LITERATURE To order Intel literature write or call: Intel Literature Sales P.O. Box 58130 Santa Clara, CA 95052-8130 Intel Literature: (800) 548-4725* Use the order blank on the facing page or call our Toll Free Number listed above to order literature. Remember to add your local sales tax and a 10% postage charge for U.S. and Canada customers, 20% for outside u.S. customers. Prices are subject to change.
infef LITERATURE SALES ORDER FORM NAME: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ COMPANY: _ _ _ _ _ _ _ _ _ _ _ _ ~ _ _ _ _ _ _ _ _ _ _ _ _ ___ ADDRESS: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ____ CITY: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ STATE: _ _ _ _ ZIP: _ _ _ __ COUNTRY: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ~~ PHONE NO.: ('--_--'-_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ ORDER NO. TITLE QTV.
CUSTOMER SUPPORT CUSTOMER SUPPORT Customer Support is Intel's complete support service that provides Intel customers with hardware support, software support, customer training, and consulting services. For more information contact your local sales offices. After a customer purchases any system hardware or software product, service and support become major factors in determining whether that product will continue to meet a customer's expectations.
80286 AND 80287 PROGRAMMER'S REFERENCE MANUAL 1987
Intel Corporation makes no warranty for the use of its products and assumes no responsibility for any errors which may appear in this document nor does it make a commitment to update the information contained herein. Intel retains the right to make changes to these specifications at any time, without notice. Contact your local sales office to obtain the latest specifications before placing your order.
PREFACE This manual describes the 80286, the most powerful 16-bit microprocessor in the 8086 family, and the 80287 Numeric Processor Extension (NPX). ORGANIZATION OF THIS MANUAL This manual is, essentially, two books in one. The first book describes the 80286, the second the 80287 NPX. 80286 The 80286 contains a table of contents, eleven chapters, four appendices, and an index. For more information on the 80286 book's organization, see its first chapter, Chapter 1, "Introduction to the 80286." Section 1.
TABLE OF CONTENTS CHAPTER 1 Page INTRODUCTION TO THE 80286 General Attributes ... ....... .... ........... ....... ..................... .... ........... ....... ....... ..... ...... ............. 1-1 Modes of Operation .......... ..... ..... ................. ..... .............................. ....... ..... ...... ............. 1-2 Advanced Features ........................................................................................................ 1-2 Memory Management ..............................
TABLE OF CONTENTS Page Rotate Instructions .................................................................................................. Type Conversion and No-Operation Instructions ...................................................... Test and Compare Instructions ..................................................................................... Control Transfer Instructions .........................................................................................
TABLE OF CONTENTS Page Reserved and Dedicated Interrupt Vectors ............................................................... 5-5 System Initialization ........................................................................................................ 5-7 CHAPTER 6 MEMORY MANAGEMENT AND VIRTUAL ADDRESSING Memory Management Overview .................................................................................... 6-1 Virtual Addresses ............. ......... ...... ..... ....... ....... ..........
TABLE OF CONTENTS Page Software Initiated Interrupts .......................................................................................... Interrupt Gates and Trap Gates ..................................................................................... Task Gates and Interrupt Tasks .................................................................................... Scheduling Considerations ........... ...... ......... ...................................... ..... ............ ........
TABLE OF CONTENTS Figures Figure 1-1 2-1 2-2 2-3 2-4 2-5 2-6 2-7 2-8 2-9 2-10 2-11 2-12 2-13 2-14 2-15 3-1 3-2 3-3 3-4 3-5 3-6 3-7 3-8 3-9 3-10 3-11 3-12 3-13 3-14 4-1 4-2 4-2a 4-2b 4-2c 4-2d 5-1 a 5-1 b 5-2 5-3 5-4 6-1 6-2 6-3 6-4 6-5 6-6 6-7 6-8 6-9 Title Page Four Privilege Levels ....... ..... ........... ...... ........ .......... .... .......... .... .......... .................... 1-4 Segmented Virtual Memory ... ................. ...................... ................. ........... ......... ..
TABLE OF CONTENTS Figure 7-1 7-2 7-3 7-4 7-5 7-6 7-7 7-8 7-9 7-10 7-11 7-12 8-1 8-2 8-3 8-4 9-1 9-2 9-3 9-4 10-1 10-2 10-3 11-1 11-2 11-3 B-1 B-2 Title Page Addressing Segments of a Module within a Task .................................................. 7-3 Descriptor Cache Registers ............................................................. '" ..... ......... ...... 7-4 80286 Virtual Address Space ................. ......... ..... ....... ...... ....... ..... .................... ......
TABLE OF CONTENTS Table 9-3 9-4 9-5 10-1 10-2 11-1 8-1 8-2 8-3 C-1 Title Page Reserved Exceptions and Interrupts ...................................................................... 9-9 Interrupt Processing Order ... .... ...... ..... .............. .... ...... ............... .............. ...... ..... ... 9-9 Conditions That Invalidate the TSS ........................................................................ 9-12 MSW 8it Functions ............................................................
inter CUSTOMER SUPPORT CUSTOMER SUPPORT Customer Support is Intel's complete support service that provides Intel customers with hardware support, software support, customer training, and consulting services. For more information contact your local sales offices. After a customer purchases any system hardware or software product, service and support become major factors in determining whether that product will continue to meet a customer's expectations.
Introduction to the 80286 1
CHAPTER 1 INTRODUCTION TO THE 80286 The 80286 is the most powerful 16-bit processor in the 8086 series of microprocessors, which includes the 8086, the 8088, the 80186, the 80188, and the 80286. It is designed for applications that require very high performance