classes of interrupt and exception sources is shown in Table 9-2. The +processor first services a pending interrupt or exception from the class +that has the highest priority, transferring control to the first +instruction of the interrupt handler. Lower priority exceptions are +discarded; lower priority interrupts are held pending. Discarded exceptions +will be rediscovered when the interrupt handler returns control to the point +of interruption. + + +9.4 Interrupt Descriptor Table + +The interrupt descriptor table (IDT) associates each interrupt or exception +identifier with a descriptor for the instructions that service the +associated event. Like the GDT and LDTs, the IDT is an array of 8-byte +descriptors. Unlike the GDT and LDTs, the first entry of the IDT may contain +a descriptor. To form an index into the IDT, the processor multiplies the +interrupt or exception identifier by eight. Because there are only 256 +identifiers, the IDT need not contain more than 256 descriptors. It can +contain fewer than 256 entries; entries are required only for interrupt +identifiers that are actually used. + +The IDT may reside anywhere in physical memory. As Figure 9-1 shows, the +processor locates the IDT by means of the IDT register (IDTR). The +instructions LIDT and SIDT operate on the IDTR. Both instructions have one +explicit operand: the address in memory of a 6-byte area. Figure 9-2 shows +the format of this area. + +LIDT (Load IDT register) loads the IDT register with the linear base +address and limit values contained in the memory operand. This instruction +can be executed only when the CPL is zero. It is normally used by the +initialization logic of an operating system when creating an IDT. An +operating system may also use it to change from one IDT to another. + +SIDT (Store IDT register) copies the base and limit value stored in IDTR +to a memory location. This instruction can be executed at any privilege +level. + + +Table 9-2. Priority Among Simultaneous Interrupts and Exceptions + +Priority Class of Interrupt or Exception + +HIGHEST Faults except debug faults + Trap instructions INTO, INT n, INT 3 + Debug traps for this instruction + Debug faults for next instruction + NMI interrupt +LOWEST INTR interrupt + + +Figure 9-1. IDT Register and Table + + INTERRUPT DESCRIPTOR TABLE + �袴袴袴佶袴袴佶袴袴佶袴袴敲 + 旼컴�� � � � � + � 픔 GATE FOR INTERRUPT #N 캘 + � � � � � � + � 훤袴袴賈袴袴賈袴袴賈袴袴袴� + �   + �   + �   + � �袴袴袴佶袴袴佶袴袴佶袴袴敲 + � � � � � � + � 픔 GATE FOR INTERRUPT #2 캘 + � � � � � � + � 勁袴袴錮袴袴錮袴袴錮袴袴袴� + IDT REGISTER � � � � � � + � 픔 GATE FOR INTERRUPT #1 캘 + 15 0 � � � � � � + �袴袴袴袴袴袴袴敲 � 勁袴袴錮袴袴錮袴袴錮袴袴袴� + � IDT LIMIT 픔컴켸 � � � � � + �袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴� 픔 GATE FOR INTERRUPT #0 캘 + � IDT BASE 픔컴컴컴컴� � � � � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 훤袴袴賈袴袴賈袴袴賈袴袴袴� + 31 0 + + +Figure 9-2. Pseudo-Descriptor Format for LIDT and SIDT + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + � BASE �2 + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴箇袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + � LIMIT �0 + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + +9.5 IDT Descriptors + +The IDT may contain any of three kinds of descriptor: + + � Task gates + � Interrupt gates + � Trap gates + +Figure 9-3 illustrates the format of task gates and 80386 interrupt gates +and trap gates. (The task gate in an IDT is the same as the task gate +already discussed in Chapter 7.) + + +Figure 9-3. 80306 IDT Gate Descriptors + + 80386 TASK GATE + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴錮袴錮袴袴袴袴曲袴袴袴袴袴袴袴袴敲 + 볍굇굇굇굇굇굇(NOT USED)굇굇굇굇굇굇� P 쿏PL�0 0 1 0 1낢굇(NOT USED)굇굇�4 + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴탠컴좔컴좔컴컴컴컴좔컴컴컴컴컴컴컴컴� + � SELECTOR 낢굇굇굇굇굇굇(NOT USED)굇굇굇굇굇굇�0 + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + 80386 INTERRUPT GATE + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴錮袴錮袴袴袴袴曲袴袴曲袴袴袴袴袴敲 + � OFFSET 31..16 � P 쿏PL�0 1 1 1 0�0 0 0�(NOT USED) �4 + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴탠컴좔컴좔컴컴컴컴좔컴컴좔컴컴컴컴컴� + � SELECTOR � OFFSET 15..0 �0 + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + 80386 TRAP GATE + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴錮袴錮袴袴袴袴曲袴袴曲袴袴袴袴袴敲 + � OFFSET 31..16 � P 쿏PL�0 1 1 1 1�0 0 0�(NOT USED) �4 + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴탠컴좔컴좔컴컴컴컴좔컴컴좔컴컴컴컴컴� + � SELECTOR � OFFSET 15..0 �0 + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴� + + +9.6 Interrupt Tasks and Interrupt Procedures + +Just as a CALL instruction can call either a procedure or a task, so an +interrupt or exception can "call" an interrupt handler that is either a +procedure or a task. When responding to an interrupt or exception, the +processor uses the interrupt or exception identifier to index a descriptor +in the IDT. If the processor indexes to an interrupt gate or trap gate, it +invokes the handler in a manner similar to a CALL to a call gate. If the +processor finds a task gate, it causes a task switch in a manner similar to +a CALL to a task gate. + + +9.6.1 Interrupt Procedures + +An interrupt gate or trap gate points indirectly to a procedure which will +execute in the context of the currently executing task as illustrated by +Figure 9-4. The selector of the gate points to an executable-segment +descriptor in either the GDT or the current LDT. The offset field of the +gate points to the beginning of the interrupt or exception handling +procedure. + +The 80386 invokes an interrupt or exception handling procedure in much the +same manner as it CALLs a procedure; the differences are explained in the +following sections. + + +Figure 9-4. Interrupt Vectoring for Procedures + + IDT EXECUTABLE SEGMENT + �袴袴袴袴袴袴袴敲 �袴袴袴袴袴袴袴敲 + � � OFFSET� � + 勁袴袴袴袴袴袴袴� 旼컴컴컴컴컴컴컴컴컴컴컴컴� ENTRY POINT � + � � � LDT OR GDT � � + 勁袴袴袴袴袴袴袴� � �袴袴袴袴袴袴袴敲 � � + � � � � � � � +INTERRUPT 勁袴袴袴袴袴袴袴� � 勁袴袴袴袴袴袴袴� � � + ID컴컴�� TRAP GATE OR 픔켸 � � � � + 튘NTERRUPT GATE 픔커 勁袴袴袴袴袴袴袴� � � + 勁袴袴袴袴袴袴袴� � � � � � + � � � 勁袴袴袴袴袴袴袴� � � + 勁袴袴袴袴袴袴袴� 읕�� SEGMENT 픔� � � + � � � DESCRIPTOR � � � � + 勁袴袴袴袴袴袴袴� 勁袴袴袴袴袴袴袴� � � � + � � � � � � � + 勁袴袴袴袴袴袴袴� 勁袴袴袴袴袴袴袴� � � � + � � � � 쿍ASE� � + 훤袴袴袴袴袴袴袴� 勁袴袴袴袴袴袴袴� 읕컴훤袴袴袴袴袴袴袴� + � � + � � + � � + 훤袴袴袴袴袴袴袴� + + +9.6.1.1 Stack of Interrupt Procedure + +Just as with a control transfer due to a CALL instruction, a control +transfer to an interrupt or exception handling procedure uses the stack to +store the information needed for returning to the original procedure. As +Figure 9-5 shows, an interrupt pushes the EFLAGS register onto the stack +before the pointer to the interrupted instruction. + +Certain types of exceptions also cause an error code to be pushed on the +stack. An exception handler can use the error code to help diagnose the +exception. + + +9.6.1.2 Returning from an Interrupt Procedure + +An interrupt procedure also differs from a normal procedure in the method +of leaving the procedure. The IRET instruction is used to exit from an +interrupt procedure. IRET is similar to RET except that IRET increments EIP +by an extra four bytes (because of the flags on the stack) and moves the +saved flags into the EFLAGS register. The IOPL field of EFLAGS is changed +only if the CPL is zero. The IF flag is changed only if CPL � IOPL. + + +Figure 9-5. Stack Layout after Exception of Interrupt + + WITHOUT PRIVILEGE TRANSITION + + D O 31 0 31 0 + I F 勁袴袴袴箇袴袴袴� 勁袴袴袴箇袴袴袴� + R 볍굇굇굇볍굇굇굇� OLD 볍굇굇굇볍굇굇굇� OLD + E E 勁袴袴袴胱袴袴袴� SS:ESP 勁袴袴袴胱袴袴袴� SS:ESP + C X 볍굇굇굇볍굇굇굇� � 볍굇굇굇볍굇굇굇� � + T P 勁袴袴袴姦袴袴袴�컴컴� 勁袴袴袴姦袴袴袴�컴컴� + I A � OLD EFLAGS � � OLD EFLAGS � + O N 勁袴袴袴箇袴袴袴� 勁袴袴袴箇袴袴袴� + N S 볍굇굇굇튟LD CS � NEW 볍굇굇굇튟LD CS � + I 勁袴袴袴姦袴袴袴� SS:ESP 勁袴袴袴姦袴袴袴� + � O � OLD EIP � � � OLD EIP � NEW + � N 勁袴袴袴袴袴袴袴�컴컴� 勁袴袴袴袴袴袴袴� SS:ESP + � � � � ERROR CODE � � +    勁袴袴袴袴袴袴袴�컴컴� +   � � +   + WITHOUT ERROR CODE WITH ERROR CODE + + WITH PRIVILEGE TRANSITION + + D O 31 0 31 0 + I F �袴袴袴藁袴袴袴敲컴컴� �袴袴袴藁袴袴袴敲컴컴� + R 볍굇굇굇튟LD SS � � 볍굇굇굇튟LD SS � � + E E 勁袴袴袴姦袴袴袴� SS:ESP 勁袴袴袴姦袴袴袴� SS:ESP + C X � OLD ESP � FROM TSS � OLD ESP � FROM TSS + T P 勁袴袴袴袴袴袴袴� 勁袴袴袴袴袴袴袴� + I A � OLD EFLAGS � � OLD EFLAGS � + O N 勁袴袴袴箇袴袴袴� 勁袴袴袴箇袴袴袴� + N S 볍굇굇굇튟LD CS � NEW 볍굇굇굇튟LD CS � + I 勁袴袴袴姦袴袴袴� SS:EIP 勁袴袴袴姦袴袴袴� + � O � OLD EIP � � � OLD EIP � NEW + � N 勁袴袴袴袴袴袴袴�컴컴� 勁袴袴袴袴袴袴袴� SS:ESP + � � � � ERROR CODE � � +    勁袴袴袴袴袴袴袴�컴컴� +   � � +   + WITHOUT ERROR CODE WITH ERROR CODE + + +9.6.1.3 Flags Usage by Interrupt Procedure + +Interrupts that vector through either interrupt gates or trap gates cause +TF (the trap flag) to be reset after the current value of TF is saved on the +stack as part of EFLAGS. By this action the processor prevents debugging +activity that uses single-stepping from affecting interrupt response. A +subsequent IRET instruction restores TF to the value in the EFLAGS image on +the stack. + +The difference between an interrupt gate and a trap gate is in the effect +on IF (the interrupt-enable flag). An interrupt that vectors through an +interrupt gate resets IF, thereby preventing other interrupts from +interfering with the current interrupt handler. A subsequent IRET +instruction restores IF to the value in the EFLAGS image on the stack. An +interrupt through a trap gate does not change IF. + + +9.6.1.4 Protection in Interrupt Procedures + +The privilege rule that governs interrupt procedures is similar to that for +procedure calls: the CPU does not permit an interrupt to transfer control to +a procedure in a segment of lesser privilege (numerically greater privilege +level) than the current privilege level. An attempt to violate this rule +results in a general protection exception. + +Because occurrence of interrupts is not generally predictable, this +privilege rule effectively imposes restrictions on the privilege levels at +which interrupt and exception handling procedures can execute. Either of the +following strategies can be employed to ensure that the privilege rule is +never violated. + + � Place the handler in a conforming segment. This strategy suits the + handlers for certain exceptions (divide error, for example). Such a + handler must use only the data available to it from the stack. If it + needed data from a data segment, the data segment would have to have + privilege level three, thereby making it unprotected. + + � Place the handler procedure in a privilege level zero segment. + + +9.6.2 Interrupt Tasks + +A task gate in the IDT points indirectly to a task, as Figure 9-6 +illustrates. The selector of the gate points to a TSS descriptor in the GDT. + +When an interrupt or exception vectors to a task gate in the IDT, a task +switch results. Handling an interrupt with a separate task offers two +advantages: + + � The entire context is saved automatically. + + � The interrupt handler can be isolated from other tasks by giving it a + separate address space, either via its LDT or via its page directory. + +The actions that the processor takes to perform a task switch are discussed +in Chapter 7. The interrupt task returns to the interrupted task by +executing an IRET instruction. + +If the task switch is caused by an exception that has an error code, the +processor automatically pushes the error code onto the stack that +corresponds to the privilege level of the first instruction to be executed +in the interrupt task. + +When interrupt tasks are used in an operating system for the 80386, there +are actually two schedulers: the software scheduler (part of the operating +system) and the hardware scheduler (part of the processor's interrupt +mechanism). The design of the software scheduler should account for the fact +that the hardware scheduler may dispatch an interrupt task whenever +interrupts are enabled. + + +Figure 9-6. Interrupt Vectoring for Tasks + + IDT GDT + �袴袴袴袴袴袴袴袴� �袴袴袴袴袴袴袴袴� + � � � � TSS + 픔컴컴컴컴컴컴컴캘 픔컴컴컴컴컴컴컴캘 �袴袴袴袴袴袴袴袴� + � � � � � � + 픔컴컴컴컴컴컴컴캘 픔컴컴컴컴컴컴컴캘 � � + � � � � � � + 픔컴컴컴컴컴컴컴캘 픔컴컴컴컴컴컴컴캘 � � + 旼�� TASK GATE 픔컴� � � � � + � 픔컴컴컴컴컴컴컴캘 � 픔컴컴컴컴컴컴컴캘 � � + � � � 읕컴� TSS DESCRIPTOR 픔컴� � � + � 픔컴컴컴컴컴컴컴캘 픔컴컴컴컴컴컴컴캘 � � � + � � � � � � � � + � 픔컴컴컴컴컴컴컴캘 픔컴컴컴컴컴컴컴캘 읕�훤袴袴袴袴袴袴袴暠 + � � � � � + � 픔컴컴컴컴컴컴컴캘 픔컴컴컴컴컴컴컴캘 + � � � � � + � 훤袴袴袴袴袴袴袴暠 훤袴袴袴袴袴袴袴暠 + � + 읕INTERRUPT ID + + +9.7 Error Code + +With exceptions that relate to a specific segment, the processor pushes an +error code onto the stack of the exception handler (whether procedure or +task). The error code has the format shown in Figure 9-7. The format of the +error code resembles that of a selector; however, instead of an RPL field, +the error code contains two one-bit items: + + 1. The processor sets the EXT bit if an event external to the program + caused the exception. + + 2. The processor sets the I-bit (IDT-bit) if the index portion of the + error code refers to a gate descriptor in the IDT. + +If the I-bit is not set, the TI bit indicates whether the error code refers +to the GDT (value 0) or to the LDT (value 1). The remaining 14 bits are the +upper 14 bits of the segment selector involved. In some cases the error code +on the stack is null, i.e., all bits in the low-order word are zero. + + +Figure 9-7. Error Code Format + + 31 15 2 1 0 + �袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴佶袴袴袴袴袴袴袴袴妄袴袴袴佶佶佶� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교 쿟� 쿐� + 볍굇굇굇굇굇UNDEFINED굇굇굇굇굇굇� SELECTOR INDEX � 쿔� � + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교 쿔� 쿦� + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴賈袴袴袴袴袴袴袴袴曲袴袴袴賈賈賈暠 + + +9.8 Exception Conditions + +The following sections describe each of the possible exception conditions +in detail. Each description classifies the exception as a fault, trap, or +abort. This classification provides information needed by systems +programmers for restarting the procedure in which the exception occurred: + +Faults The CS and EIP values saved when a fault is reported point to the + instruction causing the fault. + +Traps The CS and EIP values stored when the trap is reported point to the + instruction dynamically after the instruction causing the trap. If + a trap is detected during an instruction that alters program flow, + the reported values of CS and EIP reflect the alteration of program + flow. For example, if a trap is detected in a JMP instruction, the + CS and EIP values pushed onto the stack point to the target of the + JMP, not to the instruction after the JMP. + +Aborts An abort is an exception that permits neither precise location of + the instruction causing the exception nor restart of the program + that caused the exception. Aborts are used to report severe errors, + such as hardware errors and inconsistent or illegal values in + system tables. + + +9.8.1 Interrupt 0 컴 Divide Error + +The divide-error fault occurs during a DIV or an IDIV instruction when the +divisor is zero. + + +9.8.2 Interrupt 1 컴 Debug Exceptions + +The processor triggers this interrupt for any of a number of conditions; +whether the exception is a fault or a trap depends on the condition: + + � Instruction address breakpoint fault. + � Data address breakpoint trap. + � General detect fault. + � Single-step trap. + � Task-switch breakpoint trap. + +The processor does not push an error code for this exception. An exception +handler can examine the debug registers to determine which condition caused +the exception. Refer to Chapter 12 for more detailed information about +debugging and the debug registers. + + +9.8.3 Interrupt 3 컴 Breakpoint + +The INT 3 instruction causes this trap. The INT 3 instruction is one byte +long, which makes it easy to replace an opcode in an executable segment with +the breakpoint opcode. The operating system or a debugging subsystem can use +a data-segment alias for an executable segment to place an INT 3 anywhere it +is convenient to arrest normal execution so that some sort of special +processing can be performed. Debuggers typically use breakpoints as a way of +displaying registers, variables, etc., at crucial points in a task. + +The saved CS:EIP value points to the byte following the breakpoint. If a +debugger replaces a planted breakpoint with a valid opcode, it must subtract +one from the saved EIP value before returning. Refer also to Chapter 12 for +more information on debugging. + + +9.8.4 Interrupt 4 컴 Overflow + +This trap occurs when the processor encounters an INTO instruction and the +OF (overflow) flag is set. Since signed arithmetic and unsigned arithmetic +both use the same arithmetic instructions, the processor cannot determine +which is intended and therefore does not cause overflow exceptions +automatically. Instead it merely sets OF when the results, if interpreted as +signed numbers, would be out of range. When doing arithmetic on signed +operands, careful programmers and compilers either test OF directly or use +the INTO instruction. + + +9.8.5 Interrupt 5 컴 Bounds Check + +This fault occurs when the processor, while executing a BOUND instruction, +finds that the operand exceeds the specified limits. A program can use the +BOUND instruction to check a signed array index against signed limits +defined in a block of memory. + + +9.8.6 Interrupt 6 컴 Invalid Opcode + +This fault occurs when an invalid opcode is detected by the execution unit. +(The exception is not detected until an attempt is made to execute the +invalid opcode; i.e., prefetching an invalid opcode does not cause this +exception.) No error code is pushed on the stack. The exception can be +handled within the same task. + +This exception also occurs when the type of operand is invalid for the +given opcode. Examples include an intersegment JMP referencing a register +operand, or an LES instruction with a register source operand. + + +9.8.7 Interrupt 7 컴 Coprocessor Not Available + +This exception occurs in either of two conditions: + + � The processor encounters an ESC (escape) instruction, and the EM + (emulate) bit ofCR0 (control register zero) is set. + + � The processor encounters either the WAIT instruction or an ESC + instruction, and both the MP (monitor coprocessor) and TS (task + switched) bits of CR0 are set. + +Refer to Chapter 11 for information about the coprocessor interface. + + +9.8.8 Interrupt 8 컴 Double Fault + +Normally, when the processor detects an exception while trying to invoke +the handler for a prior exception, the two exceptions can be handled +serially. If, however, the processor cannot handle them serially, it signals +the double-fault exception instead. To determine when two faults are to be +signalled as a double fault, the 80386 divides the exceptions into three +classes: benign exceptions, contributory exceptions, and page faults. Table +9-3 shows this classification. + +Table 9-4 shows which combinations of exceptions cause a double fault and +which do not. + +The processor always pushes an error code onto the stack of the +double-fault handler; however, the error code is always zero. The faulting +instruction may not be restarted. If any other exception occurs while +attempting to invoke the double-fault handler, the processor shuts down. + + +Table 9-3. Double-Fault Detection Classes + +Class ID Description + + 1 Debug exceptions + 2 NMI + 3 Breakpoint +Benign 4 Overflow +Exceptions 5 Bounds check + 6 Invalid opcode + 7 Coprocessor not available + 16 Coprocessor error + + 0 Divide error + 9 Coprocessor Segment Overrun +Contributory 10 Invalid TSS +Exceptions 11 Segment not present + 12 Stack exception + 13 General protection + +Page Faults 14 Page fault + + +Table 9-4. Double-Fault Definition + + SECOND EXCEPTION + + Benign Contributory Page + Exception Exception Fault + + + Benign OK OK OK + Exception + +FIRST Contributory OK DOUBLE OK +EXCEPTION Exception + + Page + Fault OK DOUBLE DOUBLE + + +9.8.9 Interrupt 9 컴 Coprocessor Segment Overrun + +This exception is raised in protected mode if the 80386 detects a page or +segment violation while transferring the middle portion of a coprocessor +operand to the NPX. This exception is avoidable. Refer to Chapter 11 for +more information about the coprocessor interface. + + +9.8.10 Interrupt 10 컴 Invalid TSS + +Interrupt 10 occurs if during a task switch the new TSS is invalid. A TSS +is considered invalid in the cases shown in Table 9-5. An error code is +pushed onto the stack to help identify the cause of the fault. The EXT bit +indicates whether the exception was caused by a condition outside the +control of the program; e.g., an external interrupt via a task gate +triggered a switch to an invalid TSS. + +This fault can occur either in the context of the original task or in the +context of the new task. Until the processor has completely verified the +presence of the new TSS, the exception occurs in the context of the original +task. Once the existence of the new TSS is verified, the task switch is +considered complete; i.e., TR is updated and, if the switch is due to a +CALL or interrupt, the backlink of the new TSS is set to the old TSS. Any +errors discovered by the processor after this point are handled in the +context of the new task. + +To insure a proper TSS to process it, the handler for exception 10 must be +a task invoked via a task gate. + + +Table 9-5. Conditions That Invalidate the TSS + +Error Code Condition + +TSS id + EXT The limit in the TSS descriptor is less than 103 +LTD id + EXT Invalid LDT selector or LDT not present +SS id + EXT Stack segment selector is outside table limit +SS id + EXT Stack segment is not a writable segment +SS id + EXT Stack segment DPL does not match new CPL +SS id + EXT Stack segment selector RPL < > CPL +CS id + EXT Code segment selector is outside table limit +CS id + EXT Code segment selector does not refer to code + segment +CS id + EXT DPL of non-conforming code segment < > new CPL +CS id + EXT DPL of conforming code segment > new CPL +DS/ES/FS/GS id + EXT DS, ES, FS, or GS segment selector is outside + table limits +DS/ES/FS/GS id + EXT DS, ES, FS, or GS is not readable segment + + +9.8.11 Interrupt 11 컴 Segment Not Present + +Exception 11 occurs when the processor detects that the present bit of a +descriptor is zero. The processor can trigger this fault in any of these +cases: + + � While attempting to load the CS, DS, ES, FS, or GS registers; loading + the SS register, however, causes a stack fault. + + � While attempting loading the LDT register with an LLDT instruction; + loading the LDT register during a task switch operation, however, + causes the "invalid TSS" exception. + + � While attempting to use a gate descriptor that is marked not-present. + +This fault is restartable. If the exception handler makes the segment +present and returns, the interrupted program will resume execution. + +If a not-present exception occurs during a task switch, not all the steps +of the task switch are complete. During a task switch, the processor first +loads all the segment registers, then checks their contents for validity. If +a not-present exception is discovered, the remaining segment registers have +not been checked and therefore may not be usable for referencing memory. The +not-present handler should not rely on being able to use the values found +in CS, SS, DS, ES, FS, and GS without causing another exception. The +exception handler should check all segment registers before trying to resume +the new task; otherwise, general protection faults may result later under +conditions that make diagnosis more difficult. There are three ways to +handle this case: + + 1. Handle the not-present fault with a task. The task switch back to the + interrupted task will cause the processor to check the registers as it + loads them from the TSS. + + 2. PUSH and POP all segment registers. Each POP causes the processor to + check the new contents of the segment register. + + 3. Scrutinize the contents of each segment-register image in the TSS, + simulating the test that the processor makes when it loads a segment + register. + +This exception pushes an error code onto the stack. The EXT bit of the +error code is set if an event external to the program caused an interrupt +that subsequently referenced a not-present segment. The I-bit is set if the +error code refers to an IDT entry, e.g., an INT instruction referencing a +not-present gate. + +An operating system typically uses the "segment not present" exception to +implement virtual memory at the segment level. A not-present indication in a +gate descriptor, however, usually does not indicate that a segment is not +present (because gates do not necessarily correspond to segments). +Not-present gates may be used by an operating system to trigger exceptions +of special significance to the operating system. + + +9.8.12 Interrupt 12 컴 Stack Exception + +A stack fault occurs in either of two general conditions: + + � As a result of a limit violation in any operation that refers to the + SS register. This includes stack-oriented instructions such as POP, + PUSH, ENTER, and LEAVE, as well as other memory references that + implicitly use SS (for example, MOV AX, [BP+6]). ENTER causes this + exception when the stack is too small for the indicated local-variable + space. + + � When attempting to load the SS register with a descriptor that is + marked not-present but is otherwise valid. This can occur in a task + switch, an interlevel CALL, an interlevel return, an LSS instruction, + or a MOV or POP instruction to SS. + +When the processor detects a stack exception, it pushes an error code onto +the stack of the exception handler. If the exception is due to a not-present +stack segment or to overflow of the new stack during an interlevel CALL, the +error code contains a selector to the segment in question (the exception +handler can test the present bit in the descriptor to determine which +exception occurred); otherwise the error code is zero. + +An instruction that causes this fault is restartable in all cases. The +return pointer pushed onto the exception handler's stack points to the +instruction that needs to be restarted. This instruction is usually the one +that caused the exception; however, in the case of a stack exception due to +loading of a not-present stack-segment descriptor during a task switch, the +indicated instruction is the first instruction of the new task. + +When a stack fault occurs during a task switch, the segment registers may +not be usable for referencing memory. During a task switch, the selector +values are loaded before the descriptors are checked. If a stack fault is +discovered, the remaining segment registers have not been checked and +therefore may not be usable for referencing memory. The stack fault handler +should not rely on being able to use the values found in CS, SS, DS, ES, +FS, and GS without causing another exception. The exception handler should +check all segment registers before trying to resume the new task; otherwise, +general protection faults may result later under conditions that make +diagnosis more difficult. + + +9.8.13 Interrupt 13 컴 General Protection Exception + +All protection violations that do not cause another exception cause a +general protection exception. This includes (but is not limited to): + + 1. Exceeding segment limit when using CS, DS, ES, FS, or GS + + 2. Exceeding segment limit when referencing a descriptor table + + 3. Transferring control to a segment that is not executable + + 4. Writing into a read-only data segment or into a code segment + + 5. Reading from an execute-only segment + + 6. Loading the SS register with a read-only descriptor (unless the + selector comes from the TSS during a task switch, in which case a TSS + exception occurs + + 7. Loading SS, DS, ES, FS, or GS with the descriptor of a system segment + + 8. Loading DS, ES, FS, or GS with the descriptor of an executable + segment that is not also readable + + 9. Loading SS with the descriptor of an executable segment + + 10. Accessing memory via DS, ES, FS, or GS when the segment register + contains a null selector + + 11. Switching to a busy task + + 12. Violating privilege rules + + 13. Loading CR0 with PG=1 and PE=0. + + 14. Interrupt or exception via trap or interrupt gate from V86 mode to + privilege level other than zero. + + 15. Exceeding the instruction length limit of 15 bytes (this can occur + only if redundant prefixes are placed before an instruction) + +The general protection exception is a fault. In response to a general +protection exception, the processor pushes an error code onto the exception +handler's stack. If loading a descriptor causes the exception, the error +code contains a selector to the descriptor; otherwise, the error code is +null. The source of the selector in an error code may be any of the +following: + + 1. An operand of the instruction. + 2. A selector from a gate that is the operand of the instruction. + 3. A selector from a TSS involved in a task switch. + + +9.8.14 Interrupt 14 컴 Page Fault + +This exception occurs when paging is enabled (PG=1) and the processor +detects one of the following conditions while translating a linear address +to a physical address: + + � The page-directory or page-table entry needed for the address + translation has zero in its present bit. + + � The current procedure does not have sufficient privilege to access the + indicated page. + +The processor makes available to the page fault handler two items of +information that aid in diagnosing the exception and recovering from it: + + � An error code on the stack. The error code for a page fault has a + format different from that for other exceptions (see Figure 9-8). The + error code tells the exception handler three things: + + 1. Whether the exception was due to a not present page or to an access + rights violation. + + 2. Whether the processor was executing at user or supervisor level at + the time of the exception. + + 3. Whether the memory access that caused the exception was a read or + write. + + � CR2 (control register two). The processor stores in CR2 the linear + address used in the access that caused the exception (see Figure 9-9). + The exception handler can use this address to locate the corresponding + page directory and page table entries. If another page fault can occur + during execution of the page fault handler, the handler should push CR2 + onto the stack. + + +Figure 9-8. Page-Fault Error Code Format + + �袴袴錮袴袴錮袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + 튔ield쿣alue� Description � + 픔컴컴탠컴컴탠컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴캘 + � U/S � 0 � The access causing the fault originated when the processor � + � � � was executing in supervisor mode. � + � � � � + � � 1 � The access causing the fault originated when the processor � + � � � was executing in user mode. � + � � � � + � W/R � 0 � The access causing the fault was a read. � + � � � � + � � 1 � The access causing the fault was a write. � + � � � � + � P � 0 � The fault was caused by a not-present page. � + � � � � + � � 1 � The fault was caused by a page-level protection violation. � + 훤袴袴鳩袴袴鳩袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴暠 + + 31 15 7 3 2 1 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴袴袴袴袴佶佶佶� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교U쿥� � + 볍굇굇굇굇굇굇굇굇굇굇굇굇켝NDEFINED굇굇굇굇굇굇굇굇굇굇굇교/�/쿛� + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇교S쿝� � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴袴袴袴袴賈賈賈暠 + + +9.8.14.1 Page Fault During Task Switch + +The processor may access any of four segments during a task switch: + + 1. Writes the state of the original task in the TSS of that task. + + 2. Reads the GDT to locate the TSS descriptor of the new task. + + 3. Reads the TSS of the new task to check the types of segment + descriptors from the TSS. + + 4. May read the LDT of the new task in order to verify the segment + registers stored in the new TSS. + +A page fault can result from accessing any of these segments. In the latter +two cases the exception occurs in the context of the new task. The +instruction pointer refers to the next instruction of the new task, not to +the instruction that caused the task switch. If the design of the operating +system permits page faults to occur during task-switches, the page-fault +handler should be invoked via a task gate. + + +Figure 9-9. CR2 Format + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴敲 + � � + � PAGE FAULT LINEAR ADDRESS � + � � + 훤袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴� + + +9.8.14.2 Page Fault with Inconsistent Stack Pointer + +Special care should be taken to ensure that a page fault does not cause the +processor to use an invalid stack pointer (SS:ESP). Software written for +earlier processors in the 8086 family often uses a pair of instructions to +change to a new stack; for example: + +MOV SS, AX +MOV SP, StackTop + +With the 80386, because the second instruction accesses memory, it is +possible to get a page fault after SS has been changed but before SP has +received the corresponding change. At this point, the two parts of the stack +pointer SS:SP (or, for 32-bit programs, SS:ESP) are inconsistent. + +The processor does not use the inconsistent stack pointer if the handling +of the page fault causes a stack switch to a well defined stack (i.e., the +handler is a task or a more privileged procedure). However, if the page +fault handler is invoked by a trap or interrupt gate and the page fault +occurs at the same privilege level as the page fault handler, the processor +will attempt to use the stack indicated by the current (invalid) stack +pointer. + +In systems that implement paging and that handle page faults within the +faulting task (with trap or interrupt gates), software that executes at the +same privilege level as the page fault handler should initialize a new stack +by using the new LSS instruction rather than an instruction pair shown +above. When the page fault handler executes at privilege level zero (the +normal case), the scope of the problem is limited to privilege-level zero +code, typically the kernel of the operating system. + + +9.8.15 Interrupt 16 컴 Coprocessor Error + +The 80386 reports this exception when it detects a signal from the 80287 or +80387 on the 80386's ERROR# input pin. The 80386 tests this pin only at the +beginning of certain ESC instructions and when it encounters a WAIT +instruction while the EM bit of the MSW is zero (no emulation). Refer to +Chapter 11 for more information on the coprocessor interface. + + +9.9 Exception Summary + + +Table 9-6 summarizes the exceptions recognized by the 386. + +Table 9-6. Exception Summary + + +Description Interrupt Return Address Exception Function +That Can Generate + Number Points to Type the +Exception + Faulting + Instruction + +Divide error 0 YES FAULT DIV, IDIV +Debug exceptions 1 +Some debug exceptions are traps and some are faults. The exception +handler can determine which has occurred by examining DR6. (Refer to +Chapter 12.) +Some debug exceptions are traps and some are faults. The exception +handler can determine which has occurred by examining DR6. (Refer to +Chapter 12.) Any instruction +Breakpoint 3 NO TRAP One-byte +INT 3 +Overflow 4 NO TRAP INTO +Bounds check 5 YES FAULT BOUND +Invalid opcode 6 YES FAULT Any +illegal instruction +Coprocessor not available 7 YES FAULT ESC, WAIT +Double fault 8 YES ABORT Any +instruction that can + generate +an exception +Coprocessor Segment +Overrun 9 NO ABORT Any +operand of an ESC + +instruction that wraps around + the end of +a segment. +Invalid TSS 10 YES FAULT +An invalid-TSS fault is not restartable if it occurs during the +processing of an external interrupt. JMP, CALL, IRET, any interrupt +Segment not present 11 YES FAULT Any +segment-register modifier +Stack exception 12 YES FAULT Any memory +reference thru SS +General Protection 13 YES FAULT/ABORT +All GP faults are restartable. If the fault occurs while attempting to +vector to the handler for an external interrupt, the interrupted program is +restartable, but the interrupt may be lost. Any memory reference or code + fetch +Page fault 14 YES FAULT Any memory +reference or code + fetch +Coprocessor error 16 YES FAULT +Coprocessor errors are reported as a fault on the first ESC or WAIT +instruction executed after the ESC instruction that caused the error. +ESC, WAIT +Two-byte SW Interrupt 0-255 NO TRAP INT n + + +9.10 Error Code Summary + +Table 9-7 summarizes the error information that is available with each +exception. + + +Table 9-7. Error-Code Summary + +Description Interrupt Error Code + Number + +Divide error 0 No +Debug exceptions 1 No +Breakpoint 3 No +Overflow 4 No +Bounds check 5 No +Invalid opcode 6 No +Coprocessor not available 7 No +System error 8 Yes (always 0) +Coprocessor Segment Overrun 9 No +Invalid TSS 10 Yes +Segment not present 11 Yes +Stack exception 12 Yes +General protection fault 13 Yes +Page fault 14 Yes +Coprocessor error 16 No +Two-byte SW interrupt 0-255 No + + +Chapter 10 Initialization + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +After a signal on the RESET pin, certain registers of the 80386 are set to +predefined values. These values are adequate to enable execution of a +bootstrap program, but additional initialization must be performed by +software before all the features of the processor can be utilized. + + +10.1 Processor State After Reset + +The contents of EAX depend upon the results of the power-up self test. The +self-test may be requested externally by assertion of BUSY# at the end of +RESET. The EAX register holds zero if the 80386 passed the test. A nonzero +value in EAX after self-test indicates that the particular 80386 unit is +faulty. If the self-test is not requested, the contents of EAX after RESET +is undefined. + +DX holds a component identifier and revision number after RESET as Figure +10-1 illustrates. DH contains 3, which indicates an 80386 component. DL +contains a unique identifier of the revision level. + +Control register zero (CR0) contains the values shown in Figure 10-2. The +ET bit of CR0 is set if an 80387 is present in the configuration (according +to the state of the ERROR# pin after RESET). If ET is reset, the +configuration either contains an 80287 or does not contain a coprocessor. A +software test is required to distinguish between these latter two +possibilities. + +The remaining registers and flags are set as follows: + + EFLAGS =00000002H + IP =0000FFF0H + CS selector =000H + DS selector =0000H + ES selector =0000H + SS selector =0000H + FS selector =0000H + GS selector =0000H + IDTR: + base =0 + limit =03FFH + +All registers not mentioned above are undefined. + +These settings imply that the processor begins in real-address mode with +interrupts disabled. + + +Figure 10-1. Contents of EDX after RESET + + EDX REGISTER + + 31 23 15 7 0 + �袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴敲 + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� DH � DL � + 볍굇굇굇굇굇켝NDEFINED굇굇굇굇굇굇� DEVICE ID � STEPPING ID � + 볍굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇굇� 3 � (UNIQUE) � + 훤袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴� + + +Figure 10-2. Initial Contents of CR0 + + CONTROL REGISTER ZERO + + 31 23 15 7 4 3 1 0 + �錮袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴袴曲袴袴錮錮錮錮錮敲 + 튡� 쿐쿟쿐쿘쿛� + � � UNDEFINED � � � � � � + 튖� 쿟쿞쿘쿛쿐� + 훼鳩袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴袴袴妄袴袴局局局局局� + � � � � � � + 읕컴컴컴컴컴컴0 - PAGING DISABLED � � � � � + * - INDICATES PRESENCE OF 80387컴컴컴컴컴컴컴컴켸 � � � � + 0 - NO TASK SWITCH컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� � � � + 0 - DO NOT MONITOR COPROCESSOR컴컴컴컴컴컴컴컴컴컴컴� � � + 0 - COPROCESSOR NOT PRESENT컴컴컴컴컴컴컴컴컴컴컴컴컴켸 � + 0 - PROTECTION NOT ENABLED (REAL ADDRESS MODE)컴컴컴컴컴� + + +10.2 Software Initialization for Real-Address Mode + +In real-address mode a few structures must be initialized before a program +can take advantage of all the features available in this mode. + + +10.2.1 Stack + +No instructions that use the stack can be used until the stack-segment +register (SS) has been loaded. SS must point to an area in RAM. + + +10.2.2 Interrupt Table + +The initial state of the 80386 leaves interrupts disabled; however, the +processor will still attempt to access the interrupt table if an exception +or nonmaskable interrupt (NMI) occurs. Initialization software should take +one of the following actions: + + � Change the limit value in the IDTR to zero. This will cause a shutdown + if an exception or nonmaskable interrupt occurs. (Refer to the 80386 + Hardware Reference Manual to see how shutdown is signalled externally.) + + � Put pointers to valid interrupt handlers in all positions of the + interrupt table that might be used by exceptions or interrupts. + + � Change the IDTR to point to a valid interrupt table. + + +10.2.3 First Instructions + +After RESET, address lines A{31-20} are automatically asserted for +instruction fetches. This fact, together with the initial values of CS:IP, +causes instruction execution to begin at physical address FFFFFFF0H. Near +(intrasegment) forms of control transfer instructions may be used to pass +control to other addresses in the upper 64K bytes of the address space. The +first far (intersegment) JMP or CALL instruction causes A{31-20} to drop +low, and the 80386 continues executing instructions in the lower one +megabyte of physical memory. This automatic assertion of address lines +A{31-20} allows systems designers to use a ROM at the high end of +the address space to initialize the system. + + +10.3 Switching to Protected Mode + +Setting the PE bit of the MSW in CR0 causes the 80386 to begin executing in +protected mode. The current privilege level (CPL) starts at zero. The +segment registers continue to point to the same linear addresses as in real +address mode (in real address mode, linear addresses are the same physical +addresses). + +Immediately after setting the PE flag, the initialization code must flush +the processor's instruction prefetch queue by executing a JMP instruction. +The 80386 fetches and decodes instructions and addresses before they are +used; however, after a change into protected mode, the prefetched +instruction information (which pertains to real-address mode) is no longer +valid. A JMP forces the processor to discard the invalid information. + + +10.4 Software Initialization for Protected Mode + +Most of the initialization needed for protected mode can be done either +before or after switching to protected mode. If done in protected mode, +however, the initialization procedures must not use protected-mode features +that are not yet initialized. + + +10.4.1 Interrupt Descriptor Table + +The IDTR may be loaded in either real-address or protected mode. However, +the format of the interrupt table for protected mode is different than that +for real-address mode. It is not possible to change to protected mode and +change interrupt table formats at the same time; therefore, it is inevitable +that, if IDTR selects an interrupt table, it will have the wrong format at +some time. An interrupt or exception that occurs at this time will have +unpredictable results. To avoid this unpredictability, interrupts should +remain disabled until interrupt handlers are in place and a valid IDT has +been created in protected mode. + + +10.4.2 Stack + +The SS register may be loaded in either real-address mode or protected +mode. If loaded in real-address mode, SS continues to point to the same +linear base-address after the switch to protected mode. + + +10.4.3 Global Descriptor Table + +Before any segment register is changed in protected mode, the GDT register +must point to a valid GDT. Initialization of the GDT and GDTR may be done in +real-address mode. The GDT (as well as LDTs) should reside in RAM, because +the processor modifies the accessed bit of descriptors. + + +10.4.4 Page Tables + +Page tables and the PDBR in CR3 can be initialized in either real-address +mode or in protected mode; however, the paging enabled (PG) bit of CR0 +cannot be set until the processor is in protected mode. PG may be set +simultaneously with PE, or later. When PG is set, the PDBR in CR3 should +already be initialized with a physical address that points to a valid page +directory. The initialization procedure should adopt one of the following +strategies to ensure consistent addressing before and after paging is +enabled: + + � The page that is currently being executed should map to the same + physical addresses both before and after PG is set. + + � A JMP instruction should immediately follow the setting of PG. + + +10.4.5 First Task + +The initialization procedure can run awhile in protected mode without +initializing the task register; however, before the first task switch, the +following conditions must prevail: + + � There must be a valid task state segment (TSS) for the new task. The + stack pointers in the TSS for privilege levels numerically less than or + equal to the initial CPL must point to valid stack segments. + + � The task register must point to an area in which to save the current + task state. After the first task switch, the information dumped in this + area is not needed, and the area can be used for other purposes. + + +10.5 Initialization Example + +$TITLE ('Initial Task') + + NAME INIT + +init_stack SEGMENT RW + DW 20 DUP(?) +tos LABEL WORD +init_stack ENDS + +init_data SEGMENT RW PUBLIC + DW 20 DUP(?) +init_data ENDS + +init_code SEGMENT ER PUBLIC + +ASSUME DS:init_data + + nop + nop + nop +init_start: + ; set up stack + mov ax, init_stack + mov ss, ax + mov esp, offset tos + + mov a1,1 +blink: + xor a1,1 + out 0e4h,a1 + mov cx,3FFFh +here: + dec cx + jnz here + + jmp SHORT blink + + hlt +init_code ends + + END init_start, SS:init_stack, DS:init_data + +$TITLE('Protected Mode Transition -- 386 initialization') +NAME RESET + +;***************************************************************** +; Upon reset the 386 starts executing at address 0FFFFFFF0H. The +; upper 12 address bits remain high until a FAR call or jump is +; executed. +; +; Assume the following: +; +; +; - a short jump at address 0FFFFFFF0H (placed there by the +; system builder) causes execution to begin at START in segment +; RESET_CODE. +; +; +; - segment RESET_CODE is based at physical address 0FFFF0000H, +; i.e. at the start of the last 64K in the 4G address space. +; Note that this is the base of the CS register at reset. If +; you locate ROMcode above this address, you will need to +; figure out an adjustment factor to address things within this +; segment. +; +;***************************************************************** +$EJECT ; + +; Define addresses to locate GDT and IDT in RAM. +; These addresses are also used in the BLD386 file that defines +; the GDT and IDT. If you change these addresses, make sure you +; change the base addresses specified in the build file. + +GDTbase EQU 00001000H ; physical address for GDT base +IDTbase EQU 00000400H ; physical address for IDT base + +PUBLIC GDT_EPROM +PUBLIC IDT_EPROM +PUBLIC START + +DUMMY segment rw ; ONLY for ASM386 main module stack init + DW 0 +DUMMY ends + +;***************************************************************** +; +; Note: RESET CODE must be USEl6 because the 386 initally executes +; in real mode. +; + +RESET_CODE segment er PUBLIC USE16 + +ASSUME DS:nothing, ES:nothing + +; +; 386 Descriptor template + +DESC STRUC + lim_0_15 DW 0 ; limit bits (0..15) + bas_0_15 DW 0 ; base bits (0..15) + bas_16_23 DB 0 ; base bits (16..23) + access DB 0 ; access byte + gran DB 0 ; granularity byte + bas_24_31 DB 0 ; base bits (24..31) +DESC ENDS + +; The following is the layout of the real GDT created by BLD386. +; It is located in EPROM and will be copied to RAM. +; +; GDT[O] ... NULL +; GDT[1] ... Alias for RAM GDT +; GDT[2] ... Alias for RAM IDT +; GDT[2] ... initial task TSS +; GDT[3] ... initial task TSS alias +; GDT[4] ... initial task LDT +; GDT[5] ... initial task LDT alias + +; +; define entries in GDT and IDT. + +GDT_ENTRIES EQU 8 +IDT_ENTRIES EQU 32 + +; define some constants to index into the real GDT + +GDT_ALIAS EQU 1*SIZE DESC +IDT_ALIAS EQU 2*SIZE DESC +INIT_TSS EQU 3*SIZE DESC +INIT_TSS_A EQU 4*SIZE DESC +INIT_LDT EQU 5*SIZE DESC +INIT_LDT_A EQU 6*SIZE DESC + +; +; location of alias in INIT_LDT + +INIT_LDT_ALIAS EQU 1*SIZE DESC + +; +; access rights byte for DATA and TSS descriptors + +DS_ACCESS EQU 010010010B +TSS_ACCESS EQU 010001001B + + +; +; This temporary GDT will be used to set up the real GDT in RAM. + +Temp_GDT LABEL BYTE ; tag for begin of scratch GDT + +NULL_DES DESC <> ; NULL descriptor + + ; 32-Gigabyte data segment based at 0 +FLAT_DES DESC <0FFFFH,0,0,92h,0CFh,0> + +GDT_eprom DP ? ; Builder places GDT address and limit + ; in this 6 byte area. + +IDT_eprom DP ? ; Builder places IDT address and limit + ; in this 6 byte area. + +; +; Prepare operand for loadings GDTR and LDTR. + + +TGDT_pword LABEL PWORD ; for temp GDT + DW end_Temp_GDT_Temp_GDT -1 + DD 0 + +GDT_pword LABEL PWORD ; for GDT in RAM + DW GDT_ENTRIES * SIZE DESC -1 + DD GDTbase + +IDT_pword LABEL PWORD ; for IDT in RAM + DW IDT_ENTRIES * SIZE DESC -1 + DD IDTbase + + +end_Temp_GDT LABEL BYTE + +; +; Define equates for addressing convenience. + +GDT_DES_FLAT EQU DS:GDT_ALIAS +GDTbase +IDT_DES_FLAT EQU DS:IDT_ALIAS +GDTbase + +INIT_TSS_A_OFFSET EQU DS:INIT_TSS_A +INIT_TSS_OFFSET EQU DS:INIT_TSS + +INIT_LDT_A_OFFSET EQU DS:INIT_LDT_A +INIT_LDT_OFFSET EQU DS:INIT_LDT + + +; define pointer for first task switch + +ENTRY POINTER LABEL DWORD + DW 0, INIT_TSS + +;****************************************************************** +; +; Jump from reset vector to here. + +START: + + CLI ;disable interrupts + CLD ;clear direction flag + + LIDT NULL_des ;force shutdown on errors + +; +; move scratch GDT to RAM at physical 0 + + XOR DI,DI + MOV ES,DI ;point ES:DI to physical location 0 + + + MOV SI,OFFSET Temp_GDT + MOV CX,end_Temp_GDT-Temp_GDT ;set byte count + INC CX +; +; move table + + REP MOVS BYTE PTR ES:[DI],BYTE PTR CS:[SI] + + LGDT tGDT_pword ;load GDTR for Temp. GDT + ;(located at 0) + +; switch to protected mode + + MOV EAX,CR0 ;get current CRO + MOV EAX,1 ;set PE bit + MOV CRO,EAX ;begin protected mode +; +; clear prefetch queue + + JMP SHORT flush +flush: + +; set DS,ES,SS to address flat linear space (0 ... 4GB) + + MOV BX,FLAT_DES-Temp_GDT + MOV US,BX + MOV ES,BX + MOV SS,BX +; +; initialize stack pointer to some (arbitrary) RAM location + + MOV ESP, OFFSET end_Temp_GDT + +; +; copy eprom GDT to RAM + + MOV ESI,DWORD PTR GDT_eprom +2 ; get base of eprom GDT + ; (put here by builder). + + MOV EDI,GDTbase ; point ES:EDI to GDT base in RAM. + + MOV CX,WORD PTR gdt_eprom +0 ; limit of eprom GDT + INC CX + SHR CX,1 ; easier to move words + CLD + REP MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] + +; +; copy eprom IDT to RAM +; + MOV ESI,DWORD PTR IDT_eprom +2 ; get base of eprom IDT + ; (put here by builder) + + MOV EDI,IDTbase ; point ES:EDI to IDT base in RAM. + + MOV CX,WORD PTR idt_eprom +0 ; limit of eprom IDT + INC CX + SHR CX,1 + CLD + REP MOVS WORD PTR ES:[EDI],WORD PTR DS:[ESI] + +; switch to RAM GDT and IDT +; + LIDT IDT_pword + LGDT GDT_pword + +; + MOV BX,GDT_ALIAS ; point DS to GDT alias + MOV DS,BX +; +; copy eprom TSS to RAM +; + MOV BX,INIT_TSS_A ; INIT TSS A descriptor base + ; has RAM location of INIT TSS. + + MOV ES,BX ; ES points to TSS in RAM + + MOV BX,INIT_TSS ; get inital task selector + LAR DX,BX ; save access byte + MOV [BX].access,DS_ACCESS ; set access as data segment + MOV FS,BX ; FS points to eprom TSS + + XOR si,si ; FS:si points to eprom TSS + XOR di,di ; ES:di points to RAM TSS + + MOV CX,[BX].lim_0_15 ; get count to move + INC CX + +; +; move INIT_TSS to RAM. + + REP MOVS BYTE PTR ES:[di],BYTE PTR FS:[si] + + MOV [BX].access,DH ; restore access byte + +; +; change base of INIT TSS descriptor to point to RAM. + + MOV AX,INIT_TSS_A_OFFSET.bas_0_15 + MOV INIT_TSS_OFFSET.bas_0_15,AX + MOV AL,INIT_TSS_A_OFFSET.bas_16_23 + MOV INIT_TSS_OFFSET.bas_16_23,AL + MOV AL,INIT_TSS_A_OFFSET.bas_24_31 + MOV INIT_TSS_OFFSET.bas_24_31,AL + +; +; change INIT TSS A to form a save area for TSS on first task +; switch. Use RAM at location 0. + + MOV BX,INIT_TSS_A + MOV WORD PTR [BX].bas_0_15,0 + MOV [BX].bas_16_23,0 + MOV [BX].bas_24_31,0 + MOV [BX].access,TSS_ACCESS + MOV [BX].gran,O + LTR BX ; defines save area for TSS + +; +; copy eprom LDT to RAM + + MOV BX,INIT_LDT_A ; INIT_LDT_A descriptor has + ; base address in RAM for INIT_LDT. + + MOV ES,BX ; ES points LDT location in RAM. + + MOV AH,[BX].bas_24_31 + MOV AL,[BX].bas_16_23 + SHL EAX,16 + MOV AX,[BX].bas_0_15 ; save INIT_LDT base (ram) in EAX + + MOV BX,INIT_LDT ; get inital LDT selector + LAR DX,BX ; save access rights + MOV [BX].access,DS_ACCESS ; set access as data segment + MOV FS,BX ; FS points to eprom LDT + + XOR si,si ; FS:SI points to eprom LDT + XOR di,di ; ES:DI points to RAM LDT + + MOV CX,[BX].lim_0_15 ; get count to move + INC CX +; +; move initial LDT to RAM + + REP MOVS BYTE PTR ES:[di],BYTE PTR FS:[si] + + MOV [BX].access,DH ; restore access rights in + ; INIT_LDT descriptor + +; +; change base of alias (of INIT_LDT) to point to location in RAM. + + MOV ES:[INIT_LDT_ALIAS].bas_0_15,AX + SHR EAX,16 + MOV ES:[INIT_LDT_ALIAS].bas_16_23,AL + MOV ES:[INIT_LDT_ALIAS].bas_24_31,AH + +; +; now set the base value in INIT_LDT descriptor + + MOV AX,INIT_LDT_A_OFFSET.bas_0_15 + MOV INIT_LDT_OFFSET.bas_0_15,AX + MOV AL,INIT_LDT_A_OFFSET.bas_16_23 + MOV INIT_LDT_OFFSET.bas_16_23,AL + MOV AL,INIT_LDT_A_OFFSET.bas_24_31 + MOV INIT_LDT_OFFSET.bas_24_31,AL + +; +; Now GDT, IDT, initial TSS and initial LDT are all set up. +; +; Start the first task! +' + JMP ENTRY_POINTER + +RESET_CODE ends + END START, SS:DUMMY,DS:DUMMY + + +10.6 TLB Testing + +The 80386 provides a mechanism for testing the Translation Lookaside Buffer +(TLB), the cache used for translating linear addresses to physical +addresses. Although failure of the TLB hardware is extremely unlikely, users +may wish to include TLB confidence tests among other power-up confidence +tests for the 80386. + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE + This TLB testing mechanism is unique to the 80386 and may not be + continued in the same way in future processors. Sortware that uses + this mechanism may be incompatible with future processors. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +When testing the TLB it is recommended that paging be turned off (PG=0 in +CR0) to avoid interference with the test data being written to the TLB. + + +10.6.1 Structure of the TLB + +The TLB is a four-way set-associative memory. Figure 10-3 illustrates the +structure of the TLB. There are four sets of eight entries each. Each entry +consists of a tag and data. Tags are 24-bits wide. They contain the +high-order 20 bits of the linear address, the valid bit, and three attribute +bits. The data portion of each entry contains the high-order 20 bits of the +physical address. + + +10.6.2 Test Registers + +Two test registers, shown in Figure 10-4, are provided for the purpose of +testing. TR6 is the test command register, and TR7 is the test data +register. These registers are accessed by variants of the MOV +instruction. A test register may be either the source operand or destination +operand. The MOV instructions are defined in both real-address mode and +protected mode. The test registers are privileged resources; in protected +mode, the MOV instructions that access them can only be executed at +privilege level 0. An attempt to read or write the test registers when +executing at any other privilege level causes a general +protection exception. + +The test command register (TR6) contains a command and an address tag to +use in performing the command: + +C This is the command bit. There are two TLB testing commands: + write entries into the TLB, and perform TLB lookups. To cause an + immediate write into the TLB entry, move a doubleword into TR6 + that contains a 0 in this bit. To cause an immediate TLB lookup, + move a doubleword into TR6 that contains a 1 in this bit. + +Linear On a TLB write, a TLB entry is allocated to this linear address; +Address the rest of that TLB entry is set per the value of TR7 and the + value just written into TR6. On a TLB lookup, the TLB is + interrogated per this value; if one and only one TLB entry + matches, the rest of the fields of TR6 and TR7 are set from the + matching TLB entry. + +V The valid bit for this TLB entry. The TLB uses the valid bit to + identify entries that contain valid data. Entries of the TLB + that have not been assigned values have zero in the valid bit. + All valid bits can be cleared by writing to CR3. + +D, D# The dirty bit (and its complement) for/from the TLB entry. + +U, U# The U/S bit (and its complement) for/from the TLB entry. + +W, W# The R/W bit (and its complement) for/from the TLB entry. + + The meaning of these pairs of bits is given by Table 10-1, + where X represents D, U, or W. + +The test data register (TR7) holds data read from or data to be written to +the TLB. + +Physical This is the data field of the TLB. On a write to the TLB, the +Address TLB entry allocated to the linear address in TR6 is set to this + value. On a TLB lookup, if HT is set, the data field (physical + address) from the TLB is read out to this field. If HT is not + set, this field is undefined. + +HT For a TLB lookup, the HT bit indicates whether the lookup was a + hit (HT  1) or a miss (HT  0). For a TLB write, HT must be set + to 1. + +REP For a TLB write, selects which of four associative blocks of the + TLB is to be written. For a TLB read, if HT is set, REP reports + in which of the four associative blocks the tag was found; if HT + is not set, REP is undefined. + + +Table 10-1. Meaning of D, U, and W Bit Pairs + +X X# Effect during Value of bit X + TLB Lookup after TLB Write + +0 0 (undefined) (undefined) +0 1 Match if X=0 Bit X becomes 0 +1 0 Match if X=1 Bit X becomes 1 +1 1 (undefined) (undefined) + + +Figure 10-3. TLB Structure + + �袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴� + 7� TAG � DATA � + 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 +    + 旼컴컴컴    + � SET 11    + � 旼� 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � � 1� TAG � DATA � + � � 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � � 0� TAG � DATA � + � � 훤袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴暠 + � � + � � �袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴� + � � 7� TAG � DATA � + � � 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � �    + � 읕�    + � SET 10    + � 旼� 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � � 1� TAG � DATA � + � D � � � 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � A � � � 0� TAG � DATA � + � T 읕컴컴켸 � 훤袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴暠 + � A � + � 旼컴컴커 � �袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴� + � B � � � 7� TAG � DATA � + � U � � � 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � S � � �    + � 읕�    + � SET 01    + � 旼� 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � � 1� TAG � DATA � + � � 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � � 0� TAG � DATA � + � � 훤袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴暠 + � � + � � �袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴袴� + � � 7� TAG � DATA � + � � 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + � �    + � 읕�    + � SET 00    + 읕컴컴컴 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + 1� TAG � DATA � + 勁袴袴袴袴袴袴袴袴胱袴袴袴袴袴袴袴攷 + 0� TAG � DATA � + 훤袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴暠 + + +Figure 10-4. Test Registers + + 31 23 15 11 7 0 + �袴袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴曲袴袴妄袴袴袴妄袴袴佶佶袴佶袴� + � � 쿓� � � + � PHYSICAL ADDRESS �0 0 0 0 0 0 0� 쿝EP�0 0� TR7 + � � 쿟� � � + 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컵컫컫컫컫컫컫컵컨컴컨컫캘 + � � � 쿏� 쿢� 쿥� � � + � LINEAR ADDRESS 쿣쿏� 쿢� � � �0 0 0 0쿎� TR8 + � � � �#� �#� �#� � � + 훤袴袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴曲賈賈賈曲賈賈賈袴袴袴賈暠 + + NOTE: 0 INDICATES INTEL RESERVED. NO NOT DEFINE + + +10.6.3 Test Operations + +To write a TLB entry: + + 1. Move a doubleword to TR7 that contains the desired physical address, + HT, and REP values. HT must contain 1. REP must point to the + associative block in which to place the entry. + + 2. Move a doubleword to TR6 that contains the appropriate linear + address, and values for V, D, U, and W. Be sure C=0 for "write" + command. + +Be careful not to write duplicate tags; the results of doing so are +undefined. + +To look up (read) a TLB entry: + + 1. Move a doubleword to TR6 that contains the appropriate linear address + and attributes. Be sure C=1 for "lookup" command. + + 2. Store TR7. If the HT bit in TR7 indicates a hit, then the other + values reveal the TLB contents. If HT indicates a miss, then the other + values in TR7 are indeterminate. + +For the purposes of testing, the V bit functions as another bit of +addresss. The V bit for a lookup request should usually be set, so that +uninitialized tags do not match. Lookups with V=0 are unpredictable if any +tags are uninitialized. + + +Chapter 11 Coprocessing and Multiprocessing + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The 80386 has two levels of support for multiple parallel processing units: + + � A highly specialized interface for very closely coupled processors of + a type known as coprocessors. + + � A more general interface for more loosely coupled processors of + unspecified type. + + +11.1 Coprocessing + +The components of the coprocessor interface include: + + � ET bit of control register zero (CR0) + � The EM, and MP bits of CR0 + � The ESC instructions + � The WAIT instruction + � The TS bit of CR0 + � Exceptions + + +11.1.1 Coprocessor Identification + +The 80386 is designed to operate with either an 80287 or 80387 math +coprocessor. The ET bit of CR0 indicates which type of coprocessor is +present. ET is set automatically by the 80386 after RESET according to the +level detected on the ERROR# input. If desired, ET may also be set or reset +by loading CR0 with a MOV instruction. If ET is set, the 80386 uses the +32-bit protocol of the 80387; if reset, the 80386 uses the 16-bit protocol +of the 80287. + + +11.1.2 ESC and WAIT Instructions + +The 80386 interprets the pattern 11011B in the first five bits of an +instruction as an opcode intended for a coprocessor. Instructions thus +marked are called ESCAPE or ESC instructions. The CPU performs the following +functions upon encountering an ESC instruction before sending the +instruction to the coprocessor: + + � Tests the emulation mode (EM) flag to determine whether coprocessor + functions are being emulated by software. + + � Tests the TS flag to determine whether there has been a context change + since the last ESC instruction. + + � For some ESC instructions, tests the ERROR# pin to determine whether + the coprocessor detected an error in the previous ESC instruction. + +The WAIT instruction is not an ESC instruction, but WAIT causes the CPU to +perform some of the same tests that it performs upon encountering an ESC +instruction. The processor performs the following actions for a WAIT +instruction: + + � Waits until the coprocessor no longer asserts the BUSY# pin. + + � Tests the ERROR# pin (after BUSY# goes inactive). If ERROR# is active, + the 80386 signals exception 16, which indicates that the coprocessor + encountered an error in the previous ESC instruction. + + � WAIT can therefore be used to cause exception 16 if an error is + pending from a previous ESC instruction. Note that, if no coprocessor + is present, the ERROR# and BUSY# pins should be tied inactive to + prevent WAIT from waiting forever or causing spurious exceptions. + + +11.1.3 EM and MP Flags + +The EM and MP flags of CR0 control how the processor reacts to coprocessor +instructions. + +The EM bit indicates whether coprocessor functions are to be emulated. If +the processor finds EM set when executing an ESC instruction, it signals +exception 7, giving the exception handler an opportunity to emulate the ESC +instruction. + +The MP (monitor coprocessor) bit indicates whether a coprocessor is +actually attached. The MP flag controls the function of the WAIT +instruction. If, when executing a WAIT instruction, the CPU finds MP set, +then it tests the TS flag; it does not otherwise test TS during a WAIT +instruction. If it finds TS set under these conditions, the CPU signals +exception 7. + +The EM and MP flags can be changed with the aid of a MOV instruction using +CR0 as the destination operand and read with the aid of a MOV instruction +with CR0 as the source operand. These forms of the MOV instruction can be +executed only at privilege level zero. + + +11.1.4 The Task-Switched Flag + +The TS bit of CR0 helps to determine when the context of the coprocessor +does not match that of the task being executed by the 80386 CPU. The 80386 +sets TS each time it performs a task switch (whether triggered by software +or by hardware interrupt). If, when interpreting one of the ESC +instructions, the CPU finds TS already set, it causes exception 7. The WAIT +instruction also causes exception 7 if both TS and MP are set. Operating +systems can use this exception to switch the context of the coprocessor to +correspond to the current task. Refer to the 80386 System Software Writer's +Guide for an example. + +The CLTS instruction (legal only at privilege level zero) resets the TS +flag. + + +11.1.5 Coprocessor Exceptions + +Three exceptions aid in interfacing to a coprocessor: interrupt 7 +(coprocessor not available), interrupt 9 (coprocessor segment overrun), and +interrupt 16 (coprocessor error). + + +11.1.5.1 Interrupt 7 컴 Coprocessor Not Available + +This exception occurs in either of two conditions: + + 1. The CPU encounters an ESC instruction and EM is set. In this case, + the exception handler should emulate the instruction that caused the + exception. TS may also be set. + + 2. The CPU encounters either the WAIT instruction or an ESC instruction + when both MP and TS are set. In this case, the exception handler + should update the state of the coprocessor, if necessary. + + +11.1.5.2 Interrupt 9 컴 Coprocessor Segment Overrun + +This exception occurs in protected mode under the following conditions: + + � An operand of a coprocessor instruction wraps around an addressing + limit (0FFFFH for small segments, 0FFFFFFFFH for big segments, zero for + expand-down segments). An operand may wrap around an addressing limit + when the segment limit is near an addressing limit and the operand is + near the largest valid address in the segment. Because of the + wrap-around, the beginning and ending addresses of such an operand + will be near opposite ends of the segment. + + � Both the first byte and the last byte of the operand (considering + wrap-around) are at addresses located in the segment and in present and + accessible pages. + + � The operand spans inaccessible addresses. There are two ways that such + an operand may also span inaccessible addresses: + + 1. The segment limit is not equal to the addressing limit (e.g., + addressing limit is FFFFH and segment limit is FFFDH); therefore, + the operand will span addresses that are not within the segment + (e.g., an 8-byte operand that starts at valid offset FFFC will span + addresses FFFC-FFFF and 0000-0003; however, addresses FFFE and FFFF + are not valid, because they exceed the limit); + + 2. The operand begins and ends in present and accessible pages but + intermediate bytes of the operand fall either in a not-present page + or in a page to which the current procedure does not have access + rights. + +The address of the failing numerics instruction and data operand may be +lost; an FSTENV does not return reliable addresses. As with the 80286/80287, +the segment overrun exception should be handled by executing an FNINIT +instruction (i.e., an FINIT without a preceding WAIT). The return address on +the stack does not necessarily point to the failing instruction nor to the +following instruction. The failing numerics instruction is not restartable. + +Case 2 can be avoided by either aligning all segments on page boundaries or +by not starting them within 108 bytes of the start or end of a page. (The +maximum size of a coprocessor operand is 108 bytes.) Case 1 can be avoided +by making sure that the gap between the last valid offset and the first +valid offset of a segment is either no less than 108 bytes or is zero (i.e., +the segment is of full size). If neither software system design constraint +is acceptable, the exception handler should execute FNINIT and should +probably terminate the task. + + +11.1.5.3 Interrupt 16 컴 Coprocessor Error + +The numerics coprocessors can detect six different exception conditions +during instruction execution. If the detected exception is not masked by a +bit in the control word, the coprocessor communicates the fact that an error +occurred to the CPU by a signal at the ERROR# pin. The CPU causes interrupt +16 the next time it checks the ERROR# pin, which is only at the beginning of +a subsequent WAIT or certain ESC instructions. If the exception is masked, +the numerics coprocessor handles the exception according to on-board logic; +it does not assert the ERROR# pin in this case. + + +11.2 General Multiprocessing + +The components of the general multiprocessing interface include: + + � The LOCK# signal + + � The LOCK instruction prefix, which gives programmed control of the + LOCK# signal. + + � Automatic assertion of the LOCK# signal with implicit memory updates + by the processor + + +11.2.1 LOCK and the LOCK# Signal + +The LOCK instruction prefix and its corresponding output signal LOCK# can +be used to prevent other bus masters from interrupting a data movement +operation. LOCK may only be used with the following 80386 instructions when +they modify memory. An undefined-opcode exception results from using LOCK +before any instruction other than: + + � Bit test and change: BTS, BTR, BTC. + � Exchange: XCHG. + � Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. + � One-operand arithmetic and logical: INC, DEC, NOT, and NEG. + +A locked instruction is only guaranteed to lock the area of memory defined +by the destination operand, but it may lock a larger memory area. For +example, typical 8086 and 80286 configurations lock the entire physical +memory space. The area of memory defined by the destination operand is +guaranteed to be locked against access by a processor executing a locked +instruction on exactly the same memory area, i.e., an operand with +identical starting address and identical length. + +The integrity of the lock is not affected by the alignment of the memory +field. The LOCK signal is asserted for as many bus cycles as necessary to +update the entire operand. + + +11.2.2 Automatic Locking + +In several instances, the processor itself initiates activity on the data +bus. To help ensure that such activities function correctly in +multiprocessor configurations, the processor automatically asserts the LOCK# +signal. These instances include: + + � Acknowledging interrupts. + + After an interrupt request, the interrupt controller uses the data bus + to send the interrupt ID of the interrupt source to the CPU. The CPU + asserts LOCK# to ensure that no other data appears on the data bus + during this time. + + � Setting busy bit of TSS descriptor. + + The processor tests and sets the busy-bit in the type field of the TSS + descriptor when switching to a task. To ensure that two different + processors cannot simultaneously switch to the same task, the processor + asserts LOCK# while testing and setting this bit. + + � Loading of descriptors. + + While copying the contents of a descriptor from a descriptor table into + a segment register, the processor asserts LOCK# so that the descriptor + cannot be modified by another processor while it is being loaded. For + this action to be effective, operating-system procedures that update + descriptors should adhere to the following steps: + + 컴 Use a locked update to the access-rights byte to mark the + descriptor not-present. + + 컴 Update the fields of the descriptor. (This may require several + memory accesses; therefore, LOCK cannot be used.) + + 컴 Use a locked update to the access-rights byte to mark the + descriptor present again. + + � Updating page-table A and D bits. + + The processor exerts LOCK# while updating the A (accessed) and D + (dirty) bits of page-table entries. Also the processor bypasses the + page-table cache and directly updates these bits in memory. + + � Executing XCHG instruction. + + The 80386 always asserts LOCK during an XCHG instruction that + references memory (even if the LOCK prefix is not used). + + +11.2.3 Cache Considerations + +Systems programmers must take care when updating shared data that may also +be stored in on-chip registers and caches. With the 80386, such shared +data includes: + + � Descriptors, which may be held in segment registers. + + A change to a descriptor that is shared among processors should be + broadcast to all processors. Segment registers are effectively + "descriptor caches". A change to a descriptor will not be utilized by + another processor if that processor already has a copy of the old + version of the descriptor in a segment register. + + � Page tables, which may be held in the page-table cache. + + A change to a page table that is shared among processors should be + broadcast to all processors, so that others can flush their page-table + caches and reload them with up-to-date page tables from memory. + +Systems designers can employ an interprocessor interrupt to handle the +above cases. When one processor changes data that may be cached by other +processors, it can send an interrupt signal to all other processors that may +be affected by the change. If the interrupt is serviced by an interrupt +task, the task switch automatically flushes the segment registers. The task +switch also flushes the page-table cache if the PDBR (the contents of CR3) +of the interrupt task is different from the PDBR of every other task. + +In multiprocessor systems that need a cacheability signal from the CPU, it +is recommended that physical address pin A31 be used to indicate +cacheability. Such a system can then possess up to 2 Gbytes of physical +memory. The virtual address range available to the programmer is not +affected by this convention. + + +Chapter 12 Debugging + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The 80386 brings to Intel's line of microprocessors significant advances in +debugging power. The single-step exception and breakpoint exception of +previous processors are still available in the 80386, but the principal +debugging support takes the form of debug registers. The debug registers +support both instruction breakpoints and data breakpoints. Data breakpoints +are an important innovation that can save hours of debugging time by +pinpointing, for example, exactly when a data structure is being +overwritten. The breakpoint registers also eliminate the complexities +associated with writing a breakpoint instruction into a code segment +(requires a data-segment alias for the code segment) or a code segment +shared by multiple tasks (the breakpoint exception can occur in the context +of any of the tasks). Breakpoints can even be set in code contained in ROM. + + +12.1 Debugging Features of the Architecture + +The features of the 80386 architecture that support debugging include: + +Reserved debug interrupt vector + +Permits processor to automatically invoke a debugger task or procedure when +an event occurs that is of interest to the debugger. + +Four debug address registers + +Permit programmers to specify up to four addresses that the CPU will +automatically monitor. + +Debug control register + +Allows programmers to selectively enable various debug conditions +associated with the four debug addresses. + +Debug status register + +Helps debugger identify condition that caused debug exception. + +Trap bit of TSS (T-bit) + +Permits monitoring of task switches. + +Resume flag (RF) of flags register + +Allows an instruction to be restarted after a debug exception without +immediately causing another debug exception due to the same condition. + +Single-step flag (TF) + +Allows complete monitoring of program flow by specifying whether the CPU +should cause a debug exception with the execution of every instruction. + +Breakpoint instruction + +Permits debugger intervention at any point in program execution and aids +debugging of debugger programs. + +Reserved interrupt vector for breakpoint exception + +Permits processor to automatically invoke a handler task or procedure upon +encountering a breakpoint instruction. + +These features make it possible to invoke a debugger that is either a +separate task or a procedure in the context of the current task. The +debugger can be invoked under any of the following kinds of conditions: + + � Task switch to a specific task. + � Execution of the breakpoint instruction. + � Execution of every instruction. + � Execution of any instruction at a given address. + � Read or write of a byte, word, or doubleword at any specified address. + � Write to a byte, word, or doubleword at any specified address. + � Attempt to change a debug register. + + +12.2 Debug Registers + +Six 80386 registers are used to control debug features. These registers are +accessed by variants of the MOV instruction. A debug register may be either +the source operand or destination operand. The debug registers are +privileged resources; the MOV instructions that access them can only be +executed at privilege level zero. An attempt to read or write the debug +registers when executing at any other privilege level causes a general +protection exception. Figure 12-1 shows the format of the debug registers. + + +Figure 12-1. Debug Registers + + 31 23 15 7 0 + �袴錮袴錮袴錮袴曲袴錮袴錮袴錮袴曲袴錮錮袴袴錮錮曲錮錮錮錮錮錮錮敲 + 튛EN쿝/W쿗EN쿝/W쿗EN쿝/W쿗EN쿝/W� � � 쿒쿗쿒쿗쿒쿗쿒쿗쿒쿗� + � � � � � � � � �0 0�0�0 0 0� � � � � � � � � � � DR7 + � 3 � 3 � 2 � 2 � 1 � 1 � 0 � 0 � � � 쿐쿐�3�3�2�2�1�1�0�0� + 픔컴좔컴좔컴좔컴좔컴좔컴좔컴좔컴탠쩡탠탠컴컴좔좔좔좔좔좔탠탠탠탠� + � 쿍쿍쿍� 쿍쿍쿍쿍� + �0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0� � � �0 0 0 0 0 0 0 0 0� � � � � DR6 + � 쿟쿞쿏� �3�2�1�0� + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠좔좔좔컴컴컴컴탠컴컴컴좔좔좔좔� + � � + � RESERVED � DR5 + � � + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � � + � RESERVED � DR4 + � � + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � � + � BREAKPOINT 3 LINEAR ADDRESS � DR3 + � � + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � � + � BREAKPOINT 2 LINEAR ADDRESS � DR2 + � � + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � � + � BREAKPOINT 1 LINEAR ADDRESS � DR1 + � � + 픔컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴탠컴컴컴컴컴컴컴� + � � + � BREAKPOINT 0 LINEAR ADDRESS � DR0 + � � + 훤袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴妄袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴� + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 +NOTE + 0 MEANS INTEL RESERVED. DO NOT DEFINE. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + + +12.2.1 Debug Address Registers (DR0-DR3) + +Each of these registers contains the linear address associated with one of +four breakpoint conditions. Each breakpoint condition is further defined by +bits in DR7. + +The debug address registers are effective whether or not paging is enabled. +The addresses in these registers are linear addresses. If paging is enabled, +the linear addresses are translated into physical addresses by the +processor's paging mechanism (as explained in Chapter 5). If paging is not +enabled, these linear addresses are the same as physical addresses. + +Note that when paging is enabled, different tasks may have different +linear-to-physical address mappings. When this is the case, an address in a +debug address register may be relevant to one task but not to another. For +this reason the 80386 has both global and local enable bits in DR7. These +bits indicate whether a given debug address has a global (all tasks) or +local (current task only) relevance. + + +12.2.2 Debug Control Register (DR7) + +The debug control register shown in Figure 12-1 both helps to define the +debug conditions and selectively enables and disables those conditions. + +For each address in registers DR0-DR3, the corresponding fields R/W0 +through R/W3 specify the type of action that should cause a breakpoint. The +processor interprets these bits as follows: + + 00 컴 Break on instruction execution only + 01 컴 Break on data writes only + 10 컴 undefined + 11 컴 Break on data reads or writes but not instruction fetches + +Fields LEN0 through LEN3 specify the length of data item to be monitored. A +length of 1, 2, or 4 bytes may be specified. The values of the length fields +are interpreted as follows: + + 00 컴 one-byte length + 01 컴 two-byte length + 10 컴 undefined + 11 컴 four-byte length + +If RWn is 00 (instruction execution), then LENn should also be 00. Any other +length is undefined. + +The low-order eight bits of DR7 (L0 through L3 and G0 through G3) +selectively enable the four address breakpoint conditions. There are two +levels of enabling: the local (L0 through L3) and global (G0 through G3) +levels. The local enable bits are automatically reset by the processor at +every task switch to avoid unwanted breakpoint conditions in the new task. +The global enable bits are not reset by a task switch; therefore, they can +be used for conditions that are global to all tasks. + +The LE and GE bits control the "exact data breakpoint match" feature of the +processor. If either LE or GE is set, the processor slows execution so that +data breakpoints are reported on the instruction that causes them. It is +recommended that one of these bits be set whenever data breakpoints are +armed. The processor clears LE at a task switch but does not clear GE. + + +12.2.3 Debug Status Register (DR6) + +The debug status register shown in Figure 12-1 permits the debugger to +determine which debug conditions have occurred. + +When the processor detects an enabled debug exception, it sets the +low-order bits of this register (B0 thru B3) before entering the debug +exception handler. Bn is set if the condition described by DRn, LENn, and +R/Wn occurs. (Note that the processor sets Bn regardless of whether Gn or +Ln is set. If more than one breakpoint condition occurs at one time and if +the breakpoint trap occurs due to an enabled condition other than n, Bn may +be set, even though neither Gn nor Ln is set.) + +The BT bit is associated with the T-bit (debug trap bit) of the TSS (refer +to 7 for the location of the T-bit). The processor sets the BT bit before +entering the debug handler if a task switch has occurred and the T-bit of +the new TSS is set. There is no corresponding bit in DR7 that enables and +disables this trap; the T-bit of the TSS is the sole enabling bit. + +The BS bit is associated with the TF (trap flag) bit of the EFLAGS +register. The BS bit is set if the debug handler is entered due to the +occurrence of a single-step exception. The single-step trap is the +highest-priority debug exception; therefore, when BS is set, any of the +other debug status bits may also be set. + +The BD bit is set if the next instruction will read or write one of the +eight debug registers and ICE-386 is also using the debug registers at the +same time. + +Note that the bits of DR6 are never cleared by the processor. To avoid any +confusion in identifying the next debug exception, the debug handler should +move zeros to DR6 immediately before returning. + + +12.2.4 Breakpoint Field Recognition + +The linear address and LEN field for each of the four breakpoint conditions +define a range of sequential byte addresses for a data breakpoint. The LEN +field permits specification of a one-, two-, or four-byte field. Two-byte +fields must be aligned on word boundaries (addresses that are multiples of +two) and four-byte fields must be aligned on doubleword boundaries +(addresses that are multiples of four). These requirements are enforced by +the processor; it uses the LEN bits to mask the low-order bits of the +addresses in the debug address registers. Improperly aligned code or data +breakpoint addresses will not yield the expected results. + +A data read or write breakpoint is triggered if any of the bytes +participating in a memory access is within the field defined by a breakpoint +address register and the corresponding LEN field. Table 12-1 gives some +examples of breakpoint fields with memory references that both do and do not +cause traps. + +To set a data breakpoint for a misaligned field longer than one byte, it +may be desirable to put two sets of entries in the breakpoint register such +that each entry is properly aligned and the two entries together span the +length of the field. + +Instruction breakpoint addresses must have a length specification of one +byte (LEN = 00); other values are undefined. The processor recognizes an +instruction breakpoint address only when it points to the first byte of an +instruction. If the instruction has any prefixes, the breakpoint address +must point to the first prefix. + + +Table 12-1. Breakpoint Field Recognition Examples + + Address (hex) Length + + DR0 0A0001 1 (LEN0 = 00) +Register Contents DR1 0A0002 1 (LEN1 = 00) + DR2 0B0002 2 (LEN2 = 01) + DR3 0C0000 4 (LEN3 = 11) + +Some Examples of Memory 0A0001 1 +References That Cause Traps 0A0002 1 + 0A0001 2 + 0A0002 2 + 0B0002 2 + 0B0001 4 + 0C0000 4 + 0C0001 2 + 0C0003 1 + +Some Examples of Memory 0A0000 1 +References That Don't Cause Traps 0A0003 4 + 0B0000 2 + 0C0004 4 + + +12.3 Debug Exceptions + +Two of the interrupt vectors of the 80386 are reserved for exceptions that +relate to debugging. Interrupt 1 is the primary means of invoking debuggers +designed expressly for the 80386; interrupt 3 is intended for debugging +debuggers and for compatibility with prior processors in Intel's 8086 +processor family. + + +12.3.1 Interrupt 1 컴 Debug Exceptions + +The handler for this exception is usually a debugger or part of a debugging +system. The processor causes interrupt 1 for any of several conditions. The +debugger can check flags in DR6 and DR7 to determine what condition caused +the exception and what other conditions might be in effect at the same time. +Table 12-2 associates with each breakpoint condition the combination of +bits that indicate when that condition has caused the debug exception. + +Instruction address breakpoint conditions are faults, while other debug +conditions are traps. The debug exception may report either or both at one +time. The following paragraphs present details for each class of debug +exception. + + +Table 12-2. Debug Exception Conditions + +Flags to Test Condition + +BS=1 Single-step trap +B0=1 AND (GE0=1 OR LE0=1) Breakpoint DR0, LEN0, R/W0 +B1=1 AND (GE1=1 OR LE1=1) Breakpoint DR1, LEN1, R/W1 +B2=1 AND (GE2=1 OR LE2=1) Breakpoint DR2, LEN2, R/W2 +B3=1 AND (GE3=1 OR LE3=1) Breakpoint DR3, LEN3, R/W3 +BD=1 Debug registers not available; in use by ICE-386. +BT=1 Task switch + + +12.3.1.1 Instruction Addrees Breakpoint + +The processor reports an instruction-address breakpoint before it executes +the instruction that begins at the given address; i.e., an instruction- +address breakpoint exception is a fault. + +The RF (restart flag) permits the debug handler to retry instructions that +cause other kinds of faults in addition to debug faults. When it detects a +fault, the processor automatically sets RF in the flags image that it pushes +onto the stack. (It does not, however, set RF for traps and aborts.) + +When RF is set, it causes any debug fault to be ignored during the next +instruction. (Note, however, that RF does not cause breakpoint traps to be +ignored, nor other kinds of faults.) + +The processor automatically clears RF at the successful completion of every +instruction except after the IRET instruction, after the POPF instruction, +and after a JMP, CALL, or INT instruction that causes a task switch. These +instructions set RF to the value specified by the memory image of the EFLAGS +register. + +The processor automatically sets RF in the EFLAGS image on the stack before +entry into any fault handler. Upon entry into the fault handler for +instruction address breakpoints, for example, RF is set in the EFLAGS image +on the stack; therefore, the IRET instruction at the end of the handler will +set RF in the EFLAGS register, and execution will resume at the breakpoint +address without generating another breakpoint fault at the same address. + +If, after a debug fault, RF is set and the debug handler retries the +faulting instruction, it is possible that retrying the instruction will +raise other faults. The retry of the instruction after these faults will +also be done with RF=1, with the result that debug faults continue to be +ignored. The processor clears RF only after successful completion of the +instruction. + +Real-mode debuggers can control the RF flag by using a 32-bit IRET. A +16-bit IRET instruction does not affect the RF bit (which is in the +high-order 16 bits of EFLAGS). To use a 32-bit IRET, the debugger must +rearrange the stack so that it holds appropriate values for the 32-bit EIP, +CS, and EFLAGS (with RF set in the EFLAGS image). Then executing an IRET +with an operand size prefix causes a 32-bit return, popping the RF flag +into EFLAGS. + + +12.3.1.2 Data Address Breakpoint + +A data-address breakpoint exception is a trap; i.e., the processor reports +a data-address breakpoint after executing the instruction that accesses the +given memory item. + +When using data breakpoints it is recommended that either the LE or GE bit +of DR7 be set also. If either LE or GE is set, any data breakpoint trap is +reported exactly after completion of the instruction that accessed the +specified memory item. This exact reporting is accomplished by forcing the +80386 execution unit to wait for completion of data operand transfers before +beginning execution of the next instruction. If neither GE nor LE is set, +data breakpoints may not be reported until one instruction after the data is +accessed or may not be reported at all. This is due to the fact that, +normally, instruction execution is overlapped with memory transfers to such +a degree that execution of the next instruction may begin before memory +transfers for the prior instruction are completed. + +If a debugger needs to preserve the contents of a write breakpoint +location, it should save the original contents before setting a write +breakpoint. Because data breakpoints are traps, a write into a breakpoint +location will complete before the trap condition is reported. The handler +can report the saved value after the breakpoint is triggered. The data in +the debug registers can be used to address the new value stored by the +instruction that triggered the breakpoint. + + +12.3.1.3 General Detect Fault + +This exception occurs when an attempt is made to use the debug registers at +the same time that ICE-386 is using them. This additional protection feature +is provided to guarantee that ICE-386 can have full control over the +debug-register resources when required. ICE-386 uses the debug-registers; +therefore, a software debugger that also uses these registers cannot run +while ICE-386 is in use. The exception handler can detect this condition by +examining the BD bit of DR6. + + +12.3.1.4 Single-Step Trap + +This debug condition occurs at the end of an instruction if the trap flag +(TF) of the flags register held the value one at the beginning of that +instruction. Note that the exception does not occur at the end of an +instruction that sets TF. For example, if POPF is used to set TF, a +single-step trap does not occur until after the instruction that follows +POPF. + +The processor clears the TF bit before invoking the handler. If TF=1 in +the flags image of a TSS at the time of a task switch, the exception occurs +after the first instruction is executed in the new task. + +The single-step flag is normally not cleared by privilege changes inside a +task. INT instructions, however, do clear TF. Therefore, software +debuggers that single-step code must recognize and emulate INT n or INTO +rather than executing them directly. + +To maintain protection, system software should check the current execution +privilege level after any single step interrupt to see whether single +stepping should continue at the current privilege level. + +The interrupt priorities in hardware guarantee that if an external +interrupt occurs, single stepping stops. When both an external interrupt and +a single step interrupt occur together, the single step interrupt is +processed first. This clears the TF bit. After saving the return address or +switching tasks, the external interrupt input is examined before the first +instruction of the single step handler executes. If the external interrupt +is still pending, it is then serviced. The external interrupt handler is not +single-stepped. To single step an interrupt handler, just single step an INT +n instruction that refers to the interrupt handler. + + +12.3.1.5 Task Switch Breakpoint + +The debug exception also occurs after a switch to an 80386 task if the +T-bit of the new TSS is set. The exception occurs after control has passed +to the new task, but before the first instruction of that task is executed. +The exception handler can detect this condition by examining the BT bit of +the debug status register DR6. + +Note that if the debug exception handler is a task, the T-bit of its TSS +should not be set. Failure to observe this rule will cause the processor to +enter an infinite loop. + + +12.3.2 Interrupt 3 컴 Breakpoint Exception + +This exception is caused by execution of the breakpoint instruction INT 3. +Typically, a debugger prepares a breakpoint by substituting the opcode of +the one-byte breakpoint instruction in place of the first opcode byte of the +instruction to be trapped. When execution of the INT 3 instruction causes +the exception handler to be invoked, the saved value of ES:EIP points to the +byte following the INT 3 instruction. + +With prior generations of processors, this feature is used extensively for +trapping execution of specific instructions. With the 80386, the needs +formerly filled by this feature are more conveniently solved via the debug +registers and interrupt 1. However, the breakpoint exception is still +useful for debugging debuggers, because the breakpoint exception can vector +to a different exception handler than that used by the debugger. The +breakpoint exception can also be useful when it is necessary to set a +greater number of breakpoints than permitted by the debug registers. \ No newline at end of file diff --git a/386Intel/386INTEL.PT2 b/386Intel/386INTEL.PT2 new file mode 100644 index 0000000..2104c38 --- /dev/null +++ b/386Intel/386INTEL.PT2 @@ -0,0 +1,9919 @@ + PART III COMPATIBILITY + + +Chapter 13 Executing 80286 Protected-Mode Code + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +13.1 80286 Code Executes as a Subset of the 80386 + +In general, programs designed for execution in protected mode on an 80286 +execute without modification on the 80386, because the features of the 80286 +are a subset of those of the 80386. + +All the descriptors used by the 80286 are supported by the 80386 as long as +the Intel-reserved word (last word) of the 80286 descriptor is zero. + +The descriptors for data segments, executable segments, local descriptor +tables, and task gates are common to both the 80286 and the 80386. Other +80286 descriptors컴TSS segment, call gate, interrupt gate, and trap +gate컴are supported by the 80386. The 80386 also has new versions of +descriptors for TSS segment, call gate, interrupt gate, and trap gate that +support the 32-bit nature of the 80386. Both sets of descriptors can be +used simultaneously in the same system. + +For those descriptors that are common to both the 80286 and the 80386, the +presence of zeros in the final word causes the 80386 to interpret these +descriptors exactly as 80286 does; for example: + +Base Address The high-order eight bits of the 32-bit base address are + zero, limiting base addresses to 24 bits. + +Limit The high-order four bits of the limit field are zero, + restricting the value of the limit field to 64K. + +Granularity bit The granularity bit is zero, which implies that the value + of the 16-bit limit is interpreted in units of one byte. + +B-bit In a data-segment descriptor, the B-bit is zero, implying + that the segment is no larger than 64 Kbytes. + +D-bit In an executable-segment descriptor, the D-bit is zero, + implying that 16-bit addressing and operands are the + default. + +For formats of these descriptors and documentation of their use refer to +the iAPX 286 Programmer's Reference Manual. + + +13.2 Two ways to Execute 80286 Tasks + +When porting 80286 programs to the 80386, there are two cases to consider: + + 1. Porting an entire 80286 system to the 80386, complete with 80286 + operating system, loader, and system builder. + + In this case, all tasks will have 80286 TSSs. The 80386 is being used + as a faster 286. + + 2. Porting selected 80286 applications to run in an 80386 environment + with an 80386 operating system, loader, and system builder. + + In this case, the TSSs used to represent 80286 tasks should be + changed to 80386 TSSs. It is theoretically possible to mix 80286 and + 80386 TSSs, but the benefits are slight and the problems are great. It + is recommended that all tasks in a 80386 software system have 80386 + TSSs. It is not necessary to change the 80286 object modules + themselves; TSSs are usually constructed by the operating system, by + the loader, or by the system builder. Refer to Chapter 16 for further + discussion of the interface between 16-bit and 32-bit code. + + +13.3 Differences From 80286 + +The few differences that do exist primarily affect operating system code. + + +13.3.1 Wraparound of 80286 24-Bit Physical Address Space + +With the 80286, any base and offset combination that addresses beyond 16M +bytes wraps around to the first megabyte of the 80286 address space. With +the 80386, since it has a greater physical address space, any such address +falls into the 17th megabyte. In the unlikely event that any software +depends on this anomaly, the same effect can be simulated on the 80386 by +using paging to map the first 64K bytes of the 17th megabyte of logical +addresses to physical addresses in the first megabyte. + + +13.3.2 Reserved Word of Descriptor + +Because the 80386 uses the contents of the reserved word (last word) of +every descriptor, 80286 programs that place values in this word may not +execute correctly on the 80386. + + +13.3.3 New Descriptor Type Codes + +Operating-system code that manages space in descriptor tables often uses an +invalid value in the access-rights field of descriptor-table entries to +identify unused entries. Access rights values of 80H and 00H remain invalid +for both the 80286 and 80386. Other values that were invalid on for the +80286 may be valid for the 80386 because of the additional descriptor types +defined by the 80386. + + +13.3.4 Restricted Semantics of LOCK + +The 80286 processor implements the bus lock function differently than the +80386. Programs that use forms of memory locking specific to the 80286 may +not execute properly when transported to a specific application of the +80386. + +The LOCK prefix and its corresponding output signal should only be used to +prevent other bus masters from interrupting a data movement operation. LOCK +may only be used with the following 80386 instructions when they modify +memory. An undefined-opcode exception results from using LOCK before any +other instruction. + + � Bit test and change: BTS, BTR, BTC. + � Exchange: XCHG. + � One-operand arithmetic and logical: INC, DEC, NOT, and NEG. + � Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. + +A locked instruction is guaranteed to lock only the area of memory defined +by the destination operand, but may lock a larger memory area. For example, +typical 8086 and 80286 configurations lock the entire physical memory space. +With the 80386, the defined area of memory is guaranteed to be locked +against access by a processor executing a locked instruction on exactly the +same memory area, i.e., an operand with identical starting address and +identical length. + + +13.3.5 Additional Exceptions + +The 80386 defines new exceptions that can occur even in systems designed +for the 80286. + + � Exception #6 컴 invalid opcode + + This exception can result from improper use of the LOCK instruction. + + � Exception #14 컴 page fault + + This exception may occur in an 80286 program if the operating system + enables paging. Paging can be used in a system with 80286 tasks as long + as all tasks use the same page directory. Because there is no place in + an 80286 TSS to store the PDBR, switching to an 80286 task does not + change the value of PDBR. Tasks ported from the 80286 should be given + 80386 TSSs so they can take full advantage of paging. + + +Chapter 14 80386 Real-Address Mode + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The real-address mode of the 80386 executes object code designed for +execution on 8086, 8088, 80186, or 80188 processors, or for execution in the +real-address mode of an 80286: + +In effect, the architecture of the 80386 in this mode is almost identical +to that of the 8086, 8088, 80186, and 80188. To a programmer, an 80386 in +real-address mode appears as a high-speed 8086 with extensions to the +instruction set and registers. The principal features of this architecture +are defined in Chapters 2 and 3. + +This chapter discusses certain additional topics that complete the system +programmer's view of the 80386 in real-address mode: + + � Address formation. + � Extensions to registers and instructions. + � Interrupt and exception handling. + � Entering and leaving real-address mode. + � Real-address-mode exceptions. + � Differences from 8086. + � Differences from 80286 real-address mode. + + +14.1 Physical Address Formation + +The 80386 provides a one Mbyte + 64 Kbyte memory space for an 8086 program. +Segment relocation is performed as in the 8086: the 16-bit value in a +segment selector is shifted left by four bits to form the base address of a +segment. The effective address is extended with four high order zeros and +added to the base to form a linear address as Figure 14-1 illustrates. (The +linear address is equivalent to the physical address, because paging is not +used in real-address mode.) Unlike the 8086, the resulting linear address +may have up to 21 significant bits. There is a possibility of a carry when +the base address is added to the effective address. On the 8086, the carried +bit is truncated, whereas on the 80386 the carried bit is stored in bit +position 20 of the linear address. + +Unlike the 8086 and 80286, 32-bit effective addresses can be generated (via +the address-size prefix); however, the value of a 32-bit address may not +exceed 65535 without causing an exception. For full compatibility with 80286 +real-address mode, pseudo-protection faults (interrupt 12 or 13 with no +error code) occur if an effective address is generated outside the range 0 +through 65535. + + +Figure 14-1. Real-Address Mode Address Formation + + 19 3 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴曲袴袴袴袴敲 + BASE � 16-BIT SEGMENT SELECTOR � 0 0 0 0 � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴妄袴袴袴袴� + + + + 19 15 0 + �袴袴袴袴曲袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + OFFSET � 0 0 0 0 � 16-BIT EFFECTIVE ADDRESS � + 훤袴袴袴袴妄袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + = + 20 0 + LINEAR �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + ADDRESS � X X X X X X X X X X X X X X X X X X X X X X � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + +14.2 Registers and Instructions + +The register set available in real-address mode includes all the registers +defined for the 8086 plus the new registers introduced by the 80386: FS, GS, +debug registers, control registers, and test registers. New instructions +that explicitly operate on the segment registers FS and GS are available, +and the new segment-override prefixes can be used to cause instructions to +utilize FS and GS for address calculations. Instructions can utilize 32-bit +operands through the use of the operand size prefix. + +The instruction codes that cause undefined opcode traps (interrupt 6) +include instructions of the protected mode that manipulate or interrogate +80386 selectors and descriptors; namely, VERR, VERW, LAR, LSL, LTR, STR, +LLDT, and SLDT. Programs executing in real-address mode are able to take +advantage of the new applications-oriented instructions added to the +architecture by the introduction of the 80186/80188, 80286 and 80386: + +� New instructions introduced by 80186/80188 and 80286. + + 컴 PUSH immediate data + 컴 Push all and pop all (PUSHA and POPA) + 컴 Multiply immediate data + 컴 Shift and rotate by immediate count + 컴 String I/O + 컴 ENTER and LEAVE + 컴 BOUND + +� New instructions introduced by 80386. + + 컴 LSS, LFS, LGS instructions + 컴 Long-displacement conditional jumps + 컴 Single-bit instructions + 컴 Bit scan + 컴 Double-shift instructions + 컴 Byte set on condition + 컴 Move with sign/zero extension + 컴 Generalized multiply + 컴 MOV to and from control registers + 컴 MOV to and from test registers + 컴 MOV to and from debug registers + + +14.3 Interrupt and Exception Handling + +Interrupts and exceptions in 80386 real-address mode work as much as they +do on an 8086. Interrupts and exceptions vector to interrupt procedures via +an interrupt table. The processor multiplies the interrupt or exception +identifier by four to obtain an index into the interrupt table. The entries +of the interrupt table are far pointers to the entry points of interrupt or +exception handler procedures. When an interrupt occurs, the processor +pushes the current values of CS:IP onto the stack, disables interrupts, +clears TF (the single-step flag), then transfers control to the location +specified in the interrupt table. An IRET instruction at the end of the +handler procedure reverses these steps before returning control to the +interrupted procedure. + +The primary difference in the interrupt handling of the 80386 compared to +the 8086 is that the location and size of the interrupt table depend on the +contents of the IDTR (IDT register). Ordinarily, this fact is not apparent +to programmers, because, after RESET, the IDTR contains a base address of 0 +and a limit of 3FFH, which is compatible with the 8086. However, the LIDT +instruction can be used in real-address mode to change the base and limit +values in the IDTR. Refer to Chapter 9 for details on the IDTR, and the +LIDT and SIDT instructions. If an interrupt occurs and the corresponding +entry of the interrupt table is beyond the limit stored in the IDTR, the +processor raises exception 8. + + +14.4 Entering and Leaving Real-Address Mode + +Real-address mode is in effect after a signal on the RESET pin. Even if the +system is going to be used in protected mode, the start-up program will +execute in real-address mode temporarily while initializing for protected +mode. + + +14.4.1 Switching to Protected Mode + +The only way to leave real-address mode is to switch to protected mode. The +processor enters protected mode when a MOV to CR0 instruction sets the PE +(protection enable) bit in CR0. (For compatibility with the 80286, the LMSW +instruction may also be used to set the PE bit.) + +Refer to Chapter 10 "Initialization" for other aspects of switching to +protected mode. + + +14.5 Switching Back to Real-Address Mode + +The processor reenters real-address mode if software clears the PE bit in +CR0 with a MOV to CR0 instruction. A procedure that attempts to do this, +however, should proceed as follows: + + 1. If paging is enabled, perform the following sequence: + + � Transfer control to linear addresses that have an identity mapping; + i.e., linear addresses equal physical addresses. + + � Clear the PG bit in CR0. + + � Move zeros to CR3 to clear out the paging cache. + + 2. Transfer control to a segment that has a limit of 64K (FFFFH). This + loads the CS register with the limit it needs to have in real mode. + + 3. Load segment registers SS, DS, ES, FS, and GS with a selector that + points to a descriptor containing the following values, which are + appropriate to real mode: + + � Limit = 64K (FFFFH) + � Byte granular (G = 0) + � Expand up (E = 0) + � Writable (W = 1) + � Present (P = 1) + � Base = any value + + 4. Disable interrupts. A CLI instruction disables INTR interrupts. NMIs + can be disabled with external circuitry. + + 5. Clear the PE bit. + + 6. Jump to the real mode code to be executed using a far JMP. This + action flushes the instruction queue and puts appropriate values in + the access rights of the CS register. + + 7. Use the LIDT instruction to load the base and limit of the real-mode + interrupt vector table. + + 8. Enable interrupts. + + 9. Load the segment registers as needed by the real-mode code. + + +14.6 Real-Address Mode Exceptions + +The 80386 reports some exceptions differently when executing in +real-address mode than when executing in protected mode. Table 14-1 details +the real-address-mode exceptions. + + +14.7 Differences From 8086 + +In general, the 80386 in real-address mode will correctly execute ROM-based +software designed for the 8086, 8088, 80186, and 80188. Following is a list +of the minor differences between 8086 execution on the 80386 and on an 8086. + + 1. Instruction clock counts. + + The 80386 takes fewer clocks for most instructions than the 8086/8088. + The areas most likely to be affected are: + + � Delays required by I/O devices between I/O operations. + + � Assumed delays with 8086/8088 operating in parallel with an 8087. + + 2. Divide Exceptions Point to the DIV instruction. + + Divide exceptions on the 80386 always leave the saved CS:IP value + pointing to the instruction that failed. On the 8086/8088, the CS:IP + value points to the next instruction. + + 3. Undefined 8086/8088 opcodes. + + Opcodes that were not defined for the 8086/8088 will cause exception + 6 or will execute one of the new instructions defined for the 80386. + + 4. Value written by PUSH SP. + + The 80386 pushes a different value on the stack for PUSH SP than the + 8086/8088. The 80386 pushes the value of SP before SP is incremented + as part of the push operation; the 8086/8088 pushes the value of SP + after it is incremented. If the value pushed is important, replace + PUSH SP instructions with the following three instructions: + + PUSH BP + MOV BP, SP + XCHG BP, [BP] + + This code functions as the 8086/8088 PUSH SP instruction on the 80386. + + 5. Shift or rotate by more than 31 bits. + + The 80386 masks all shift and rotate counts to the low-order five + bits. This MOD 32 operation limits the count to a maximum of 31 bits, + thereby limiting the time that interrupt response is delayed while + the instruction is executing. + + 6. Redundant prefixes. + + The 80386 sets a limit of 15 bytes on instruction length. The only + way to violate this limit is by putting redundant prefixes before an + instruction. Exception 13 occurs if the limit on instruction length + is violated. The 8086/8088 has no instruction length limit. + + 7. Operand crossing offset 0 or 65,535. + + On the 8086, an attempt to access a memory operand that crosses + offset 65,535 (e.g., MOV a word to offset 65,535) or offset 0 (e.g., + PUSH a word when SP = 1) causes the offset to wrap around modulo + 65,536. The 80386 raises an exception in these cases컴exception 13 if + the segment is a data segment (i.e., if CS, DS, ES, FS, or GS is being + used to address the segment), exception 12 if the segment is a stack + segment (i.e., if SS is being used). + + 8. Sequential execution across offset 65,535. + + On the 8086, if sequential execution of instructions proceeds past + offset 65,535, the processor fetches the next instruction byte from + offset 0 of the same segment. On the 80386, the processor raises + exception 13 in such a case. + + 9. LOCK is restricted to certain instructions. + + The LOCK prefix and its corresponding output signal should only be + used to prevent other bus masters from interrupting a data movement + operation. The 80386 always asserts the LOCK signal during an XCHG + instruction with memory (even if the LOCK prefix is not used). LOCK + may only be used with the following 80386 instructions when they + update memory: BTS, BTR, BTC, XCHG, ADD, ADC, SUB, SBB, INC, DEC, + AND, OR, XOR, NOT, and NEG. An undefined-opcode exception + (interrupt 6) results from using LOCK before any other instruction. + + 10. Single-stepping external interrupt handlers. + + The priority of the 80386 single-step exception is different from that + of the 8086/8088. The change prevents an external interrupt handler + from being single-stepped if the interrupt occurs while a program is + being single-stepped. The 80386 single-step exception has higher + priority that any external interrupt. The 80386 will still single-step + through an interrupt handler invoked by the INT instructions or by an + exception. + + 11. IDIV exceptions for quotients of 80H or 8000H. + + The 80386 can generate the largest negative number as a quotient for + the IDIV instruction. The 8086/8088 causes exception zero instead. + + 12. Flags in stack. + + The setting of the flags stored by PUSHF, by interrupts, and by + exceptions is different from that stored by the 8086 in bit positions + 12 through 15. On the 8086 these bits are stored as ones, but in + 80386 real-address mode bit 15 is always zero, and bits 14 through 12 + reflect the last value loaded into them. + + 13. NMI interrupting NMI handlers. + + After an NMI is recognized on the 80386, the NMI interrupt is masked + until an IRET instruction is executed. + + 14. Coprocessor errors vector to interrupt 16. + + Any 80386 system with a coprocessor must use interrupt vector 16 for + the coprocessor error exception. If an 8086/8088 system uses another + vector for the 8087 interrupt, both vectors should point to the + coprocessor-error exception handler. + + 15. Numeric exception handlers should allow prefixes. + + On the 80386, the value of CS:IP saved for coprocessor exceptions + points at any prefixes before an ESC instruction. On 8086/8088 + systems, the saved CS:IP points to the ESC instruction. + + 16. Coprocessor does not use interrupt controller. + + The coprocessor error signal to the 80386 does not pass through an + interrupt controller (an 8087 INT signal does). Some instructions in + a coprocessor error handler may need to be deleted if they deal with + the interrupt controller. + + 17. Six new interrupt vectors. + + The 80386 adds six exceptions that arise only if the 8086 program has + a hidden bug. It is recommended that exception handlers be added that + treat these exceptions as invalid operations. This additional + software does not significantly affect the existing 8086 software + because the interrupts do not normally occur. These interrupt + identifiers should not already have been used by the 8086 software, + because they are in the range reserved by Intel. Table 14-2 describes + the new 80386 exceptions. + + 18. One megabyte wraparound. + + The 80386 does not wrap addresses at 1 megabyte in real-address mode. + On members of the 8086 family, it possible to specify addresses + greater than one megabyte. For example, with a selector value 0FFFFH + and an offset of 0FFFFH, the effective address would be 10FFEFH (1 + Mbyte + 65519). The 8086, which can form adresses only up to 20 bits + long, truncates the high-order bit, thereby "wrapping" this address + to 0FFEFH. However, the 80386, which can form addresses up to 32 + bits long does not truncate such an address. + + +Table 14-1. 80386 Real-Address Mode Exceptions + + +Description Interrupt Function that Can +Return Address + Number Generate the Exception +Points to Faulting + +Instruction +Divide error 0 DIV, IDIV +YES +Debug exceptions 1 All + +Some debug exceptions point to the faulting instruction, others to the +next instruction. The exception handler can determine which has occurred by +examining DR6. + + + + + +Breakpoint 3 INT +NO +Overflow 4 INTO +NO +Bounds check 5 BOUND +YES +Invalid opcode 6 Any undefined opcode or LOCK +YES + used with wrong instruction +Coprocessor not available 7 ESC or WAIT +YES +Interrupt table limit too small 8 INT vector is not within IDTR +YES + limit +Reserved 9-12 +Stack fault 12 Memory operand crosses offset +YES + 0 or 0FFFFH +Pseudo-protection exception 13 Memory operand crosses offset +YES + 0FFFFH or attempt to execute + past offset 0FFFFH or + instruction longer than 15 + bytes +Reserved 14,15 +Coprocessor error 16 ESC or WAIT +YES +Coprocessor errors are reported on the first ESC or WAIT instruction +after the ESC instruction that caused the error. + + + + + +Two-byte SW interrupt 0-255 INT n +NO + + +Table 14-2. New 80386 Exceptions + +Interrupt Function +Identifier + + 5 A BOUND instruction was executed with a register value outside + the limit values. + + 6 An undefined opcode was encountered or LOCK was used improperly + before an instruction to which it does not apply. + + 7 The EM bit in the MSW is set when an ESC instruction was + encountered. This exception also occurs on a WAIT instruction + if TS is set. + + 8 An exception or interrupt has vectored to an interrupt table + entry beyond the interrupt table limit in IDTR. This can occur + only if the LIDT instruction has changed the limit from the + default value of 3FFH, which is enough for all 256 interrupt + IDs. + + 12 Operand crosses extremes of stack segment, e.g., MOV operation + at offset 0FFFFH or push with SP=1 during PUSH, CALL, or INT. + + 13 Operand crosses extremes of a segment other than a stack + segment; or sequential instruction execution attempts to + proceed beyond offset 0FFFFH; or an instruction is longer than + 15 bytes (including prefixes). + + +14.8 Differences From 80286 Real-Address Mode + +The few differences that exist between 80386 real-address mode and 80286 +real-address mode are not likely to affect any existing 80286 programs +except possibly the system initialization procedures. + + +14.8.1 Bus Lock + +The 80286 processor implements the bus lock function differently than the +80386. Programs that use forms of memory locking specific to the 80286 may +not execute properly if transported to a specific application of the 80386. + +The LOCK prefix and its corresponding output signal should only be used to +prevent other bus masters from interrupting a data movement operation. LOCK +may only be used with the following 80386 instructions when they modify +memory. An undefined-opcode exception results from using LOCK before any +other instruction. + + � Bit test and change: BTS, BTR, BTC. + � Exchange: XCHG. + � One-operand arithmetic and logical: INC, DEC, NOT, and NEG. + � Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. + +A locked instruction is guaranteed to lock only the area of memory defined +by the destination operand, but may lock a larger memory area. For example, +typical 8086 and 80286 configurations lock the entire physical memory space. +With the 80386, the defined area of memory is guranteed to be locked against +access by a processor executing a locked instruction on exactly the same +memory area, i.e., an operand with identical starting address and identical +length. + + +14.8.2 Location of First Instruction + +The starting location is 0FFFFFFF0H (sixteen bytes from end of 32-bit +address space) on the 80386 rather than 0FFFFF0H (sixteen bytes from end of +24-bit address space) as on the 80286. Many 80286 ROM initialization +programs will work correctly in this new environment. Others can be made to +work correctly with external hardware that redefines the signals on +A{31-20}. + + +14.8.3 Initial Values of General Registers + +On the 80386, certain general registers may contain different values after +RESET than on the 80286. This should not cause compatibility problems, +because the content of 8086 registers after RESET is undefined. If +self-test is requested during the reset sequence and errors are detected in +the 80386 unit, EAX will contain a nonzero value. EDX contains the component +and revision identifier. Refer to Chapter 10 for more information. + + +14.8.4 MSW Initialization + +The 80286 initializes the MSW register to FFF0H, but the 80386 initializes +this register to 0000H. This difference should have no effect, because the +bits that are different are undefined on the 80286. Programs that read the +value of the MSW will behave differently on the 80386 only if they depend on +the setting of the undefined, high-order bits. + + +Chapter 15 Virtual 8086 Mode + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The 80386 supports execution of one or more 8086, 8088, 80186, or 80188 +programs in an 80386 protected-mode environment. An 8086 program runs in +this environment as part of a V86 (virtual 8086) task. V86 tasks take +advantage of the hardware support of multitasking offered by the protected +mode. Not only can there be multiple V86 tasks, each one executing an 8086 +program, but V86 tasks can be multiprogrammed with other 80386 tasks. + +The purpose of a V86 task is to form a "virtual machine" with which to +execute an 8086 program. A complete virtual machine consists not only of +80386 hardware but also of systems software. Thus, the emulation of an 8086 +is the result of cooperation between hardware and software: + + � The hardware provides a virtual set of registers (via the TSS), a + virtual memory space (the first megabyte of the linear address space of + the task), and directly executes all instructions that deal with these + registers and with this address space. + + � The software controls the external interfaces of the virtual machine + (I/O, interrupts, and exceptions) in a manner consistent with the + larger environment in which it executes. In the case of I/O, software + can choose either to emulate I/O instructions or to let the hardware + execute them directly without software intervention. + +Software that helps implement virtual 8086 machines is called a V86 +monitor. + + +15.1 Executing 8086 Code + +The processor executes in V86 mode when the VM (virtual machine) bit in the +EFLAGS register is set. The processor tests this flag under two general +conditions: + + 1. When loading segment registers to know whether to use 8086-style + address formation. + + 2. When decoding instructions to determine which instructions are + sensitive to IOPL. + +Except for these two modifications to its normal operations, the 80386 in +V86 mode operated much as in protected mode. + + +15.1.1 Registers and Instructions + +The register set available in V86 mode includes all the registers defined +for the 8086 plus the new registers introduced by the 80386: FS, GS, debug +registers, control registers, and test registers. New instructions that +explicitly operate on the segment registers FS and GS are available, and the +new segment-override prefixes can be used to cause instructions to utilize +FS and GS for address calculations. Instructions can utilize 32-bit +operands through the use of the operand size prefix. + +8086 programs running as V86 tasks are able to take advantage of the new +applications-oriented instructions added to the architecture by the +introduction of the 80186/80188, 80286 and 80386: + + � New instructions introduced by 80186/80188 and 80286. + 컴 PUSH immediate data + 컴 Push all and pop all (PUSHA and POPA) + 컴 Multiply immediate data + 컴 Shift and rotate by immediate count + 컴 String I/O + 컴 ENTER and LEAVE + 컴 BOUND + + � New instructions introduced by 80386. + 컴 LSS, LFS, LGS instructions + 컴 Long-displacement conditional jumps + 컴 Single-bit instructions + 컴 Bit scan + 컴 Double-shift instructions + 컴 Byte set on condition + 컴 Move with sign/zero extension + 컴 Generalized multiply + + +15.1.2 Linear Address Formation + +In V86 mode, the 80386 processor does not interpret 8086 selectors by +referring to descriptors; instead, it forms linear addresses as an 8086 +would. It shifts the selector left by four bits to form a 20-bit base +address. The effective address is extended with four high-order zeros and +added to the base address to create a linear address as Figure 15-1 +illustrates. + +Because of the possibility of a carry, the resulting linear address may +contain up to 21 significant bits. An 8086 program may generate linear +addresses anywhere in the range 0 to 10FFEFH (one megabyte plus +approximately 64 Kbytes) of the task's linear address space. + +V86 tasks generate 32-bit linear addresses. While an 8086 program can only +utilize the low-order 21 bits of a linear address, the linear address can be +mapped via page tables to any 32-bit physical address. + +Unlike the 8086 and 80286, 32-bit effective addresses can be generated (via +the address-size prefix); however, the value of a 32-bit address may not +exceed 65,535 without causing an exception. For full compatibility with +80286 real-address mode, pseudo-protection faults (interrupt 12 or 13 with +no error code) occur if an address is generated outside the range 0 through +65,535. + + +Figure 15-1. V86 Mode Address Formation + + 19 3 0 + �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴曲袴袴袴袴敲 + BASE � 16-BIT SEGMENT SELECTOR � 0 0 0 0 � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴妄袴袴袴袴� + + + + 19 15 0 + �袴袴袴袴曲袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + OFFSET � 0 0 0 0 � 16-BIT EFFECTIVE ADDRESS � + 훤袴袴袴袴妄袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + = + 20 0 + LINEAR �袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + ADDRESS � X X X X X X X X X X X X X X X X X X X X X X � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + +15.2 Structure of a V86 Task + +A V86 task consists partly of the 8086 program to be executed and partly of +80386 "native mode" code that serves as the virtual-machine monitor. The +task must be represented by an 80386 TSS (not an 80286 TSS). The processor +enters V86 mode to execute the 8086 program and returns to protected mode to +execute the monitor or other 80386 tasks. + +To run successfully in V86 mode, an existing 8086 program needs the +following: + + � A V86 monitor. + � Operating-system services. + +The V86 monitor is 80386 protected-mode code that executes at +privilege-level zero. The monitor consists primarily of initialization and +exception-handling procedures. As for any other 80386 program, +executable-segment descriptors for the monitor must exist in the GDT or in +the task's LDT. The linear addresses above 10FFEFH are available for the +V86 monitor, the operating system, and other systems software. The monitor +may also need data-segment descriptors so that it can examine the interrupt +vector table or other parts of the 8086 program in the first megabyte of the +address space. + +In general, there are two options for implementing the 8086 operating +system: + + 1. The 8086 operating system may run as part of the 8086 code. This + approach is desirable for any of the following reasons: + + � The 8086 applications code modifies the operating system. + + � There is not sufficient development time to reimplement the 8086 + operating system as 80386 code. + + 2. The 8086 operating system may be implemented or emulated in the V86 + monitor. This approach is desirable for any of the following reasons: + + � Operating system functions can be more easily coordinated among + several V86 tasks. + + � The functions of the 8086 operating system can be easily emulated + by calls to the 80386 operating system. + +Note that, regardless of the approach chosen for implementing the 8086 +operating system, different V86 tasks may use different 8086 operating +systems. + + +15.2.1 Using Paging for V86 Tasks + +Paging is not necessary for a single V86 task, but paging is useful or +necessary for any of the following reasons: + + � To create multiple V86 tasks. Each task must map the lower megabyte of + linear addresses to different physical locations. + + � To emulate the megabyte wrap. On members of the 8086 family, it is + possible to specify addresses larger than one megabyte. For example, + with a selector value of 0FFFFH and an offset of 0FFFFH, the effective + address would be 10FFEFH (one megabyte + 65519). The 8086, which can + form addresses only up to 20 bits long, truncates the high-order bit, + thereby "wrapping" this address to 0FFEFH. The 80386, however, which + can form addresses up to 32 bits long does not truncate such an + address. If any 8086 programs depend on this addressing anomaly, the + same effect can be achieved in a V86 task by mapping linear addresses + between 100000H and 110000H and linear addresses between 0 and 10000H + to the same physical addresses. + + � To create a virtual address space larger than the physical address + space. + + � To share 8086 OS code or ROM code that is common to several 8086 + programs that are executing simultaneously. + + � To redirect or trap references to memory-mapped I/O devices. + + +15.2.2 Protection within a V86 Task + +Because it does not refer to descriptors while executing 8086 programs, the +processor also does not utilize the protection mechanisms offered by +descriptors. To protect the systems software that runs in a V86 task from +the 8086 program, software designers may follow either of these approaches: + + � Reserve the first megabyte (plus 64 kilobytes) of each task's linear + address space for the 8086 program. An 8086 task cannot generate + addresses outside this range. + + � Use the U/S bit of page-table entries to protect the virtual-machine + monitor and other systems software in each virtual 8086 task's space. + When the processor is in V86 mode, CPL is 3. Therefore, an 8086 program + has only user privileges. If the pages of the virtual-machine monitor + have supervisor privilege, they cannot be accessed by the 8086 program. + + +15.3 Entering and Leaving V86 Mode + +Figure 15-2 summarizes the ways that the processor can enter and leave an +8086 program. The processor can enter V86 by either of two means: + + 1. A task switch to an 80386 task loads the image of EFLAGS from the new + TSS. The TSS of the new task must be an 80386 TSS, not an 80286 TSS, + because the 80286 TSS does not store the high-order word of EFLAGS, + which contains the VM flag. A value of one in the VM bit of the new + EFLAGS indicates that the new task is executing 8086 instructions; + therefore, while loading the segment registers from the TSS, the + processor forms base addresses as the 8086 would. + + 2. An IRET from a procedure of an 80386 task loads the image of EFLAGS + from the stack. A value of one in VM in this case indicates that the + procedure to which control is being returned is an 8086 procedure. The + CPL at the time the IRET is executed must be zero, else the processor + does not change VM. + +The processor leaves V86 mode when an interrupt or exception occurs. There +are two cases: + + 1. The interrupt or exception causes a task switch. A task switch from a + V86 task to any other task loads EFLAGS from the TSS of the new task. + If the new TSS is an 80386 TSS and the VM bit in the EFLAGS image is + zero or if the new TSS is an 80286 TSS, then the processor clears the + VM bit of EFLAGS, loads the segment registers from the new TSS using + 80386-style address formation, and begins executing the instructions + of the new task according to 80386 protected-mode semantics. + + 2. The interrupt or exception vectors to a privilege-level zero + procedure. The processor stores the current setting of EFLAGS on the + stack, then clears the VM bit. The interrupt or exception handler, + therefore, executes as "native" 80386 protected-mode code. If an + interrupt or exception vectors to a conforming segment or to a + privilege level other than three, the processor causes a + general-protection exception; the error code is the selector of the + executable segment to which transfer was attempted. + +Systems software does not manipulate the VM flag directly, but rather +manipulates the image of the EFLAGS register that is stored on the stack or +in the TSS. The V86 monitor sets the VM flag in the EFLAGS image on the +stack or in the TSS when first creating a V86 task. Exception and interrupt +handlers can examine the VM flag on the stack. If the interrupted procedure +was executing in V86 mode, the handler may need to invoke the V86 monitor. + + +Figure 15-2. Entering and Leaving the 8086 Program + + MODE TRANSITION DIAGRAM + + �袴袴袴袴袴敲 + TASK SWITCH � INITIAL � + 旼컴컴컴컴컴컴컴캘 ENTRY � + � OR IRET 훤袴袴袴袴袴� + � +  + �袴袴袴袴袴袴袴� INTERRUPT, EXCEPTION �袴袴袴袴袴袴敲 + � 8086 PROGRAM 픔컴컴컴컴컴컴컴컴컴컴컴컴컴컴� V86 MONITOR � + � (V86 MODE) �컴컴컴컴컴컴컴컴컴컴컴컴컴컴캘 (PROTECTED � + 훤袴袴袴佶袴袴暠 IRET � MODE) � +  � 훤袴袴佶袴袴袴� + � � �  + � � � � + � � � � + � 쿟ASK SWITCH �袴袴袴袴袴袴袴袴袴敲 TASK SWITCH � + � 읕컴컴컴컴컴� OTHER 80386 TASKS �컴컴컴컴켸 � + 읕컴컴컴컴컴컴캘 (PROTECTED MODE) 픔컴컴컴컴컴컴� + TASK SWITCH 훤袴袴袴袴袴袴袴袴袴� TASK SWITCH + + +15.3.1 Transitions Through Task Switches + +A task switch to or from a V86 task may be due to any of three causes: + + 1. An interrupt that vectors to a task gate. + 2. An action of the scheduler of the 80386 operating system. + 3. An IRET when the NT flag is set. + +In any of these cases, the processor changes the VM bit in EFLAGS according +to the image of EFLAGS in the new TSS. If the new TSS is an 80286 TSS, the +high-order word of EFLAGS is not in the TSS; the processor clears VM in this +case. The processor updates VM prior to loading the segment registers from +the images in the new TSS. The new setting of VM determines whether the +processor interprets the new segment-register images as 8086 selectors or +80386/80286 selectors. + + +15.3.2 Transitions Through Trap Gates and Interrupt Gates + +The processor leaves V86 mode as the result of an exception or interrupt +that vectors via a trap or interrupt gate to a privilege-level zero +procedure. The exception or interrupt handler returns to the 8086 code by +executing an IRET. + +Because it was designed for execution by an 8086 processor, an 8086 program +in a V86 task will have an 8086-style interrupt table starting at linear +address zero. However, the 80386 does not use this table directly. For all +exceptions and interrupts that occur in V86 mode, the processor vectors +through the IDT. The IDT entry for an interrupt or exception that occurs in +a V86 task must contain either: + + � A task gate. + + � An 80386 trap gate (type 14) or an 80386 interrupt gate (type 15), + which must point to a nonconforming, privilege-level zero, code + segment. + +Interrupts and exceptions that have 80386 trap or interrupt gates in the +IDT vector to the appropriate handler procedure at privilege-level zero. The +contents of all the 8086 segment registers are stored on the PL 0 stack. +Figure 15-3 shows the format of the PL 0 stack after an exception or +interrupt that occurs while a V86 task is executing an 8086 program. + +After the processor stores all the 8086 segment registers on the PL 0 +stack, it loads all the segment registers with zeros before starting to +execute the handler procedure. This permits the interrupt handler to safely +save and restore the DS, ES, FS, and GS registers as 80386 selectors. +Interrupt handlers that may be invoked in the context of either a regular +task or a V86 task, can use the same prolog and epilog code for register +saving regardless of the kind of task. Restoring zeros to these registers +before execution of the IRET does not cause a trap in the interrupt handler. +Interrupt procedures that expect values in the segment registers or that +return values via segment registers have to use the register images stored +on the PL 0 stack. Interrupt handlers that need to know whether the +interrupt occurred in V86 mode can examine the VM bit in the stored EFLAGS +image. + +An interrupt handler passes control to the V86 monitor if the VM bit is set +in the EFLAGS image stored on the stack and the interrupt or exception is +one that the monitor needs to handle. The V86 monitor may either: + + � Handle the interrupt completely within the V86 monitor. + � Invoke the 8086 program's interrupt handler. + +Reflecting an interrupt or exception back to the 8086 code involves the +following steps: + + 1. Refer to the 8086 interrupt vector to locate the appropriate handler + procedure. + + 2. Store the state of the 8086 program on the privilege-level three + stack. + + 3. Change the return link on the privilege-level zero stack to point to + the privilege-level three handler procedure. + + 4. Execute an IRET so as to pass control to the handler. + + 5. When the IRET by the privilege-level three handler again traps to the + V86 monitor, restore the return link on the privilege-level zero stack + to point to the originally interrupted, privilege-level three + procedure. + + 6. Execute an IRET so as to pass control back to the interrupted + procedure. + + +Figure 15-3. PL 0 Stack after Interrupt in V86 Task + + + WITHOUT ERROR CODE WITH ERROR CODE + 31 0 31 0 + �袴袴袴箇袴袴袴�컴컴� �袴袴袴箇袴袴袴�컴컴� + 볍굇굇군OLD GS � � 볍굇굇군OLD GS � � + 勁袴袴誥袴袴袴攷 SS:ESP 勁袴袴誥袴袴袴攷 SS:ESP + D O 볍굇굇군OLD FS � FROM TSS 볍굇굇군OLD FS � FROM TSS + I F 勁袴袴誥袴袴袴攷 勁袴袴誥袴袴袴攷 + R 볍굇굇군OLD DS � 볍굇굇군OLD DS � + E E 勁袴袴誥袴袴袴攷 勁袴袴誥袴袴袴攷 + C X 볍굇굇군OLD ES � 볍굇굇군OLD ES � + T P 勁袴袴誥袴袴袴攷 勁袴袴誥袴袴袴攷 + I A 볍굇굇군OLD SS � 볍굇굇군OLD SS � + O N 勁袴袴菰袴袴袴攷 勁袴袴菰袴袴袴攷 + N S � OLD ESP � � OLD ESP � + I 勁袴袴袴袴袴袴攷 勁袴袴袴袴袴袴攷 + � O � OLD EFLAGS � � OLD EFLAGS � + � N 勁袴袴藁袴袴袴攷 勁袴袴藁袴袴袴攷 + � 볍굇굇군OLD CS � NEW 볍굇굇군OLD CS � +  勁袴袴菰袴袴袴攷 SS:EIP 勁袴袴菰袴袴袴攷 + � OLD EIP � � � OLD EIP � NEW + 勁袴袴袴袴袴袴攷컴켸 勁袴袴袴袴袴袴攷 SS:EIP + � � � ERROR CODE � � +   勁袴袴袴袴袴袴攷컴켸 +   � � +     + + +15.4 Additional Sensitive Instructions + +When the 80386 is executing in V86 mode, the instructions PUSHF, POPF, +INT n, and IRET are sensitive to IOPL. The instructions IN, INS, OUT, and +OUTS, which are ordinarily sensitive in protected mode, are not sensitive +in V86 mode. Following is a complete list of instructions that are sensitive +in V86 mode: + + CLI 컴 Clear Interrupt-Enable Flag + STI 컴 Set Interrupt-Enable Flag + LOCK 컴 Assert Bus-Lock Signal + PUSHF 컴 Push Flags + POPF 컴 Pop Flags + INT n 컴 Software Interrupt + RET 컴 Interrupt Return + +CPL is always three in V86 mode; therefore, if IOPL < 3, these instructions +will trigger a general-protection exceptions. These instructions are made +sensitive so that their functions can be simulated by the V86 monitor. + + +15.4.1 Emulating 8086 Operating System Calls + +INT n is sensitive so that the V86 monitor can intercept calls to the +8086 OS. Many 8086 operating systems are called by pushing parameters onto +the stack, then executing an INT n instruction. If IOPL < 3, INT n +instructions will be intercepted by the V86 monitor. The V86 monitor can +then emulate the function of the 8086 operating system or reflect the +interrupt back to the 8086 operating system in V86 mode. + + +15.4.2 Virtualizing the Interrupt-Enable Flag + +When the processor is executing 8086 code in a V86 task, the instructions +PUSHF, POPF, and IRET are sensitive to IOPL so that the V86 monitor can +control changes to the interrupt-enable flag (IF). Other instructions that +affect IF (STI and CLI) are IOPL sensitive both in 8086 code and in +80386/80386 code. + +Many 8086 programs that were designed to execute on single-task systems set +and clear IF to control interrupts. However, when these same programs are +executed in a multitasking environment, such control of IF can be +disruptive. If IOPL is less than three, all instructions that change or +interrogate IF will trap to the V86 monitor. The V86 monitor can then +control IF in a manner that both suits the needs of the larger environment +and is transparent to the 8086 program. + + +15.5 Virtual I/O + +Many 8086 programs that were designed to execute on single-task systems use +I/O devices directly. However, when these same programs are executed in a +multitasking environment, such use of devices can be disruptive. The 80386 +provides sufficient flexibility to control I/O in a manner that both suits +the needs of the new environment and is transparent to the 8086 program. +Designers may take any of several possible approaches to controlling I/O: + + � Implement or emulate the 8086 operating system as an 80386 program and + require the 8086 application to do I/O via software interrupts to the + operating system, trapping all attempts to do I/O directly. + + � Let the 8086 program take complete control of all I/O. + + � Selectively trap and emulate references that a task makes to specific + I/O ports. + + � Trap or redirect references to memory-mapped I/O addresses. + +The method of controlling I/O depends upon whether I/O ports are I/O mapped +or memory mapped. + + +15.5.1 I/O-Mapped I/O + +I/O-mapped I/O in V86 mode differs from protected mode only in that the +protection mechanism does not consult IOPL when executing the I/O +instructions IN, INS, OUT, OUTS. Only the I/O permission bit map controls +the right for V86 tasks to execute these I/O instructions. + +The I/O permission map traps I/O instructions selectively depending on the +I/O addresses to which they refer. The I/O permission bit map of each V86 +task determines which I/O addresses are trapped for that task. Because each +task may have a different I/O permission bit map, the addresses trapped for +one task may be different from those trapped for others. Refer to Chapter 8 +for more information about the I/O permission map. + + +15.5.2 Memory-Mapped I/O + +In hardware designs that utilize memory-mapped I/O, the paging facilities +of the 80386 can be used to trap or redirect I/O operations. Each task that +executes memory-mapped I/O must have a page (or pages) for the memory-mapped +address space. The V86 monitor may control memory-mapped I/O by any of +these means: + + � Assign the memory-mapped page to appropriate physical addresses. + Different tasks may have different physical addresses, thereby + preventing the tasks from interfering with each other. + + � Cause a trap to the monitor by forcing a page fault on the + memory-mapped page. Read-only pages trap writes. Not-present pages trap + both reads and writes. + +Intervention for every I/O might be excessive for some kinds of I/O +devices. A page fault can still be used in this case to cause intervention +on the first I/O operation. The monitor can then at least make sure that the +task has exclusive access to the device. Then the monitor can change the +page status to present and read/write, allowing subsequent I/O to proceed at +full speed. + + +15.5.3 Special I/O Buffers + +Buffers of intelligent controllers (for example, a bit-mapped graphics +buffer) can also be virtualized via page mapping. The linear space for the +buffer can be mapped to a different physical space for each virtual 8086 +task. The V86 monitor can then assume responsibility for spooling the data +or assigning the virtual buffer to the real buffer at appropriate times. + + +15.6 Differences From 8086 + +In general, V86 mode will correctly execute software designed for the 8086, +8088, 80186, and 80188. Following is a list of the minor differences between +8086 execution on the 80386 and on an 8086. + + 1. Instruction clock counts. + + The 80386 takes fewer clocks for most instructions than the + 8086/8088. The areas most likely to be affected are: + + � Delays required by I/O devices between I/O operations. + + � Assumed delays with 8086/8088 operating in parallel with an 8087. + + 2. Divide exceptions point to the DIV instruction. + + Divide exceptions on the 80386 always leave the saved CS:IP value + pointing to the instruction that failed. On the 8086/8088, the CS:IP + value points to the next instruction. + + 3. Undefined 8086/8088 opcodes. + + Opcodes that were not defined for the 8086/8088 will cause exception + 6 or will execute one of the new instructions defined for the 80386. + + 4. Value written by PUSH SP. + + The 80386 pushes a different value on the stack for PUSH SP than the + 8086/8088. The 80386 pushes the value of SP before SP is incremented + as part of the push operation; the 8086/8088 pushes the value of SP + after it is incremented. If the value pushed is important, replace + PUSH SP instructions with the following three instructions: + + PUSH BP + MOV BP, SP + XCHG BP, [BP] + + This code functions as the 8086/8088 PUSH SP instruction on the + 80386. + + 5. Shift or rotate by more than 31 bits. + + The 80386 masks all shift and rotate counts to the low-order five + bits. This MOD 32 operation limits the count to a maximum of 31 bits, + thereby limiting the time that interrupt response is delayed while + the instruction is executing. + + 6. Redundant prefixes. + + The 80386 sets a limit of 15 bytes on instruction length. The only + way to violate this limit is by putting redundant prefixes before an + instruction. Exception 13 occurs if the limit on instruction length + is violated. The 8086/8088 has no instruction length limit. + + 7. Operand crossing offset 0 or 65,535. + + On the 8086, an attempt to access a memory operand that crosses + offset 65,535 (e.g., MOV a word to offset 65,535) or offset 0 (e.g., + PUSH a word when SP = 1) causes the offset to wrap around modulo + 65,536. The 80386 raises an exception in these cases컴exception 13 if + the segment is a data segment (i.e., if CS, DS, ES, FS, or GS is + being used to address the segment), exception 12 if the segment is a + stack segment (i.e., if SS is being used). + + 8. Sequential execution across offset 65,535. + + On the 8086, if sequential execution of instructions proceeds past + offset 65,535, the processor fetches the next instruction byte from + offset 0 of the same segment. On the 80386, the processor raises + exception 13 in such a case. + + 9. LOCK is restricted to certain instructions. + + The LOCK prefix and its corresponding output signal should only be + used to prevent other bus masters from interrupting a data movement + operation. The 80386 always asserts the LOCK signal during an XCHG + instruction with memory (even if the LOCK prefix is not used). LOCK + may only be used with the following 80386 instructions when they + update memory: BTS, BTR, BTC, XCHG, ADD, ADC, SUB, SBB, INC, DEC, + AND, OR, XOR, NOT, and NEG. An undefined-opcode exception (interrupt + 6) results from using LOCK before any other instruction. + + 10. Single-stepping external interrupt handlers. + + The priority of the 80386 single-step exception is different from + that of the 8086/8088. The change prevents an external interrupt + handler from being single-stepped if the interrupt occurs while a + program is being single-stepped. The 80386 single-step exception has + higher priority that any external interrupt. The 80386 will still + single-step through an interrupt handler invoked by the INT + instructions or by an exception. + + 11. IDIV exceptions for quotients of 80H or 8000H. + + The 80386 can generate the largest negative number as a quotient for + the IDIV instruction. The 8086/8088 causes exception zero instead. + + 12. Flags in stack. + + The setting of the flags stored by PUSHF, by interrupts, and by + exceptions is different from that stored by the 8086 in bit positions + 12 through 15. On the 8086 these bits are stored as ones, but in V86 + mode bit 15 is always zero, and bits 14 through 12 reflect the last + value loaded into them. + + 13. NMI interrupting NMI handlers. + + After an NMI is recognized on the 80386, the NMI interrupt is masked + until an IRET instruction is executed. + + 14. Coprocessor errors vector to interrupt 16. + + Any 80386 system with a coprocessor must use interrupt vector 16 for + the coprocessor error exception. If an 8086/8088 system uses another + vector for the 8087 interrupt, both vectors should point to the + coprocessor-error exception handler. + + 15. Numeric exception handlers should allow prefixes. + + On the 80386, the value of CS:IP saved for coprocessor exceptions + points at any prefixes before an ESC instruction. On 8086/8088 + systems, the saved CS:IP points to the ESC instruction itself. + + 16. Coprocessor does not use interrupt controller. + + The coprocessor error signal to the 80386 does not pass through an + interrupt controller (an 8087 INT signal does). Some instructions in + a coprocessor error handler may need to be deleted if they deal with + the interrupt controller. + + +15.7 Differences From 80286 Real-Address Mode + +The 80286 processor implements the bus lock function differently than the +80386. This fact may or may not be apparent to 8086 programs, depending on +how the V86 monitor handles the LOCK prefix. LOCKed instructions are +sensitive to IOPL; therefore, software designers can choose to emulate its +function. If, however, 8086 programs are allowed to execute LOCK directly, +programs that use forms of memory locking specific to the 8086 may not +execute properly when transported to a specific application of the 80386. + +The LOCK prefix and its corresponding output signal should only be used to +prevent other bus masters from interrupting a data movement operation. LOCK +may only be used with the following 80386 instructions when they modify +memory. An undefined-opcode exception results from using LOCK before any +other instruction. + + � Bit test and change: BTS, BTR, BTC. + � Exchange: XCHG. + � One-operand arithmetic and logical: INC, DEC, NOT, and NEG. + � Two-operand arithmetic and logical: ADD, ADC, SUB, SBB, AND, OR, XOR. + +A locked instruction is guaranteed to lock only the area of memory defined +by the destination operand, but may lock a larger memory area. For example, +typical 8086 and 80286 configurations lock the entire physical memory space. +With the 80386, the defined area of memory is guaranteed to be locked +against access by a processor executing a locked instruction on exactly the +same memory area, i.e., an operand with identical starting address and +identical length. + + +Chapter 16 Mixing 16-Bit and 32 Bit Code + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +The 80386 running in protected mode is a 32-bit microprocessor, but it is +designed to support 16-bit processing at three levels: + + 1. Executing 8086/80286 16-bit programs efficiently with complete + compatibility. + + 2. Mixing 16-bit modules with 32-bit modules. + + 3. Mixing 16-bit and 32-bit addresses and operands within one module. + +The first level of support for 16-bit programs has already been discussed +in Chapter 13, Chapter 14, and Chapter 15. This chapter shows how 16-bit +and 32-bit modules can cooperate with one another, and how one module can +utilize both 16-bit and 32-bit operands and addressing. + +The 80386 functions most efficiently when it is possible to distinguish +between pure 16-bit modules and pure 32-bit modules. A pure 16-bit module +has these characteristics: + + � All segments occupy 64 Kilobytes or less. + � Data items are either 8 bits or 16 bits wide. + � Pointers to code and data have 16-bit offsets. + � Control is transferred only among 16-bit segments. + +A pure 32-bit module has these characteristics: + + � Segments may occupy more than 64 Kilobytes (zero bytes to 4 + gigabytes). + + � Data items are either 8 bits or 32 bits wide. + + � Pointers to code and data have 32-bit offsets. + + � Control is transferred only among 32-bit segments. + +Pure 16-bit modules do exist; they are the modules designed for 16-bit +microprocessors. Pure 32-bit modules may exist in new programs designed +explicitly for the 80386. However, as systems designers move applications +from 16-bit processors to the 32-bit 80386, it will not always be possible +to maintain these ideals of pure 16-bit or 32-bit modules. It may be +expedient to execute old 16-bit modules in a new 32-bit environment without +making source-code changes to the old modules if any of the following +conditions is true: + + � Modules will be converted one-by-one from 16-bit environments to + 32-bit environments. + + � Older, 16-bit compilers and software-development tools will be + utilized in the new32-bit operating environment until new 32-bit + versions can be created. + + � The source code of 16-bit modules is not available for modification. + + � The specific data structures used by a given module inherently utilize + 16-bit words. + + � The native word size of the source language is 16 bits. + +On the 80386, 16-bit modules can be mixed with 32-bit modules. To design a +system that mixes 16- and 32-bit code requires an understanding of the +mechanisms that the 80386 uses to invoke and control its 32-bit and 16-bit +features. + + +16.1 How the 80386 Implements 16-Bit and 32-Bit Features + +The features of the architecture that permit the 80386 to work equally well +with 32-bit and 16-bit address and operand sizes include: + + � The D-bit (default bit) of code-segment descriptors, which determines + the default choice of operand-size and address-size for the + instructions of a code segment. (In real-address mode and V86 mode, + which do not use descriptors, the default is 16 bits.) A code segment + whose D-bit is set is known as a USE32 segment; a code segment whose + D-bit is zero is a USE16 segment. The D-bit eliminates the need to + encode the operand size and address size in instructions when all + instructions use operands and effective addresses of the same size. + + � Instruction prefixes that explicitly override the default choice of + operand size and address size (available in protected mode as well as + in real-address mode and V86 mode). + + � Separate 32-bit and 16-bit gates for intersegment control transfers + (including call gates, interrupt gates, and trap gates). The operand + size for the control transfer is determined by the type of gate, not by + the D-bit or prefix of the transfer instruction. + + � Registers that can be used both for 32-bit and 16-bit operands and + effective-address calculations. + + � The B-bit (big bit) of data-segment descriptors, which determines the + size of stack pointer (32-bit ESP or 16-bit SP) used by the CPU for + implicit stack references. + + +16.2 Mixing 32-Bit and 16-Bit Operations + +The 80386 has two instruction prefixes that allow mixing of 32-bit and +16-bit operations within one segment: + + � The operand-size prefix (66H) + � The address-size prefix (67H) + +These prefixes reverse the default size selected by the D-bit. For example, +the processor can interpret the word-move instruction MOV mem, reg in any of +four ways: + + � In a USE32 segment: + + 1. Normally moves 32 bits from a 32-bit register to a 32-bit + effective address in memory. + + 2. If preceded by an operand-size prefix, moves 16 bits from a 16-bit + register to 32-bit effective address in memory. + + 3. If preceded by an address-size prefix, moves 32 bits from a 32-bit + register to a16-bit effective address in memory. + + 4. If preceded by both an address-size prefix and an operand-size + prefix, moves 16 bits from a 16-bit register to a 16-bit effective + address in memory. + + � In a USE16 segment: + + 1. Normally moves 16 bits from a 16-bit register to a 16-bit + effective address in memory. + + 2. If preceded by an operand-size prefix, moves 32 bits from a 32-bit + register to 16-bit effective address in memory. + + 3. If preceded by an address-size prefix, moves 16 bits from a 16-bit + register to a32-bit effective address in memory. + + 4. If preceded by both an address-size prefix and an operand-size + prefix, moves 32 bits from a 32-bit register to a 32-bit effective + address in memory. + +These examples illustrate that any instruction can generate any combination +of operand size and address size regardless of whether the instruction is in +a USE16 or USE32 segment. The choice of the USE16 or USE32 attribute for a +code segment is based upon these criteria: + + 1. The need to address instructions or data in segments that are larger + than 64 Kilobytes. + + 2. The predominant size of operands. + + 3. The addressing modes desired. (Refer to Chapter 17 for an explanation + of the additional addressing modes that are available when 32-bit + addressing is used.) + +Choosing a setting of the D-bit that is contrary to the predominant size of +operands requires the generation of an excessive number of operand-size +prefixes. + + +16.3 Sharing Data Segments Among Mixed Code Segments + +Because the choice of operand size and address size is defined in code +segments and their descriptors, data segments can be shared freely among +both USE16 and USE32 code segments. The only limitation is the one imposed +by pointers with 16-bit offsets, which can only point to the first 64 +Kilobytes of a segment. When a data segment that contains more than 64 +Kilobytes is to be shared among USE32 and USE16 segments, the data that is +to be accessed by the USE16 segments must be located within the first 64 +Kilobytes. + +A stack that spans addresses less than 64K can be shared by both USE16 and +USE32 code segments. This class of stacks includes: + + � Stacks in expand-up segments with G=0 and B=0. + + � Stacks in expand-down segments with G=0 and B=0. + + � Stacks in expand-up segments with G=1 and B=0, in which the stack is + contained completely within the lower 64 Kilobytes. (Offsets greater + than 64K can be used for data, other than the stack, that is not + shared.) + +The B-bit of a stack segment cannot, in general, be used to change the size +of stack used by a USE16 code segment. The size of stack pointer used by the +processor for implicit stack references is controlled by the B-bit of the +data-segment descriptor for the stack. Implicit references are those caused +by interrupts, exceptions, and instructions such as PUSH, POP, CALL, and +RET. One might be tempted, therefore, to try to increase beyond 64K the +size of the stack used by 16-bit code simply by supplying a larger stack +segment with the B-bit set. However, the B-bit does not control explicit +stack references, such as accesses to parameters or local variables. A USE16 +code segment can utilize a "big" stack only if the code is modified so that +all explicit references to the stack are preceded by the address-size +prefix, causing those references to use 32-bit addressing. + +In big, expand-down segments (B=1, G=1, and E=1), all offsets are greater +than 64K, therefore USE16 code cannot utilize such a stack segment unless +the code segment is modified to employ 32-bit addressing. (Refer to Chapter +6 for a review of the B, G, and E bits.) + + +16.4 Transferring Control Among Mixed Code Segments + +When transferring control among procedures in USE16 and USE32 code +segments, programmers must be aware of three points: + + � Addressing limitations imposed by pointers with 16-bit offsets. + + � Matching of operand-size attribute in effect for the CALL/RET pair and + theInterrupt/IRET pair so as to manage the stack correctly. + + � Translation of parameters, especially pointer parameters. + +Clearly, 16-bit effective addresses cannot be used to address data or code +located beyond 64K in a 32-bit segment, nor can large 32-bit parameters be +squeezed into a 16-bit word; however, except for these obvious limits, most +interfacing problems between 16-bit and 32-bit modules can be solved. Some +solutions involve inserting interface procedures between the procedures in +question. + + +16.4.1 Size of Code-Segment Pointer + +For control-transfer instructions that use a pointer to identify the next +instruction (i.e., those that do not use gates), the size of the offset +portion of the pointer is determined by the operand-size attribute. The +implications of the use of two different sizes of code-segment pointer are: + + � JMP, CALL, or RET from 32-bit segment to 16-bit segment is always + possible using a 32-bit operand size. + + � JMP, CALL, or RET from 16-bit segment using a 16-bit operand size + cannot address the target in a 32-bit segment if the address of the + target is greater than 64K. + +An interface procedure can enable transfers from USE16 segments to 32-bit +addresses beyond 64K without requiring modifications any more extensive than +relinking or rebinding the old programs. The requirements for such an +interface procedure are discussed later in this chapter. + + +16.4.2 Stack Management for Control Transfers + +Because stack management is different for 16-bit CALL/RET than for 32-bit +CALL/RET, the operand size of RET must match that of CALL. (Refer to Figure +16-1.) A 16-bit CALL pushes the 16-bit IP and (for calls between privilege +levels) the 16-bit SP register. The corresponding RET must also use a 16-bit +operand size to POP these 16-bit values from the stack into the 16-bit +registers. A 32-bit CALL pushes the 32-bit EIP and (for interlevel calls) +the 32-bit ESP register. The corresponding RET must also use a 32-bit +operand size to POP these 32-bit values from the stack into the 32-bit +registers. If the two halves of a CALL/RET pair do not have matching operand +sizes, the stack will not be managed correctly and the values of the +instruction pointer and stack pointer will not be restored to correct +values. + +When the CALL and its corresponding RET are in segments that have D-bits +with the same values (i.e., both have 32-bit defaults or both have 16-bit +defaults), there is no problem. When the CALL and its corresponding RET are +in segments that have different D-bit values, however, programmers (or +program development software) must ensure that the CALL and RET match. + +There are three ways to cause a 16-bit procedure to execute a 32-bit call: + + 1. Use a 16-bit call to a 32-bit interface procedure that then uses a + 32-bit call to invoke the intended target. + + 2. Bind the 16-bit call to a 32-bit call gate. + + 3. Modify the 16-bit procedure, inserting an operand-size prefix before + the call, thereby changing it to a 32-bit call. + +Likewise, there are three ways to cause a 32-bit procedure to execute a +16-bit call: + + 1. Use a 32-bit call to a 32-bit interface procedure that then uses a + 16-bit call to invoke the intended target. + + 2. Bind the 32-bit call to a 16-bit call gate. + + 3. Modify the 32-bit procedure, inserting an operand-size prefix before + the call, thereby changing it to a 16-bit call. (Be certain that the + return offset does not exceed 64K.) + +Programmers can utilize any of the preceding methods to make a CALL in a +USE16 segment match the corresponding RET in a USE32 segment, or to make a +CALL in a USE32 segment match the corresponding RET in a USE16 segment. + + +Figure 16-1. Stack after Far 16-Bit and 32-Bit Calls + + WITHOUT PRIVILEGE TRANSITION + + AFTER 16-BIT CALL AFTER 32-BIT CALL + + 31 0 31 0 + D O � � � � + I F 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + R 볍굇굇굇굇굇굇굇� 볍굇굇굇굇굇굇굇� + E E 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + C X � PARM2 � PARM1 � � PARM2 � + T P 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + I A � CS � IP �컴SP � PARM1 � + O N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + N S � � 볍굇굇굇� CS � + I 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � O � � � EIP �컴ESP + � N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � � +      + + WITH PRIVILEGE TRANSITION + + AFTER 16-BIT CALL AFTER 32-BIT CALL + + D O 31 0 31 0 + I F �袴袴袴曲袴袴袴敲 �袴袴袴曲袴袴袴敲 + R � SS � SP � 볍굇굇굇� SS � + E E 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + C X � PARM2 � PARM1 � � ESP � + T P 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + I A � CS � IP �컴SP � PARM2 � + O N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + N S � � � PARM1 � + I 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � O � � 볍굇굇굇� CS � + � N 勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � EIP �컴ESP +  勁袴袴袴妄袴袴袴� 勁袴袴袴妄袴袴袴� + � � � � +     + + +16.4.2.1 Controlling the Operand-Size for a Call + +When the selector of the pointer referenced by a CALL instruction selects a +segment descriptor, the operand-size attribute in effect for the CALL +instruction is determined by the D-bit in the segment descriptor and by any +operand-size instruction prefix. + +When the selector of the pointer referenced by a CALL instruction selects a +gate descriptor, the type of call is determined by the type of call gate. A +call via an 80286 call gate (descriptor type 4) always has a 16-bit +operand-size attribute; a call via an 80386 call gate (descriptor type 12) +always has a 32-bit operand-size attribute. The offset of the target +procedure is taken from the gate descriptor; therefore, even a 16-bit +procedure can call a procedure that is located more than 64 kilobytes from +the base of a 32-bit segment, because a 32-bit call gate contains a 32-bit +target offset. + +An unmodified 16-bit code segment that has run successfully on an 8086 or +real-mode 80286 will always have a D-bit of zero and will not use +operand-size override prefixes; therefore, it will always execute 16-bit +versions of CALL. The only modification needed to make a16-bit procedure +effect a 32-bit call is to relink the call to an 80386 call gate. + + +16.4.2.2 Changing Size of Call + +When adding 32-bit gates to 16-bit procedures, it is important to consider +the number of parameters. The count field of the gate descriptor specifies +the size of the parameter string to copy from the current stack to the stack +of the more privileged procedure. The count field of a 16-bit gate specifies +the number of words to be copied, whereas the count field of a 32-bit gate +specifies the number of doublewords to be copied; therefore, the 16-bit +procedure must use an even number of words as parameters. + + +16.4.3 Interrupt Control Transfers + +With a control transfer due to an interrupt or exception, a gate is always +involved. The operand-size attribute for the interrupt is determined by the +type of IDT gate. + +A 386 interrupt or trap gate (descriptor type 14 or 15) to a 32-bit +interrupt procedure can be used to interrupt either 32-bit or 16-bit +procedures. However, it is not generally feasible to permit an interrupt or +exception to invoke a 16-bit handler procedure when 32-bit code is +executing, because a 16-bit interrupt procedure has a return offset of only +16-bits on its stack. If the 32-bit procedure is executing at an address +greater than 64K, the 16-bit interrupt procedure cannot return correctly. + + +16.4.4 Parameter Translation + +When segment offsets or pointers (which contain segment offsets) are passed +as parameters between 16-bit and 32-bit procedures, some translation is +required. Clearly, if a 32-bit procedure passes a pointer to data located +beyond 64K to a 16-bit procedure, the 16-bit procedure cannot utilize it. +Beyond this natural limitation, an interface procedure can perform any +format conversion between 32-bit and 16-bit pointers that may be needed. + +Parameters passed by value between 32-bit and 16-bit code may also require +translation between 32-bit and 16-bit formats. Such translation requirements +are application dependent. Systems designers should take care to limit the +range of values passed so that such translations are possible. + + +16.4.5 The Interface Procedure + +Interposing an interface procedure between 32-bit and 16-bit procedures can +be the solution to any of several interface requirements: + + � Allowing procedures in 16-bit segments to transfer control to + instructions located beyond 64K in 32-bit segments. + + � Matching of operand size for CALL/RET. + + � Parameter translation. + +Interface procedures between USE32 and USE16 segments can be constructed +with these properties: + + � The procedures reside in a code segment whose D-bit is set, indicating + a default operand size of 32-bits. + + � All entry points that may be called by 16-bit procedures have offsets + that are actually less than 64K. + + � All points to which called 16-bit procedures may return also lie + within 64K. + +The interface procedures do little more than call corresponding procedures +in other segments. There may be two kinds of procedures: + + � Those that are called by 16-bit procedures and call 32-bit procedures. + These interface procedures are called by 16-bit CALLs and use the + operand-size prefix before RET instructions to cause a 16-bit RET. + CALLs to 32-bit segments are 32-bit calls (by default, because the + D-bit is set), and the 32-bit code returns with 32-bit RET + instructions. + + � Those that are called by 32-bit procedures and call 16-bit procedures. + These interface procedures are called by 32-bit CALL instructions, and + return with 32-bit RET instructions (by default, because the D-bit is + set). CALLs to 16-bit procedures use the operand-size prefix; + procedures in the 16-bit code return with 16-bit RET instructions. + + + PART IV INSTRUCTION SET + + +Chapter 17 80386 Instruction Set + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴 + +This chapter presents instructions for the 80386 in alphabetical order. For +each instruction, the forms are given for each operand combination, +including object code produced, operands required, execution time, and a +description. For each instruction, there is an operational description and a +summary of exceptions generated. + + +17.1 Operand-Size and Address-Size Attributes + +When executing an instruction, the 80386 can address memory using either 16 +or 32-bit addresses. Consequently, each instruction that uses memory +addresses has associated with it an address-size attribute of either 16 or +32 bits. 16-bit addresses imply both the use of a 16-bit displacement in +the instruction and the generation of a 16-bit address offset (segment +relative address) as the result of the effective address calculation. +32-bit addresses imply the use of a 32-bit displacement and the generation +of a 32-bit address offset. Similarly, an instruction that accesses words +(16 bits) or doublewords (32 bits) has an operand-size attribute of either +16 or 32 bits. + +The attributes are determined by a combination of defaults, instruction +prefixes, and (for programs executing in protected mode) size-specification +bits in segment descriptors. + + +17.1.1 Default Segment Attribute + +For programs executed in protected mode, the D-bit in executable-segment +descriptors determines the default attribute for both address size and +operand size. These default attributes apply to the execution of all +instructions in the segment. A value of zero in the D-bit sets the default +address size and operand size to 16 bits; a value of one, to 32 bits. + +Programs that execute in real mode or virtual-8086 mode have 16-bit +addresses and operands by default. + + +17.1.2 Operand-Size and Address-Size Instruction Prefixes + +The internal encoding of an instruction can include two byte-long prefixes: +the address-size prefix, 67H, and the operand-size prefix, 66H. (A later +section, "Instruction Format," shows the position of the prefixes in an +instruction's encoding.) These prefixes override the default segment +attributes for the instruction that follows. Table 17-1 shows the effect of +each possible combination of defaults and overrides. + + +17.1.3 Address-Size Attribute for Stack + +Instructions that use the stack implicitly (for example: POP EAX also have +a stack address-size attribute of either 16 or 32 bits. Instructions with a +stack address-size attribute of 16 use the 16-bit SP stack pointer register; +instructions with a stack address-size attribute of 32 bits use the 32-bit +ESP register to form the address of the top of the stack. + +The stack address-size attribute is controlled by the B-bit of the +data-segment descriptor in the SS register. A value of zero in the B-bit +selects a stack address-size attribute of 16; a value of one selects a stack +address-size attribute of 32. + + +Table 17-1. Effective Size Attributes + +Segment Default D = ... 0 0 0 0 1 1 1 1 +Operand-Size Prefix 66H N N Y Y N N Y Y +Address-Size Prefix 67H N Y N Y N Y N Y + +Effective Operand Size 16 16 32 32 32 32 16 16 +Effective Address Size 16 32 16 32 32 16 32 16 + +Y = Yes, this instruction prefix is present +N = No, this instruction prefix is not present + + +17.2 Instruction Format + +All instruction encodings are subsets of the general instruction format +shown in Figure 17-1. Instructions consist of optional instruction +prefixes, one or two primary opcode bytes, possibly an address specifier +consisting of the ModR/M byte and the SIB (Scale Index Base) byte, a +displacement, if required, and an immediate data field, if required. + +Smaller encoding fields can be defined within the primary opcode or +opcodes. These fields define the direction of the operation, the size of the +displacements, the register encoding, or sign extension; encoding fields +vary depending on the class of operation. + +Most instructions that can refer to an operand in memory have an addressing +form byte following the primary opcode byte(s). This byte, called the ModR/M +byte, specifies the address form to be used. Certain encodings of the ModR/M +byte indicate a second addressing byte, the SIB (Scale Index Base) byte, +which follows the ModR/M byte and is required to fully specify the +addressing form. + +Addressing forms can include a displacement immediately following either +the ModR/M or SIB byte. If a displacement is present, it can be 8-, 16- or +32-bits. + +If the instruction specifies an immediate operand, the immediate operand +always follows any displacement bytes. The immediate operand, if specified, +is always the last field of the instruction. + +The following are the allowable instruction prefix codes: + + F3H REP prefix (used only with string instructions) + F3H REPE/REPZ prefix (used only with string instructions + F2H REPNE/REPNZ prefix (used only with string instructions) + F0H LOCK prefix + +The following are the segment override prefixes: + + 2EH CS segment override prefix + 36H SS segment override prefix + 3EH DS segment override prefix + 26H ES segment override prefix + 64H FS segment override prefix + 65H GS segment override prefix + 66H Operand-size override + 67H Address-size override + + +Figure 17-1. 80386 Instruction Format + + �袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴藁袴袴袴袴袴袴袴敲 + � INSTRUCTION � ADDRESS- � OPERAND- � SEGMENT � + � PREFIX � SIZE PREFIX � SIZE PREFIX � OVERRIDE � + 勁袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴姦袴袴袴袴袴袴袴� + � 0 OR 1 0 OR 1 0 OR 1 0 OR 1 � + 픔 � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 캘 + � NUMBER OF BYTES � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + �袴袴袴袴袴箇袴袴袴袴袴箇袴袴袴箇袴袴袴袴袴袴袴袴藁袴袴袴袴袴袴敲 + � OPCODE � MODR/M � SIB � DISPLACEMENT � IMMEDIATE � + � � � � � � + 勁袴袴袴袴菰袴袴袴袴袴菰袴袴袴菰袴袴袴袴袴袴袴袴袴姦袴袴袴袴袴袴� + � 1 OR 2 0 OR 1 0 OR 1 0,1,2 OR 4 0,1,2 OR 4 � + 픔 � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 캘 + � NUMBER OF BYTES � + 훤袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� + + +17.2.1 ModR/M and SIB Bytes + +The ModR/M and SIB bytes follow the opcode byte(s) in many of the 80386 +instructions. They contain the following information: + + � The indexing type or register number to be used in the instruction + � The register to be used, or more information to select the instruction + � The base, index, and scale information + +The ModR/M byte contains three fields of information: + + � The mod field, which occupies the two most significant bits of the + byte, combines with the r/m field to form 32 possible values: eight + registers and 24 indexing modes + + � The reg field, which occupies the next three bits following the mod + field, specifies either a register number or three more bits of opcode + information. The meaning of the reg field is determined by the first + (opcode) byte of the instruction. + + � The r/m field, which occupies the three least significant bits of the + byte, can specify a register as the location of an operand, or can form + part of the addressing-mode encoding in combination with the field as + described above + +The based indexed and scaled indexed forms of 32-bit addressing require the +SIB byte. The presence of the SIB byte is indicated by certain encodings of +the ModR/M byte. The SIB byte then includes the following fields: + + � The ss field, which occupies the two most significant bits of the + byte, specifies the scale factor + + � The index field, which occupies the next three bits following the ss + field and specifies the register number of the index register + + � The base field, which occupies the three least significant bits of the + byte, specifies the register number of the base register + +Figure 17-2 shows the formats of the ModR/M and SIB bytes. + +The values and the corresponding addressing forms of the ModR/M and SIB +bytes are shown in Tables 17-2, 17-3, and 17-4. The 16-bit addressing +forms specified by the ModR/M byte are in Table 17-2. The 32-bit addressing +forms specified by ModR/M are in Table 17-3. Table 17-4 shows the 32-bit +addressing forms specified by the SIB byte + + +Figure 17-2. ModR/M and SIB Byte Formats + + MODR/M BYTE + + 7 6 5 4 3 2 1 0 + �袴袴袴袴箇袴袴袴袴袴袴箇袴袴袴袴袴袴� + � MOD � REG/OPCODE � R/M � + 훤袴袴袴菰袴袴袴袴袴袴菰袴袴袴袴袴袴暠 + + SIB (SCALE INDEX BASE) BYTE + + 7 6 5 4 3 2 1 0 + �袴袴袴袴箇袴袴袴袴袴袴箇袴袴袴袴袴袴� + � SS � INDEX � BASE � + 훤袴袴袴菰袴袴袴袴袴袴菰袴袴袴袴袴袴暠 + + +Table 17-2. 16-Bit Addressing Forms with the ModR/M Byte + + +r8(/r) AL CL DL BL AH CH DH BH +r16(/r) AX CX DX BX SP BP SI DI +r32(/r) EAX ECX EDX EBX ESP EBP ESI EDI +/digit (Opcode) 0 1 2 3 4 5 6 7 +REG = 000 001 010 011 100 101 110 111 + + Effective +旼컴Address +disp8 denotes an 8-bit displacement following the ModR/M byte, to be +sign-extended and added to the index. disp16 denotes a 16-bit displacement +following the ModR/M byte, to be added to the index. Default segment +register is SS for the effective addresses containing a BP index, DS for +other effective addresses.컴� �Mod R/M� 旼컴컴컴횺odR/M Values in +Hexadecimal컴컴컴컴� + +[BX + SI] 000 00 08 10 18 20 28 30 38 +[BX + DI] 001 01 09 11 19 21 29 31 39 +[BP + SI] 010 02 0A 12 1A 22 2A 32 3A +[BP + DI] 011 03 0B 13 1B 23 2B 33 3B +[SI] 00 100 04 0C 14 1C 24 2C 34 3C +[DI] 101 05 0D 15 1D 25 2D 35 3D +disp16 110 06 0E 16 1E 26 2E 36 3E +[BX] 111 07 0F 17 1F 27 2F 37 3F + +[BX+SI]+disp8 000 40 48 50 58 60 68 70 78 +[BX+DI]+disp8 001 41 49 51 59 61 69 71 79 +[BP+SI]+disp8 010 42 4A 52 5A 62 6A 72 7A +[BP+DI]+disp8 011 43 4B 53 5B 63 6B 73 7B +[SI]+disp8 01 100 44 4C 54 5C 64 6C 74 7C +[DI]+disp8 101 45 4D 55 5D 65 6D 75 7D +[BP]+disp8 110 46 4E 56 5E 66 6E 76 7E +[BX]+disp8 111 47 4F 57 5F 67 6F 77 7F + +[BX+SI]+disp16 000 80 88 90 98 A0 A8 B0 B8 +[BX+DI]+disp16 001 81 89 91 99 A1 A9 B1 B9 +[BX+SI]+disp16 010 82 8A 92 9A A2 AA B2 BA +[BX+DI]+disp16 011 83 8B 93 9B A3 AB B3 BB +[SI]+disp16 10 100 84 8C 94 9C A4 AC B4 BC +[DI]+disp16 101 85 8D 95 9D A5 AD B5 BD +[BP]+disp16 110 86 8E 96 9E A6 AE B6 BE +[BX]+disp16 111 87 8F 97 9F A7 AF B7 BF + +EAX/AX/AL 000 C0 C8 D0 D8 E0 E8 F0 F8 +ECX/CX/CL 001 C1 C9 D1 D9 E1 E9 F1 F9 +EDX/DX/DL 010 C2 CA D2 DA E2 EA F2 FA +EBX/BX/BL 011 C3 CB D3 DB E3 EB F3 FB +ESP/SP/AH 11 100 C4 CC D4 DC E4 EC F4 FC +EBP/BP/CH 101 C5 CD D5 DD E5 ED F5 FD +ESI/SI/DH 110 C6 CE D6 DE E6 EE F6 FE +EDI/DI/BH 111 C7 CF D7 DF E7 EF F7 FF + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + disp8 denotes an 8-bit displacement following the ModR/M byte, to be + sign-extended and added to the index. disp16 denotes a 16-bit displacement + following the ModR/M byte, to be added to the index. Default segment + register is SS for the effective addresses containing a BP index, DS for + other effective addresses. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + +Table 17-3. 32-Bit Addressing Forms with the ModR/M Byte + + +r8(/r) AL CL DL BL AH CH DH BH +r16(/r) AX CX DX BX SP BP SI DI +r32(/r) EAX ECX EDX EBX ESP EBP ESI EDI +/digit (Opcode) 0 1 2 3 4 5 6 7 +REG = 000 001 010 011 100 101 110 111 + + Effective +旼컴Address +[--] [--] means a SIB follows the ModR/M byte. disp8 denotes an 8-bit +displacement following the SIB byte, to be sign-extended and added to the +index. disp32 denotes a 32-bit displacement following the ModR/M byte, to +be added to the index.컴� �Mod R/M� 旼컴컴컴컴ModR/M Values in +Hexadecimal컴컴컴커 + +[EAX] 000 00 08 10 18 20 28 30 38 +[ECX] 001 01 09 11 19 21 29 31 39 +[EDX] 010 02 0A 12 1A 22 2A 32 3A +[EBX] 011 03 0B 13 1B 23 2B 33 3B +[--] [--] 00 100 04 0C 14 1C 24 2C 34 3C +disp32 101 05 0D 15 1D 25 2D 35 3D +[ESI] 110 06 0E 16 1E 26 2E 36 3E +[EDI] 111 07 0F 17 1F 27 2F 37 3F + +disp8[EAX] 000 40 48 50 58 60 68 70 78 +disp8[ECX] 001 41 49 51 59 61 69 71 79 +disp8[EDX] 010 42 4A 52 5A 62 6A 72 7A +disp8[EPX]; 011 43 4B 53 5B 63 6B 73 7B +disp8[--] [--] 01 100 44 4C 54 5C 64 6C 74 7C +disp8[ebp] 101 45 4D 55 5D 65 6D 75 7D +disp8[ESI] 110 46 4E 56 5E 66 6E 76 7E +disp8[EDI] 111 47 4F 57 5F 67 6F 77 7F + +disp32[EAX] 000 80 88 90 98 A0 A8 B0 B8 +disp32[ECX] 001 81 89 91 99 A1 A9 B1 B9 +disp32[EDX] 010 82 8A 92 9A A2 AA B2 BA +disp32[EBX] 011 83 8B 93 9B A3 AB B3 BB +disp32[--] [--] 10 100 84 8C 94 9C A4 AC B4 BC +disp32[EBP] 101 85 8D 95 9D A5 AD B5 BD +disp32[ESI] 110 86 8E 96 9E A6 AE B6 BE +disp32[EDI] 111 87 8F 97 9F A7 AF B7 BF + +EAX/AX/AL 000 C0 C8 D0 D8 E0 E8 F0 F8 +ECX/CX/CL 001 C1 C9 D1 D9 E1 E9 F1 F9 +EDX/DX/DL 010 C2 CA D2 DA E2 EA F2 FA +EBX/BX/BL 011 C3 CB D3 DB E3 EB F3 FB +ESP/SP/AH 11 100 C4 CC D4 DC E4 EC F4 FC +EBP/BP/CH 101 C5 CD D5 DD E5 ED F5 FD +ESI/SI/DH 110 C6 CE D6 DE E6 EE F6 FE +EDI/DI/BH 111 C7 CF D7 DF E7 EF F7 FF + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + [--] [--] means a SIB follows the ModR/M byte. disp8 denotes an 8-bit + displacement following the SIB byte, to be sign-extended and added to the + index. disp32 denotes a 32-bit displacement following the ModR/M byte, to + be added to the index. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + +Table 17-4. 32-Bit Addressing Forms with the SIB Byte + + + r32 EAX ECX EDX EBX ESP [*] +[*] means a disp32 with no base if MOD is 00, [ESP] otherwise. This provides +the following addressing modes: + disp32[index] (MOD=00) + disp8[EBP][index] (MOD=01) + disp32[EBP][index] (MOD=10) ESI EDI + Base = 0 1 2 3 4 5 6 7 + Base = 000 001 010 011 100 101 110 111 + +�Scaled Index +[*] means a disp32 with no base if MOD is 00, [ESP] otherwise. This provides +the following addressing modes: + disp32[index] (MOD=00) + disp8[EBP][index] (MOD=01) + disp32[EBP][index] (MOD=10)왯SS Index� 旼컴컴컴횺odR/M Values in +Hexadecimal컴컴컴컴� + +[EAX] 000 00 01 02 03 04 05 06 07 +[ECX] 001 08 09 0A 0B 0C 0D 0E 0F +[EDX] 010 10 11 12 13 14 15 16 17 +[EBX] 011 18 19 1A 1B 1C 1D 1E 1F +none 00 100 20 21 22 23 24 25 26 27 +[EBP] 101 28 29 2A 2B 2C 2D 2E 2F +[ESI] 110 30 31 32 33 34 35 36 37 +[EDI] 111 38 39 3A 3B 3C 3D 3E 3F + +[EAX*2] 000 40 41 42 43 44 45 46 47 +[ECX*2] 001 48 49 4A 4B 4C 4D 4E 4F +[ECX*2] 010 50 51 52 53 54 55 56 57 +[EBX*2] 011 58 59 5A 5B 5C 5D 5E 5F +none 01 100 60 61 62 63 64 65 66 67 +[EBP*2] 101 68 69 6A 6B 6C 6D 6E 6F +[ESI*2] 110 70 71 72 73 74 75 76 77 +[EDI*2] 111 78 79 7A 7B 7C 7D 7E 7F + +[EAX*4] 000 80 81 82 83 84 85 86 87 +[ECX*4] 001 88 89 8A 8B 8C 8D 8E 8F +[EDX*4] 010 90 91 92 93 94 95 96 97 +[EBX*4] 011 98 89 9A 9B 9C 9D 9E 9F +none 10 100 A0 A1 A2 A3 A4 A5 A6 A7 +[EBP*4] 101 A8 A9 AA AB AC AD AE AF +[ESI*4] 110 B0 B1 B2 B3 B4 B5 B6 B7 +[EDI*4] 111 B8 B9 BA BB BC BD BE BF + +[EAX*8] 000 C0 C1 C2 C3 C4 C5 C6 C7 +[ECX*8] 001 C8 C9 CA CB CC CD CE CF +[EDX*8] 010 D0 D1 D2 D3 D4 D5 D6 D7 +[EBX*8] 011 D8 D9 DA DB DC DD DE DF +none 11 100 E0 E1 E2 E3 E4 E5 E6 E7 +[EBP*8] 101 E8 E9 EA EB EC ED EE EF +[ESI*8] 110 F0 F1 F2 F3 F4 F5 F6 F7 +[EDI*8] 111 F8 F9 FA FB FC FD FE FF + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + [*] means a disp32 with no base if MOD is 00, [ESP] otherwise. This + provides the following addressing modes: + disp32[index] (MOD=00) + disp8[EBP][index] (MOD=01) + disp32[EBP][index] (MOD=10) +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + +17.2.2 How to Read the Instruction Set Pages + +The following is an example of the format used for each 80386 instruction +description in this chapter: + +CMC 컴 Complement Carry Flag + +Opcode Instruction Clocks Description + +F5 CMC 2 Complement carry flag + +The above table is followed by paragraphs labelled "Operation," +"Description," "Flags Affected," "Protected Mode Exceptions," "Real +Address Mode Exceptions," and, optionally, "Notes." The following sections +explain the notational conventions and abbreviations used in these +paragraphs of the instruction descriptions. + + +17.2.2.1 Opcode + +The "Opcode" column gives the complete object code produced for each form +of the instruction. When possible, the codes are given as hexadecimal bytes, +in the same order in which they appear in memory. Definitions of entries +other than hexadecimal bytes are as follows: + +/digit: (digit is between 0 and 7) indicates that the ModR/M byte of the +instruction uses only the r/m (register or memory) operand. The reg field +contains the digit that provides an extension to the instruction's opcode. + +/r: indicates that the ModR/M byte of the instruction contains both a +register operand and an r/m operand. + +cb, cw, cd, cp: a 1-byte (cb), 2-byte (cw), 4-byte (cd) or 6-byte (cp) +value following the opcode that is used to specify a code offset and +possibly a new value for the code segment register. + +ib, iw, id: a 1-byte (ib), 2-byte (iw), or 4-byte (id) immediate operand to +the instruction that follows the opcode, ModR/M bytes or scale-indexing +bytes. The opcode determines if the operand is a signed value. All words and +doublewords are given with the low-order byte first. + ++rb, +rw, +rd: a register code, from 0 through 7, added to the hexadecimal +byte given at the left of the plus sign to form a single opcode byte. The +codes are컴 + + rb rw rd + AL = 0 AX = 0 EAX = 0 + CL = 1 CX = 1 ECX = 1 + DL = 2 DX = 2 EDX = 2 + BL = 3 BX = 3 EBX = 3 + AH = 4 SP = 4 ESP = 4 + CH = 5 BP = 5 EBP = 5 + DH = 6 SI = 6 ESI = 6 + BH = 7 DI = 7 EDI = 7 + + +17.2.2.2 Instruction + +The "Instruction" column gives the syntax of the instruction statement as +it would appear in an ASM386 program. The following is a list of the symbols +used to represent operands in the instruction statements: + +rel8: a relative address in the range from 128 bytes before the end of the +instruction to 127 bytes after the end of the instruction. + +rel16, rel32: a relative address within the same code segment as the +instruction assembled. rel16 applies to instructions with an operand-size +attribute of 16 bits; rel32 applies to instructions with an operand-size +attribute of 32 bits. + +ptr16:16, ptr16:32: a FAR pointer, typically in a code segment different +from that of the instruction. The notation 16:16 indicates that the value of +the pointer has two parts. The value to the right of the colon is a 16-bit +selector or value destined for the code segment register. The value to the +left corresponds to the offset within the destination segment. ptr16:16 is +used when the instruction's operand-size attribute is 16 bits; ptr16:32 is +used with the 32-bit attribute. + +r8: one of the byte registers AL, CL, DL, BL, AH, CH, DH, or BH. + +r16: one of the word registers AX, CX, DX, BX, SP, BP, SI, or DI. + +r32: one of the doubleword registers EAX, ECX, EDX, EBX, ESP, EBP, ESI, or +EDI. + +imm8: an immediate byte value. imm8 is a signed number between -128 and ++127 inclusive. For instructions in which imm8 is combined with a word or +doubleword operand, the immediate value is sign-extended to form a word or +doubleword. The upper byte of the word is filled with the topmost bit of the +immediate value. + +imm16: an immediate word value used for instructions whose operand-size +attribute is 16 bits. This is a number between -32768 and +32767 inclusive. + +imm32: an immediate doubleword value used for instructions whose +operand-size attribute is 32-bits. It allows the use of a number between ++2147483647 and -2147483648. + +r/m8: a one-byte operand that is either the contents of a byte register +(AL, BL, CL, DL, AH, BH, CH, DH), or a byte from memory. + +r/m16: a word register or memory operand used for instructions whose +operand-size attribute is 16 bits. The word registers are: AX, BX, CX, DX, +SP, BP, SI, DI. The contents of memory are found at the address provided by +the effective address computation. + +r/m32: a doubleword register or memory operand used for instructions whose +operand-size attribute is 32-bits. The doubleword registers are: EAX, EBX, +ECX, EDX, ESP, EBP, ESI, EDI. The contents of memory are found at the +address provided by the effective address computation. + +m8: a memory byte addressed by DS:SI or ES:DI (used only by string +instructions). + +m16: a memory word addressed by DS:SI or ES:DI (used only by string +instructions). + +m32: a memory doubleword addressed by DS:SI or ES:DI (used only by string +instructions). + +m16:16, M16:32: a memory operand containing a far pointer composed of two +numbers. The number to the left of the colon corresponds to the pointer's +segment selector. The number to the right corresponds to its offset. + +m16 & 32, m16 & 16, m32 & 32: a memory operand consisting of data item pairs +whose sizes are indicated on the left and the right side of the ampersand. +All memory addressing modes are allowed. m16 & 16 and m32 & 32 operands are +used by the BOUND instruction to provide an operand containing an upper and +lower bounds for array indices. m16 & 32 is used by LIDT and LGDT to +provide a word with which to load the limit field, and a doubleword with +which to load the base field of the corresponding Global and Interrupt +Descriptor Table Registers. + +moffs8, moffs16, moffs32: (memory offset) a simple memory variable of type +BYTE, WORD, or DWORD used by some variants of the MOV instruction. The +actual address is given by a simple offset relative to the segment base. No +ModR/M byte is used in the instruction. The number shown with moffs +indicates its size, which is determined by the address-size attribute of the +instruction. + +Sreg: a segment register. The segment register bit assignments are ES=0, +CS=1, SS=2, DS=3, FS=4, and GS=5. + + +17.2.2.3 Clocks + +The "Clocks" column gives the number of clock cycles the instruction takes +to execute. The clock count calculations makes the following assumptions: + + � The instruction has been prefetched and decoded and is ready for + execution. + + � Bus cycles do not require wait states. + + � There are no local bus HOLD requests delaying processor access to the + bus. + + � No exceptions are detected during instruction execution. + + � Memory operands are aligned. + +Clock counts for instructions that have an r/m (register or memory) operand +are separated by a slash. The count to the left is used for a register +operand; the count to the right is used for a memory operand. + +The following symbols are used in the clock count specifications: + + � n, which represents a number of repetitions. + + � m, which represents the number of components in the next instruction + executed, where the entire displacement (if any) counts as one + component, the entire immediate data (if any) counts as one component, + and every other byte of the instruction and prefix(es) each counts as + one component. + + � pm=, a clock count that applies when the instruction executes in + Protected Mode. pm= is not given when the clock counts are the same for + Protected and Real Address Modes. + +When an exception occurs during the execution of an instruction and the +exception handler is in another task, the instruction execution time is +increased by the number of clocks to effect a task switch. This parameter +depends on several factors: + + � The type of TSS used to represent the current task (386 TSS or 286 + TSS). + + � The type of TSS used to represent the new task. + + � Whether the current task is in V86 mode. + + � Whether the new task is in V86 mode. + +Table 17-5 summarizes the task switch times for exceptions. + + +Table 17-5. Task Switch Times for Exceptions + + New Task + +Old 386 TSS 286 TSS +Task VM = 0 + +386 VM = 0 309 282 +TSS + +386 VM = 1 314 231 +TSS + +286 307 282 +TSS + + +17.2.2.4 Description + +The "Description" column following the "Clocks" column briefly explains the +various forms of the instruction. The "Operation" and "Description" sections +contain more details of the instruction's operation. + + +17.2.2.5 Operation + +The "Operation" section contains an algorithmic description of the +instruction which uses a notation similar to the Algol or Pascal language. +The algorithms are composed of the following elements: + +Comments are enclosed within the symbol pairs "(*" and "*)". + +Compound statements are enclosed between the keywords of the "if" statement +(IF, THEN, ELSE, FI) or of the "do" statement (DO, OD), or of the "case" +statement (CASE ... OF, ESAC). + +A register name implies the contents of the register. A register name +enclosed in brackets implies the contents of the location whose address is +contained in that register. For example, ES:[DI] indicates the contents of +the location whose ES segment relative address is in register DI. [SI] +indicates the contents of the address contained in register SI relative to +SI's default segment (DS) or overridden segment. + +Brackets also used for memory operands, where they mean that the contents +of the memory location is a segment-relative offset. For example, [SRC] +indicates that the contents of the source operand is a segment-relative +offset. + +A  B; indicates that the value of B is assigned to A. + +The symbols =, <>, �, and � are relational operators used to compare two +values, meaning equal, not equal, greater or equal, less or equal, +respectively. A relational expression such as A = B is TRUE if the value of +A is equal to B; otherwise it is FALSE. + +The following identifiers are used in the algorithmic descriptions: + + � OperandSize represents the operand-size attribute of the instruction, + which is either 16 or 32 bits. AddressSize represents the address-size + attribute, which is either 16 or 32 bits. For example, + + IF instruction = CMPSW + THEN OperandSize  16; + ELSE + IF instruction = CMPSD + THEN OperandSize  32; + FI; + FI; + +indicates that the operand-size attribute depends on the form of the CMPS +instruction used. Refer to the explanation of address-size and operand-size +attributes at the beginning of this chapter for general guidelines on how +these attributes are determined. + + � StackAddrSize represents the stack address-size attribute associated + with the instruction, which has a value of 16 or 32 bits, as explained + earlier in the chapter. + + � SRC represents the source operand. When there are two operands, SRC is + the one on the right. + + � DEST represents the destination operand. When there are two operands, + DEST is the one on the left. + + � LeftSRC, RightSRC distinguishes between two operands when both are + source operands. + + � eSP represents either the SP register or the ESP register depending on + the setting of the B-bit for the current stack segment. + +The following functions are used in the algorithmic descriptions: + + � Truncate to 16 bits(value) reduces the size of the value to fit in 16 + bits by discarding the uppermost bits as needed. + + � Addr(operand) returns the effective address of the operand (the result + of the effective address calculation prior to adding the segment base). + + � ZeroExtend(value) returns a value zero-extended to the operand-size + attribute of the instruction. For example, if OperandSize = 32, + ZeroExtend of a byte value of -10 converts the byte from F6H to + doubleword with hexadecimal value 000000F6H. If the value passed to + ZeroExtend and the operand-size attribute are the same size, + ZeroExtend returns the value unaltered. + + � SignExtend(value) returns a value sign-extended to the operand-size + attribute of the instruction. For example, if OperandSize = 32, + SignExtend of a byte containing the value -10 converts the byte from + F6H to a doubleword with hexadecimal value FFFFFFF6H. If the value + passed to SignExtend and the operand-size attribute are the same size, + SignExtend returns the value unaltered. + + � Push(value) pushes a value onto the stack. The number of bytes pushed + is determined by the operand-size attribute of the instruction. The + action of Push is as follows: + + IF StackAddrSize = 16 + THEN + IF OperandSize = 16 + THEN + SP  SP - 2; + SS:[SP]  value; (* 2 bytes assigned starting at + byte address in SP *) + ELSE (* OperandSize = 32 *) + SP  SP - 4; + SS:[SP]  value; (* 4 bytes assigned starting at + byte address in SP *) + FI; + ELSE (* StackAddrSize = 32 *) + IF OperandSize = 16 + THEN + ESP  ESP - 2; + SS:[ESP]  value; (* 2 bytes assigned starting at + byte address in ESP*) + ELSE (* OperandSize = 32 *) + ESP  ESP - 4; + SS:[ESP]  value; (* 4 bytes assigned starting at + byte address in ESP*) + FI; + FI; + + � Pop(value) removes the value from the top of the stack and returns it. + The statement EAX  Pop( ); assigns to EAX the 32-bit value that Pop + took from the top of the stack. Pop will return either a word or a + doubleword depending on the operand-size attribute. The action of Pop + is as follows: + + IF StackAddrSize = 16 + THEN + IF OperandSize = 16 + THEN + ret val  SS:[SP]; (* 2-byte value *) + SP  SP + 2; + ELSE (* OperandSize = 32 *) + ret val  SS:[SP]; (* 4-byte value *) + SP  SP + 4; + FI; + ELSE (* StackAddrSize = 32 *) + IF OperandSize = 16 + THEN + ret val  SS:[ESP]; (* 2 bytes value *) + ESP  ESP + 2; + ELSE (* OperandSize = 32 *) + ret val  SS:[ESP]; (* 4 bytes value *) + ESP  ESP + 4; + FI; + FI; + RETURN(ret val); (*returns a word or doubleword*) + + � Bit[BitBase, BitOffset] returns the address of a bit within a bit + string, which is a sequence of bits in memory or a register. Bits are + numbered from low-order to high-order within registers and within + memory bytes. In memory, the two bytes of a word are stored with the + low-order byte at the lower address. + + If the base operand is a register, the offset can be in the range 0..31. + This offset addresses a bit within the indicated register. An example, + "BIT[EAX, 21]," is illustrated in Figure 17-3. + + If BitBase is a memory address, BitOffset can range from -2 gigabits to 2 + gigabits. The addressed bit is numbered (Offset MOD 8) within the byte at + address (BitBase + (BitOffset DIV 8)), where DIV is signed division with + rounding towards negative infinity, and MOD returns a positive number. + This is illustrated in Figure 17-4. + + � I-O-Permission(I-O-Address, width) returns TRUE or FALSE depending on + the I/O permission bitmap and other factors. This function is defined as + follows: + + IF TSS type is 286 THEN RETURN FALSE; FI; + Ptr  [TSS + 66]; (* fetch bitmap pointer *) + BitStringAddr  SHR (I-O-Address, 3) + Ptr; + MaskShift  I-O-Address AND 7; + CASE width OF: + BYTE: nBitMask  1; + WORD: nBitMask  3; + DWORD: nBitMask  15; + ESAC; + mask  SHL (nBitMask, MaskShift); + CheckString  [BitStringAddr] AND mask; + IF CheckString = 0 + THEN RETURN (TRUE); + ELSE RETURN (FALSE); + FI; + + � Switch-Tasks is the task switching function described in Chapter 7. + + +17.2.2.6 Description + +The "Description" section contains further explanation of the instruction's +operation. + + +Figure 17-3. Bit Offset for BIT[EAX, 21] + + 31 21 0 + �袴袴袴袴袴袴袴袴袴袴藁藁袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴敲 + � � � � + 훤袴袴袴袴袴袴袴袴袴袴姦姦袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴袴� +   + 읕컴컴컴컴컴컴컴컴컴횭ITOFFSET = 21컴컴컴컴컴컴컴� + + +Figure 17-4. Memory Bit Indexing + + BIT INDEXING (POSITIVE OFFSET) + + 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 + �袴袴佶佶袴袴袴袴佶袴袴袴袴袴袴袴佶袴袴袴袴袴袴袴敲 + � � � � � � + 훤袴賈賈袴袴袴袴賈袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴袴� + � BITBASE + 1 � BITBASE � BITBASE - 1 � +  � + 읕컴컴컴횽FFSET = 13컴컴컴켸 + + BIT INDEXING (NEGATIVE OFFSET) + + 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0 + �袴袴袴袴袴袴袴袴佶袴袴袴袴袴袴袴佶袴佶佶袴袴袴袴敲 + � � � � � � + 훤袴袴袴袴袴袴袴曲袴袴袴袴袴袴袴賈袴賈賈袴袴袴袴袴� + � BITBASE � BITBASE - 1 � BITBASE - 2 � + �  + 읕컴컴OFFSET = -11컴켸 + + +17.2.2.7 Flags Affected + +The "Flags Affected" section lists the flags that are affected by the +instruction, as follows: + + � If a flag is always cleared or always set by the instruction, the + value is given (0 or 1) after the flag name. Arithmetic and logical + instructions usually assign values to the status flags in the uniform + manner described in Appendix C. Nonconventional assignments are + described in the "Operation" section. + + � The values of flags listed as "undefined" may be changed by the + instruction in an indeterminate manner. + +All flags not listed are unchanged by the instruction. + + +17.2.2.8 Protected Mode Exceptions + +This section lists the exceptions that can occur when the instruction is +executed in 80386 Protected Mode. The exception names are a pound sign (#) +followed by two letters and an optional error code in parentheses. For +example, #GP(0) denotes a general protection exception with an error code of +0. Table 17-6 associates each two-letter name with the corresponding +interrupt number. + +Chapter 9 describes the exceptions and the 80386 state upon entry to the +exception. + +Application programmers should consult the documentation provided with +their operating systems to determine the actions taken when exceptions +occur. + + +Table 17-6. 80386 Exceptions + +Mnemonic Interrupt Description + +#UD 6 Invalid opcode +#NM 7 Coprocessor not available +#DF 8 Double fault +#TS 10 Invalid TSS +#NP 11 Segment or gate not present +#SS 12 Stack fault +#GP 13 General protection fault +#PF 14 Page fault +#MF 16 Math (coprocessor) fault + + +17.2.2.9 Real Address Mode Exceptions + +Because less error checking is performed by the 80386 in Real Address Mode, +this mode has fewer exception conditions. Refer to Chapter 14 for further +information on these exceptions. + + +17.2.2.10 Virtual-8086 Mode Exceptions + +Virtual 8086 tasks provide the ability to simulate Virtual 8086 machines. +Virtual 8086 Mode exceptions are similar to those for the 8086 processor, +but there are some differences. Refer to Chapter 15 for details. + + +AAA 컴 ASCII Adjust after Addition + +Opcode Instruction Clocks Description + +37 AAA 4 ASCII adjust AL after addition + + +Operation + +IF ((AL AND 0FH) > 9) OR (AF = 1) +THEN + AL  (AL + 6) AND 0FH; + AH  AH + 1; + AF  1; + CF  1; +ELSE + CF  0; + AF  0; +FI; + +Description + +Execute AAA only following an ADD instruction that leaves a byte result +in the AL register. The lower nibbles of the operands of the ADD instruction +should be in the range 0 through 9 (BCD digits). In this case, AAA adjusts +AL to contain the correct decimal digit result. If the addition produced a +decimal carry, the AH register is incremented, and the carry and auxiliary +carry flags are set to 1. If there was no decimal carry, the carry and +auxiliary flags are set to 0 and AH is unchanged. In either case, AL is left +with its top nibble set to 0. To convert AL to an ASCII result, follow the +AAA instruction with OR AL, 30H. + +Flags Affected + +AF and CF as described above; OF, SF, ZF, and PF are undefined + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +AAD 컴 ASCII Adjust AX before Division + +Opcode Instruction Clocks Description + +D5 0A AAD 19 ASCII adjust AX before division + + +Operation + +AL  AH * 10 + AL; +AH  0; + +Description + +AAD is used to prepare two unpacked BCD digits (the least-significant +digit in AL, the most-significant digit in AH) for a division operation that +will yield an unpacked result. This is accomplished by setting AL to +AL + (10 * AH), and then setting AH to 0. AX is then equal to the binary +equivalent of the original unpacked two-digit number. + +Flags Affected + +SF, ZF, and PF as described in Appendix C; OF, AF, and CF are undefined + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +AAM 컴 ASCII Adjust AX after Multiply + +Opcode Instruction Clocks Description + +D4 0A AAM 17 ASCII adjust AX after multiply + + +Operation + +AH  AL / 10; +AL  AL MOD 10; + +Description + +Execute AAM only after executing a MUL instruction between two unpacked +BCD digits that leaves the result in the AX register. Because the result is +less than 100, it is contained entirely in the AL register. AAM unpacks the +AL result by dividing AL by 10, leaving the quotient (most-significant +digit) in AH and the remainder (least-significant digit) in AL. + +Flags Affected + +SF, ZF, and PF as described in Appendix C; OF, AF, and CF are undefined + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +AAS 컴 ASCII Adjust AL after Subtraction + +Opcode Instruction Clocks Description + +3F AAS 4 ASCII adjust AL after subtraction + + +Operation + +IF (AL AND 0FH) > 9 OR AF = 1 +THEN + AL  AL - 6; + AL  AL AND 0FH; + AH  AH - 1; + AF  1; + CF  1; +ELSE + CF  0; + AF  0; +FI; + +Description + +Execute AAS only after a SUB instruction that leaves the byte result in the +AL register. The lower nibbles of the operands of the SUB instruction must +have been in the range 0 through 9 (BCD digits). In this case, AAS adjusts +AL so it contains the correct decimal digit result. If the subtraction +produced a decimal carry, the AH register is decremented, and the carry and +auxiliary carry flags are set to 1. If no decimal carry occurred, the carry +and auxiliary carry flags are set to 0, and AH is unchanged. In either case, +AL is left with its top nibble set to 0. To convert AL to an ASCII result, +follow the AAS with OR AL, 30H. + +Flags Affected + +AF and CF as described above; OF, SF, ZF, and PF are undefined + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +ADC 컴 Add with Carry + + +Opcode Instruction Clocks Description + +14 ib ADC AL,imm8 2 Add with carry immediate byte to AL +15 iw ADC AX,imm16 2 Add with carry immediate word to AX +15 id ADC EAX,imm32 2 Add with carry immediate dword to EAX +80 /2 ib ADC r/m8,imm8 2/7 Add with carry immediate byte to r/m + byte +81 /2 iw ADC r/m16,imm16 2/7 Add with carry immediate word to r/m + word +81 /2 id ADC r/m32,imm32 2/7 Add with CF immediate dword to r/m + dword +83 /2 ib ADC r/m16,imm8 2/7 Add with CF sign-extended immediate + byte to r/m word +83 /2 ib ADC r/m32,imm8 2/7 Add with CF sign-extended immediate + byte into r/m dword +10 /r ADC r/m8,r8 2/7 Add with carry byte register to r/m + byte +11 /r ADC r/m16,r16 2/7 Add with carry word register to r/m + word +11 /r ADC r/m32,r32 2/7 Add with CF dword register to r/m dword +12 /r ADC r8,r/m8 2/6 Add with carry r/m byte to byte + register +13 /r ADC r16,r/m16 2/6 Add with carry r/m word to word + register +13 /r ADC r32,r/m32 2/6 Add with CF r/m dword to dword register + + +Operation + +DEST  DEST + SRC + CF; + +Description + +ADC performs an integer addition of the two operands DEST and SRC and the +carry flag, CF. The result of the addition is assigned to the first operand +(DEST), and the flags are set accordingly. ADC is usually executed as part +of a multi-byte or multi-word addition operation. When an immediate byte +value is added to a word or doubleword operand, the immediate value is first +sign-extended to the size of the word or doubleword operand. + +Flags Affected + +OF, SF, ZF, AF, CF, and PF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) if page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +ADD 컴 Add + +Opcode Instruction Clocks Description + +04 ib ADD AL,imm8 2 Add immediate byte to AL +05 iw ADD AX,imm16 2 Add immediate word to AX +05 id ADD EAX,imm32 2 Add immediate dword to EAX +80 /0 ib ADD r/m8,imm8 2/7 Add immediate byte to r/m byte +81 /0 iw ADD r/m16,imm16 2/7 Add immediate word to r/m word +81 /0 id ADD r/m32,imm32 2/7 Add immediate dword to r/m dword +83 /0 ib ADD r/m16,imm8 2/7 Add sign-extended immediate byte + to r/m word +83 /0 ib ADD r/m32,imm8 2/7 Add sign-extended immediate byte + to r/m dword +00 /r ADD r/m8,r8 2/7 Add byte register to r/m byte +01 /r ADD r/m16,r16 2/7 Add word register to r/m word +01 /r ADD r/m32,r32 2/7 Add dword register to r/m dword +02 /r ADD r8,r/m8 2/6 Add r/m byte to byte register +03 /r ADD r16,r/m16 2/6 Add r/m word to word register +03 /r ADD r32,r/m32 2/6 Add r/m dword to dword register + + +Operation + +DEST  DEST + SRC; + +Description + +ADD performs an integer addition of the two operands (DEST and SRC). The +result of the addition is assigned to the first operand (DEST), and the +flags are set accordingly. + +When an immediate byte is added to a word or doubleword operand, the +immediate value is sign-extended to the size of the word or doubleword +operand. + +Flags Affected + +OF, SF, ZF, AF, CF, and PF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +AND 컴 Logical AND + +Opcode Instruction Clocks Description + +24 ib AND AL,imm8 2 AND immediate byte to AL +25 iw AND AX,imm16 2 AND immediate word to AX +25 id AND EAX,imm32 2 AND immediate dword to EAX +80 /4 ib AND r/m8,imm8 2/7 AND immediate byte to r/m byte +81 /4 iw AND r/m16,imm16 2/7 AND immediate word to r/m word +81 /4 id AND r/m32,imm32 2/7 AND immediate dword to r/m dword +83 /4 ib AND r/m16,imm8 2/7 AND sign-extended immediate byte + with r/m word +83 /4 ib AND r/m32,imm8 2/7 AND sign-extended immediate byte + with r/m dword +20 /r AND r/m8,r8 2/7 AND byte register to r/m byte +21 /r AND r/m16,r16 2/7 AND word register to r/m word +21 /r AND r/m32,r32 2/7 AND dword register to r/m dword +22 /r AND r8,r/m8 2/6 AND r/m byte to byte register +23 /r AND r16,r/m16 2/6 AND r/m word to word register +23 /r AND r32,r/m32 2/6 AND r/m dword to dword register + + +Operation + +DEST  DEST AND SRC; +CF  0; +OF  0; + +Description + +Each bit of the result of the AND instruction is a 1 if both corresponding +bits of the operands are 1; otherwise, it becomes a 0. + +Flags Affected + +CF = 0, OF = 0; PF, SF, and ZF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +ARPL 컴 Adjust RPL Field of Selector + +Opcode Instruction Clocks Description + +63 /r ARPL r/m16,r16 pm=20/21 Adjust RPL of r/m16 to not + less than RPL of r16 + + +Operation + +IF RPL bits(0,1) of DEST < RPL bits(0,1) of SRC +THEN + ZF  1; + RPL bits(0,1) of DEST  RPL bits(0,1) of SRC; +ELSE + ZF  0; +FI; + +Description + +The ARPL instruction has two operands. The first operand is a 16-bit +memory variable or word register that contains the value of a selector. The +second operand is a word register. If the RPL field ("requested privilege +level"컴bottom two bits) of the first operand is less than the RPL field of +the second operand, the zero flag is set to 1 and the RPL field of the +first operand is increased to match the second operand. Otherwise, the zero +flag is set to 0 and no change is made to the first operand. + +ARPL appears in operating system software, not in application programs. It +is used to guarantee that a selector parameter to a subroutine does not +request more privilege than the caller is allowed. The second operand of +ARPL is normally a register that contains the CS selector value of the +caller. + +Flags Affected + +ZF as described above + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 6; ARPL is not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +BOUND 컴 Check Array Index Against Bounds + +Opcode Instruction Clocks Description + +62 /r BOUND r16,m16&16 10 Check if r16 is within bounds + (passes test) +62 /r BOUND r32,m32&32 10 Check if r32 is within bounds + (passes test) + + +Operation + +IF (LeftSRC < [RightSRC] OR LeftSRC > [RightSRC + OperandSize/8]) + (* Under lower bound or over upper bound *) +THEN Interrupt 5; +FI; + +Description + +BOUND ensures that a signed array index is within the limits specified by a +block of memory consisting of an upper and a lower bound. Each bound uses +one word for an operand-size attribute of 16 bits and a doubleword for an +operand-size attribute of 32 bits. The first operand (a register) must be +greater than or equal to the first bound in memory (lower bound), and less +than or equal to the second bound in memory (upper bound). If the register +is not within bounds, an Interrupt 5 occurs; the return EIP points to the +BOUND instruction. + +The bounds limit data structure is usually placed just before the array +itself, making the limits addressable via a constant offset from the +beginning of the array. + +Flags Affected + +None + +Protected Mode Exceptions + +Interrupt 5 if the bounds test fails, as described above; #GP(0) for an +illegal memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +The second operand must be a memory operand, not a register. If BOUND is +executed with a ModRM byte representing a register as the second operand, +#UD occurs. + +Real Address Mode Exceptions + +Interrupt 5 if the bounds test fails; Interrupt 13 if any part of the +operand would lie outside of the effective address space from 0 to 0FFFFH; +Interrupt 6 if the second operand is a register + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +BSF 컴 Bit Scan Forward + +Opcode Instruction Clocks Description + +0F BC BSF r16,r/m16 10+3n Bit scan forward on r/m word +0F BC BSF r32,r/m32 10+3n Bit scan forward on r/m dword + + +Notes + + is the number of leading zero bits. + +Operation + +IF r/m = 0 +THEN + ZF  1; + register  UNDEFINED; +ELSE + temp  0; + ZF  0; + WHILE BIT[r/m, temp = 0] + DO + temp  temp + 1; + register  temp; + OD; +FI; + +Description + +BSF scans the bits in the second word or doubleword operand starting with +bit 0. The ZF flag is cleared if the bits are all 0; otherwise, the ZF flag +is set and the destination register is loaded with the bit index of the +first set bit. + +Flags Affected + +ZF as described above + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, ES, +FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +BSR 컴 Bit Scan Reverse + +Opcode Instruction Clocks Description + +0F BD BSR r16,r/m16 10+3n Bit scan reverse on r/m word +0F BD BSR r32,r/m32 10+3n Bit scan reverse on r/m dword + + +Operation + +IF r/m = 0 +THEN + ZF  1; + register  UNDEFINED; +ELSE + temp  OperandSize - 1; + ZF  0; + WHILE BIT[r/m, temp] = 0 + DO + temp  temp - 1; + register  temp; + OD; +FI; + +Description + +BSR scans the bits in the second word or doubleword operand from the most +significant bit to the least significant bit. The ZF flag is cleared if the +bits are all 0; otherwise, ZF is set and the destination register is loaded +with the bit index of the first set bit found when scanning in the reverse +direction. + +Flags Affected + +ZF as described above + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +BT 컴 Bit Test + +Opcode Instruction Clocks Description + +0F A3 BT r/m16,r16 3/12 Save bit in carry flag +0F A3 BT r/m32,r32 3/12 Save bit in carry flag +0F BA /4 ib BT r/m16,imm8 3/6 Save bit in carry flag +0F BA /4 ib BT r/m32,imm8 3/6 Save bit in carry flag + + +Operation + +CF  BIT[LeftSRC, RightSRC]; + +Description + +BT saves the value of the bit indicated by the base (first operand) and the +bit offset (second operand) into the carry flag. + +Flags Affected + +CF as described above + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, ES, +FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +The index of the selected bit can be given by the immediate constant in the +instruction or by a value in a general register. Only an 8-bit immediate +value is used in the instruction. This operand is taken modulo 32, so the +range of immediate bit offsets is 0..31. This allows any bit within a +register to be selected. For memory bit strings, this immediate field gives +only the bit offset within a word or doubleword. Immediate bit offsets +larger than 31 are supported by using the immediate bit offset field in +combination with the displacement field of the memory operand. The low-order +3 to 5 bits of the immediate bit offset are stored in the immediate bit +offset field, and the high-order 27 to 29 bits are shifted and combined with +the byte displacement in the addressing mode. + +When accessing a bit in memory, the 80386 may access four bytes starting +from the memory address given by: + + Effective Address + (4 * (BitOffset DIV 32)) + +for a 32-bit operand size, or two bytes starting from the memory address +given by: + + Effective Address + (2 * (BitOffset DIV 16)) + +for a 16-bit operand size. It may do so even when only a single byte needs +to be accessed in order to reach the given bit. You must therefore avoid +referencing areas of memory close to address space holes. In particular, +avoid references to memory-mapped I/O registers. Instead, use the MOV +instructions to load from or store to these addresses, and use the register +form of these instructions to manipulate the data. + + +BTC 컴 Bit Test and Complement + +Opcode Instruction Clocks Description + +0F BB BTC r/m16,r16 6/13 Save bit in carry flag and complement +0F BB BTC r/m32,r32 6/13 Save bit in carry flag and complement +0F BA /7 ib BTC r/m16,imm8 6/8 Save bit in carry flag and complement +0F BA /7 ib BTC r/m32,imm8 6/8 Save bit in carry flag and complement + + +Operation + +CF  BIT[LeftSRC, RightSRC]; +BIT[LeftSRC, RightSRC]  NOT BIT[LeftSRC, RightSRC]; + +Description + +BTC saves the value of the bit indicated by the base (first operand) and the +bit offset (second operand) into the carry flag and then complements the +bit. + +Flags Affected + +CF as described above + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +The index of the selected bit can be given by the immediate constant in the +instruction or by a value in a general register. Only an 8-bit immediate +value is used in the instruction. This operand is taken modulo 32, so the +range of immediate bit offsets is 0..31. This allows any bit within a +register to be selected. For memory bit strings, this immediate field gives +only the bit offset within a word or doubleword. Immediate bit offsets +larger than 31 are supported by using the immediate bit offset field in +combination with the displacement field of the memory operand. The low-order +3 to 5 bits of the immediate bit offset are stored in the immediate bit +offset field, and the high-order 27 to 29 bits are shifted and combined with +the byte displacement in the addressing mode. + +When accessing a bit in memory, the 80386 may access four bytes starting +from the memory address given by: + + Effective Address + (4 * (BitOffset DIV 32)) + +for a 32-bit operand size, or two bytes starting from the memory address +given by: + + Effective Address + (2 * (BitOffset DIV 16)) + +for a 16-bit operand size. It may do so even when only a single byte needs +to be accessed in order to reach the given bit. You must therefore avoid +referencing areas of memory close to address space holes. In particular, +avoid references to memory-mapped I/O registers. Instead, use the MOV +instructions to load from or store to these addresses, and use the register +form of these instructions to manipulate the data. + + +BTR 컴 Bit Test and Reset + +Opcode Instruction Clocks Description + +0F B3 BTR r/m16,r16 6/13 Save bit in carry flag and reset +0F B3 BTR r/m32,r32 6/13 Save bit in carry flag and reset +0F BA /6 ib BTR r/m16,imm8 6/8 Save bit in carry flag and reset +0F BA /6 ib BTR r/m32,imm8 6/8 Save bit in carry flag and reset + + +Operation + +CF  BIT[LeftSRC, RightSRC]; +BIT[LeftSRC, RightSRC]  0; + +Description + +BTR saves the value of the bit indicated by the base (first operand) and the +bit offset (second operand) into the carry flag and then stores 0 in the +bit. + +Flags Affected + +CF as described above + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +The index of the selected bit can be given by the immediate constant in the +instruction or by a value in a general register. Only an 8-bit immediate +value is used in the instruction. This operand is taken modulo 32, so the +range of immediate bit offsets is 0..31. This allows any bit within a +register to be selected. For memory bit strings, this immediate field gives +only the bit offset within a word or doubleword. Immediate bit offsets +larger than 31 (or 15) are supported by using the immediate bit offset field +in combination with the displacement field of the memory operand. The +low-order 3 to 5 bits of the immediate bit offset are stored in the +immediate bit offset field, and the high-order 27 to 29 bits are shifted and +combined with the byte displacement in the addressing mode. + +When accessing a bit in memory, the 80386 may access four bytes starting +from the memory address given by: + + Effective Address + 4 * (BitOffset DIV 32) + +for a 32-bit operand size, or two bytes starting from the memory address +given by: + + Effective Address + 2 * (BitOffset DIV 16) + +for a 16-bit operand size. It may do so even when only a single byte needs +to be accessed in order to reach the given bit. You must therefore avoid +referencing areas of memory close to address space holes. In particular, +avoid references to memory-mapped I/O registers. Instead, use the MOV +instructions to load from or store to these addresses, and use the register +form of these instructions to manipulate the data. + + +BTS 컴 Bit Test and Set + +Opcode Instruction Clocks Description + +0F AB BTS r/m16,r16 6/13 Save bit in carry flag and set +0F AB BTS r/m32,r32 6/13 Save bit in carry flag and set +0F BA /5 ib BTS r/m16,imm8 6/8 Save bit in carry flag and set +0F BA /5 ib BTS r/m32,imm8 6/8 Save bit in carry flag and set + + +Operation + +CF  BIT[LeftSRC, RightSRC]; +BIT[LeftSRC, RightSRC]  1; + +Description + +BTS saves the value of the bit indicated by the base (first operand) and the +bit offset (second operand) into the carry flag and then stores 1 in the +bit. + +Flags Affected + +CF as described above + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +The index of the selected bit can be given by the immediate constant in the +instruction or by a value in a general register. Only an 8-bit immediate +value is used in the instruction. This operand is taken modulo 32, so the +range of immediate bit offsets is 0..31. This allows any bit within a +register to be selected. For memory bit strings, this immediate field gives +only the bit offset within a word or doubleword. Immediate bit offsets +larger than 31 are supported by using the immediate bit offset field in +combination with the displacement field of the memory operand. The +low-order 3 to 5 bits of the immediate bit offset are stored in the +immediate bit offset field, and the high order 27 to 29 bits are shifted and +combined with the byte displacement in the addressing mode. + +When accessing a bit in memory, the processor may access four bytes starting +from the memory address given by: + + Effective Address + (4 * (BitOffset DIV 32)) + +for a 32-bit operand size, or two bytes starting from the memory address +given by: + + Effective Address + (2 * (BitOffset DIV 16)) + +for a 16-bit operand size. It may do this even when only a single byte needs +to be accessed in order to get at the given bit. Thus the programmer must be +careful to avoid referencing areas of memory close to address space holes. +In particular, avoid references to memory-mapped I/O registers. Instead, use +the MOV instructions to load from or store to these addresses, and use the +register form of these instructions to manipulate the data. + + +CALL 컴 Call Procedure + + +Opcode Instruction Clocks + Values of ts are given by the following table: + + New Task + 386 TSS 386 TSS 286 TSS + Old VM = 0 VM = 1 + Task Via Task Gate? + + N Y N Y N Y + +386 300 309 217 226 273 282 +TSS VM=0 + +286 298 307 217 226 273 282 +TSS Description + +E8 cw CALL rel16 7+m Call near, displacement relative + to next instruction +FF /2 CALL r/m16 7+m/10+m Call near, register + indirect/memory indirect +9A cd CALL ptr16:16 17+m,pm=34+m Call intersegment, to full + pointer given +9A cd CALL ptr16:16 pm=52+m Call gate, same privilege +9A cd CALL ptr16:16 pm=86+m Call gate, more privilege, no + parameters +9A cd CALL ptr16:16 pm=94+4x+m Call gate, more privilege, x + parameters +9A cd CALL ptr16:16 ts Call to task +FF /3 CALL m16:16 22+m,pm=38+m Call intersegment, address at + r/m dword +FF /3 CALL m16:16 pm=56+m Call gate, same privilege +FF /3 CALL m16:16 pm=90+m Call gate, more privilege, no + parameters +FF /3 CALL m16:16 pm=98+4x+m Call gate, more privilege, x + parameters +FF /3 CALL m16:16 5 + ts Call to task +E8 cd CALL rel32 7+m Call near, displacement relative + to next instruction +FF /2 CALL r/m32 7+m/10+m Call near, indirect +9A cp CALL ptr16:32 17+m,pm=34+m Call intersegment, to full + pointer given +9A cp CALL ptr16:32 pm=52+m Call gate, same privilege +9A cp CALL ptr16:32 pm=86+m Call gate, more privilege, no + parameters +9A cp CALL ptr32:32 pm=94+4x+m Call gate, more privilege, x + parameters +9A cp CALL ptr16:32 ts Call to task +FF /3 CALL m16:32 22+m,pm=38+m Call intersegment, address at + r/m dword +FF /3 CALL m16:32 pm=56+m Call gate, same privilege +FF /3 CALL m16:32 pm=90+m Call gate, more privilege, no + parameters +FF /3 CALL m16:32 pm=98+4x+m Call gate, more privilege, x + parameters +FF /3 CALL m16:32 5 + ts Call to task + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE: + Values of ts are given by the following table: + + New Task + 386 TSS 386 TSS 286 TSS + Old VM = 0 VM = 1 + Task Via Task Gate? + + N Y N Y N Y + +386 300 309 217 226 273 282 +TSS VM=0 + +286 298 307 217 226 273 282 +TSS +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF rel16 or rel32 type of call +THEN (* near relative call *) + IF OperandSize = 16 + THEN + Push(IP); + EIP  (EIP + rel16) AND 0000FFFFH; + ELSE (* OperandSize = 32 *) + Push(EIP); + EIP  EIP + rel32; + FI; +FI; + +IF r/m16 or r/m32 type of call +THEN (* near absolute call *) + IF OperandSize = 16 + THEN + Push(IP); + EIP  [r/m16] AND 0000FFFFH; + ELSE (* OperandSize = 32 *) + Push(EIP); + EIP  [r/m32]; + FI; +FI; + +IF (PE = 0 OR (PE = 1 AND VM = 1)) +(* real mode or virtual 8086 mode *) + AND instruction = far CALL + (* i.e., operand type is m16:16, m16:32, ptr16:16, ptr16:32 *) +THEN + IF OperandSize = 16 + THEN + Push(CS); + Push(IP); (* address of next instruction; 16 bits *) + ELSE + Push(CS); (* padded with 16 high-order bits *) + Push(EIP); (* address of next instruction; 32 bits *) + FI; + IF operand type is m16:16 or m16:32 + THEN (* indirect far call *) + IF OperandSize = 16 + THEN + CS:IP  [m16:16]; + EIP  EIP AND 0000FFFFH; (* clear upper 16 bits *) + ELSE (* OperandSize = 32 *) + CS:EIP  [m16:32]; + FI; + FI; + IF operand type is ptr16:16 or ptr16:32 + THEN (* direct far call *) + IF OperandSize = 16 + THEN + CS:IP  ptr16:16; + EIP  EIP AND 0000FFFFH; (* clear upper 16 bits *) + ELSE (* OperandSize = 32 *) + CS:EIP  ptr16:32; + FI; + FI; +FI; + +IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *) + AND instruction = far CALL +THEN + If indirect, then check access of EA doubleword; + #GP(0) if limit violation; + New CS selector must not be null else #GP(0); + Check that new CS selector index is within its + descriptor table limits; else #GP(new CS selector); + Examine AR byte of selected descriptor for various legal values; + depending on value: + go to CONFORMING-CODE-SEGMENT; + go to NONCONFORMING-CODE-SEGMENT; + go to CALL-GATE; + go to TASK-GATE; + go to TASK-STATE-SEGMENT; + ELSE #GP(code segment selector); +FI; + +CONFORMING-CODE-SEGMENT: + DPL must be � CPL ELSE #GP(code segment selector); + Segment must be present ELSE #NP(code segment selector); + Stack must be big enough for return address ELSE #SS(0); + Instruction pointer must be in code segment limit ELSE #GP(0); + Load code segment descriptor into CS register; + Load CS with new code segment selector; + Load EIP with zero-extend(new offset); + IF OperandSize=16 THEN EIP  EIP AND 0000FFFFH; FI; + +NONCONFORMING-CODE-SEGMENT: + RPL must be � CPL ELSE #GP(code segment selector) + DPL must be = CPL ELSE #GP(code segment selector) + Segment must be present ELSE #NP(code segment selector) + Stack must be big enough for return address ELSE #SS(0) + Instruction pointer must be in code segment limit ELSE #GP(0) + Load code segment descriptor into CS register + Load CS with new code segment selector + Set RPL of CS to CPL + Load EIP with zero-extend(new offset); + IF OperandSize=16 THEN EIP  EIP AND 0000FFFFH; FI; + +CALL-GATE: + Call gate DPL must be � CPL ELSE #GP(call gate selector) + Call gate DPL must be � RPL ELSE #GP(call gate selector) + Call gate must be present ELSE #NP(call gate selector) + Examine code segment selector in call gate descriptor: + Selector must not be null ELSE #GP(0) + Selector must be within its descriptor table + limits ELSE #GP(code segment selector) + AR byte of selected descriptor must indicate code + segment ELSE #GP(code segment selector) + DPL of selected descriptor must be � CPL ELSE + #GP(code segment selector) + IF non-conforming code segment AND DPL < CPL + THEN go to MORE-PRIVILEGE + ELSE go to SAME-PRIVILEGE + FI; + +MORE-PRIVILEGE: + Get new SS selector for new privilege level from TSS + Check selector and descriptor for new SS: + Selector must not be null ELSE #TS(0) + Selector index must be within its descriptor + table limits ELSE #TS(SS selector) + Selector's RPL must equal DPL of code segment + ELSE #TS(SS selector) + Stack segment DPL must equal DPL of code + segment ELSE #TS(SS selector) + Descriptor must indicate writable data segment + ELSE #TS(SS selector) + Segment present ELSE #SS(SS selector) + IF OperandSize=32 + THEN + New stack must have room for parameters plus 16 bytes + ELSE #SS(0) + EIP must be in code segment limit ELSE #GP(0) + Load new SS:eSP value from TSS + Load new CS:EIP value from gate + ELSE + New stack must have room for parameters plus 8 bytes ELSE #SS(0) + IP must be in code segment limit ELSE #GP(0) + Load new SS:eSP value from TSS + Load new CS:IP value from gate + FI; + Load CS descriptor + Load SS descriptor + Push long pointer of old stack onto new stack + Get word count from call gate, mask to 5 bits + Copy parameters from old stack onto new stack + Push return address onto new stack + Set CPL to stack segment DPL + Set RPL of CS to CPL + +SAME-PRIVILEGE: + IF OperandSize=32 + THEN + Stack must have room for 6-byte return address (padded to 8 bytes) + ELSE #SS(0) + EIP must be within code segment limit ELSE #GP(0) + Load CS:EIP from gate + ELSE + Stack must have room for 4-byte return address ELSE #SS(0) + IP must be within code segment limit ELSE #GP(0) + Load CS:IP from gate + FI; + Push return address onto stack + Load code segment descriptor into CS register + Set RPL of CS to CPL + +TASK-GATE: + Task gate DPL must be � CPL ELSE #TS(gate selector) + Task gate DPL must be � RPL ELSE #TS(gate selector) + Task Gate must be present ELSE #NP(gate selector) + Examine selector to TSS, given in Task Gate descriptor: + Must specify global in the local/global bit ELSE #TS(TSS selector) + Index must be within GDT limits ELSE #TS(TSS selector) + TSS descriptor AR byte must specify nonbusy TSS + ELSE #TS(TSS selector) + Task State Segment must be present ELSE #NP(TSS selector) + SWITCH-TASKS (with nesting) to TSS + IP must be in code segment limit ELSE #TS(0) + +TASK-STATE-SEGMENT: + TSS DPL must be � CPL else #TS(TSS selector) + TSS DPL must be � RPL ELSE #TS(TSS selector) + TSS descriptor AR byte must specify available TSS + ELSE #TS(TSS selector) + Task State Segment must be present ELSE #NP(TSS selector) + SWITCH-TASKS (with nesting) to TSS + IP must be in code segment limit ELSE #TS(0) + +Description + +The CALL instruction causes the procedure named in the operand to be +executed. When the procedure is complete (a return instruction is executed +within the procedure), execution continues at the instruction that follows +the CALL instruction. + +The action of the different forms of the instruction are described below. + +Near calls are those with destinations of type r/m16, r/m32, rel16, rel32; +changing or saving the segment register value is not necessary. The CALL +rel16 and CALL rel32 forms add a signed offset to the address of the +instruction following CALL to determine the destination. The rel16 form is +used when the instruction's operand-size attribute is 16 bits; rel32 is used +when the operand-size attribute is 32 bits. The result is stored in the +32-bit EIP register. With rel16, the upper 16 bits of EIP are cleared, +resulting in an offset whose value does not exceed 16 bits. CALL r/m16 and +CALL r/m32 specify a register or memory location from which the absolute +segment offset is fetched. The offset fetched from r/m is 32 bits for an +operand-size attribute of 32 (r/m32), or 16 bits for an operand-size of 16 +(r/m16). The offset of the instruction following CALL is pushed onto the +stack. It will be popped by a near RET instruction within the procedure. The +CS register is not changed by this form of CALL. + +The far calls, CALL ptr16:16 and CALL ptr16:32, use a four-byte or six-byte +operand as a long pointer to the procedure called. The CALL m16:16 and +m16:32 forms fetch the long pointer from the memory location +specified (indirection). In Real Address Mode or Virtual 8086 Mode, the long +pointer provides 16 bits for the CS register and 16 or 32 bits for the EIP +register (depending on the operand-size attribute). These forms of the +instruction push both CS and IP or EIP as a return address. + +In Protected Mode, both long pointer forms consult the AR byte in the +descriptor indexed by the selector part of the long pointer. Depending on +the value of the AR byte, the call will perform one of the following types +of control transfers: + + � A far call to the same protection level + � An inter-protection level far call + � A task switch + +For more information on Protected Mode control transfers, refer to +Chapter 6 and Chapter 7. + +Flags Affected + +All flags are affected if a task switch occurs; no flags are affected if a +task switch does not occur + +Protected Mode Exceptions + +For far calls: #GP, #NP, #SS, and #TS, as indicated in the list above + +For near direct calls: #GP(0) if procedure location is beyond the code +segment limits; #SS(0) if pushing the return address exceeds the bounds of +the stack segment; #PF (fault-code) for a page fault + +For a near indirect call: #GP(0) for an illegal memory operand effective +address in the CS, DS, ES, FS, or GS segments; #SS(0) for an illegal address +in the SS segment; #GP(0) if the indirect offset obtained is beyond the code +segment limits; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +Any far call from a 32-bit code segment to 16-bit code segments should be +made from the first 64K bytes of the 32-bit code segment, since the +operand-size attribute of the instruction is set to 16, thus allowing only a +16-bit return address offset to be saved. + + +CBW/CWDE 컴 Convert Byte to Word/Convert Word to Doubleword + +Opcode Instruction Clocks Description + +98 CBW 3 AX  sign-extend of AL +98 CWDE 3 EAX  sign-extend of AX + + +Operation + +IF OperandSize = 16 (* instruction = CBW *) +THEN AX  SignExtend(AL); +ELSE (* OperandSize = 32, instruction = CWDE *) + EAX  SignExtend(AX); +FI; + +Description + +CBW converts the signed byte in AL to a signed word in AX by extending the +most significant bit of AL (the sign bit) into all of the bits of AH. CWDE +converts the signed word in AX to a doubleword in EAX by extending the most +significant bit of AX into the two most significant bytes of EAX. Note that +CWDE is different from CWD. CWD uses DX:AX rather than EAX as a destination. + +Flags Affected + +None + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +CLC 컴 Clear Carry Flag + +Opcode Instruction Clocks Description + +F8 CLC 2 Clear carry flag + + +Operation + +CF  0; + +Description + +CLC sets the carry flag to zero. It does not affect other flags or +registers. + +Flags Affected + +CF = 0 + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +CLD 컴 Clear Direction Flag + +Opcode Instruction Clocks Description + +FC CLD 2 Clear direction flag; SI and DI + will increment during string + instructions + + +Operation + +DF  0; + +Description + +CLD clears the direction flag. No other flags or registers are affected. +After CLD is executed, string operations will increment the index registers +(SI and/or DI) that they use. + +Flags Affected + +DF = 0 + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +CLI 컴 Clear Interrupt Flag + +Opcode Instruction Clocks Description + +FA CLI 3 Clear interrupt flag; interrupts disabled + + +Operation + +IF  0; + +Description + +CLI clears the interrupt flag if the current privilege level is at least as +privileged as IOPL. No other flags are affected. External interrupts are not +recognized at the end of the CLI instruction or from that point on until the +interrupt flag is set. + +Flags Affected + +IF = 0 + +Protected Mode Exceptions + +#GP(0) if the current privilege level is greater (has less privilege) than +the IOPL in the flags register. IOPL specifies the least privileged level at +which I/O can be performed. + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +#GP(0) as for Protected Mode + + +CLTS 컴 Clear Task-Switched Flag in CR0 + +Opcode Instruction Clocks Description + +OF 06 CLTS 5 Clear task-switched flag + + +Operation + +TS Flag in CR0  0; + +Description + +CLTS clears the task-switched (TS) flag in register CR0. This flag is set by +the 80386 every time a task switch occurs. The TS flag is used to manage +processor extensions as follows: + + � Every execution of an ESC instruction is trapped if the TS flag is set. + + � Execution of a WAIT instruction is trapped if the MP flag and the TS + flag are both set. + +Thus, if a task switch was made after an ESC instruction was begun, the +processor extension's context may need to be saved before a new ESC +instruction can be issued. The fault handler saves the context and resets +the TS flag. + +CLTS appears in operating system software, not in application programs. It +is a privileged instruction that can only be executed at privilege level 0. + +Flags Affected + +TS = 0 (TS is in CR0, not the flag register) + +Protected Mode Exceptions + +#GP(0) if CLTS is executed with a current privilege level other than 0 + +Real Address Mode Exceptions + +None (valid in Real Address Mode to allow initialization for Protected +Mode) + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + + +CMC 컴 Complement Carry Flag + +Opcode Instruction Clocks Description + +F5 CMC 2 Complement carry flag + + +Operation + +CF  NOT CF; + +Description + +CMC reverses the setting of the carry flag. No other flags are affected. + +Flags Affected + +CF as described above + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +CMP 컴 Compare Two Operands + + +Opcode Instruction Clocks Description + +3C ib CMP AL,imm8 2 Compare immediate byte to AL +3D iw CMP AX,imm16 2 Compare immediate word to AX +3D id CMP EAX,imm32 2 Compare immediate dword to EAX +80 /7 ib CMP r/m8,imm8 2/5 Compare immediate byte to r/m + byte +81 /7 iw CMP r/m16,imm16 2/5 Compare immediate word to r/m + word +81 /7 id CMP r/m32,imm32 2/5 Compare immediate dword to r/m + dword +83 /7 ib CMP r/m16,imm8 2/5 Compare sign extended immediate + byte to r/m word +83 /7 ib CMP r/m32,imm8 2/5 Compare sign extended immediate + byte to r/m dword +38 /r CMP r/m8,r8 2/5 Compare byte register to r/m + byte +39 /r CMP r/m16,r16 2/5 Compare word register to r/m + word +39 /r CMP r/m32,r32 2/5 Compare dword register to r/m + dword +3A /r CMP r8,r/m8 2/6 Compare r/m byte to byte + register +3B /r CMP r16,r/m16 2/6 Compare r/m word to word + register +3B /r CMP r32,r/m32 2/6 Compare r/m dword to dword + register + + +Operation + +LeftSRC - SignExtend(RightSRC); +(* CMP does not store a result; its purpose is to set the flags *) + +Description + +CMP subtracts the second operand from the first but, unlike the SUB +instruction, does not store the result; only the flags are changed. CMP is +typically used in conjunction with conditional jumps and the SETcc +instruction. (Refer to Appendix D for the list of signed and unsigned flag +tests provided.) If an operand greater than one byte is compared to an +immediate byte, the byte value is first sign-extended. + +Flags Affected + +OF, SF, ZF, AF, PF, and CF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, ES, +FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +CMPS/CMPSB/CMPSW/CMPSD 컴 Compare String Operands + +Opcode Instruction Clocks Description + +A6 CMPS m8,m8 10 Compare bytes ES:[(E)DI] (second + operand) with [(E)SI] (first + operand) +A7 CMPS m16,m16 10 Compare words ES:[(E)DI] (second + operand) with [(E)SI] (first + operand) +A7 CMPS m32,m32 10 Compare dwords ES:[(E)DI] + (second operand) with [(E)SI] + (first operand) +A6 CMPSB 10 Compare bytes ES:[(E)DI] with + DS:[SI] +A7 CMPSW 10 Compare words ES:[(E)DI] with + DS:[SI] +A7 CMPSD 10 Compare dwords ES:[(E)DI] with + DS:[SI] + + +Operation + +IF (instruction = CMPSD) OR + (instruction has operands of type DWORD) +THEN OperandSize  32; +ELSE OperandSize  16; +FI; +IF AddressSize = 16 +THEN + use SI for source-index and DI for destination-index +ELSE (* AddressSize = 32 *) + use ESI for source-index and EDI for destination-index; +FI; +IF byte type of instruction +THEN + [source-index] - [destination-index]; (* byte comparison *) + IF DF = 0 THEN IncDec  1 ELSE IncDec  -1; FI; +ELSE + IF OperandSize = 16 + THEN + [source-index] - [destination-index]; (* word comparison *) + IF DF = 0 THEN IncDec  2 ELSE IncDec  -2; FI; + ELSE (* OperandSize = 32 *) + [source-index] - [destination-index]; (* dword comparison *) + IF DF = 0 THEN IncDec  4 ELSE IncDec  -4; FI; + FI; +FI; +source-index = source-index + IncDec; +destination-index = destination-index + IncDec; + +Description + +CMPS compares the byte, word, or doubleword pointed to by the source-index +register with the byte, word, or doubleword pointed to by the +destination-index register. + +If the address-size attribute of this instruction is 16 bits, SI and DI +will be used for source- and destination-index registers; otherwise ESI and +EDI will be used. Load the correct index values into SI and DI (or ESI and +EDI) before executing CMPS. + +The comparison is done by subtracting the operand indexed by +the destination-index register from the operand indexed by the source-index +register. + +Note that the direction of subtraction for CMPS is [SI] - [DI] or +[ESI] - [EDI]. The left operand (SI or ESI) is the source and the right +operand (DI or EDI) is the destination. This is the reverse of the usual +Intel convention in which the left operand is the destination and the right +operand is the source. + +The result of the subtraction is not stored; only the flags reflect the +change. The types of the operands determine whether bytes, words, or +doublewords are compared. For the first operand (SI or ESI), the DS register +is used, unless a segment override byte is present. The second operand (DI +or EDI) must be addressable from the ES register; no segment override is +possible. + +After the comparison is made, both the source-index register and +destination-index register are automatically advanced. If the direction flag +is 0 (CLD was executed), the registers increment; if the direction flag is 1 +(STD was executed), the registers decrement. The registers increment or +decrement by 1 if a byte is compared, by 2 if a word is compared, or by 4 if +a doubleword is compared. + +CMPSB, CMPSW and CMPSD are synonyms for the byte, word, and +doubleword CMPS instructions, respectively. + +CMPS can be preceded by the REPE or REPNE prefix for block comparison of CX +or ECX bytes, words, or doublewords. Refer to the description of the REP +instruction for more information on this operation. + +Flags Affected + +OF, SF, ZF, AF, PF, and CF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, ES, +FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF (fault-code) for a page fault + + +CWD/CDQ 컴 Convert Word to Doubleword/Convert Doubleword to + Quadword + +Opcode Instruction Clocks Description + +99 CWD 2 DX:AX  sign-extend of AX +99 CDQ 2 EDX:EAX  sign-extend of EAX + + +Operation + +IF OperandSize = 16 (* CWD instruction *) +THEN + IF AX < 0 THEN DX  0FFFFH; ELSE DX  0; FI; +ELSE (* OperandSize = 32, CDQ instruction *) + IF EAX < 0 THEN EDX  0FFFFFFFFH; ELSE EDX  0; FI; +FI; + +Description + +CWD converts the signed word in AX to a signed doubleword in DX:AX +by extending the most significant bit of AX into all the bits of DX. CDQ +converts the signed doubleword in EAX to a signed 64-bit integer in the +register pair EDX:EAX by extending the most significant bit of EAX +(the sign bit) into all the bits of EDX. Note that CWD is different from +CWDE. CWDE uses EAX as a destination, instead of DX:AX. + +Flags Affected + +None + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +DAA 컴 Decimal Adjust AL after Addition + +Opcode Instruction Clocks Description + +27 DAA 4 Decimal adjust AL after addition + + +Operation + +IF ((AL AND 0FH) > 9) OR (AF = 1) +THEN + AL  AL + 6; + AF  1; +ELSE + AF  0; +FI; +IF (AL > 9FH) OR (CF = 1) +THEN + AL  AL + 60H; + CF  1; +ELSE CF  0; +FI; + +Description + +Execute DAA only after executing an ADD instruction that leaves a +two-BCD-digit byte result in the AL register. The ADD operands should +consist of two packed BCD digits. The DAA instruction adjusts AL to +contain the correct two-digit packed decimal result. + +Flags Affected + +AF and CF as described above; SF, ZF, PF, and CF as described in +Appendix C. + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +DAS 컴 Decimal Adjust AL after Subtraction + +Opcode Instruction Clocks Description + +2F DAS 4 Decimal adjust AL after subtraction + + +Operation + +IF (AL AND 0FH) > 9 OR AF = 1 +THEN + AL  AL - 6; + AF  1; +ELSE + AF  0; +FI; +IF (AL > 9FH) OR (CF = 1) +THEN + AL  AL - 60H; + CF  1; +ELSE CF  0; +FI; + +Description + +Execute DAS only after a subtraction instruction that leaves a +two-BCD-digit byte result in the AL register. The operands should consist +of two packed BCD digits. DAS adjusts AL to contain the correct packed +two-digit decimal result. + +Flags Affected + +AF and CF as described above; SF, ZF, and PF as described in Appendix C. + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +DEC 컴 Decrement by 1 + +Opcode Instruction Clocks Description + +FE /1 DEC r/m8 2/6 Decrement r/m byte by 1 +FF /1 DEC r/m16 2/6 Decrement r/m word by 1 + DEC r/m32 2/6 Decrement r/m dword by 1 +48+rw DEC r16 2 Decrement word register by 1 +48+rw DEC r32 2 Decrement dword register by 1 + + +Operation + +DEST  DEST - 1; + +Description + +DEC subtracts 1 from the operand. DEC does not change the carry flag. +To affect the carry flag, use the SUB instruction with an immediate +operand of 1. + +Flags Affected + +OF, SF, ZF, AF, and PF as described in Appendix C. + +Protected Mode Exceptions + +#GP(0) if the result is a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +DIV 컴 Unsigned Divide + +Opcode Instruction Clocks Description + +F6 /6 DIV AL,r/m8 14/17 Unsigned divide AX by r/m byte + (AL=Quo, AH=Rem) +F7 /6 DIV AX,r/m16 22/25 Unsigned divide DX:AX by r/m + word (AX=Quo, DX=Rem) +F7 /6 DIV EAX,r/m32 38/41 Unsigned divide EDX:EAX by r/m + dword (EAX=Quo, EDX=Rem) + + +Operation + +temp  dividend / divisor; +IF temp does not fit in quotient +THEN Interrupt 0; +ELSE + quotient  temp; + remainder  dividend MOD (r/m); +FI; + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +Note: + Divisions are unsigned. The divisor is given by the r/m operand. + The dividend, quotient, and remainder use implicit registers. Refer to + the table under "Description." +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Description + +DIV performs an unsigned division. The dividend is implicit; only the +divisor is given as an operand. The remainder is always less than the +divisor. The type of the divisor determines which registers to use as +follows: + + Size Dividend Divisor Quotient Remainder + byte AX r/m8 AL AH + word DX:AX r/m16 AX DX + dword EDX:EAX r/m32 EAX EDX + +Flags Affected + +OF, SF, ZF, AR, PF, CF are undefined. + +Protected Mode Exceptions + +Interrupt 0 if the quotient is too large to fit in the designated register +(AL, AX, or EAX), or if the divisor is 0; #GP(0) for an illegal memory +operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) +for an illegal address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 0 if the quotient is too big to fit in the designated register +(AL, AX, or EAX), or if the divisor is 0; Interrupt 13 if any part of the +operand would lie outside of the effective address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +ENTER 컴 Make Stack Frame for Procedure Parameters + +Opcode Instruction Clocks Description + +C8 iw 00 ENTER imm16,0 10 Make procedure stack frame +C8 iw 01 ENTER imm16,1 12 Make stack frame for procedure + parameters +C8 iw ib ENTER imm16,imm8 15+4(n-1) Make stack frame for + procedure parameters + + +Operation + +level  level MOD 32 +IF OperandSize = 16 THEN Push(BP) ELSE Push (EBP) FI; + (* Save stack pointer *) +frame-ptr  eSP +IF level > 0 +THEN (* level is rightmost parameter *) + FOR i  1 TO level - 1 + DO + IF OperandSize = 16 + THEN + BP  BP - 2; + Push[BP] + ELSE (* OperandSize = 32 *) + EBP  EBP - 4; + Push[EBP]; + FI; + OD; + Push(frame-ptr) +FI; +IF OperandSize = 16 THEN BP  frame-ptr ELSE EBP  frame-ptr; FI; +IF StackAddrSize = 16 +THEN SP  SP - First operand; +ELSE ESP  ESP - ZeroExtend(First operand); +FI; + +Description + +ENTER creates the stack frame required by most block-structured +high-level languages. The first operand specifies the number of bytes of +dynamic storage allocated on the stack for the routine being entered. +The second operand gives the lexical nesting level (0 to 31) of the routine +within the high-level language source code. It determines the number of +stack frame pointers copied into the new stack frame from the preceding +frame. BP (or EBP, if the operand-size attribute is 32 bits) is the current +stack frame pointer. + +If the operand-size attribute is 16 bits, the processor uses BP as the +frame pointer and SP as the stack pointer. If the operand-size attribute is +32 bits, the processor uses EBP for the frame pointer and ESP for the stack +pointer. + +If the second operand is 0, ENTER pushes the frame pointer (BP or +EBP) onto the stack; ENTER then subtracts the first operand from the +stack pointer and sets the frame pointer to the current stack-pointer +value. + +For example, a procedure with 12 bytes of local variables would have an +ENTER 12,0 instruction at its entry point and a LEAVE instruction +before every RET. The 12 local bytes would be addressed as negative +offsets from the frame pointer. + +Flags Affected + +None + +Protected Mode Exceptions + +#SS(0) if SP or ESP would exceed the stack limit at any point during +instruction execution; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +HLT 컴 Halt + +Opcode Instruction Clocks Description + +F4 HLT 5 Halt + + +Operation + +Enter Halt state; + +Description + +HALT stops instruction execution and places the 80386 in a HALT state. +An enabled interrupt, NMI, or a reset will resume execution. If an +interrupt (including NMI) is used to resume execution after HLT, the saved +CS:IP (or CS:EIP) value points to the instruction following HLT. + +Flags Affected + +None + +Protected Mode Exceptions + +HLT is a privileged instruction; #GP(0) if the current privilege level is +not 0 + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +#GP(0); HLT is a privileged instruction + + +IDIV 컴 Signed Divide + +Opcode Instruction Clocks Description + +F6 /7 IDIV r/m8 19 Signed divide AX by r/m byte + (AL=Quo, AH=Rem) +F7 /7 IDIV AX,r/m16 27 Signed divide DX:AX by EA word + (AX=Quo, DX=Rem) +F7 /7 IDIV EAX,r/m32 43 Signed divide EDX:EAX by DWORD + byte (EAX=Quo, EDX=Rem) + + +Operation + +temp  dividend / divisor; +IF temp does not fit in quotient +THEN Interrupt 0; +ELSE + quotient  temp; + remainder  dividend MOD (r/m); +FI; + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +Notes: + Divisions are signed. The divisor is given by the r/m operand. The + dividend, quotient, and remainder use implicit registers. Refer to the + table under "Description." +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Description + +IDIV performs a signed division. The dividend, quotient, and remainder +are implicitly allocated to fixed registers. Only the divisor is given as +an explicit r/m operand. The type of the divisor determines which registers +to use as follows: + +Size Divisor Quotient Remainder Dividend +byte r/m8 AL AH AX +word r/m16 AX DX DX:AX +dword r/m32 EAX EDX EDX:EAX + +If the resulting quotient is too large to fit in the destination, or if the +division is 0, an Interrupt 0 is generated. Nonintegral quotients are +truncated toward 0. The remainder has the same sign as the dividend +and the absolute value of the remainder is always less than the absolute +value of the divisor. + +Flags Affected + +OF, SF, ZF, AR, PF, CF are undefined. + +Protected Mode Exceptions + +Interrupt 0 if the quotient is too large to fit in the designated register +(AL or AX), or if the divisor is 0; #GP (0) for an illegal memory operand +effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an +illegal address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 0 if the quotient is too large to fit in the designated register +(AL or AX), or if the divisor is 0; Interrupt 13 if any part of the operand +would lie outside of the effective address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +IMUL 컴 Signed Multiply + + +Opcode Instruction Clocks Description + +F6 /5 IMUL r/m8 9-14/12-17 AX AL * r/m byte +F7 /5 IMUL r/m16 9-22/12-25 DX:AX  AX * r/m word +F7 /5 IMUL r/m32 9-38/12-41 EDX:EAX  EAX * r/m dword +0F AF /r IMUL r16,r/m16 9-22/12-25 word register  word + register * r/m word +0F AF /r IMUL r32,r/m32 9-38/12-41 dword register  dword + register * r/m dword +6B /r ib IMUL r16,r/m16,imm8 9-14/12-17 word register  r/m16 * + sign-extended immediate byte +6B /r ib IMUL r32,r/m32,imm8 9-14/12-17 dword register  r/m32 * + sign-extended immediate byte +6B /r ib IMUL r16,imm8 9-14/12-17 word register  word + register * sign-extended + immediate byte +6B /r ib IMUL r32,imm8 9-14/12-17 dword register  dword + register * sign-extended + immediate byte +69 /r iw IMUL r16,r/m16,imm16 9-22/12-25 word register  r/m16 * + immediate word +69 /r id IMUL r32,r/m32,imm32 9-38/12-41 dword register  r/m32 * + immediate dword +69 /r iw IMUL r16,imm16 9-22/12-25 word register  r/m16 * + immediate word +69 /r id IMUL r32,imm32 9-38/12-41 dword register  r/m32 * + immediate dword + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + The 80386 uses an early-out multiply algorithm. The actual number of + clocks depends on the position of the most significant bit in the + optimizing multiplier, shown underlined above. The optimization occurs for + positive and negative values. Because of the early-out algorithm, clock + counts given are minimum to maximum. To calculate the actual clocks, use + the following formula: +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + + Actual clock = if m <> 0 then max(ceiling(log{2} 쿺�), 3) + 6 clocks + Actual clock = if m = 0 then 9 clocks + (where m is the multiplier) + +Add three clocks if the multiplier is a memory operand. + +Operation + +result  multiplicand * multiplier; + +Description + +IMUL performs signed multiplication. Some forms of the instruction +use implicit register operands. The operand combinations for all forms +of the instruction are shown in the "Description" column above. + +IMUL clears the overflow and carry flags under the following conditions: + + Instruction Form Condition for Clearing CF and OF + r/m8 AL = sign-extend of AL to 16 bits + r/m16 AX = sign-extend of AX to 32 bits + r/m32 EDX:EAX = sign-extend of EAX to 32 bits + r16,r/m16 Result exactly fits within r16 + r/32,r/m32 Result exactly fits within r32 + r16,r/m16,imm16 Result exactly fits within r16 + r32,r/m32,imm32 Result exactly fits within r32 + +Flags Affected + +OF and CF as described above; SF, ZF, AF, and PF are undefined + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exeptions as in Real Address Mode; #PF(fault-code) for a page +fault + +Notes + +When using the accumulator forms (IMUL r/m8, IMUL r/m16, or IMUL +r/m32), the result of the multiplication is available even if the overflow +flag is set because the result is two times the size of the multiplicand +and multiplier. This is large enough to handle any possible result. + + +IN 컴 Input from Port + +Opcode Instruction Clocks Description + +E4 ib IN AL,imm8 12,pm=6*/26** Input byte from immediate port + into AL +E5 ib IN AX,imm8 12,pm=6*/26** Input word from immediate port + into AX +E5 ib IN EAX,imm8 12,pm=6*/26** Input dword from immediate port + into EAX +EC IN AL,DX 13,pm=7*/27** Input byte from port DX into AL +ED IN AX,DX 13,pm=7*/27** Input word from port DX into AX +ED IN EAX,DX 13,pm=7*/27** Input dword from port DX into + EAX + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + *If CPL � IOPL + **If CPL > IOPL or if in virtual 8086 mode +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) +THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) + IF NOT I-O-Permission (SRC, width(SRC)) + THEN #GP(0); + FI; +FI; +DEST  [SRC]; (* Reads from I/O address space *) + +Description + +IN transfers a data byte or data word from the port numbered by the +second operand into the register (AL, AX, or EAX) specified by the first +operand. Access any port from 0 to 65535 by placing the port number +in the DX register and using an IN instruction with DX as the second +parameter. These I/O instructions can be shortened by using an 8-bit +port I/O in the instruction. The upper eight bits of the port address will +be 0 when 8-bit port I/O is used. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the current privilege level is larger (has less privilege) than +IOPL and any of the corresponding I/O permission bits in TSS equals 1 + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +#GP(0) fault if any of the corresponding I/O permission bits in TSS +equals 1 + + +INC 컴 Increment by 1 + +Opcode Instruction Clocks Description + +FE /0 INC r/m8 Increment r/m byte by 1 +FF /0 INC r/m16 Increment r/m word by 1 +FF /6 INC r/m32 Increment r/m dword by 1 +40 + rw INC r16 Increment word register by 1 +40 + rd INC r32 Increment dword register by 1 + + +Operation + +DEST  DEST + 1; + +Description + +INC adds 1 to the operand. It does not change the carry flag. To affect +the carry flag, use the ADD instruction with a second operand of 1. + +Flags Affected + +OF, SF, ZF, AF, and PF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the operand is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +INS/INSB/INSW/INSD 컴 Input from Port to String + +Opcode Instruction Clocks Description + +6C INS r/m8,DX 15,pm=9*/29** Input byte from port DX into ES:(E)DI +6D INS r/m16,DX 15,pm=9*/29** Input word from port DX into ES:(E)DI +6D INS r/m32,DX 15,pm=9*/29** Input dword from port DX into ES:(E)DI +6C INSB 15,pm=9*/29** Input byte from port DX into ES:(E)DI +6D INSW 15,pm=9*/29** Input word from port DX into ES:(E)DI +6D INSD 15,pm=9*/29** Input dword from port DX into ES:(E)DI + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + *If CPL � IOPL + **If CPL > IOPL or if in virtual 8086 mode +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF AddressSize = 16 +THEN use DI for dest-index; +ELSE (* AddressSize = 32 *) + use EDI for dest-index; +FI; +IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) +THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) + IF NOT I-O-Permission (SRC, width(SRC)) + THEN #GP(0); + FI; +FI; +IF byte type of instruction +THEN + ES:[dest-index]  [DX]; (* Reads byte at DX from I/O address space *) + IF DF = 0 THEN IncDec  1 ELSE IncDec  -1; FI; +FI; +IF OperandSize = 16 +THEN + ES:[dest-index]  [DX]; (* Reads word at DX from I/O address space *) + IF DF = 0 THEN IncDec  2 ELSE IncDec  -2; FI; +FI; +IF OperandSize = 32 +THEN + ES:[dest-index]  [DX]; (* Reads dword at DX from I/O address space *) + IF DF = 0 THEN IncDec  4 ELSE IncDec  -4; FI; +FI; +dest-index  dest-index + IncDec; + +Description + +INS transfers data from the input port numbered by the DX register to +the memory byte or word at ES:dest-index. The memory operand must +be addressable from ES; no segment override is possible. The destination +register is DI if the address-size attribute of the instruction is 16 bits, +or EDI if the address-size attribute is 32 bits. + +INS does not allow the specification of the port number as an immediate +value. The port must be addressed through the DX register value. Load +the correct value into DX before executing the INS instruction. + +The destination address is determined by the contents of the destination +index register. Load the correct index into the destination index register +before executing INS. + +After the transfer is made, DI or EDI advances automatically. If the +direction flag is 0 (CLD was executed), DI or EDI increments; if the +direction flag is 1 (STD was executed), DI or EDI decrements. DI +increments or decrements by 1 if a byte is input, by 2 if a word is input, +or by 4 if a doubleword is input. + +INSB, INSW and INSD are synonyms of the byte, word, and doubleword +INS instructions. INS can be preceded by the REP prefix for block input of +CX bytes or words. Refer to the REP instruction for details of this +operation. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if CPL is numerically greater than IOPL and any of the +corresponding I/O permission bits in TSS equals 1; #GP(0) if the +destination is in a nonwritable segment; #GP(0) for an illegal memory +operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for +an illegal address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +#GP(0) fault if any of the corresponding I/O permission bits in TSS +equals 1; #PF(fault-code) for a page fault + + +INT/INTO 컴 Call to Interrupt Procedure + + +Opcode Instruction Clocks Description + +CC INT 3 33 Interrupt 3--trap to debugger +CC INT 3 pm=59 Interrupt 3--Protected Mode, same + privilege +CC INT 3 pm=99 Interrupt 3--Protected Mode, more + privilege +CC INT 3 pm=119 Interrupt 3--from V86 mode to PL 0 +CC INT 3 ts Interrupt 3--Protected Mode, via + task gate +CD ib INT imm8 37 Interrupt numbered by immediate + byte +CD ib INT imm8 pm=59 Interrupt--Protected Mode, same + privilege +CD ib INT imm8 pm=99 Interrupt--Protected Mode, more + privilege +CD ib INT imm8 pm=119 Interrupt--from V86 mode to PL 0 +CD ib INT imm8 ts Interrupt--Protected Mode, via task + gate +CE INTO Fail:3,pm=3; + Pass:35 Interrupt 4--if overflow flag is 1 +CE INTO pm=59 Interrupt 4--Protected Mode, same + privilege +CE INTO pm=99 Interrupt 4--Protected Mode, more + privilege +CE INTO pm=119 Interrupt 4--from V86 mode to PL 0 +CE INTO ts Interrupt 4--Protected Mode, via + task gate + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE: + Approximate values of ts are given by the following table: + + New Task + +Old Task 386 TSS 386 TSS 286 TSS + VM = 0 VM = 1 + +386 +TSS VM=0 309 226 282 + +386 +TSS VM=1 314 231 287 + +286 +TSS 307 224 280 +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE: + The following operational description applies not only to the + above instructions but also to external interrupts and exceptions. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +IF PE = 0 +THEN GOTO REAL-ADDRESS-MODE; +ELSE GOTO PROTECTED-MODE; +FI; + +REAL-ADDRESS-MODE: + Push (FLAGS); + IF  0; (* Clear interrupt flag *) + TF  0; (* Clear trap flag *) + Push(CS); + Push(IP); + (* No error codes are pushed *) + CS  IDT[Interrupt number * 4].selector; + IP  IDT[Interrupt number * 4].offset; + +PROTECTED-MODE: + Interrupt vector must be within IDT table limits, + else #GP(vector number * 8+2+EXT); + Descriptor AR byte must indicate interrupt gate, trap gate, or task gate, + else #GP(vector number * 8+2+EXT); + IF software interrupt (* i.e. caused by INT n, INT 3, or INTO *) + THEN + IF gate descriptor DPL < CPL + THEN #GP(vector number * 8+2+EXT); + FI; + FI; + Gate must be present, else #NP(vector number * 8+2+EXT); + IF trap gate OR interrupt gate + THEN GOTO TRAP-GATE-OR-INTERRUPT-GATE; + ELSE GOTO TASK-GATE; + FI; + +TRAP-GATE-OR-INTERRUPT-GATE: + Examine CS selector and descriptor given in the gate descriptor; + Selector must be non-null, else #GP (EXT); + Selector must be within its descriptor table limits + ELSE #GP(selector+EXT); + Descriptor AR byte must indicate code segment + ELSE #GP(selector + EXT); + Segment must be present, else #NP(selector+EXT); + IF code segment is non-conforming AND DPL < CPL + THEN GOTO INTERRUPT-TO-INNER-PRIVILEGE; + ELSE + IF code segment is conforming OR code segment DPL = CPL + THEN GOTO INTERRUPT-TO-SAME-PRIVILEGE-LEVEL; + ELSE #GP(CS selector + EXT); + FI; + FI; + +INTERRUPT-TO-INNER-PRIVILEGE: + Check selector and descriptor for new stack in current TSS; + Selector must be non-null, else #GP(EXT); + Selector index must be within its descriptor table limits + ELSE #TS(SS selector+EXT); + Selector's RPL must equal DPL of code segment, else #TS(SS + selector+EXT); + Stack segment DPL must equal DPL of code segment, else #TS(SS + selector+EXT); + Descriptor must indicate writable data segment, else #TS(SS + selector+EXT); + Segment must be present, else #SS(SS selector+EXT); + IF 32-bit gate + THEN New stack must have room for 20 bytes else #SS(0) + ELSE New stack must have room for 10 bytes else #SS(0) + FI; + Instruction pointer must be within CS segment boundaries else #GP(0); + Load new SS and eSP value from TSS; + IF 32-bit gate + THEN CS:EIP  selector:offset from gate; + ELSE CS:IP  selector:offset from gate; + FI; + Load CS descriptor into invisible portion of CS register; + Load SS descriptor into invisible portion of SS register; + IF 32-bit gate + THEN + Push (long pointer to old stack) (* 3 words padded to 4 *); + Push (EFLAGS); + Push (long pointer to return location) (* 3 words padded to 4*); + ELSE + Push (long pointer to old stack) (* 2 words *); + Push (FLAGS); + Push (long pointer to return location) (* 2 words *); + FI; + Set CPL to new code segment DPL; + Set RPL of CS to CPL; + IF interrupt gate THEN IF  0 (* interrupt flag to 0 (disabled) *); FI; + TF  0; + NT  0; + +INTERRUPT-FROM-V86-MODE: + TempEFlags  EFLAGS; + VM  0; + TF  0; + IF service through Interrupt Gate THEN IF  0; + TempSS  SS; + TempESP  ESP; + SS  TSS.SS0; (* Change to level 0 stack segment *) + ESP  TSS.ESP0; (* Change to level 0 stack pointer *) + Push(GS); (* padded to two words *) + Push(FS); (* padded to two words *) + Push(DS); (* padded to two words *) + Push(ES); (* padded to two words *) + GS  0; + FS  0; + DS  0; + ES  0; + Push(TempSS); (* padded to two words *) + Push(TempESP); + Push(TempEFlags); + Push(CS); (* padded to two words *) + Push(EIP); + CS:EIP  selector:offset from interrupt gate; + (* Starts execution of new routine in 80386 Protected Mode *) + +INTERRUPT-TO-SAME-PRIVILEGE-LEVEL: + IF 32-bit gate + THEN Current stack limits must allow pushing 10 bytes, else #SS(0); + ELSE Current stack limits must allow pushing 6 bytes, else #SS(0); + FI; + IF interrupt was caused by exception with error code + THEN Stack limits must allow push of two more bytes; + ELSE #SS(0); + FI; + Instruction pointer must be in CS limit, else #GP(0); + IF 32-bit gate + THEN + Push (EFLAGS); + Push (long pointer to return location); (* 3 words padded to 4 *) + CS:EIP  selector:offset from gate; + ELSE (* 16-bit gate *) + Push (FLAGS); + Push (long pointer to return location); (* 2 words *) + CS:IP  selector:offset from gate; + FI; + Load CS descriptor into invisible portion of CS register; + Set the RPL field of CS to CPL; + Push (error code); (* if any *) + IF interrupt gate THEN IF  0; FI; + TF  0; + NT  0; + +TASK-GATE: + Examine selector to TSS, given in task gate descriptor; + Must specify global in the local/global bit, else #TS(TSS selector); + Index must be within GDT limits, else #TS(TSS selector); + AR byte must specify available TSS (bottom bits 00001), + else #TS(TSS selector; + TSS must be present, else #NP(TSS selector); + SWITCH-TASKS with nesting to TSS; + IF interrupt was caused by fault with error code + THEN + Stack limits must allow push of two more bytes, else #SS(0); + Push error code onto stack; + FI; + Instruction pointer must be in CS limit, else #GP(0); + +Description + +The INT instruction generates via software a call to an interrupt +handler. The immediate operand, from 0 to 255, gives the index number +into the Interrupt Descriptor Table (IDT) of the interrupt routine to be +called. In Protected Mode, the IDT consists of an array of eight-byte +descriptors; the descriptor for the interrupt invoked must indicate an +interrupt, trap, or task gate. In Real Address Mode, the IDT is an array +of four byte-long pointers. In Protected and Real Address Modes, the +base linear address of the IDT is defined by the contents of the IDTR. + +The INTO conditional software instruction is identical to the INT +interrupt instruction except that the interrupt number is implicitly 4, +and the interrupt is made only if the 80386 overflow flag is set. + +The first 32 interrupts are reserved by Intel for system use. Some of +these interrupts are use for internally generated exceptions. + +INT n generally behaves like a far call except that the flags register is +pushed onto the stack before the return address. Interrupt procedures +return via the IRET instruction, which pops the flags and return address +from the stack. + +In Real Address Mode, INT n pushes the flags, CS, and the return IP +onto the stack, in that order, then jumps to the long pointer indexed by +the interrupt number. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP, #NP, #SS, and #TS as indicated under "Operation" above + +Real Address Mode Exceptions + +None; if the SP or ESP = 1, 3, or 5 before executing INT or INTO, +the 80386 will shut down due to insufficient stack space + +Virtual 8086 Mode Exceptions + +#GP(0) fault if IOPL is less than 3, for INT only, to permit emulation; +Interrupt 3 (0CCH) generates Interrupt 3; INTO generates Interrupt 4 +if the overflow flag equals 1 + + +IRET/IRETD 컴 Interrupt Return + +Opcode Instruction Clocks Description + +CF IRET 22,pm=38 Interrupt return (far return and pop + flags) +CF IRET pm=82 Interrupt return to lesser privilege +CF IRET ts Interrupt return, different task (NT = 1) +CF IRETD 22,pm=38 Interrupt return (far return and pop + flags) +CF IRETD pm=82 Interrupt return to lesser privilege +CF IRETD pm=60 Interrupt return to V86 mode +CF IRETD ts Interrupt return, different task (NT = 1) + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE: + Values of ts are given by the following table: + + New Task + +Old Task 386 TSS 386 TSS 286 TSS + VM = 0 VM = 1 + +386 +TSS VM=0 275 224 271 + +286 +TSS 265 214 232 +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF PE = 0 +THEN (* Real-address mode *) + IF OperandSize = 32 (* Instruction = IRETD *) + THEN EIP  Pop(); + ELSE (* Instruction = IRET *) + IP  Pop(); + FI; + CS  Pop(); + IF OperandSize = 32 (* Instruction = IRETD *) + THEN EFLAGS  Pop(); + ELSE (* Instruction = IRET *) + FLAGS  Pop(); + FI; +ELSE (* Protected mode *) + IF VM = 1 + THEN #GP(0); + ELSE + IF NT = 1 + THEN GOTO TASK-RETURN; + ELSE + IF VM = 1 in flags image on stack + THEN GO TO STACK-RETURN-TO-V86; + ELSE GOTO STACK-RETURN; + FI; + FI; + FI; +FI;STACK-RETURN-TO-V86: (* Interrupted procedure was in V86 mode *) + IF return CS selector RPL < > 3 + THEN #GP(Return selector); + FI; + IF top 36 bytes of stack not within limits + THEN #SS(0); + FI; + Examine return CS selector and associated descriptor: + IF selector is null, THEN #GP(0); FI; + IF selector index not within its descriptor table limits; + THEN #GP(Return selector); + FI; + IF AR byte does not indicate code segment + THEN #GP(Return selector); + FI; + IF code segment DPL not = 3; + THEN #GP(Return selector); + FI; + IF code segment not present + THEN #NP(Return selector); + FI; + + Examine return SS selector and associated descriptor: + IF selector is null THEN #GP(0); FI; + IF selector index not within its descriptor table limits + THEN #GP(SS selector); + FI; + IF selector RPL not = RPL of return CS selector + THEN #GP(SS selector); + FI; + IF AR byte does not indicate a writable data segment + THEN #GP(SS selector); + FI; + IF stack segment DPL not = RPL of return CS selector + THEN #GP(SS selector); + FI; + IF SS not present + THEN #NP(SS selector); + FI; + + IF instruction pointer not within code segment limit THEN #GP(0); + FI; + EFLAGS  SS:[eSP + 8]; (* Sets VM in interrupted routine *) + EIP  Pop(); + CS  Pop(); (* CS behaves as in 8086, due to VM = 1 *) + throwaway  Pop(); (* pop away EFLAGS already read *) + ES  Pop(); (* pop 2 words; throw away high-order word *) + DS  Pop(); (* pop 2 words; throw away high-order word *) + FS  Pop(); (* pop 2 words; throw away high-order word *) + GS  Pop(); (* pop 2 words; throw away high-order word *) + IF CS.RPL > CPL + THEN + TempESP  Pop(); + TempSS  Pop(); + SS:ESP  TempSS:TempESP; + FI; + + (* Resume execution in Virtual 8086 mode *) + +TASK-RETURN: + Examine Back Link Selector in TSS addressed by the current task + register: + Must specify global in the local/global bit, else #TS(new TSS + selector); + Index must be within GDT limits, else #TS(new TSS selector); + AR byte must specify TSS, else #TS(new TSS selector); + New TSS must be busy, else #TS(new TSS selector); + TSS must be present, else #NP(new TSS selector); + SWITCH-TASKS without nesting to TSS specified by back link selector; + Mark the task just abandoned as NOT BUSY; + Instruction pointer must be within code segment limit ELSE #GP(0); + +STACK-RETURN: + IF OperandSize=32 + THEN Third word on stack must be within stack limits, else #SS(0); + ELSE Second word on stack must be within stack limits, else #SS(0); + FI; + Return CS selector RPL must be � CPL, else #GP(Return selector); + IF return selector RPL = CPL + THEN GOTO RETURN-SAME-LEVEL; + ELSE GOTO RETURN-OUTER-LEVEL; + FI; + +RETURN-SAME-LEVEL: + IF OperandSize=32 + THEN + Top 12 bytes on stack must be within limits, else #SS(0); + Return CS selector (at eSP+4) must be non-null, else #GP(0); + ELSE + Top 6 bytes on stack must be within limits, else #SS(0); + Return CS selector (at eSP+2) must be non-null, else #GP(0); + FI; + Selector index must be within its descriptor table limits, else #GP + (Return selector); + AR byte must indicate code segment, else #GP(Return selector); + IF non-conforming + THEN code segment DPL must = CPL; + ELSE #GP(Return selector); + FI; + IF conforming + THEN code segment DPL must be � CPL, else #GP(Return selector); + Segment must be present, else #NP(Return selector); + Instruction pointer must be within code segment boundaries, else #GP(0); + FI; + IF OperandSize=32 + THEN + Load CS:EIP from stack; + Load CS-register with new code segment descriptor; + Load EFLAGS with third doubleword from stack; + Increment eSP by 12; + ELSE + Load CS-register with new code segment descriptor; + Load FLAGS with third word on stack; + Increment eSP by 6; + FI; + +RETURN-OUTER-LEVEL: + IF OperandSize=32 + THEN Top 20 bytes on stack must be within limits, else #SS(0); + ELSE Top 10 bytes on stack must be within limits, else #SS(0); + FI; + Examine return CS selector and associated descriptor: + Selector must be non-null, else #GP(0); + Selector index must be within its descriptor table limits; + ELSE #GP(Return selector); + AR byte must indicate code segment, else #GP(Return selector); + IF non-conforming + THEN code segment DPL must = CS selector RPL; + ELSE #GP(Return selector); + FI; + IF conforming + THEN code segment DPL must be > CPL; + ELSE #GP(Return selector); + FI; + Segment must be present, else #NP(Return selector); + Examine return SS selector and associated descriptor: + Selector must be non-null, else #GP(0); + Selector index must be within its descriptor table limits + ELSE #GP(SS selector); + Selector RPL must equal the RPL of the return CS selector + ELSE #GP(SS selector); + AR byte must indicate a writable data segment, else #GP(SS selector); + Stack segment DPL must equal the RPL of the return CS selector + ELSE #GP(SS selector); + SS must be present, else #NP(SS selector); + + Instruction pointer must be within code segment limit ELSE #GP(0); + IF OperandSize=32 + THEN + Load CS:EIP from stack; + Load EFLAGS with values at (eSP+8); + ELSE + Load CS:IP from stack; + Load FLAGS with values at (eSP+4); + FI; + Load SS:eSP from stack; + Set CPL to the RPL of the return CS selector; + Load the CS register with the CS descriptor; + Load the SS register with the SS descriptor; + FOR each of ES, FS, GS, and DS + DO; + IF the current value of the register is not valid for the outer level; + THEN zero the register and clear the valid flag; + FI; + To be valid, the register setting must satisfy the following + properties: + Selector index must be within descriptor table limits; + AR byte must indicate data or readable code segment; + IF segment is data or non-conforming code, + THEN DPL must be � CPL, or DPL must be � RPL; + OD; + +Description + +In Real Address Mode, IRET pops the instruction pointer, CS, and the +flags register from the stack and resumes the interrupted routine. + +In Protected Mode, the action of IRET depends on the setting of the +nested task flag (NT) bit in the flag register. When popping the new +flag image from the stack, the IOPL bits in the flag register are changed +only when CPL equals 0. + +If NT equals 0, IRET returns from an interrupt procedure without a +task switch. The code returned to must be equally or less privileged than +the interrupt routine (as indicated by the RPL bits of the CS selector +popped from the stack). If the destination code is less privileged, IRET +also pops the stack pointer and SS from the stack. + +If NT equals 1, IRET reverses the operation of a CALL or INT that +caused a task switch. The updated state of the task executing IRET is +saved in its task state segment. If the task is reentered later, the code +that follows IRET is executed. + +Flags Affected + +All; the flags register is popped from stack + +Protected Mode Exceptions + +#GP, #NP, or #SS, as indicated under "Operation" above + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand being popped lies beyond address +0FFFFH + +Virtual 8086 Mode Exceptions + +#GP(0) fault if IOPL is less than 3, to permit emulation + + +Jcc 컴 Jump if Condition is Met + + +Opcode Instruction Clocks Description + +77 cb JA rel8 7+m,3 Jump short if above (CF=0 and + ZF=0) +73 cb JAE rel8 7+m,3 Jump short if above or equal + (CF=0) +72 cb JB rel8 7+m,3 Jump short if below (CF=1) +76 cb JBE rel8 7+m,3 Jump short if below or equal + (CF=1 or ZF=1) +72 cb JC rel8 7+m,3 Jump short if carry (CF=1) +E3 cb JCXZ rel8 9+m,5 Jump short if CX register is 0 +E3 cb JECXZ rel8 9+m,5 Jump short if ECX register is 0 +74 cb JE rel8 7+m,3 Jump short if equal (ZF=1) +74 cb JZ rel8 7+m,3 Jump short if 0 (ZF=1) +7F cb JG rel8 7+m,3 Jump short if greater (ZF=0 and + SF=OF) +7D cb JGE rel8 7+m,3 Jump short if greater or equal + (SF=OF) +7C cb JL rel8 7+m,3 Jump short if less (SF<>OF) +7E cb JLE rel8 7+m,3 Jump short if less or equal + (ZF=1 and SF<>OF) +76 cb JNA rel8 7+m,3 Jump short if not above (CF=1 or + ZF=1) +72 cb JNAE rel8 7+m,3 Jump short if not above or equal + (CF=1) +73 cb JNB rel8 7+m,3 Jump short if not below (CF=0) +77 cb JNBE rel8 7+m,3 Jump short if not below or equal + (CF=0 and ZF=0) +73 cb JNC rel8 7+m,3 Jump short if not carry (CF=0) +75 cb JNE rel8 7+m,3 Jump short if not equal (ZF=0) +7E cb JNG rel8 7+m,3 Jump short if not greater (ZF=1 + or SF<>OF) +7C cb JNGE rel8 7+m,3 Jump short if not greater or + equal (SF<>OF) +7D cb JNL rel8 7+m,3 Jump short if not less (SF=OF) +7F cb JNLE rel8 7+m,3 Jump short if not less or equal + (ZF=0 and SF=OF) +71 cb JNO rel8 7+m,3 Jump short if not overflow + (OF=0) +7B cb JNP rel8 7+m,3 Jump short if not parity (PF=0) +79 cb JNS rel8 7+m,3 Jump short if not sign (SF=0) +75 cb JNZ rel8 7+m,3 Jump short if not zero (ZF=0) +70 cb JO rel8 7+m,3 Jump short if overflow (OF=1) +7A cb JP rel8 7+m,3 Jump short if parity (PF=1) +7A cb JPE rel8 7+m,3 Jump short if parity even (PF=1) +7B cb JPO rel8 7+m,3 Jump short if parity odd (PF=0) +78 cb JS rel8 7+m,3 Jump short if sign (SF=1) +74 cb JZ rel8 7+m,3 Jump short if zero (ZF = 1) +0F 87 cw/cd JA rel16/32 7+m,3 Jump near if above (CF=0 and + ZF=0) +0F 83 cw/cd JAE rel16/32 7+m,3 Jump near if above or equal + (CF=0) +0F 82 cw/cd JB rel16/32 7+m,3 Jump near if below (CF=1) +0F 86 cw/cd JBE rel16/32 7+m,3 Jump near if below or equal + (CF=1 or ZF=1) +0F 82 cw/cd JC rel16/32 7+m,3 Jump near if carry (CF=1) +0F 84 cw/cd JE rel16/32 7+m,3 Jump near if equal (ZF=1) +0F 84 cw/cd JZ rel16/32 7+m,3 Jump near if 0 (ZF=1) +0F 8F cw/cd JG rel16/32 7+m,3 Jump near if greater (ZF=0 and + SF=OF) +0F 8D cw/cd JGE rel16/32 7+m,3 Jump near if greater or equal + (SF=OF) +0F 8C cw/cd JL rel16/32 7+m,3 Jump near if less (SF<>OF) +0F 8E cw/cd JLE rel16/32 7+m,3 Jump near if less or equal (ZF=1 + and SF<>OF) +0F 86 cw/cd JNA rel16/32 7+m,3 Jump near if not above (CF=1 or + ZF=1) +0F 82 cw/cd JNAE rel16/32 7+m,3 Jump near if not above or equal + (CF=1) +0F 83 cw/cd JNB rel16/32 7+m,3 Jump near if not below (CF=0) +0F 87 cw/cd JNBE rel16/32 7+m,3 Jump near if not below or equal + (CF=0 and ZF=0) +0F 83 cw/cd JNC rel16/32 7+m,3 Jump near if not carry (CF=0) +0F 85 cw/cd JNE rel16/32 7+m,3 Jump near if not equal (ZF=0) +0F 8E cw/cd JNG rel16/32 7+m,3 Jump near if not greater (ZF=1 + or SF<>OF) +0F 8C cw/cd JNGE rel16/32 7+m,3 Jump near if not greater or + equal (SF<>OF) +0F 8D cw/cd JNL rel16/32 7+m,3 Jump near if not less (SF=OF) +0F 8F cw/cd JNLE rel16/32 7+m,3 Jump near if not less or equal + (ZF=0 and SF=OF) +0F 81 cw/cd JNO rel16/32 7+m,3 Jump near if not overflow (OF=0) +0F 8B cw/cd JNP rel16/32 7+m,3 Jump near if not parity (PF=0) +0F 89 cw/cd JNS rel16/32 7+m,3 Jump near if not sign (SF=0) +0F 85 cw/cd JNZ rel16/32 7+m,3 Jump near if not zero (ZF=0) +0F 80 cw/cd JO rel16/32 7+m,3 Jump near if overflow (OF=1) +0F 8A cw/cd JP rel16/32 7+m,3 Jump near if parity (PF=1) +0F 8A cw/cd JPE rel16/32 7+m,3 Jump near if parity even (PF=1) +0F 8B cw/cd JPO rel16/32 7+m,3 Jump near if parity odd (PF=0) +0F 88 cw/cd JS rel16/32 7+m,3 Jump near if sign (SF=1) +0F 84 cw/cd JZ rel16/32 7+m,3 Jump near if 0 (ZF=1) + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + The first clock count is for the true condition (branch taken); the + second clock count is for the false condition (branch not taken). rel16/32 + indicates that these instructions map to two; one with a 16-bit relative + displacement, the other with a 32-bit relative displacement, depending on + the operand-size attribute of the instruction. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF condition +THEN + EIP  EIP + SignExtend(rel8/16/32); + IF OperandSize = 16 + THEN EIP  EIP AND 0000FFFFH; + FI; +FI; + +Description + +Conditional jumps (except JCXZ) test the flags which have been set by +a previous instruction. The conditions for each mnemonic are given in +parentheses after each description above. The terms "less" and "greater" +are used for comparisons of signed integers; "above" and "below" are +used for unsigned integers. + +If the given condition is true, a jump is made to the location provided as +the operand. Instruction coding is most efficient when the target for the +conditional jump is in the current code segment and within -128 to ++127 bytes of the next instruction's first byte. The jump can also target +-32768 thru +32767 (segment size attribute 16) or -2^(31) thru +2^(31) -1 +(segment size attribute 32) relative to the next instruction's first byte. +When the target for the conditional jump is in a different segment, use +the opposite case of the jump instruction (i.e., JE and JNE), and then +access the target with an unconditional far jump to the other segment. +For example, you cannot code컴 + +JZ FARLABEL; + +You must instead code컴 + + JNZ BEYOND; + JMP FARLABEL; +BEYOND: + +Because there can be several ways to interpret a particular state of the +flags, ASM386 provides more than one mnemonic for most of the +conditional jump opcodes. For example, if you compared two characters in +AX and want to jump if they are equal, use JE; or, if you ANDed AX +with a bit field mask and only want to jump if the result is 0, use JZ, a +synonym for JE. + +JCXZ differs from other conditional jumps because it tests the contents of +the CX or ECX register for 0, not the flags. JCXZ is useful at the beginning +of a conditional loop that terminates with a conditional loop instruction +(such as LOOPNE TARGET LABEL. The JCXZ prevents entering the loop with CX or +ECX equal to zero, which would cause the loop to execute 64K or 32G times +instead of zero times. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the offset jumped to is beyond the limits of the code segment + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +JMP 컴 Jump + + +Opcode Instruction Clocks Description + +EB cb JMP rel8 7+m Jump short +E9 cw JMP rel16 7+m Jump near, displacement relative + to next instruction +FF /4 JMP r/m16 7+m/10+m Jump near indirect +EA cd JMP ptr16:16 12+m,pm=27+m Jump intersegment, 4-byte + immediate address +EA cd JMP ptr16:16 pm=45+m Jump to call gate, same + privilege +EA cd JMP ptr16:16 ts Jump via task state segment +EA cd JMP ptr16:16 ts Jump via task gate +FF /5 JMP m16:16 43+m,pm=31+m Jump r/m16:16 indirect and + intersegment +FF /5 JMP m16:16 pm=49+m Jump to call gate, same + privilege +FF /5 JMP m16:16 5 + ts Jump via task state segment +FF /5 JMP m16:16 5 + ts Jump via task gate +E9 cd JMP rel32 7+m Jump near, displacement relative + to next instruction +FF /4 JMP r/m32 7+m,10+m Jump near, indirect +EA cp JMP ptr16:32 12+m,pm=27+m Jump intersegment, 6-byte + immediate address +EA cp JMP ptr16:32 pm=45+m Jump to call gate, same + privilege +EA cp JMP ptr16:32 ts Jump via task state segment +EA cp JMP ptr16:32 ts Jump via task gate +FF /5 JMP m16:32 43+m,pm=31+m Jump intersegment, address at + r/m dword +FF /5 JMP m16:32 pm=49+m Jump to call gate, same + privilege +FF /5 JMP m16:32 5 + ts Jump via task state segment +FF /5 JMP m16:32 5 + ts Jump via task gate + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTE: +Values of ts are given by the following table: + + New Task + + 386 TSS 386 TASK 286 TSS + VM = 0 VM = 1 + +Old Task Via Task Gate? + + N Y N Y N Y +386 +TSS VM=0 303 312 220 229 276 285 + +286 +TSS 301 310 218 227 274 283 +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF instruction = relative JMP + (* i.e. operand is rel8, rel16, or rel32 *) +THEN + EIP  EIP + rel8/16/32; + IF OperandSize = 16 + THEN EIP  EIP AND 0000FFFFH; + FI; +FI; +IF instruction = near indirect JMP + (* i.e. operand is r/m16 or r/m32 *) +THEN + IF OperandSize = 16 + THEN + EIP  [r/m16] AND 0000FFFFH; + ELSE (* OperandSize = 32 *) + EIP  [r/m32]; + FI; +FI; + +IF (PE = 0 OR (PE = 1 AND VM = 1)) (* real mode or V86 mode *) + AND instruction = far JMP + (* i.e., operand type is m16:16, m16:32, ptr16:16, ptr16:32 *) +THEN GOTO REAL-OR-V86-MODE; + IF operand type = m16:16 or m16:32 + THEN (* indirect *) + IF OperandSize = 16 + THEN + CS:IP  [m16:16]; + EIP  EIP AND 0000FFFFH; (* clear upper 16 bits *) + ELSE (* OperandSize = 32 *) + CS:EIP  [m16:32]; + FI; + FI; + IF operand type = ptr16:16 or ptr16:32 + THEN + IF OperandSize = 16 + THEN + CS:IP  ptr16:16; + EIP  EIP AND 0000FFFFH; (* clear upper 16 bits *) + ELSE (* OperandSize = 32 *) + CS:EIP  ptr16:32; + FI; + FI; +FI; + +IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *) + AND instruction = far JMP +THEN + IF operand type = m16:16 or m16:32 + THEN (* indirect *) + check access of EA dword; + #GP(0) or #SS(0) IF limit violation; + FI; + Destination selector is not null ELSE #GP(0) + Destination selector index is within its descriptor table limits ELSE +#GP(selector) + Depending on AR byte of destination descriptor: + GOTO CONFORMING-CODE-SEGMENT; + GOTO NONCONFORMING-CODE-SEGMENT; + GOTO CALL-GATE; + GOTO TASK-GATE; + GOTO TASK-STATE-SEGMENT; + ELSE #GP(selector); (* illegal AR byte in descriptor *) +FI; + +CONFORMING-CODE-SEGMENT: + Descriptor DPL must be � CPL ELSE #GP(selector); + Segment must be present ELSE #NP(selector); + Instruction pointer must be within code-segment limit ELSE #GP(0); + IF OperandSize = 32 + THEN Load CS:EIP from destination pointer; + ELSE Load CS:IP from destination pointer; + FI; + Load CS register with new segment descriptor; + +NONCONFORMING-CODE-SEGMENT: + RPL of destination selector must be � CPL ELSE #GP(selector); + Descriptor DPL must be = CPL ELSE #GP(selector); + Segment must be present ELSE # NP(selector); + Instruction pointer must be within code-segment limit ELSE #GP(0); + IF OperandSize = 32 + THEN Load CS:EIP from destination pointer; + ELSE Load CS:IP from destination pointer; + FI; + Load CS register with new segment descriptor; + Set RPL field of CS register to CPL; + +CALL-GATE: + Descriptor DPL must be � CPL ELSE #GP(gate selector); + Descriptor DPL must be � gate selector RPL ELSE #GP(gate selector); + Gate must be present ELSE #NP(gate selector); + Examine selector to code segment given in call gate descriptor: + Selector must not be null ELSE #GP(0); + Selector must be within its descriptor table limits ELSE + #GP(CS selector); + Descriptor AR byte must indicate code segment + ELSE #GP(CS selector); + IF non-conforming + THEN code-segment descriptor, DPL must = CPL + ELSE #GP(CS selector); + FI; + IF conforming + THEN code-segment descriptor DPL must be � CPL; + ELSE #GP(CS selector); + Code segment must be present ELSE #NP(CS selector); + Instruction pointer must be within code-segment limit ELSE #GP(0); + IF OperandSize = 32 + THEN Load CS:EIP from call gate; + ELSE Load CS:IP from call gate; + FI; + Load CS register with new code-segment descriptor; + Set RPL of CS to CPL + +TASK-GATE: + Gate descriptor DPL must be � CPL ELSE #GP(gate selector); + Gate descriptor DPL must be � gate selector RPL ELSE #GP(gate + selector); + Task Gate must be present ELSE #NP(gate selector); + Examine selector to TSS, given in Task Gate descriptor: + Must specify global in the local/global bit ELSE #GP(TSS selector); + Index must be within GDT limits ELSE #GP(TSS selector); + Descriptor AR byte must specify available TSS (bottom bits 00001); + ELSE #GP(TSS selector); + Task State Segment must be present ELSE #NP(TSS selector); +SWITCH-TASKS (without nesting) to TSS; +Instruction pointer must be within code-segment limit ELSE #GP(0); + +TASK-STATE-SEGMENT: + TSS DPL must be � CPL ELSE #GP(TSS selector); + TSS DPL must be � TSS selector RPL ELSE #GP(TSS selector); + Descriptor AR byte must specify available TSS (bottom bits 00001) + ELSE #GP(TSS selector); + Task State Segment must be present ELSE #NP(TSS selector); + SWITCH-TASKS (without nesting) to TSS; + Instruction pointer must be within code-segment limit ELSE #GP(0); + +Description + +The JMP instruction transfers control to a different point in the +instruction stream without recording return information. + +The action of the various forms of the instruction are shown below. + +Jumps with destinations of type r/m16, r/m32, rel16, and rel32 are near +jumps and do not involve changing the segment register value. + +The JMP rel16 and JMP rel32 forms of the instruction add an offset to +the address of the instruction following the JMP to determine the +destination. The rel16 form is used when the instruction's operand-size +attribute is 16 bits (segment size attribute 16 only); rel32 is used when +the operand-size attribute is 32 bits (segment size attribute 32 only). The +result is stored in the 32-bit EIP register. With rel16, the upper 16 bits +of EIP are cleared, which results in an offset whose value does not exceed +16 bits. + +JMP r/m16 and JMP r/m32 specifies a register or memory location from which +the absolute offset from the procedure is fetched. The offset fetched from +r/m is 32 bits for an operand-size attribute of 32 bits (r/m32), or 16 bits +for an operand-size attribute of 16 bits (r/m16). + +The JMP ptr16:16 and ptr16:32 forms of the instruction use a four-byte +or six-byte operand as a long pointer to the destination. The JMP +and forms fetch the long pointer from the memory location +specified (indirection). In Real Address Mode or Virtual 8086 Mode, +the long pointer provides 16 bits for the CS register and 16 or 32 bits +for the EIP register (depending on the operand-size attribute). In +Protected Mode, both long pointer forms consult the Access Rights (AR) +byte in the descriptor indexed by the selector part of the long pointer. + +Depending on the value of the AR byte, the jump will perform one of +the following types of control transfers: + + � A jump to a code segment at the same privilege level + � A task switch + +For more information on protected mode control transfers, refer to +Chapter 6 and Chapter 7. + +Flags Affected + +All if a task switch takes place; none if no task switch occurs + +Protected Mode Exceptions + +Far jumps: #GP, #NP, #SS, and #TS, as indicated in the list above. + +Near direct jumps: #GP(0) if procedure location is beyond the code +segment limits. + +Near indirect jumps: #GP(0) for an illegal memory operand effective +address in the CS, DS, ES, FS, or GS segments: #SS(0) for an illegal +address in the SS segment; #GP if the indirect offset obtained is beyond +the code segment limits; #PF(fault-code) for a page fault. + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would be outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as under Real Address Mode; #PF(fault-code) for a +page fault + + +LAHF 컴 Load Flags into AH Register + +Opcode Instruction Clocks Description + +9F LAHF 2 Load: AH = flags SF ZF xx AF xx PF xx CF + + +Operation + +AH  SF:ZF:xx:AF:xx:PF:xx:CF; + +Description + +LAHF transfers the low byte of the flags word to AH. The bits, from +MSB to LSB, are sign, zero, indeterminate, auxiliary, carry, +indeterminate, parity, indeterminate, and carry. + +Flags Affected + +None + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +LAR 컴 Load Access Rights Byte + +Opcode Instruction Clocks Description + +0F 02 /r LAR r16,r/m16 pm=15/16 r16  r/m16 masked by FF00 +0F 02 /r LAR r32,r/m32 pm=15/16 r32  r/m32 masked by 00FxFF00 + + +Description + +The LAR instruction stores a marked form of the second doubleword of +the descriptor for the source selector if the selector is visible at the +CPL (modified by the selector's RPL) and is a valid descriptor type. The +destination register is loaded with the high-order doubleword of the +descriptor masked by 00FxFF00, and ZF is set to 1. The x indicates that the +four bits corresponding to the upper four bits of the limit are undefined in +the value loaded by LAR. If the selector is invisible or of the wrong type, +ZF is cleared. + +If the 32-bit operand size is specified, the entire 32-bit value is loaded +into the 32-bit destination register. If the 16-bit operand size is +specified, the lower 16-bits of this value are stored in the 16-bit +destination register. + +All code and data segment descriptors are valid for LAR. + +The valid special segment and gate descriptor types for LAR are given +in the following table: + +Type Name Valid/Invalid + + 0 Invalid Invalid + 1 Available 80286 TSS Valid + 2 LDT Valid + 3 Busy 80286 TSS Valid + 4 80286 call gate Valid + 5 80286/80386 task gate Valid + 6 80286 trap gate Valid + 7 80286 interrupt gate Valid + 8 Invalid Invalid + 9 Available 80386 TSS Valid + A Invalid Invalid + B Busy 80386 TSS Valid + C 80386 call gate Valid + D Invalid Invalid + E 80386 trap gate Valid + F 80386 interrupt gate Valid + +Flags Affected + +ZF as described above + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 6; LAR is unrecognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + + +LEA 컴 Load Effective Address + +Opcode Instruction Clocks Description + +8D /r LEA r16,m 2 Store effective address for m in register r16 +8D /r LEA r32,m 2 Store effective address for m in register r32 +8D /r LEA r16,m 2 Store effective address for m in register r16 +8D /r LEA r32,m 2 Store effective address for m in register r32 + + +Operation + +IF OperandSize = 16 AND AddressSize = 16 +THEN r16  Addr(m); +ELSE + IF OperandSize = 16 AND AddressSize = 32 + THEN + r16  Truncate_to_16bits(Addr(m)); (* 32-bit address *) + ELSE + IF OperandSize = 32 AND AddressSize = 16 + THEN + r32  Truncate_to_16bits(Addr(m)); + ELSE + IF OperandSize = 32 AND AddressSize = 32 + THEN r32  Addr(m); + FI; + FI; + FI; +FI; + +Description + +LEA calculates the effective address (offset part) and stores it in the +specified register. The operand-size attribute of the instruction +(represented by OperandSize in the algorithm under "Operation" above) is +determined by the chosen register. The address-size attribute (represented +by AddressSize) is determined by the USE attribute of the segment containing +the second operand. The address-size and operand-size attributes affect the +action performed by LEA, as follows: + +Operand Size Address Size Action Performed + + 16 16 16-bit effective address is calculated and + stored in requested 16-bit register + destination. + + 16 32 32-bit effective address is calculated. The + lower 16 bits of the address are stored in + the requested 16-bit register destination. + + 32 16 16-bit effective address is calculated. The + 16-bit address is zero-extended and stored + in the requested 32-bit register destination. + + 32 32 32-bit effective address is calculated and + stored in the requested 32-bit register + destination. + +Flags Affected + +None + +Protected Mode Exceptions + +#UD if the second operand is a register + +Real Address Mode Exceptions + +Interrupt 6 if the second operand is a register + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + + +LEAVE 컴 High Level Procedure Exit + +Opcode Instruction Clocks Description + +C9 LEAVE 4 Set SP to BP, then pop BP +C9 LEAVE 4 Set ESP to EBP, then pop EBP + + +Operation + +IF StackAddrSize = 16 +THEN + SP  BP; +ELSE (* StackAddrSize = 32 *) + ESP  EBP; +FI; +IF OperandSize = 16 +THEN + BP  Pop(); +ELSE (* OperandSize = 32 *) + EBP  Pop(); +FI; + +Description + +LEAVE reverses the actions of the ENTER instruction. By copying the +frame pointer to the stack pointer, LEAVE releases the stack space used +by a procedure for its local variables. The old frame pointer is popped +into BP or EBP, restoring the caller's frame. A subsequent RET +instruction removes any arguments pushed onto the stack of the exiting +procedure. + +Flags Affected + +None + +Protected Mode Exceptions + +#SS(0) if BP does not point to a location within the limits of the current +stack segment + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + + +LGDT/LIDT 컴 Load Global/Interrupt Descriptor Table Register + +Opcode Instruction Clocks Description + +0F 01 /2 LGDT m16&32 11 Load m into GDTR +0F 01 /3 LIDT m16&32 11 Load m into IDTR + + +Operation + +IF instruction = LIDT +THEN + IF OperandSize = 16 + THEN IDTR.Limit:Base  m16:24 (* 24 bits of base loaded *) + ELSE IDTR.Limit:Base  m16:32 + FI; +ELSE (* instruction = LGDT *) + IF OperandSize = 16 + THEN GDTR.Limit:Base  m16:24 (* 24 bits of base loaded *) + ELSE GDTR.Limit:Base  m16:32; + FI; +FI; + +Description + +The LGDT and LIDT instructions load a linear base address and limit +value from a six-byte data operand in memory into the GDTR or IDTR, +respectively. If a 16-bit operand is used with LGDT or LIDT, the +register is loaded with a 16-bit limit and a 24-bit base, and the +high-order eight bits of the six-byte data operand are not used. If a 32-bit +operand is used, a 16-bit limit and a 32-bit base is loaded; the high-order +eight bits of the six-byte operand are used as high-order base address bits. + +The SGDT and SIDT instructions always store into all 48 bits of the +six-byte data operand. With the 80286, the upper eight bits are undefined +after SGDT or SIDT is executed. With the 80386, the upper eight bits +are written with the high-order eight address bits, for both a 16-bit +operand and a 32-bit operand. If LGDT or LIDT is used with a 16-bit +operand to load the register stored by SGDT or SIDT, the upper eight +bits are stored as zeros. + +LGDT and LIDT appear in operating system software; they are not used +in application programs. They are the only instructions that directly load +a linear address (i.e., not a segment relative address) in 80386 Protected +Mode. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the current privilege level is not 0; #UD if the source operand +is a register; #GP(0) for an illegal memory operand effective address in +the CS, DS, ES, FS, or GS segments; #SS(0) for an illegal address in +the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH; Interrupt 6 if the source operand is a +register + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +Note: + These instructions are valid in Real Address Mode to allow + power-up initialization for Protected Mode +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +LGS/LSS/LDS/LES/LFS 컴 Load Full Pointer + +Opcode Instruction Clocks Description + +C5 /r LDS r16,m16:16 7,p=22 Load DS:r16 with pointer from memory +C5 /r LDS r32,m16:32 7,p=22 Load DS:r32 with pointer from memory +0F B2 /r LSS r16,m16:16 7,p=22 Load SS:r16 with pointer from memory +0F B2 /r LSS r32,m16:32 7,p=22 Load SS:r32 with pointer from memory +C4 /r LES r16,m16:16 7,p=22 Load ES:r16 with pointer from memory +C4 /r LES r32,m16:32 7,p=22 Load ES:r32 with pointer from memory +0F B4 /r LFS r16,m16:16 7,p=25 Load FS:r16 with pointer from memory +0F B4 /r LFS r32,m16:32 7,p=25 Load FS:r32 with pointer from memory +0F B5 /r LGS r16,m16:16 7,p=25 Load GS:r16 with pointer from memory +0F B5 /r LGS r32,m16:32 7,p=25 Load GS:r32 with pointer from memory + + +Operation + +CASE instruction OF + LSS: Sreg is SS; (* Load SS register *) + LDS: Sreg is DS; (* Load DS register *) + LES: Sreg is ES; (* Load ES register *) + LFS: Sreg is FS; (* Load FS register *) + LGS: Sreg is DS; (* Load GS register *) +ESAC; +IF (OperandSize = 16) +THEN + r16  [Effective Address]; (* 16-bit transfer *) + Sreg  [Effective Address + 2]; (* 16-bit transfer *) + (* In Protected Mode, load the descriptor into the segment register *) +ELSE (* OperandSize = 32 *) + r32  [Effective Address]; (* 32-bit transfer *) + Sreg  [Effective Address + 4]; (* 16-bit transfer *) + (* In Protected Mode, load the descriptor into the segment register *) +FI; + +Description + +These instructions read a full pointer from memory and store it in the +selected segment register:register pair. The full pointer loads 16 bits +into the segment register SS, DS, ES, FS, or GS. The other register loads 32 +bits if the operand-size attribute is 32 bits, or loads 16 bits if the +operand-size attribute is 16 bits. The other 16- or 32-bit register to be +loaded is determined by the r16 or r32 register operand specified. + +When an assignment is made to one of the segment registers, the +descriptor is also loaded into the segment register. The data for the +register is obtained from the descriptor table entry for the selector +given. + +A null selector (values 0000-0003) can be loaded into DS, ES, FS, or +GS registers without causing a protection exception. (Any subsequent +reference to a segment whose corresponding segment register is loaded +with a null selector to address memory causes a #GP(0) exception. No +memory reference to the segment occurs.) + +The following is a listing of the Protected Mode checks and actions taken in +the loading of a segment register: + +IF SS is loaded: + IF selector is null THEN #GP(0); FI; + Selector index must be within its descriptor table limits ELSE + #GP(selector); + Selector's RPL must equal CPL ELSE #GP(selector); + AR byte must indicate a writable data segment ELSE #GP(selector); + DPL in the AR byte must equal CPL ELSE #GP(selector); + Segment must be marked present ELSE #SS(selector); + Load SS with selector; + Load SS with descriptor; +IF DS, ES, FS, or GS is loaded with non-null selector: + Selector index must be within its descriptor table limits ELSE + #GP(selector); + AR byte must indicate data or readable code segment ELSE + #GP(selector); + IF data or nonconforming code + THEN both the RPL and the CPL must be less than or equal to DPL in + AR byte; + ELSE #GP(selector); + Segment must be marked present ELSE #NP(selector); +Load segment register with selector and RPL bits; +Load segment register with descriptor; +IF DS, ES, FS or GS is loaded with a null selector: + Clear descriptor valid bit; + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +the second operand must be a memory operand, not a register; #GP(0) +if a null selector is loaded into SS; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +The second operand must be a memory operand, not a register; Interrupt +13 if any part of the operand would lie outside of the effective address +space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +LLDT 컴 Load Local Descriptor Table Register + +Opcode Instruction Clocks Description + +0F 00 /2 LLDT r/m16 20 Load selector r/m16 into LDTR + + +Operation + +LDTR  SRC; + +Description + +LLDT loads the Local Descriptor Table register (LDTR). The word +operand (memory or register) to LLDT should contain a selector to the +Global Descriptor Table (GDT). The GDT entry should be a Local Descriptor +Table. If so, then the LDTR is loaded from the entry. The descriptor +registers DS, ES, SS, FS, GS, and CS are not affected. The LDT field in the +task state segment does not change. + +The selector operand can be 0; if so, the LDTR is marked invalid. All +descriptor references (except by the LAR, VERR, VERW or LSL +instructions) cause a #GP fault. + +LLDT is used in operating system software; it is not used in application +programs. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the current privilege level is not 0; #GP(selector) if the +selector operand does not point into the Global Descriptor Table, or if the +entry in the GDT is not a Local Descriptor Table; #NP(selector) if the +LDT descriptor is not present; #GP(0) for an illegal memory operand +effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an +illegal address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 6; LLDT is not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode (because the instruction is +not recognized, it will not execute or perform a memory reference) + +Note + +The operand-size attribute has no effect on this instruction. + + +LMSW 컴 Load Machine Status Word + +Opcode Instruction Clocks Description + +0F 01 /6 LMSW r/m16 10/13 Load r/m16 in machine status word + + +Operation + +MSW  r/m16; (* 16 bits is stored in the machine status word *) + +Description + +LMSW loads the machine status word (part of CR0) from the source +operand. This instruction can be used to switch to Protected Mode; if so, +it must be followed by an intrasegment jump to flush the instruction +queue. LMSW will not switch back to Real Address Mode. + +LMSW is used only in operating system software. It is not used in +application programs. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the current privilege level is not 0; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + +Notes + +The operand-size attribute has no effect on this instruction. This +instruction is provided for compatibility with the 80286; 80386 programs +should use MOV CR0, ... instead. + + +LOCK 컴 Assert LOCK# Signal Prefix + +Opcode Instruction Clocks Description + +F0 LOCK 0 Assert LOCK# signal for the next instruction + + +Description + +The LOCK prefix causes the LOCK# signal of the 80386 to be asserted +during execution of the instruction that follows it. In a multiprocessor +environment, this signal can be used to ensure that the 80386 has +exclusive use of any shared memory while LOCK# is asserted. The +read-modify-write sequence typically used to implement test-and-set on the +80386 is the BTS instruction. + +The LOCK prefix functions only with the following instructions: + +BT, BTS, BTR, BTC mem, reg/imm +XCHG reg, mem +XCHG mem, reg +ADD, OR, ADC, SBB, AND, SUB, XOR mem, reg/imm +NOT, NEG, INC, DEC mem + +An undefined opcode trap will be generated if a LOCK prefix is used +with any instruction not listed above. + +XCHG always asserts LOCK# regardless of the presence or absence of +the LOCK prefix. + +The integrity of the LOCK is not affected by the alignment of the +memory field. Memory locking is observed for arbitrarily misaligned +fields. + +Locked access is not assured if another 80386 processor is executing an +instruction concurrently that has one of the following characteristics: + + � Is not preceded by a LOCK prefix + + � Is not one of the instructions in the preceding list + + � Specifies a memory operand that does not exactly overlap the + destination operand. Locking is not guaranteed for partial overlap, + even if one memory operand is wholly contained within another. + +Flags Affected + +None + +Protected Mode Exceptions + +#UD if LOCK is used with an instruction not listed in the "Description" +section above; other exceptions can be generated by the subsequent +(locked) instruction + +Real Address Mode Exceptions + +Interrupt 6 if LOCK is used with an instruction not listed in the +"Description" section above; exceptions can still be generated by the +subsequent (locked) instruction + +Virtual 8086 Mode Exceptions + +#UD if LOCK is used with an instruction not listed in the "Description" +section above; exceptions can still be generated by the subsequent (locked) +instruction + + +LODS/LODSB/LODSW/LODSD 컴 Load String Operand + +Opcode Instruction Clocks Description + +AC LODS m8 5 Load byte [(E)SI] into AL +AD LODS m16 5 Load word [(E)SI] into AX +AD LODS m32 5 Load dword [(E)SI] into EAX +AC LODSB 5 Load byte DS:[(E)SI] into AL +AD LODSW 5 Load word DS:[(E)SI] into AX +AD LODSD 5 Load dword DS:[(E)SI] into EAX + + +Operation + +IF AddressSize = 16 +THEN use SI for source-index +ELSE (* AddressSize = 32 *) + use ESI for source-index; +FI; +IF byte type of instruction +THEN + AL  [source-index]; (* byte load *) + IF DF = 0 THEN IncDec  1 ELSE IncDec  -1; FI; +ELSE + IF OperandSize = 16 + THEN + AX  [source-index]; (* word load *) + IF DF = 0 THEN IncDec  2 ELSE IncDec  -2; FI; + ELSE (* OperandSize = 32 *) + EAX  [source-index]; (* dword load *) + IF DF = 0 THEN IncDec  4 ELSE IncDec  -4; FI; + FI; +FI; +source-index  source-index + IncDec + +Description + +LODS loads the AL, AX, or EAX register with the memory byte, word, +or doubleword at the location pointed to by the source-index register. +After the transfer is made, the source-index register is automatically +advanced. If the direction flag is 0 (CLD was executed), the source index +increments; if the direction flag is 1 (STD was executed), it decrements. +The increment or decrement is 1 if a byte is loaded, 2 if a word is loaded, +or 4 if a doubleword is loaded. + +If the address-size attribute for this instruction is 16 bits, SI is used +for the source-index register; otherwise the address-size attribute is 32 +bits, and the ESI register is used. The address of the source data is +determined solely by the contents of ESI/SI. Load the correct index value +into SI before executing the LODS instruction. LODSB, LODSW, LODSD are +synonyms for the byte, word, and doubleword LODS instructions. + +LODS can be preceded by the REP prefix; however, LODS is used more typically +within a LOOP construct, because further processing of the data moved into +EAX, AX, or AL is usually necessary. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +LOOP/LOOPcond 컴 Loop Control with CX Counter + +Opcode Instruction Clocks Description + +E2 cb LOOP rel8 11+m DEC count; jump short if count <> 0 +E1 cb LOOPE rel8 11+m DEC count; jump short if count <> 0 and ZF=1 +E1 cb LOOPZ rel8 11+m DEC count; jump short if count <> 0 and ZF=1 +E0 cb LOOPNE rel8 11+m DEC count; jump short if count <> 0 and ZF=0 +E0 cb LOOPNZ rel8 11+m DEC count; jump short if count <> 0 and ZF=0 + + +Operation + +IF AddressSize = 16 THEN CountReg is CX ELSE CountReg is ECX; FI; +CountReg  CountReg - 1; +IF instruction <> LOOP +THEN + IF (instruction = LOOPE) OR (instruction = LOOPZ) + THEN BranchCond  (ZF = 1) AND (CountReg <> 0); + FI; + IF (instruction = LOOPNE) OR (instruction = LOOPNZ) + THEN BranchCond  (ZF = 0) AND (CountReg <> 0); + FI; +FI; + +IF BranchCond +THEN + IF OperandSize = 16 + THEN + IP  IP + SignExtend(rel8); + ELSE (* OperandSize = 32 *) + EIP  EIP + SignExtend(rel8); + FI; +FI; + +Description + +LOOP decrements the count register without changing any of the flags. +Conditions are then checked for the form of LOOP being used. If the +conditions are met, a short jump is made to the label given by the operand +to LOOP. If the address-size attribute is 16 bits, the CX register is used +as the count register; otherwise the ECX register is used. The operand +of LOOP must be in the range from 128 (decimal) bytes before the +instruction to 127 bytes ahead of the instruction. + +The LOOP instructions provide iteration control and combine loop index +management with conditional branching. Use the LOOP instruction by +loading an unsigned iteration count into the count register, then code the +LOOP at the end of a series of instructions to be iterated. The +destination of LOOP is a label that points to the beginning of the +iteration. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the offset jumped to is beyond the limits of the current code +segment + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +LSL 컴 Load Segment Limit + +Opcode Instruction Clocks Description + +0F 03 /r LSL r16,r/m16 pm=20/21 Load: r16  segment limit, + selector r/m16 (byte granular) +0F 03 /r LSL r32,r/m32 pm=20/21 Load: r32  segment limit, + selector r/m32 (byte granular) +0F 03 /r LSL r16,r/m16 pm=25/26 Load: r16  segment limit, + selector r/m16 (page granular) +0F 03 /r LSL r32,r/m32 pm=25/26 Load: r32  segment limit, + selector r/m32 (page granular) + + +Description + +The LSL instruction loads a register with an unscrambled segment limit, +and sets ZF to 1, provided that the source selector is visible at the CPL +weakened by RPL, and that the descriptor is a type accepted by LSL. +Otherwise, ZF is cleared to 0, and the destination register is unchanged. +The segment limit is loaded as a byte granular value. If the descriptor +has a page granular segment limit, LSL will translate it to a byte limit +before loading it in the destination register (shift left 12 the 20-bit +"raw" limit from descriptor, then OR with 00000FFFH). + +The 32-bit forms of this instruction store the 32-bit byte granular limit +in the 16-bit destination register. + +Code and data segment descriptors are valid for LSL. + +The valid special segment and gate descriptor types for LSL are given +in the following table: + +Type Name Valid/Invalid + + 0 Invalid Invalid + 1 Available 80286 TSS Valid + 2 LDT Valid + 3 Busy 80286 TSS Valid + 4 80286 call gate Invalid + 5 80286/80386 task gate Invalid + 6 80286 trap gate Invalid + 7 80286 interrupt gate Invalid + 8 Invalid Valid + 9 Available 80386 TSS Valid + A Invalid Invalid + B Busy 80386 TSS Valid + C 80386 call gate Invalid + D Invalid Invalid + E 80386 trap gate Invalid + F 80386 interrupt gate Invalid + +Flags Affected + +ZF as described above + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 6; LSL is not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + + +LTR 컴 Load Task Register + +Opcode Instruction Clocks Description + +0F 00 /3 LTR r/m16 pm=23/27 Load EA word into task register + + +Description + +LTR loads the task register from the source register or memory location +specified by the operand. The loaded task state segment is marked busy. +A task switch does not occur. + +LTR is used only in operating system software; it is not used in +application programs. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#GP(0) if the current privilege level is not 0; #GP(selector) if the object +named by the source selector is not a TSS or is already busy; +#NP(selector) if the TSS is marked "not present"; #PF(fault-code) for +a page fault + +Real Address Mode Exceptions + +Interrupt 6; LTR is not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + +Notes + +The operand-size attribute has no effect on this instruction. + + +MOV 컴 Move Data + + +Opcode Instruction Clocks Description + +88 /r MOV r/m8,r8 2/2 Move byte register to r/m byte +89 /r MOV r/m16,r16 2/2 Move word register to r/m word +89 /r MOV r/m32,r32 2/2 Move dword register to r/m dword +8A /r MOV r8,r/m8 2/4 Move r/m byte to byte register +8B /r MOV r16,r/m16 2/4 Move r/m word to word register +8B /r MOV r32,r/m32 2/4 Move r/m dword to dword register +8C /r MOV r/m16,Sreg 2/2 Move segment register to r/m word +8D /r MOV Sreg,r/m16 2/5,pm=18/19 Move r/m word to segment register +A0 MOV AL,moffs8 4 Move byte at (seg:offset) to AL +A1 MOV AX,moffs16 4 Move word at (seg:offset) to AX +A1 MOV EAX,moffs32 4 Move dword at (seg:offset) to EAX +A2 MOV moffs8,AL 2 Move AL to (seg:offset) +A3 MOV moffs16,AX 2 Move AX to (seg:offset) +A3 MOV moffs32,EAX 2 Move EAX to (seg:offset) +B0 + rb MOV reg8,imm8 2 Move immediate byte to register +B8 + rw MOV reg16,imm16 2 Move immediate word to register +B8 + rd MOV reg32,imm32 2 Move immediate dword to register +C6 MOV r/m8,imm8 2/2 Move immediate byte to r/m byte +C7 MOV r/m16,imm16 2/2 Move immediate word to r/m word +C7 MOV r/m32,imm32 2/2 Move immediate dword to r/m dword + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + moffs8, moffs16, and moffs32 all consist of a simple offset relative + to the segment base. The 8, 16, and 32 refer to the size of the data. The + address-size attribute of the instruction determines the size of the + offset, either 16 or 32 bits. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +DEST  SRC; + +Description + +MOV copies the second operand to the first operand. + +If the destination operand is a segment register (DS, ES, SS, etc.), then +data from a descriptor is also loaded into the register. The data for the +register is obtained from the descriptor table entry for the selector +given. A null selector (values 0000-0003) can be loaded into DS and ES +registers without causing an exception; however, use of DS or ES causes a +#GP(0), and no memory reference occurs. + +A MOV into SS inhibits all interrupts until after the execution of the +next instruction (which is presumably a MOV into eSP). + +Loading a segment register under 80386 Protected Mode results in special +checks and actions, as described in the following listing: + +IF SS is loaded; +THEN + IF selector is null THEN #GP(0); +FI; + Selector index must be within its descriptor table limits else + #GP(selector); + Selector's RPL must equal CPL else #GP(selector); +AR byte must indicate a writable data segment else #GP(selector); + DPL in the AR byte must equal CPL else #GP(selector); + Segment must be marked present else #SS(selector); + Load SS with selector; + Load SS with descriptor. +FI; +IF DS, ES, FS or GS is loaded with non-null selector; +THEN + Selector index must be within its descriptor table limits + else #GP(selector); + AR byte must indicate data or readable code segment else + #GP(selector); + IF data or nonconforming code segment + THEN both the RPL and the CPL must be less than or equal to DPL in + AR byte; + ELSE #GP(selector); + FI; + Segment must be marked present else #NP(selector); + Load segment register with selector; + Load segment register with descriptor; +FI; +IF DS, ES, FS or GS is loaded with a null selector; +THEN + Load segment register with selector; + Clear descriptor valid bit; +FI; + +Flags Affected + +None + +Protected Mode Exceptions + +#GP, #SS, and #NP if a segment register is being loaded; otherwise, +#GP(0) if the destination is in a nonwritable segment; #GP(0) for an +illegal memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +MOV 컴 Move to/from Special Registers + +Opcode Instruction Clocks Description + +0F 20 /r MOV r32,CR0/CR2/CR3 6 Move (control register) to + (register) +0F 22 /r MOV CR0/CR2/CR3,r32 10/4/5 Move (register) to (control + register) +0F 21 /r MOV r32,DR0 -- 3 22 Move (debug register) to + (register) +0F 21 /r MOV r32,DR6/DR7 14 Move (debug register) to + (register) +0F 23 /r MOV DR0 -- 3,r32 22 Move (register) to (debug + register) +0F 23 /r MOV DR6/DR7,r32 16 Move (register) to (debug + register) +0F 24 /r MOV r32,TR6/TR7 12 Move (test register) to + (register) +0F 26 /r MOV TR6/TR7,r32 12 Move (register) to (test + register) + + +Operation + +DEST  SRC; + +Description + +The above forms of MOV store or load the following special registers in +or from a general purpose register: + + � Control registers CR0, CR2, and CR3 + � Debug Registers DR0, DR1, DR2, DR3, DR6, and DR7 + � Test Registers TR6 and TR7 + +32-bit operands are always used with these instructions, regardless of the +operand-size attribute. + +Flags Affected + +OF, SF, ZF, AF, PF, and CF are undefined + +Protected Mode Exceptions + +#GP(0) if the current privilege level is not 0 + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +#GP(0) if instruction execution is attempted + +Notes + +The instructions must be executed at privilege level 0 or in real-address +mode; otherwise, a protection exception will be raised. + +The reg field within the ModRM byte specifies which of the special +registers in each category is involved. The two bits in the field are +always 11. The r/m field specifies the general register involved. + + +MOVS/MOVSB/MOVSW/MOVSD 컴 Move Data from String to String + +Opcode Instruction Clocks Description + +A4 MOVS m8,m8 7 Move byte [(E)SI] to ES:[(E)DI] +A5 MOVS m16,m16 7 Move word [(E)SI] to ES:[(E)DI] +A5 MOVS m32,m32 7 Move dword [(E)SI] to ES:[(E)DI] +A4 MOVSB 7 Move byte DS:[(E)SI] to ES:[(E)DI] +A5 MOVSW 7 Move word DS:[(E)SI] to ES:[(E)DI] +A5 MOVSD 7 Move dword DS:[(E)SI] to ES:[(E)DI] + + +Operation + +IF (instruction = MOVSD) OR (instruction has doubleword operands) +THEN OperandSize  32; +ELSE OperandSize  16; +IF AddressSize = 16 +THEN use SI for source-index and DI for destination-index; +ELSE (* AddressSize = 32 *) + use ESI for source-index and EDI for destination-index; +FI; +IF byte type of instruction +THEN + [destination-index]  [source-index]; (* byte assignment *) + IF DF = 0 THEN IncDec  1 ELSE IncDec  -1; FI; +ELSE + IF OperandSize = 16 + THEN + [destination-index]  [source-index]; (* word assignment *) + IF DF = 0 THEN IncDec  2 ELSE IncDec  -2; FI; + ELSE (* OperandSize = 32 *) + [destination-index]  [source-index]; (* doubleword assignment *) + IF DF = 0 THEN IncDec  4 ELSE IncDec  -4; FI; + FI; +FI; +source-index  source-index + IncDec; +destination-index  destination-index + IncDec; + +Description + +MOVS copies the byte or word at [(E)SI] to the byte or word at +ES:[(E)DI]. The destination operand must be addressable from the ES +register; no segment override is possible for the destination. A segment +override can be used for the source operand; the default is DS. + +The addresses of the source and destination are determined solely by the +contents of (E)SI and (E)DI. Load the correct index values into (E)SI +and (E)DI before executing the MOVS instruction. MOVSB, MOVSW, +and MOVSD are synonyms for the byte, word, and doubleword MOVS +instructions. + +After the data is moved, both (E)SI and (E)DI are advanced +automatically. If the direction flag is 0 (CLD was executed), the registers +are incremented; if the direction flag is 1 (STD was executed), the +registers are decremented. The registers are incremented or decremented by 1 +if a byte was moved, 2 if a word was moved, or 4 if a doubleword was moved. + +MOVS can be preceded by the REP prefix for block movement of CX +bytes or words. Refer to the REP instruction for details of this operation. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +MOVSX 컴 Move with Sign-Extend + +Opcode Instruction Clocks Description + +0F BE /r MOVSX r16,r/m8 3/6 Move byte to word with sign-extend +0F BE /r MOVSX r32,r/m8 3/6 Move byte to dword, sign-extend +0F BF /r MOVSX r32,r/m16 3/6 Move word to dword, sign-extend + + +Operation + +DEST  SignExtend(SRC); + +Description + +MOVSX reads the contents of the effective address or register as a byte +or a word, sign-extends the value to the operand-size attribute of the +instruction (16 or 32 bits), and stores the result in the destination +register. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +MOVZX 컴 Move with Zero-Extend + +Opcode Instruction Clocks Description + +0F B6 /r MOVZX r16,r/m8 3/6 Move byte to word with zero-extend +0F B6 /r MOVZX r32,r/m8 3/6 Move byte to dword, zero-extend +0F B7 /r MOVZX r32,r/m16 3/6 Move word to dword, zero-extend + + +Operation + +DEST  ZeroExtend(SRC); + +Description + +MOVZX reads the contents of the effective address or register as a byte +or a word, zero extends the value to the operand-size attribute of the +instruction (16 or 32 bits), and stores the result in the destination +register. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +MUL 컴 Unsigned Multiplication of AL or AX + +Opcode Instruction Clocks Description + +F6 /4 MUL AL,r/m8 9-14/12-17 Unsigned multiply (AX  AL * r/m byte) +F7 /4 MUL AX,r/m16 9-22/12-25 Unsigned multiply (DX:AX  AX * r/m + word) +F7 /4 MUL EAX,r/m32 9-38/12-41 Unsigned multiply (EDX:EAX  EAX * r/m + dword) + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + The 80386 uses an early-out multiply algorithm. The actual number of + clocks depends on the position of the most significant bit in the + optimizing multiplier, shown underlined above. The optimization occurs + for positive and negative multiplier values. Because of the early-out + algorithm, clock counts given are minimum to maximum. To calculate the + actual clocks, use the following formula: + + Actual clock = if <> 0 then max(ceiling(log{2} 쿺�), 3) + 6 clocks; + + Actual clock = if = 0 then 9 clocks + + where m is the multiplier. +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF byte-size operation +THEN AX  AL * r/m8 +ELSE (* word or doubleword operation *) + IF OperandSize = 16 + THEN DX:AX  AX * r/m16 + ELSE (* OperandSize = 32 *) + EDX:EAX  EAX * r/m32 + FI; +FI; + +Description + +MUL performs unsigned multiplication. Its actions depend on the size +of its operand, as follows: + + � A byte operand is multiplied by AL; the result is left in AX. The + carry and overflow flags are set to 0 if AH is 0; otherwise, they are + set to 1. + + � A word operand is multiplied by AX; the result is left in DX:AX. + DX contains the high-order 16 bits of the product. The carry and + overflow flags are set to 0 if DX is 0; otherwise, they are set to 1. + + � A doubleword operand is multiplied by EAX and the result is left in + EDX:EAX. EDX contains the high-order 32 bits of the product. The + carry and overflow flags are set to 0 if EDX is 0; otherwise, they are + set to 1. + +Flags Affected + +OF and CF as described above; SF, ZF, AF, PF, and CF are undefined + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +NEG 컴 Two's Complement Negation + +Opcode Instruction Clocks Description + +F6 /3 NEG r/m8 2/6 Two's complement negate r/m byte +F7 /3 NEG r/m16 2/6 Two's complement negate r/m word +F7 /3 NEG r/m32 2/6 Two's complement negate r/m dword + + +Operation + +IF r/m = 0 THEN CF  0 ELSE CF  1; FI; +r/m  - r/m; + +Description + +NEG replaces the value of a register or memory operand with its two's +complement. The operand is subtracted from zero, and the result is placed +in the operand. + +The carry flag is set to 1, unless the operand is zero, in which case the +carry flag is cleared to 0. + +Flags Affected + +CF as described above; OF, SF, ZF, and PF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +NOP 컴 No Operation + +Opcode Instruction Clocks Description + +90 NOP 3 No operation + + +Description + +NOP performs no operation. NOP is a one-byte instruction that takes +up space but affects none of the machine context except (E)IP. + +NOP is an alias mnemonic for the XCHG (E)AX, (E)AX instruction. + +Flags Affected + +None + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +NOT 컴 One's Complement Negation + +Opcode Instruction Clocks Description + +F6 /2 NOT r/m8 2/6 Reverse each bit of r/m byte +F7 /2 NOT r/m16 2/6 Reverse each bit of r/m word +F7 /2 NOT r/m32 2/6 Reverse each bit of r/m dword + + +Operation + +r/m  NOT r/m; + +Description + +NOT inverts the operand; every 1 becomes a 0, and vice versa. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +OR 컴 Logical Inclusive OR + +Opcode Instruction Clocks Description + +0C ib OR AL,imm8 2 OR immediate byte to AL +0D iw OR AX,imm16 2 OR immediate word to AX +0D id OR EAX,imm32 2 OR immediate dword to EAX +80 /1 ib OR r/m8,imm8 2/7 OR immediate byte to r/m byte +81 /1 iw OR r/m16,imm16 2/7 OR immediate word to r/m word +81 /1 id OR r/m32,imm32 2/7 OR immediate dword to r/m dword +83 /1 ib OR r/m16,imm8 2/7 OR sign-extended immediate byte + with r/m word +83 /1 ib OR r/m32,imm8 2/7 OR sign-extended immediate byte + with r/m dword +08 /r OR r/m8,r8 2/6 OR byte register to r/m byte +09 /r OR r/m16,r16 2/6 OR word register to r/m word +09 /r OR r/m32,r32 2/6 OR dword register to r/m dword +0A /r OR r8,r/m8 2/7 OR byte register to r/m byte +0B /r OR r16,r/m16 2/7 OR word register to r/m word +0B /r OR r32,r/m32 2/7 OR dword register to r/m dword + + +Operation + +DEST  DEST OR SRC; +CF  0; +OF  0 + +Description + +OR computes the inclusive OR of its two operands and places the result +in the first operand. Each bit of the result is 0 if both corresponding +bits of the operands are 0; otherwise, each bit is 1. + +Flags Affected + +OF  0, CF  0; SF, ZF, and PF as described in Appendix C; AF is +undefined + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +OUT 컴 Output to Port + +Opcode Instruction Clocks Description + +E6 ib OUT imm8,AL 10,pm=4*/24** Output byte AL to immediate port + number +E7 ib OUT imm8,AX 10,pm=4*/24** Output word AL to immediate port + number +E7 ib OUT imm8,EAX 10,pm=4*/24** Output dword AL to immediate + port number +EE OUT DX,AL 11,pm=5*/25** Output byte AL to port number in +DX +EF OUT DX,AX 11,pm=5*/25** Output word AL to port number in +DX +EF OUT DX,EAX 11,pm=5*/25** Output dword AL to port number + in DX + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + *If CPL � IOPL + **If CPL > IOPL or if in virtual 8086 mode +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) +THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) + IF NOT I-O-Permission (DEST, width(DEST)) + THEN #GP(0); + FI; +FI; +[DEST]  SRC; (* I/O address space used *) + +Description + +OUT transfers a data byte or data word from the register (AL, AX, or +EAX) given as the second operand to the output port numbered by the +first operand. Output to any port from 0 to 65535 is performed by placing +the port number in the DX register and then using an OUT instruction +with DX as the first operand. If the instruction contains an eight-bit port +ID, that value is zero-extended to 16 bits. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the current privilege level is higher (has less privilege) than +IOPL and any of the corresponding I/O permission bits in TSS equals 1 + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +#GP(0) fault if any of the corresponding I/O permission bits in TSS +equals 1 + + +OUTS/OUTSB/OUTSW/OUTSD 컴 Output String to Port + +Opcode Instruction Clocks Description + +6E OUTS DX,r/m8 14,pm=8*/28** Output byte [(E)SI] to port in DX +6F OUTS DX,r/m16 14,pm=8*/28** Output word [(E)SI] to port in DX +6F OUTS DX,r/m32 14,pm=8*/28** Output dword [(E)SI] to port in DX +6E OUTSB 14,pm=8*/28** Output byte DS:[(E)SI] to port in + DX +6F OUTSW 14,pm=8*/28** Output word DS:[(E)SI] to port in + DX +6F OUTSD 14,pm=8*/28** Output dword DS:[(E)SI] to port in + DX + + +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� +NOTES: + *If CPL � IOPL + **If CPL > IOPL or if in virtual 8086 mode +컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� + +Operation + +IF AddressSize = 16 +THEN use SI for source-index; +ELSE (* AddressSize = 32 *) + use ESI for source-index; +FI; + +IF (PE = 1) AND ((VM = 1) OR (CPL > IOPL)) +THEN (* Virtual 8086 mode, or protected mode with CPL > IOPL *) + IF NOT I-O-Permission (DEST, width(DEST)) + THEN #GP(0); + FI; +FI; +IF byte type of instruction +THEN + [DX]  [source-index]; (* Write byte at DX I/O address *) + IF DF = 0 THEN IncDec  1 ELSE IncDec  -1; FI; +FI; +IF OperandSize = 16 +THEN + [DX]  [source-index]; (* Write word at DX I/O address *) + IF DF = 0 THEN IncDec  2 ELSE IncDec  -2; FI; +FI; +IF OperandSize = 32 +THEN + [DX]  [source-index]; (* Write dword at DX I/O address *) + IF DF = 0 THEN IncDec  4 ELSE IncDec  -4; FI; + FI; +FI; +source-index  source-index + IncDec; + +Description + +OUTS transfers data from the memory byte, word, or doubleword at the +source-index register to the output port addressed by the DX register. If +the address-size attribute for this instruction is 16 bits, SI is used for +the source-index register; otherwise, the address-size attribute is 32 bits, +and ESI is used for the source-index register. + +OUTS does not allow specification of the port number as an immediate value. +The port must be addressed through the DX register value. Load the correct +value into DX before executing the OUTS instruction. + +The address of the source data is determined by the contents of +source-index register. Load the correct index value into SI or ESI before +executing the OUTS instruction. + +After the transfer, source-index register is advanced automatically. If +the direction flag is 0 (CLD was executed), the source-index register is +incremented; if the direction flag is 1 (STD was executed), it is +decremented. The amount of the increment or decrement is 1 if a byte is +output, 2 if a word is output, or 4 if a doubleword is output. + +OUTSB, OUTSW, and OUTSD are synonyms for the byte, word, and +doubleword OUTS instructions. OUTS can be preceded by the REP +prefix for block output of CX bytes or words. Refer to the REP +instruction for details on this operation. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if CPL is greater than IOPL and any of the corresponding I/O +permission bits in TSS equals 1; #GP(0) for an illegal memory operand +effective address in the CS, DS, or ES segments; #SS(0) for an illegal +address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +#GP(0) fault if any of the corresponding I/O permission bits in TSS +equals 1; #PF(fault-code) for a page fault + + +POP 컴 Pop a Word from the Stack + +Opcode Instruction Clocks Description + +8F /0 POP m16 5 Pop top of stack into memory word +8F /0 POP m32 5 Pop top of stack into memory dword +58 + rw POP r16 4 Pop top of stack into word register +58 + rd POP r32 4 Pop top of stack into dword register +1F POP DS 7,pm=21 Pop top of stack into DS +07 POP ES 7,pm=21 Pop top of stack into ES +17 POP SS 7,pm=21 Pop top of stack into SS +0F A1 POP FS 7,pm=21 Pop top of stack into FS +0F A9 POP GS 7,pm=21 Pop top of stack into GS + + +Operation + +IF StackAddrSize = 16 +THEN + IF OperandSize = 16 + THEN + DEST  (SS:SP); (* copy a word *) + SP  SP + 2; + ELSE (* OperandSize = 32 *) + DEST  (SS:SP); (* copy a dword *) + SP  SP + 4; + FI; +ELSE (* StackAddrSize = 32 * ) + IF OperandSize = 16 + THEN + DEST  (SS:ESP); (* copy a word *) + ESP  ESP + 2; + ELSE (* OperandSize = 32 *) + DEST  (SS:ESP); (* copy a dword *) + ESP  ESP + 4; + FI; +FI; + +Description + +POP replaces the previous contents of the memory, the register, or the +segment register operand with the word on the top of the 80386 stack, +addressed by SS:SP (address-size attribute of 16 bits) or SS:ESP +(addresssize attribute of 32 bits). The stack pointer SP is incremented +by 2 for an operand-size of 16 bits or by 4 for an operand-size of 32 bits. +It then points to the new top of stack. + +POP CS is not an 80386 instruction. Popping from the stack into the CS +register is accomplished with a RET instruction. + +If the destination operand is a segment register (DS, ES, FS, GS, or +SS), the value popped must be a selector. In protected mode, loading the +selector initiates automatic loading of the descriptor information +associated with that selector into the hidden part of the segment register; +loading also initiates validation of both the selector and the descriptor +information. + +A null value (0000-0003) may be popped into the DS, ES, FS, or GS +register without causing a protection exception. An attempt to reference +a segment whose corresponding segment register is loaded with a null +value causes a #GP(0) exception. No memory reference occurs. The saved +value of the segment register is null. + +A POP SS instruction inhibits all interrupts, including NMI, until after +execution of the next instruction. This allows sequential execution of POP +SS and POP eSP instructions without danger of having an invalid stack +during an interrupt. However, use of the LSS instruction is the preferred +method of loading the SS and eSP registers. + +Loading a segment register while in protected mode results in special +checks and actions, as described in the following listing: + +IF SS is loaded: + IF selector is null THEN #GP(0); + Selector index must be within its descriptor table limits ELSE + #GP(selector); + Selector's RPL must equal CPL ELSE #GP(selector); + AR byte must indicate a writable data segment ELSE #GP(selector); + DPL in the AR byte must equal CPL ELSE #GP(selector); + Segment must be marked present ELSE #SS(selector); + Load SS register with selector; + Load SS register with descriptor; + +IF DS, ES, FS or GS is loaded with non-null selector: + AR byte must indicate data or readable code segment ELSE + #GP(selector); + IF data or nonconforming code + THEN both the RPL and the CPL must be less than or equal to DPL in + AR byte + ELSE #GP(selector); + FI; + Segment must be marked present ELSE #NP(selector); + Load segment register with selector; + Load segment register with descriptor; + +IF DS, ES, FS, or GS is loaded with a null selector: + Load segment register with selector + Clear valid bit in invisible portion of register + +Flags Affected + +None + +Protected Mode Exceptions + +#GP, #SS, and #NP if a segment register is being loaded; #SS(0) if the +current top of stack is not within the stack segment; #GP(0) if the result +is in a nonwritable segment; #GP(0) for an illegal memory operand +effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for an +illegal address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +POPA/POPAD 컴 Pop all General Registers + +Opcode Instruction Clocks Description + +61 POPA 24 Pop DI, SI, BP, SP, BX, DX, CX, and AX +61 POPAD 24 Pop EDI, ESI, EBP, ESP, EDX, ECX, and EAX + + +Operation + +IF OperandSize = 16 (* instruction = POPA *) +THEN + DI  Pop(); + SI  Pop(); + BP  Pop(); + throwaway  Pop (); (* Skip SP *) + BX  Pop(); + DX  Pop(); + CX  Pop(); + AX  Pop(); +ELSE (* OperandSize = 32, instruction = POPAD *) + EDI  Pop(); + ESI  Pop(); + EBP  Pop(); + throwaway  Pop (); (* Skip ESP *) + EBX  Pop(); + EDX  Pop(); + ECX  Pop(); + EAX  Pop(); +FI; + +Description + +POPA pops the eight 16-bit general registers. However, the SP value is +discarded instead of loaded into SP. POPA reverses a previous PUSHA, +restoring the general registers to their values before PUSHA was +executed. The first register popped is DI. + +POPAD pops the eight 32-bit general registers. The ESP value is +discarded instead of loaded into ESP. POPAD reverses the previous +PUSHAD, restoring the general registers to their values before PUSHAD +was executed. The first register popped is EDI. + +Flags Affected + +None + +Protected Mode Exceptions + +#SS(0) if the starting or ending stack address is not within the stack +segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +POPF/POPFD 컴 Pop Stack into FLAGS or EFLAGS Register + +Opcode Instruction Clocks Description + +9D POPF 5 Pop top of stack FLAGS +9D POPFD 5 Pop top of stack into EFLAGS + + +Operation + +Flags  Pop(); + +Description + +POPF/POPFD pops the word or doubleword on the top of the stack and +stores the value in the flags register. If the operand-size attribute of +the instruction is 16 bits, then a word is popped and the value is stored in +FLAGS. If the operand-size attribute is 32 bits, then a doubleword is popped +and the value is stored in EFLAGS. + +Refer to Chapter 2 and Chapter 4 for information about the FLAGS +and EFLAGS registers. Note that bits 16 and 17 of EFLAGS, called +VM and RF, respectively, are not affected by POPF or POPFD. + +The I/O privilege level is altered only when executing at privilege level +0. The interrupt flag is altered only when executing at a level at least as +privileged as the I/O privilege level. (Real-address mode is equivalent to +privilege level 0.) If a POPF instruction is executed with insufficient +privilege, an exception does not occur, but the privileged bits do not +change. + +Flags Affected + +All flags except VM and RF + +Protected Mode Exceptions + +#SS(0) if the top of stack is not within the stack segment + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +#GP(0) fault if IOPL is less than 3, to permit emulation + + +PUSH 컴 Push Operand onto the Stack + +Opcode Instruction Clocks Description + +FF /6 PUSH m16 5 Push memory word +FF /6 PUSH m32 5 Push memory dword +50 + /r PUSH r16 2 Push register word +50 + /r PUSH r32 2 Push register dword +6A PUSH imm8 2 Push immediate byte +68 PUSH imm16 2 Push immediate word +68 PUSH imm32 2 Push immediate dword +0E PUSH CS 2 Push CS +16 PUSH SS 2 Push SS +1E PUSH DS 2 Push DS +06 PUSH ES 2 Push ES +0F A0 PUSH FS 2 Push FS +OF A8 PUSH GS 2 Push GS + + +Operation + +IF StackAddrSize = 16 +THEN + IF OperandSize = 16 THEN + SP  SP - 2; + (SS:SP)  (SOURCE); (* word assignment *) + ELSE + SP  SP - 4; + (SS:SP)  (SOURCE); (* dword assignment *) + FI; +ELSE (* StackAddrSize = 32 *) + IF OperandSize = 16 + THEN + ESP  ESP - 2; + (SS:ESP)  (SOURCE); (* word assignment *) + ELSE + ESP  ESP - 4; + (SS:ESP)  (SOURCE); (* dword assignment *) + FI; +FI; + +Description + +PUSH decrements the stack pointer by 2 if the operand-size attribute of +the instruction is 16 bits; otherwise, it decrements the stack pointer by +4. PUSH then places the operand on the new top of stack, which is +pointed to by the stack pointer. + +The 80386 PUSH eSP instruction pushes the value of eSP as it existed +before the instruction. This differs from the 8086, where PUSH SP +pushes the new value (decremented by 2). + +Flags Affected + +None + +Protected Mode Exceptions + +#SS(0) if the new value of SP or ESP is outside the stack segment limit; +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +None; if SP or ESP is 1, the 80386 shuts down due to a lack of stack +space + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +PUSHA/PUSHAD 컴 Push all General Registers + +Opcode Instruction Clocks Description + +60 PUSHA 18 Push AX, CX, DX, BX, original SP, BP, SI, and + DI +60 PUSHAD 18 Push EAX, ECX, EDX, EBX, original ESP, EBP, + ESI, and EDI + + +Operation + +IF OperandSize = 16 (* PUSHA instruction *) +THEN + Temp  (SP); + Push(AX); + Push(CX); + Push(DX); + Push(BX); + Push(Temp); + Push(BP); + Push(SI); + Push(DI); +ELSE (* OperandSize = 32, PUSHAD instruction *) + Temp  (ESP); + Push(EAX); + Push(ECX); + Push(EDX); + Push(EBX); + Push(Temp); + Push(EBP); + Push(ESI); + Push(EDI); +FI; + +Description + +PUSHA and PUSHAD save the 16-bit or 32-bit general registers, +respectively, on the 80386 stack. PUSHA decrements the stack pointer +(SP) by 16 to hold the eight word values. PUSHAD decrements the +stack pointer (ESP) by 32 to hold the eight doubleword values. Because +the registers are pushed onto the stack in the order in which they were +given, they appear in the 16 or 32 new stack bytes in reverse order. The +last register pushed is DI or EDI. + +Flags Affected + +None + +Protected Mode Exceptions + +#SS(0) if the starting or ending stack address is outside the stack segment +limit; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Before executing PUSHA or PUSHAD, the 80386 shuts down if SP or +ESP equals 1, 3, or 5; if SP or ESP equals 7, 9, 11, 13, or 15, exception +13 occurs + +Virtual 8086 Mode Exceptions + +Same exceptions as in real-address mode; #PF(fault-code) for a page +fault + + +PUSHF/PUSHFD 컴 Push Flags Register onto the Stack + +Opcode Instruction Clocks Description + +9C PUSHF 4 Push FLAGS +9C PUSHFD 4 Push EFLAGS + + +Operation + +IF OperandSize = 32 +THEN push(EFLAGS); +ELSE push(FLAGS); +FI; + +Description + +PUSHF decrements the stack pointer by 2 and copies the FLAGS +register to the new top of stack; PUSHFD decrements the stack pointer by +4, and the 80386 EFLAGS register is copied to the new top of stack +which is pointed to by SS:eSP. Refer to Chapter 2 and Chapter 4 for +information on the EFLAGS register. + +Flags Affected + +None + +Protected Mode Exceptions + +#SS(0) if the new value of eSP is outside the stack segment boundaries + +Real Address Mode Exceptions + +None; the 80386 shuts down due to a lack of stack space + +Virtual 8086 Mode Exceptions + +#GP(0) fault if IOPL is less than 3, to permit emulation + + +RCL/RCR/ROL/ROR 컴 Rotate + + +Opcode Instruction Clocks Description + +D0 /2 RCL r/m8,1 9/10 Rotate 9 bits (CF,r/m byte) left + once +D2 /2 RCL r/m8,CL 9/10 Rotate 9 bits (CF,r/m byte) left CL + times +C0 /2 ib RCL r/m8,imm8 9/10 Rotate 9 bits (CF,r/m byte) left + imm8 times +D1 /2 RCL r/m16,1 9/10 Rotate 17 bits (CF,r/m word) left + once +D3 /2 RCL r/m16,CL 9/10 Rotate 17 bits (CF,r/m word) left + CL times +C1 /2 ib RCL r/m16,imm8 9/10 Rotate 17 bits (CF,r/m word) left + imm8 times +D1 /2 RCL r/m32,1 9/10 Rotate 33 bits (CF,r/m dword) left + once +D3 /2 RCL r/m32,CL 9/10 Rotate 33 bits (CF,r/m dword) left + CL times +C1 /2 ib RCL r/m32,imm8 9/10 Rotate 33 bits (CF,r/m dword) left + imm8 times +D0 /3 RCR r/m8,1 9/10 Rotate 9 bits (CF,r/m byte) right + once +D2 /3 RCR r/m8,CL 9/10 Rotate 9 bits (CF,r/m byte) right + CL times +C0 /3 ib RCR r/m8,imm8 9/10 Rotate 9 bits (CF,r/m byte) right + imm8 times +D1 /3 RCR r/m16,1 9/10 Rotate 17 bits (CF,r/m word) right + once +D3 /3 RCR r/m16,CL 9/10 Rotate 17 bits (CF,r/m word) right + CL times +C1 /3 ib RCR r/m16,imm8 9/10 Rotate 17 bits (CF,r/m word) right + imm8 times +D1 /3 RCR r/m32,1 9/10 Rotate 33 bits (CF,r/m dword) right + once +D3 /3 RCR r/m32,CL 9/10 Rotate 33 bits (CF,r/m dword) right + CL times +C1 /3 ib RCR r/m32,imm8 9/10 Rotate 33 bits (CF,r/m dword) right + imm8 times +D0 /0 ROL r/m8,1 3/7 Rotate 8 bits r/m byte left once +D2 /0 ROL r/m8,CL 3/7 Rotate 8 bits r/m byte left CL + times +C0 /0 ib ROL r/m8,imm8 3/7 Rotate 8 bits r/m byte left imm8 + times +D1 /0 ROL r/m16,1 3/7 Rotate 16 bits r/m word left once +D3 /0 ROL r/m16,CL 3/7 Rotate 16 bits r/m word left CL + times +C1 /0 ib ROL r/m16,imm8 3/7 Rotate 16 bits r/m word left imm8 + times +D1 /0 ROL r/m32,1 3/7 Rotate 32 bits r/m dword left once +D3 /0 ROL r/m32,CL 3/7 Rotate 32 bits r/m dword left CL + times +C1 /0 ib ROL r/m32,imm8 3/7 Rotate 32 bits r/m dword left imm8 + times +D0 /1 ROR r/m8,1 3/7 Rotate 8 bits r/m byte right once +D2 /1 ROR r/m8,CL 3/7 Rotate 8 bits r/m byte right CL + times +C0 /1 ib ROR r/m8,imm8 3/7 Rotate 8 bits r/m word right imm8 + times +D1 /1 ROR r/m16,1 3/7 Rotate 16 bits r/m word right once +D3 /1 ROR r/m16,CL 3/7 Rotate 16 bits r/m word right CL + times +C1 /1 ib ROR r/m16,imm8 3/7 Rotate 16 bits r/m word right imm8 + times +D1 /1 ROR r/m32,1 3/7 Rotate 32 bits r/m dword right once +D3 /1 ROR r/m32,CL 3/7 Rotate 32 bits r/m dword right CL + times +C1 /1 ib ROR r/m32,imm8 3/7 Rotate 32 bits r/m dword right imm8 + times + + +Operation + +(* ROL - Rotate Left *) +temp  COUNT; +WHILE (temp <> 0) +DO + tmpcf  high-order bit of (r/m); + r/m  r/m * 2 + (tmpcf); + temp  temp - 1; +OD; +IF COUNT = 1 +THEN + IF high-order bit of r/m <> CF + THEN OF  1; + ELSE OF  0; + FI; +ELSE OF  undefined; +FI; +(* ROR - Rotate Right *) +temp  COUNT; +WHILE (temp <> 0 ) +DO + tmpcf  low-order bit of (r/m); + r/m  r/m / 2 + (tmpcf * 2^(width(r/m))); + temp  temp - 1; +DO; +IF COUNT = 1 +THEN + IF (high-order bit of r/m) <> (bit next to high-order bit of r/m) + THEN OF  1; + ELSE OF  0; + FI; +ELSE OF  undefined; +FI; + +Description + +Each rotate instruction shifts the bits of the register or memory operand +given. The left rotate instructions shift all the bits upward, except for +the top bit, which is returned to the bottom. The right rotate instructions +do the reverse: the bits shift downward until the bottom bit arrives at +the top. + +For the RCL and RCR instructions, the carry flag is part of the rotated +quantity. RCL shifts the carry flag into the bottom bit and shifts the top +bit into the carry flag; RCR shifts the carry flag into the top bit and +shifts the bottom bit into the carry flag. For the ROL and ROR +instructions, the original value of the carry flag is not a part of the +result, but the carry flag receives a copy of the bit that was shifted from +one end to the other. + +The rotate is repeated the number of times indicated by the second +operand, which is either an immediate number or the contents of the CL +register. To reduce the maximum instruction execution time, the 80386 +does not allow rotation counts greater than 31. If a rotation count greater +than 31 is attempted, only the bottom five bits of the rotation are used. +The 8086 does not mask rotation counts. The 80386 in Virtual 8086 Mode does +mask rotation counts. + +The overflow flag is defined only for the single-rotate forms of the +instructions (second operand = 1). It is undefined in all other cases. For +left shifts/rotates, the CF bit after the shift is XORed with the +high-order result bit. For right shifts/rotates, the high-order two bits of +the result are XORed to get OF. + +Flags Affected + +OF only for single rotates; OF is undefined for multi-bit rotates; CF as +described above + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +REP/REPE/REPZ/REPNE/REPNZ 컴 Repeat Following String Operation + + +Opcode Instruction Clocks Description + +F3 6C REP INS r/m8, DX 13+6*(E)CX, + pm=7+6*(E)CX +If CPL � IOPL/ + 27+6*(E)CX +If CPL > IOPL or if in virtual 8086 mode Input (E)CX bytes from port + DX into ES:[(E)DI] +F3 6D REP INS r/m16,DX 13+6*(E)CX, + pm=7+6*(E)CX +If CPL � IOPL/ + 27+6*(E)CX +If CPL > IOPL or if in virtual 8086 mode Input (E)CX words from port + DX into ES:[(E)DI] +F3 6D REP INS r/m32,DX 13+6*(E)CX, + pm=7+6*(E)CX +If CPL � IOPL/ + 27+6*(E)CX +If CPL > IOPL or if in virtual 8086 mode Input (E)CX dwords from port + DX into ES:[(E)DI] +F3 A4 REP MOVS m8,m8 5+4*(E)CX Move (E)CX bytes from + [(E)SI] to ES:[(E)DI] +F3 A5 REP MOVS m16,m16 5+4*(E)CX Move (E)CX words from + [(E)SI] to ES:[(E)DI] +F3 A5 REP MOVS m32,m32 5+4*(E)CX Move (E)CX dwords from + [(E)SI] to ES:[(E)DI] +F3 6E REP OUTS DX,r/m8 5+12*(E)CX, + pm=6+5*(E)CX +If CPL � IOPL/ + 26+5*(E)CX +If CPL > IOPL or if in virtual 8086 mode Output (E)CX bytes from + [(E)SI] to port DX +F3 6F REP OUTS DX,r/m16 5+12*(E)CX, + pm=6+5*(E)CX +If CPL � IOPL/ + 26+5*(E)CX +If CPL > IOPL or if in virtual 8086 mode Output (E)CX words from + [(E)SI] to port DX +F3 6F REP OUTS DX,r/m32 5+12*(E)CX, + pm=6+5*(E)CX +If CPL � IOPL/ + 26+5*(E)CX +If CPL > IOPL or if in virtual 8086 mode Output (E)CX dwords from + [(E)SI] to port DX +F3 AA REP STOS m8 5+5*(E)CX Fill (E)CX bytes at + ES:[(E)DI] with AL +F3 AB REP STOS m16 5+5*(E)CX Fill (E)CX words at + ES:[(E)DI] with AX +F3 AB REP STOS m32 5+5*(E)CX Fill (E)CX dwords at + ES:[(E)DI] with EAX +F3 A6 REPE CMPS m8,m8 5+9*N Find nonmatching bytes in + ES:[(E)DI] and [(E)SI] +F3 A7 REPE CMPS m16,m16 5+9*N Find nonmatching words in + ES:[(E)DI] and [(E)SI] +F3 A7 REPE CMPS m32,m32 5+9*N Find nonmatching dwords in + ES:[(E)DI] and [(E)SI] +F3 AE REPE SCAS m8 5+8*N Find non-AL byte starting + at ES:[(E)DI] +F3 AF REPE SCAS m16 5+8*N Find non-AX word starting + at ES:[(E)DI] +F3 AF REPE SCAS m32 5+8*N Find non-EAX dword starting + at ES:[(E)DI] +F2 A6 REPNE CMPS m8,m8 5+9*N Find matching bytes in + ES:[(E)DI] and [(E)SI] +F2 A7 REPNE CMPS m16,m16 5+9*N Find matching words in + ES:[(E)DI] and [(E)SI] +F2 A7 REPNE CMPS m32,m32 5+9*N Find matching dwords in + ES:[(E)DI] and [(E)SI] +F2 AE REPNE SCAS m8 5+8*N Find AL, starting at + ES:[(E)DI] +F2 AF REPNE SCAS m16 5+8*N Find AX, starting at + ES:[(E)DI] +F2 AF REPNE SCAS m32 5+8*N Find EAX, starting at + ES:[(E)DI] + + +Operation + +IF AddressSize = 16 +THEN use CX for CountReg; +ELSE (* AddressSize = 32 *) use ECX for CountReg; +FI; +WHILE CountReg <> 0 +DO + service pending interrupts (if any); + perform primitive string instruction; + CountReg  CountReg - 1; + IF primitive operation is CMPB, CMPW, SCAB, or SCAW + THEN + IF (instruction is REP/REPE/REPZ) AND (ZF=1) + THEN exit WHILE loop + ELSE + IF (instruction is REPNZ or REPNE) AND (ZF=0) + THEN exit WHILE loop; + FI; + FI; + FI; +OD; + +Description + +REP, REPE (repeat while equal), and REPNE (repeat while not equal) +are prefix that are applied to string operation. Each prefix cause the +string instruction that follows to be repeated the number of times +indicated in the count register or (for REPE and REPNE) until the +indicated condition in the zero flag is no longer met. + +Synonymous forms of REPE and REPNE are REPZ and REPNZ, +respectively. + +The REP prefixes apply only to one string instruction at a time. To repeat +a block of instructions, use the LOOP instruction or another looping +construct. + +The precise action for each iteration is as follows: + + 1. If the address-size attribute is 16 bits, use CX for the count + register; if the address-size attribute is 32 bits, use ECX for the + count register. + + 2. Check CX. If it is zero, exit the iteration, and move to the next + instruction. + + 3. Acknowledge any pending interrupts. + + 4. Perform the string operation once. + + 5. Decrement CX or ECX by one; no flags are modified. + + 6. Check the zero flag if the string operation is SCAS or CMPS. If + the repeat condition does not hold, exit the iteration and move to + the next instruction. Exit the iteration if the prefix is REPE and ZF + is 0 (the last comparison was not equal), or if the prefix is REPNE + and ZF is one (the last comparison was equal). + + 7. Return to step 1 for the next iteration. + +Repeated CMPS and SCAS instructions can be exited if the count is +exhausted or if the zero flag fails the repeat condition. These two cases +can be distinguished by using either the JCXZ instruction, or by using +the conditional jumps that test the zero flag (JZ, JNZ, and JNE). + +Flags Affected + +ZF by REP CMPS and REP SCAS as described above + +Protected Mode Exceptions + +#UD if a repeat prefix is used before an instruction that is not in the +list above; further exceptions can be generated when the string operation is +executed; refer to the descriptions of the string instructions themselves + +Real Address Mode Exceptions + +Interrupt 6 if a repeat prefix is used before an instruction that is not in +the list above; further exceptions can be generated when the string +operation is executed; refer to the descriptions of the string instructions +themselves + +Virtual 8086 Mode Exceptions + +#UD if a repeat prefix is used before an instruction that is not in the +list above; further exceptions can be generated when the string operation is +executed; refer to the descriptions of the string instructions themselves + +Notes + +Not all input/output ports can handle the rate at which the REP INS +and REP OUTS instructions execute. + + +RET 컴 Return from Procedure + +Opcode Instruction Clocks Description + +C3 RET 10+m Return (near) to caller +CB RET 18+m,pm=32+m Return (far) to caller, same + privilege +CB RET pm=68 Return (far), lesser privilege, + switch stacks +C2 iw RET imm16 10+m Return (near), pop imm16 bytes of + parameters +CA iw RET imm16 18+m,pm=32+m Return (far), same privilege, pop + imm16 bytes +CA iw RET imm16 pm=68 Return (far), lesser privilege, pop + imm16 bytes + + +Operation + +IF instruction = near RET +THEN; + IF OperandSize = 16 + THEN + IP  Pop(); + EIP  EIP AND 0000FFFFH; + ELSE (* OperandSize = 32 *) + EIP  Pop(); + FI; + IF instruction has immediate operand THEN eSP  eSP + imm16; FI; +FI; + +IF (PE = 0 OR (PE = 1 AND VM = 1)) + (* real mode or virtual 8086 mode *) + AND instruction = far RET +THEN; + IF OperandSize = 16 + THEN + IP  Pop(); + EIP  EIP AND 0000FFFFH; + CS  Pop(); (* 16-bit pop *) + ELSE (* OperandSize = 32 *) + EIP  Pop(); + CS  Pop(); (* 32-bit pop, high-order 16-bits discarded *) + FI; + IF instruction has immediate operand THEN eSP  eSP + imm16; FI; +FI; + +IF (PE = 1 AND VM = 0) (* Protected mode, not V86 mode *) + AND instruction = far RET +THEN + IF OperandSize=32 + THEN Third word on stack must be within stack limits else #SS(0); + ELSE Second word on stack must be within stack limits else #SS(0); + FI; + Return selector RPL must be � CPL ELSE #GP(return selector) + IF return selector RPL = CPL + THEN GOTO SAME-LEVEL; + ELSE GOTO OUTER-PRIVILEGE-LEVEL; + FI; +FI; + +SAME-LEVEL: + Return selector must be non-null ELSE #GP(0) + Selector index must be within its descriptor table limits ELSE + #GP(selector) + Descriptor AR byte must indicate code segment ELSE #GP(selector) + IF non-conforming + THEN code segment DPL must equal CPL; + ELSE #GP(selector); + FI; + IF conforming + THEN code segment DPL must be � CPL; + ELSE #GP(selector); + FI; + Code segment must be present ELSE #NP(selector); + Top word on stack must be within stack limits ELSE #SS(0); + IP must be in code segment limit ELSE #GP(0); + IF OperandSize=32 + THEN + Load CS:EIP from stack + Load CS register with descriptor + Increment eSP by 8 plus the immediate offset if it exists + ELSE (* OperandSize=16 *) + Load CS:IP from stack + Load CS register with descriptor + Increment eSP by 4 plus the immediate offset if it exists + FI; + +OUTER-PRIVILEGE-LEVEL: + IF OperandSize=32 + THEN Top (16+immediate) bytes on stack must be within stack limits + ELSE #SS(0); + ELSE Top (8+immediate) bytes on stack must be within stack limits ELSE + #SS(0); + FI; + Examine return CS selector and associated descriptor: + Selector must be non-null ELSE #GP(0); + Selector index must be within its descriptor table limits ELSE + #GP(selector) + Descriptor AR byte must indicate code segment ELSE #GP(selector); + IF non-conforming + THEN code segment DPL must equal return selector RPL + ELSE #GP(selector); + FI; + IF conforming + THEN code segment DPL must be � return selector RPL; + ELSE #GP(selector); + FI; + Segment must be present ELSE #NP(selector) + Examine return SS selector and associated descriptor: + Selector must be non-null ELSE #GP(0); + Selector index must be within its descriptor table limits + ELSE #GP(selector); + Selector RPL must equal the RPL of the return CS selector ELSE + #GP(selector); + Descriptor AR byte must indicate a writable data segment ELSE + #GP(selector); + Descriptor DPL must equal the RPL of the return CS selector ELSE + #GP(selector); + Segment must be present ELSE #NP(selector); + IP must be in code segment limit ELSE #GP(0); + Set CPL to the RPL of the return CS selector; + IF OperandMode=32 + THEN + Load CS:EIP from stack; + Set CS RPL to CPL; + Increment eSP by 8 plus the immediate offset if it exists; + Load SS:eSP from stack; + ELSE (* OperandMode=16 *) + Load CS:IP from stack; + Set CS RPL to CPL; + Increment eSP by 4 plus the immediate offset if it exists; + Load SS:eSP from stack; + FI; + Load the CS register with the return CS descriptor; + Load the SS register with the return SS descriptor; + For each of ES, FS, GS, and DS + DO + IF the current register setting is not valid for the outer level, + set the register to null (selector  AR  0); + To be valid, the register setting must satisfy the following + properties: + Selector index must be within descriptor table limits; + Descriptor AR byte must indicate data or readable code segment; + IF segment is data or non-conforming code, THEN + DPL must be � CPL, or DPL must be � RPL; + FI; + OD; + +Description + +RET transfers control to a return address located on the stack. The +address is usually placed on the stack by a CALL instruction, and the +return is made to the instruction that follows the CALL. + +The optional numeric parameter to RET gives the number of stack bytes +(OperandMode=16) or words (OperandMode=32) to be released after the return +address is popped. These items are typically used as input parameters to the +procedure called. + +For the intrasegment (near) return, the address on the stack is a segment +offset, which is popped into the instruction pointer. The CS register is +unchanged. For the intersegment (far) return, the address on the stack +is a long pointer. The offset is popped first, followed by the selector. + +In real mode, CS and IP are loaded directly. In Protected Mode, an +intersegment return causes the processor to check the descriptor +addressed by the return selector. The AR byte of the descriptor must +indicate a code segment of equal or lesser privilege (or greater or equal +numeric value) than the current privilege level. Returns to a lesser +privilege level cause the stack to be reloaded from the value saved beyond +the parameter block. + +The DS, ES, FS, and GS segment registers can be set to 0 by the RET +instruction during an interlevel transfer. If these registers refer to +segments that cannot be used by the new privilege level, they are set to +0 to prevent unauthorized access from the new privilege level. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP, #NP, or #SS, as described under "Operation" above; #PF(fault-code) for +a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would be outside the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +SAHF 컴 Store AH into Flags + +Opcode Instruction Clocks Description + +9E SAHF 3 Store AH into flags SF ZF xx AF xx PF xx CF + + +Operation + +SF:ZF:xx:AF:xx:PF:xx:CF  AH; + +Description + +SAHF loads the flags listed above with values from the AH register, +from bits 7, 6, 4, 2, and 0, respectively. + +Flags Affected + +SF, ZF, AF, PF, and CF as described above + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +SAL/SAR/SHL/SHR 컴 Shift Instructions + + +Opcode Instruction Clocks Description + +D0 /4 SAL r/m8,1 3/7 Multiply r/m byte by 2, once +D2 /4 SAL r/m8,CL 3/7 Multiply r/m byte by 2, CL times +C0 /4 ib SAL r/m8,imm8 3/7 Multiply r/m byte by 2, imm8 + times +D1 /4 SAL r/m16,1 3/7 Multiply r/m word by 2, once +D3 /4 SAL r/m16,CL 3/7 Multiply r/m word by 2, CL times +C1 /4 ib SAL r/m16,imm8 3/7 Multiply r/m word by 2, imm8 + times +D1 /4 SAL r/m32,1 3/7 Multiply r/m dword by 2, once +D3 /4 SAL r/m32,CL 3/7 Multiply r/m dword by 2, CL + times +C1 /4 ib SAL r/m32,imm8 3/7 Multiply r/m dword by 2, imm8 + times +D0 /7 SAR r/m8,1 3/7 Signed divide^(1) r/m byte by 2, + once +D2 /7 SAR r/m8,CL 3/7 Signed divide^(1) r/m byte by 2, + CL times +C0 /7 ib SAR r/m8,imm8 3/7 Signed divide^(1) r/m byte by 2, + imm8 times +D1 /7 SAR r/m16,1 3/7 Signed divide^(1) r/m word by 2, + once +D3 /7 SAR r/m16,CL 3/7 Signed divide^(1) r/m word by 2, + CL times +C1 /7 ib SAR r/m16,imm8 3/7 Signed divide^(1) r/m word by 2, + imm8 times +D1 /7 SAR r/m32,1 3/7 Signed divide^(1) r/m dword by 2, + once +D3 /7 SAR r/m32,CL 3/7 Signed divide^(1) r/m dword by 2, + CL times +C1 /7 ib SAR r/m32,imm8 3/7 Signed divide^(1) r/m dword by 2, + imm8 times +D0 /4 SHL r/m8,1 3/7 Multiply r/m byte by 2, once +D2 /4 SHL r/m8,CL 3/7 Multiply r/m byte by 2, CL times +C0 /4 ib SHL r/m8,imm8 3/7 Multiply r/m byte by 2, imm8 + times +D1 /4 SHL r/m16,1 3/7 Multiply r/m word by 2, once +D3 /4 SHL r/m16,CL 3/7 Multiply r/m word by 2, CL times +C1 /4 ib SHL r/m16,imm8 3/7 Multiply r/m word by 2, imm8 + times +D1 /4 SHL r/m32,1 3/7 Multiply r/m dword by 2, once +D3 /4 SHL r/m32,CL 3/7 Multiply r/m dword by 2, CL + times +C1 /4 ib SHL r/m32,imm8 3/7 Multiply r/m dword by 2, imm8 + times +D0 /5 SHR r/m8,1 3/7 Unsigned divide r/m byte by 2, + once +D2 /5 SHR r/m8,CL 3/7 Unsigned divide r/m byte by 2, + CL times +C0 /5 ib SHR r/m8,imm8 3/7 Unsigned divide r/m byte by 2, + imm8 times +D1 /5 SHR r/m16,1 3/7 Unsigned divide r/m word by 2, + once +D3 /5 SHR r/m16,CL 3/7 Unsigned divide r/m word by 2, + CL times +C1 /5 ib SHR r/m16,imm8 3/7 Unsigned divide r/m word by 2, + imm8 times +D1 /5 SHR r/m32,1 3/7 Unsigned divide r/m dword by 2, + once +D3 /5 SHR r/m32,CL 3/7 Unsigned divide r/m dword by 2, + CL times +C1 /5 ib SHR r/m32,imm8 3/7 Unsigned divide r/m dword by 2, + imm8 times + + +Not the same division as IDIV; rounding is toward negative infinity. + +Operation + +(* COUNT is the second parameter *) +(temp)  COUNT; +WHILE (temp <> 0) +DO + IF instruction is SAL or SHL + THEN CF  high-order bit of r/m; + FI; + IF instruction is SAR or SHR + THEN CF  low-order bit of r/m; + FI; + IF instruction = SAL or SHL + THEN r/m  r/m * 2; + FI; + IF instruction = SAR + THEN r/m  r/m /2 (*Signed divide, rounding toward negative infinity*); + FI; + IF instruction = SHR + THEN r/m  r/m / 2; (* Unsigned divide *); + FI; + temp  temp - 1; +OD; +(* Determine overflow for the various instructions *) +IF COUNT = 1 +THEN + IF instruction is SAL or SHL + THEN OF  high-order bit of r/m <> (CF); + FI; + IF instruction is SAR + THEN OF  0; + FI; + IF instruction is SHR + THEN OF  high-order bit of operand; + FI; +ELSE OF  undefined; +FI; + +Description + +SAL (or its synonym, SHL) shifts the bits of the operand upward. The +high-order bit is shifted into the carry flag, and the low-order bit is set +to 0. + +SAR and SHR shift the bits of the operand downward. The low-order +bit is shifted into the carry flag. The effect is to divide the operand by +2. SAR performs a signed divide with rounding toward negative infinity (not +the same as IDIV); the high-order bit remains the same. SHR performs an +unsigned divide; the high-order bit is set to 0. + +The shift is repeated the number of times indicated by the second +operand, which is either an immediate number or the contents of the CL +register. To reduce the maximum execution time, the 80386 does not +allow shift counts greater than 31. If a shift count greater than 31 is +attempted, only the bottom five bits of the shift count are used. (The +8086 uses all eight bits of the shift count.) + +The overflow flag is set only if the single-shift forms of the instructions +are used. For left shifts, OF is set to 0 if the high bit of the answer is +the same as the result of the carry flag (i.e., the top two bits of the +original operand were the same); OF is set to 1 if they are different. For +SAR, OF is set to 0 for all single shifts. For SHR, OF is set to the +high-order bit of the original operand. + +Flags Affected + +OF for single shifts; OF is undefined for multiple shifts; CF, ZF, PF, +and SF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +SBB 컴 Integer Subtraction with Borrow + + +Opcode Instruction Clocks Description + +1C ib SBB AL,imm8 2 Subtract with borrow immediate byte + from AL +1D iw SBB AX,imm16 2 Subtract with borrow immediate word + from AX +1D id SBB EAX,imm32 2 Subtract with borrow immediate + dword from EAX +80 /3 ib SBB r/m8,imm8 2/7 Subtract with borrow immediate byte + from r/m byte +81 /3 iw SBB r/m16,imm16 2/7 Subtract with borrow immediate word + from r/m word +81 /3 id SBB r/m32,imm32 2/7 Subtract with borrow immediate + dword from r/m dword +83 /3 ib SBB r/m16,imm8 2/7 Subtract with borrow sign-extended + immediate byte from r/m word +83 /3 ib SBB r/m32,imm8 2/7 Subtract with borrow sign-extended + immediate byte from r/m dword +18 /r SBB r/m8,r8 2/6 Subtract with borrow byte register + from r/m byte +19 /r SBB r/m16,r16 2/6 Subtract with borrow word register + from r/m word +19 /r SBB r/m32,r32 2/6 Subtract with borrow dword register + from r/m dword +1A /r SBB r8,r/m8 2/7 Subtract with borrow byte register + from r/m byte +1B /r SBB r16,r/m16 2/7 Subtract with borrow word register + from r/m word +1B /r SBB r32,r/m32 2/7 Subtract with borrow dword register + from r/m dword + + +Operation + +IF SRC is a byte and DEST is a word or dword +THEN DEST = DEST - (SignExtend(SRC) + CF) +ELSE DEST  DEST - (SRC + CF); + +Description + +SBB adds the second operand (DEST) to the carry flag (CF) and +subtracts the result from the first operand (SRC). The result of the +subtraction is assigned to the first operand (DEST), and the flags are +set accordingly. + +When an immediate byte value is subtracted from a word operand, the +immediate value is first sign-extended. + +Flags Affected + +OF, SF, ZF, AF, PF, and CF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +SCAS/SCASB/SCASW/SCASD 컴 Compare String Data + +Opcode Instruction Clocks Description + +AE SCAS m8 7 Compare bytes AL-ES:[DI], update (E)DI +AF SCAS m16 7 Compare words AX-ES:[DI], update (E)DI +AF SCAS m32 7 Compare dwords EAX-ES:[DI], update (E)DI +AE SCASB 7 Compare bytes AL-ES:[DI], update (E)DI +AF SCASW 7 Compare words AX-ES:[DI], update (E)DI +AF SCASD 7 Compare dwords EAX-ES:[DI], update (E)DI + + +Operation + +IF AddressSize = 16 +THEN use DI for dest-index; +ELSE (* AddressSize = 32 *) use EDI for dest-index; +FI; +IF byte type of instruction +THEN + AL - [dest-index]; (* Compare byte in AL and dest *) + IF DF = 0 THEN IndDec  1 ELSE IncDec  -1; FI; +ELSE + IF OperandSize = 16 + THEN + AX - [dest-index]; (* compare word in AL and dest *) + IF DF = 0 THEN IncDec  2 ELSE IncDec  -2; FI; + ELSE (* OperandSize = 32 *) + EAX - [dest-index];(* compare dword in EAX & dest *) + IF DF = 0 THEN IncDec  4 ELSE IncDec  -4; FI; + FI; +FI; +dest-index = dest-index + IncDec + +Description + +SCAS subtracts the memory byte or word at the destination register from +the AL, AX or EAX register. The result is discarded; only the flags are set. +The operand must be addressable from the ES segment; no segment override is +possible. + +If the address-size attribute for this instruction is 16 bits, DI is used +as the destination register; otherwise, the address-size attribute is 32 +bits and EDI is used. + +The address of the memory data being compared is determined solely by the +contents of the destination register, not by the operand to SCAS. The +operand validates ES segment addressability and determines the data type. +Load the correct index value into DI or EDI before executing SCAS. + +After the comparison is made, the destination register is automatically +updated. If the direction flag is 0 (CLD was executed), the destination +register is incremented; if the direction flag is 1 (STD was executed), it +is decremented. The increments or decrements are by 1 if bytes are compared, +by 2 if words are compared, or by 4 if doublewords are compared. + +SCASB, SCASW, and SCASD are synonyms for the byte, word and +doubleword SCAS instructions that don't require operands. They are +simpler to code, but provide no type or segment checking. + +SCAS can be preceded by the REPE or REPNE prefix for a block search +of CX or ECX bytes or words. Refer to the REP instruction for further +details. + +Flags Affected + +OF, SF, ZF, AF, PF, and CF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +SETcc 컴 Byte Set on Condition + + +Opcode Instruction Clocks Description + +0F 97 SETA r/m8 4/5 Set byte if above (CF=0 and ZF=0) +0F 93 SETAE r/m8 4/5 Set byte if above or equal (CF=0) +0F 92 SETB r/m8 4/5 Set byte if below (CF=1) +0F 96 SETBE r/m8 4/5 Set byte if below or equal (CF=1 or (ZF=1) +0F 92 SETC r/m8 4/5 Set if carry (CF=1) +0F 94 SETE r/m8 4/5 Set byte if equal (ZF=1) +0F 9F SETG r/m8 4/5 Set byte if greater (ZF=0 or SF=OF) +0F 9D SETGE r/m8 4/5 Set byte if greater or equal (SF=OF) +0F 9C SETL r/m8 4/5 Set byte if less (SF<>OF) +0F 9E SETLE r/m8 4/5 Set byte if less or equal (ZF=1 and + SF<>OF) +0F 96 SETNA r/m8 4/5 Set byte if not above (CF=1) +0F 92 SETNAE r/m8 4/5 Set byte if not above or equal (CF=1) +0F 93 SETNB r/m8 4/5 Set byte if not below (CF=0) +0F 97 SETNBE r/m8 4/5 Set byte if not below or equal (CF=0 and + ZF=0) +0F 93 SETNC r/m8 4/5 Set byte if not carry (CF=0) +0F 95 SETNE r/m8 4/5 Set byte if not equal (ZF=0) +0F 9E SETNG r/m8 4/5 Set byte if not greater (ZF=1 or SF<>OF) +0F 9C SETNGE r/m8 4/5 Set if not greater or equal (SF<>OF) +0F 9D SETNL r/m8 4/5 Set byte if not less (SF=OF) +0F 9F SETNLE r/m8 4/5 Set byte if not less or equal (ZF=1 and + SF<>OF) +0F 91 SETNO r/m8 4/5 Set byte if not overflow (OF=0) +0F 9B SETNP r/m8 4/5 Set byte if not parity (PF=0) +0F 99 SETNS r/m8 4/5 Set byte if not sign (SF=0) +0F 95 SETNZ r/m8 4/5 Set byte if not zero (ZF=0) +0F 90 SETO r/m8 4/5 Set byte if overflow (OF=1) +0F 9A SETP r/m8 4/5 Set byte if parity (PF=1) +0F 9A SETPE r/m8 4/5 Set byte if parity even (PF=1) +0F 9B SETPO r/m8 4/5 Set byte if parity odd (PF=0) +0F 98 SETS r/m8 4/5 Set byte if sign (SF=1) +0F 94 SETZ r/m8 4/5 Set byte if zero (ZF=1) + + +Operation + +IF condition THEN r/m8  1 ELSE r/m8  0; FI; + +Description + +SETcc stores a byte at the destination specified by the effective address +or register if the condition is met, or a 0 byte if the condition is not +met. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a non-writable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +SGDT/SIDT 컴 Store Global/Interrupt Descriptor Table Register + +Opcode Instruction Clocks Description + +0F 01 /0 SGDT m 9 Store GDTR to m +0F 01 /1 SIDT m 9 Store IDTR to m + + +Operation + +DEST  48-bit BASE/LIMIT register contents; + +Description + +SGDT/SIDT copies the contents of the descriptor table register the six +bytes of memory indicated by the operand. The LIMIT field of the +register is assigned to the first word at the effective address. If the +operand-size attribute is 32 bits, the next three bytes are assigned the +BASE field of the register, and the fourth byte is written with zero. The +last byte is undefined. Otherwise, if the operand-size attribute is 16 +bits, the next four bytes are assigned the 32-bit BASE field of the +register. + +SGDT and SIDT are used only in operating system software; they are +not used in application programs. + +Flags Affected + +None + +Protected Mode Exceptions + +Interrupt 6 if the destination operand is a register; #GP(0) if the +destination is in a nonwritable segment; #GP(0) for an illegal memory +operand effective address in the CS, DS, ES, FS, or GS segments; #SS(0) for +an illegal address in the SS segment; #PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 6 if the destination operand is a register; Interrupt 13 if any +part of the operand would lie outside of the effective address space from +0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + +Compatability Note + +The 16-bit forms of the SGDT/SIDT instructions are compatible with +the 80286, if the value in the upper eight bits is not referenced. The +80286 stores 1's in these upper bits, whereas the 80386 stores 0's if the +operand-size attribute is 16 bits. These bits were specified as undefined +by the SGDT/SIDT instructions in the iAPX 286 Programmer's +Reference Manual. + + +SHLD 컴 Double Precision Shift Left + +Opcode Instruction Clocks Description + +0F A4 SHLD r/m16,r16,imm8 3/7 r/m16 gets SHL of r/m16 concatenated + with r16 +0F A4 SHLD r/m32,r32,imm8 3/7 r/m32 gets SHL of r/m32 concatenated + with r32 +0F A5 SHLD r/m16,r16,CL 3/7 r/m16 gets SHL of r/m16 concatenated + with r16 +0F A5 SHLD r/m32,r32,CL 3/7 r/m32 gets SHL of r/m32 concatenated + with r32 + + +Operation + +(* count is an unsigned integer corresponding to the last operand of the +instruction, either an immediate byte or the byte in register CL *) +ShiftAmt  count MOD 32; +inBits  register; (* Allow overlapped operands *) +IF ShiftAmt = 0 +THEN no operation +ELSE + IF ShiftAmt � OperandSize + THEN (* Bad parameters *) + r/m  UNDEFINED; + CF, OF, SF, ZF, AF, PF  UNDEFINED; + ELSE (* Perform the shift *) + CF  BIT[Base, OperandSize - ShiftAmt]; + (* Last bit shifted out on exit *) + FOR i  OperandSize - 1 DOWNTO ShiftAmt + DO + BIT[Base, i]  BIT[Base, i - ShiftAmt]; + OF; + FOR i  ShiftAmt - 1 DOWNTO 0 + DO + BIT[Base, i]  BIT[inBits, i - ShiftAmt + OperandSize]; + OD; + Set SF, ZF, PF (r/m); + (* SF, ZF, PF are set according to the value of the result *) + AF  UNDEFINED; + FI; +FI; + +Description + +SHLD shifts the first operand provided by the r/m field to the left as +many bits as specified by the count operand. The second operand (r16 or r32) +provides the bits to shift in from the right (starting with bit 0). The +result is stored back into the r/m operand. The register remains unaltered. + +The count operand is provided by either an immediate byte or the contents +of the CL register. These operands are taken MODULO 32 to provide a number +between 0 and 31 by which to shift. Because the bits to shift are provided +by the specified registers, the operation is useful for multiprecision +shifts (64 bits or more). The SF, ZF and PF flags are set according to the +value of the result. CS is set to the value of the last bit shifted out. OF +and AF are left undefined. + +Flags Affected + +OF, SF, ZF, PF, and CF as described above; AF and OF are undefined + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +SHRD 컴 Double Precision Shift Right + +Opcode Instruction Clocks Description + +0F AC SHRD r/m16,r16,imm8 3/7 r/m16 gets SHR of r/m16 concatenated + with r16 +0F AC SHRD r/m32,r32,imm8 3/7 r/m32 gets SHR of r/m32 concatenated + with r32 +0F AD SHRD r/m16,r16,CL 3/7 r/m16 gets SHR of r/m16 concatenated + with r16 +0F AD SHRD r/m32,r32,CL 3/7 r/m32 gets SHR of r/m32 concatenated + with r32 + + +Operation + +(* count is an unsigned integer corresponding to the last operand of the +instruction, either an immediate byte or the byte in register CL *) +ShiftAmt  count MOD 32; +inBits  register; (* Allow overlapped operands *) +IF ShiftAmt = 0 +THEN no operation +ELSE + IF ShiftAmt � OperandSize + THEN (* Bad parameters *) + r/m  UNDEFINED; + CF, OF, SF, ZF, AF, PF  UNDEFINED; + ELSE (* Perform the shift *) + CF  BIT[r/m, ShiftAmt - 1]; (* last bit shifted out on exit *) + FOR i  0 TO OperandSize - 1 - ShiftAmt + DO + BIT[r/m, i]  BIT[r/m, i - ShiftAmt]; + OD; + FOR i  OperandSize - ShiftAmt TO OperandSize - 1 + DO + BIT[r/m,i]  BIT[inBits,i+ShiftAmt - OperandSize]; + OD; + Set SF, ZF, PF (r/m); + (* SF, ZF, PF are set according to the value of the result *) + Set SF, ZF, PF (r/m); + AF  UNDEFINED; + FI; +FI; + +Description + +SHRD shifts the first operand provided by the r/m field to the right as many +bits as specified by the count operand. The second operand (r16 or r32) +provides the bits to shift in from the left (starting with bit 31). The +result is stored back into the r/m operand. The register remains unaltered. + +The count operand is provided by either an immediate byte or the contents +of the CL register. These operands are taken MODULO 32 to provide a number +between 0 and 31 by which to shift. Because the bits to shift are provided +by the specified register, the operation is useful for multi-precision +shifts (64 bits or more). The SF, ZF and PF flags are set according to the +value of the result. CS is set to the value of the last bit shifted out. OF +and AF are left undefined. + +Flags Affected + +OF, SF, ZF, PF, and CF as described above; AF and OF are undefined + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +SLDT 컴 Store Local Descriptor Table Register + +Opcode Instruction Clocks Description + +0F 00 /0 SLDT r/m16 pm=2/2 Store LDTR to EA word + + +Operation + +r/m16  LDTR; + +Description + +SLDT stores the Local Descriptor Table Register (LDTR) in the two-byte +register or memory location indicated by the effective address operand. +This register is a selector that points into the Global Descriptor Table. + +SLDT is used only in operating system software. It is not used in +application programs. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 6; SLDT is not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +The operand-size attribute has no effect on the operation of the +instruction. + + +SMSW 컴 Store Machine Status Word + +Opcode Instruction Clocks Description + +0F 01 /4 SMSW r/m16 2/3,pm=2/2 Store machine status word to EA + word + + +Operation + +r/m16  MSW; + +Description + +SMSW stores the machine status word (part of CR0) in the two-byte register +or memory location indicated by the effective address operand. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + +Notes + +This instruction is provided for compatibility with the 80286; 80386 +programs should use MOV ..., CR0. + + +STC 컴 Set Carry Flag + +Opcode Instruction Clocks Description + +F9 STC 2 Set carry flag + + +Operation + +CF  1; + +Description + +STC sets the carry flag to 1. + +Flags Affected + +CF = 1 + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +STD 컴 Set Direction Flag + +Opcode Instruction Clocks Description + +FD STD 2 Set direction flag so (E)SI and/or (E)DI + decrement + + +Operation + +DF  1; + +Description + +STD sets the direction flag to 1, causing all subsequent string operations +to decrement the index registers, (E)SI and/or (E)DI, on which they +operate. + +Flags Affected + +DF = 1 + +Protected Mode Exceptions + +None + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +STI 컴 Set Interrupt Flag + +Opcode Instruction Clocks Description + +F13 STI 3 Set interrupt flag; interrupts enabled at the + end of the next instruction + + +Operation + +IF  1 + +Description + +STI sets the interrupt flag to 1. The 80386 then responds to external +interrupts after executing the next instruction if the next instruction +allows the interrupt flag to remain enabled. If external interrupts are +disabled and you code STI, RET (such as at the end of a subroutine), +the RET is allowed to execute before external interrupts are recognized. +Also, if external interrupts are disabled and you code STI, CLI, then +external interrupts are not recognized because the CLI instruction clears +the interrupt flag during its execution. + +Flags Affected + +IF = 1 + +Protected Mode Exceptions + +#GP(0) if the current privilege level is greater (has less privilege) than +the I/O privilege level + +Real Address Mode Exceptions + +None + +Virtual 8086 Mode Exceptions + +None + + +STOS/STOSB/STOSW/STOSD 컴 Store String Data + +Opcode Instruction Clocks Description + +AA STOS m8 4 Store AL in byte ES:[(E)DI], update (E)DI +AB STOS m16 4 Store AX in word ES:[(E)DI], update (E)DI +AB STOS m32 4 Store EAX in dword ES:[(E)DI], update (E)DI +AA STOSB 4 Store AL in byte ES:[(E)DI], update (E)DI +AB STOSW 4 Store AX in word ES:[(E)DI], update (E)DI +AB STOSD 4 Store EAX in dword ES:[(E)DI], update (E)DI + + +Operation + +IF AddressSize = 16 +THEN use ES:DI for DestReg +ELSE (* AddressSize = 32 *) use ES:EDI for DestReg; +FI; +IF byte type of instruction +THEN + (ES:DestReg)  AL; + IF DF = 0 + THEN DestReg  DestReg + 1; + ELSE DestReg  DestReg - 1; + FI; +ELSE IF OperandSize = 16 + THEN + (ES:DestReg)  AX; + IF DF = 0 + THEN DestReg  DestReg + 2; + ELSE DestReg  DestReg - 2; + FI; + ELSE (* OperandSize = 32 *) + (ES:DestReg)  EAX; + IF DF = 0 + THEN DestReg  DestReg + 4; + ELSE DestReg  DestReg - 4; + FI; + FI; +FI; + +Description + +STOS transfers the contents of all AL, AX, or EAX register to the memory +byte or word given by the destination register relative to the ES segment. +The destination register is DI for an address-size attribute of 16 bits or +EDI for an address-size attribute of 32 bits. + +The destination operand must be addressable from the ES register. A segment +override is not possible. + +The address of the destination is determined by the contents of the +destination register, not by the explicit operand of STOS. This operand is +used only to validate ES segment addressability and to determine the data +type. Load the correct index value into the destination register before +executing STOS. + +After the transfer is made, DI is automatically updated. If the direction +flag is 0 (CLD was executed), DI is incremented; if the direction flag is +1 (STD was executed), DI is decremented. DI is incremented or decremented by +1 if a byte is stored, by 2 if a word is stored, or by 4 if a doubleword is +stored. + +STOSB, STOSW, and STOSD are synonyms for the byte, word, and doubleword STOS +instructions, that do not require an operand. They are simpler to use, but +provide no type or segment checking. + +STOS can be preceded by the REP prefix for a block fill of CX or ECX bytes, +words, or doublewords. Refer to the REP instruction for further details. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +STR 컴 Store Task Register + +Opcode Instruction Clocks Description + +0F 00 /1 STR r/m16 pm=23/27 Load EA word into task register + + +Operation + +r/m  task register; + +Description + +The contents of the task register are copied to the two-byte register or +memory location indicated by the effective address operand. + +STR is used only in operating system software. It is not used in application +programs. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 6; STR is not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode + +Notes + +The operand-size attribute has no effect on this instruction. + + +SUB 컴 Integer Subtraction + +Opcode Instruction Clocks Description + +2C ib SUB AL,imm8 2 Subtract immediate byte from AL +2D iw SUB AX,imm16 2 Subtract immediate word from AX +2D id SUB EAX,imm32 2 Subtract immediate dword from EAX +80 /5 ib SUB r/m8,imm8 2/7 Subtract immediate byte from r/m byte +81 /5 iw SUB r/m16,imm16 2/7 Subtract immediate word from r/m word +81 /5 id SUB r/m32,imm32 2/7 Subtract immediate dword from r/m + dword +83 /5 ib SUB r/m16,imm8 2/7 Subtract sign-extended immediate byte + from r/m word +83 /5 ib SUB r/m32,imm8 2/7 Subtract sign-extended immediate byte + from r/m dword +28 /r SUB r/m8,r8 2/6 Subtract byte register from r/m byte +29 /r SUB r/m16,r16 2/6 Subtract word register from r/m word +29 /r SUB r/m32,r32 2/6 Subtract dword register from r/m + dword +2A /r SUB r8,r/m8 2/7 Subtract byte register from r/m byte +2B /r SUB r16,r/m16 2/7 Subtract word register from r/m word +2B /r SUB r32,r/m32 2/7 Subtract dword register from r/m + dword + + +Operation + +IF SRC is a byte and DEST is a word or dword +THEN DEST = DEST - SignExtend(SRC); +ELSE DEST  DEST - SRC; +FI; + +Description + +SUB subtracts the second operand (SRC) from the first operand (DEST). The +first operand is assigned the result of the subtraction, and the flags are +set accordingly. + +When an immediate byte value is subtracted from a word operand, the +immediate value is first sign-extended to the size of the destination +operand. + +Flags Affected + +OF, SF, ZF, AF, PF, and CF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +TEST 컴 Logical Compare + +Opcode Instruction Clocks Description + +A8 ib TEST AL,imm8 2 AND immediate byte with AL +A9 iw TEST AX,imm16 2 AND immediate word with AX +A9 id TEST EAX,imm32 2 AND immediate dword with EAX +F6 /0 ib TEST r/m8,imm8 2/5 AND immediate byte with r/m byte +F7 /0 iw TEST r/m16,imm16 2/5 AND immediate word with r/m word +F7 /0 id TEST r/m32,imm32 2/5 AND immediate dword with r/m dword +84 /r TEST r/m8,r8 2/5 AND byte register with r/m byte +85 /r TEST r/m16,r16 2/5 AND word register with r/m word +85 /r TEST r/m32,r32 2/5 AND dword register with r/m dword + + +Operation + +DEST : = LeftSRC AND RightSRC; +CF  0; +OF  0; + +Description + +TEST computes the bit-wise logical AND of its two operands. Each bit +of the result is 1 if both of the corresponding bits of the operands are 1; +otherwise, each bit is 0. The result of the operation is discarded and only +the flags are modified. + +Flags Affected + +OF = 0, CF = 0; SF, ZF, and PF as described in Appendix C + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +VERR, VERW 컴 Verify a Segment for Reading or Writing + +Opcode Instruction Clocks Description + +0F 00 /4 VERR r/m16 pm=10/11 Set ZF=1 if segment can be read, + selector in r/m16 +0F 00 /5 VERW r/m16 pm=15/16 Set ZF=1 if segment can be written, + selector in r/m16 + + +Operation + +IF segment with selector at (r/m) is accessible + with current protection level + AND ((segment is readable for VERR) OR + (segment is writable for VERW)) +THEN ZF  0; +ELSE ZF  1; +FI; + +Description + +The two-byte register or memory operand of VERR and VERW contains +the value of a selector. VERR and VERW determine whether the +segment denoted by the selector is reachable from the current privilege +level and whether the segment is readable (VERR) or writable (VERW). +If the segment is accessible, the zero flag is set to 1; if the segment is +not accessible, the zero flag is set to 0. To set ZF, the following +conditions must be met: + + � The selector must denote a descriptor within the bounds of the table + (GDT or LDT); the selector must be "defined." + + � The selector must denote the descriptor of a code or data segment + (not that of a task state segment, LDT, or a gate). + + � For VERR, the segment must be readable. For VERW, the segment + must be a writable data segment. + + � If the code segment is readable and conforming, the descriptor + privilege level (DPL) can be any value for VERR. Otherwise, the + DPL must be greater than or equal to (have less or the same + privilege as) both the current privilege level and the selector's RPL. + +The validation performed is the same as if the segment were loaded into +DS, ES, FS, or GS, and the indicated access (read or write) were +performed. The zero flag receives the result of the validation. The +selector's value cannot result in a protection exception, enabling the +software to anticipate possible segment access problems. + +Flags Affected + +ZF as described above + +Protected Mode Exceptions + +Faults generated by illegal addressing of the memory operand that +contains the selector, the selector is not loaded into any segment +register, and no faults attributable to the selector operand are generated + +#GP(0) for an illegal memory operand effective address in the CS, DS, +ES, FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 6; VERR and VERW are not recognized in Real Address Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +WAIT 컴 Wait until BUSY# Pin is Inactive (HIGH) + +Opcode Instruction Clocks Description + +9B WAIT 6 min. Wait until BUSY pin is inactive (HIGH) + + +Description + +WAIT suspends execution of 80386 instructions until the BUSY# pin is +inactive (high). The BUSY# pin is driven by the 80287 numeric processor +extension. + +Flags Affected + +None + +Protected Mode Exceptions + +#NM if the task-switched flag in the machine status word (the lower 16 bits +of register CR0) is set; #MF if the ERROR# input pin is asserted (i.e., the +80287 has detected an unmasked numeric error) + +Real Address Mode Exceptions + +Same exceptions as in Protected Mode + +Virtual 8086 Mode Exceptions + +Same exceptions as in Protected Mode + + +XCHG 컴 Exchange Register/Memory with Register + +Opcode Instruction Clocks Description + +90 + r XCHG AX,r16 3 Exchange word register with AX +90 + r XCHG r16,AX 3 Exchange word register with AX +90 + r XCHG EAX,r32 3 Exchange dword register with EAX +90 + r XCHG r32,EAX 3 Exchange dword register with EAX +86 /r XCHG r/m8,r8 3 Exchange byte register with EA byte +86 /r XCHG r8,r/m8 3/5 Exchange byte register with EA byte +87 /r XCHG r/m16,r16 3 Exchange word register with EA word +87 /r XCHG r16,r/m16 3/5 Exchange word register with EA word +87 /r XCHG r/m32,r32 3 Exchange dword register with EA dword +87 /r XCHG r32,r/m32 3/5 Exchange dword register with EA dword + + +Operation + +temp  DEST +DEST  SRC +SRC  temp + +Description + +XCHG exchanges two operands. The operands can be in either order. If a +memory operand is involved, BUS LOCK is asserted for the duration of the +exchange, regardless of the presence or absence of the LOCK prefix or of the +value of the IOPL. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) if either operand is in a nonwritable segment; #GP(0) for an +illegal memory operand effective address in the CS, DS, ES, FS, or GS +segments; #SS(0) for an illegal address in the SS segment; #PF(fault-code) +for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault + + +XLAT/XLATB 컴 Table Look-up Translation + +D7 XLAT m8 5 Set AL to memory byte DS:[(E)BX + unsigned AL] +D7 XLATB 5 Set AL to memory byte DS:[(E)BX + unsigned AL] + + +Operation + +IF AddressSize = 16 +THEN + AL  (BX + ZeroExtend(AL)) +ELSE (* AddressSize = 32 *) + AL  (EBX + ZeroExtend(AL)); +FI; + +Description + +XLAT changes the AL register from the table index to the table entry. AL +should be the unsigned index into a table addressed by DS:BX (for an +address-size attribute of 16 bits) or DS:EBX (for an address-size attribute +of 32 bits). + +The operand to XLAT allows for the possibility of a segment override. XLAT +uses the contents of BX even if they differ from the offset of the operand. +The offset of the operand should have been moved intoBX/EBX with a previous +instruction. + +The no-operand form, XLATB, can be used if the BX/EBX table will always +reside in the DS segment. + +Flags Affected + +None + +Protected Mode Exceptions + +#GP(0) for an illegal memory operand effective address in the CS, DS, ES, +FS, or GS segments; #SS(0) for an illegal address in the SS segment; +#PF(fault-code) for a page fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page fault + + +XOR 컴 Logical Exclusive OR + + +Opcode Instruction Clocks Description + +34 ib XOR AL,imm8 2 Exclusive-OR immediate byte to AL +35 iw XOR AX,imm16 2 Exclusive-OR immediate word to AX +35 id XOR EAX,imm32 2 Exclusive-OR immediate dword to EAX +80 /6 ib XOR r/m8,imm8 2/7 Exclusive-OR immediate byte to r/m + byte +81 /6 iw XOR r/m16,imm16 2/7 Exclusive-OR immediate word to r/m + word +81 /6 id XOR r/m32,imm32 2/7 Exclusive-OR immediate dword to r/m + dword +83 /6 ib XOR r/m16,imm8 2/7 XOR sign-extended immediate byte + with r/m word +83 /6 ib XOR r/m32,imm8 2/7 XOR sign-extended immediate byte + with r/m dword +30 /r XOR r/m8,r8 2/6 Exclusive-OR byte register to r/m + byte +31 /r XOR r/m16,r16 2/6 Exclusive-OR word register to r/m + word +31 /r XOR r/m32,r32 2/6 Exclusive-OR dword register to r/m + dword +32 /r XOR r8,r/m8 2/7 Exclusive-OR byte register to r/m + byte +33 /r XOR r16,r/m16 2/7 Exclusive-OR word register to r/m + word +33 /r XOR r32,r/m32 2/7 Exclusive-OR dword register to r/m + dword + + +Operation + +DEST  LeftSRC XOR RightSRC +CF  0 +OF  0 + +Description + +XOR computes the exclusive OR of the two operands. Each bit of the result +is 1 if the corresponding bits of the operands are different; each bit is 0 +if the corresponding bits are the same. The answer replaces the first +operand. + +Flags Affected + +CF = 0, OF = 0; SF, ZF, and PF as described in Appendix C; AF is undefined + +Protected Mode Exceptions + +#GP(0) if the result is in a nonwritable segment; #GP(0) for an illegal +memory operand effective address in the CS, DS, ES, FS, or GS segments; +#SS(0) for an illegal address in the SS segment; #PF(fault-code) for a page +fault + +Real Address Mode Exceptions + +Interrupt 13 if any part of the operand would lie outside of the effective +address space from 0 to 0FFFFH + +Virtual 8086 Mode Exceptions + +Same exceptions as in Real Address Mode; #PF(fault-code) for a page +fault \ No newline at end of file diff --git a/386Intel/README.md b/386Intel/README.md new file mode 100644 index 0000000..3167c00 --- /dev/null +++ b/386Intel/README.md @@ -0,0 +1,14 @@ +This subfolder contains the documents and other stuff for Intel 80386 family. + +[Main Wikipedia article on this family](https://en.wikipedia.org/wiki/Intel_80386) + +The files were given to me (@The-Blue-Wizard) by my friend a long time ago, and the original source for it is unknown. + +These files are typed in IBM PC ASCII (code 437), so these are best viewed using that character set. See https://en.wikipedia.org/wiki/Code_page_437 for information on that character set. + +| Files | Description | +| ----- | ----------- | +| 386INTEL.PT1 | Intel 80386 manual, Part 1 | +| 386INTEL.PT2 | Intel 80386 manual, Part 2 | +| 386INTEL.APA | Intel 80386 manual, Appendix A | +| 386INTEL.APB | Intel 80386 manual, Appendix B |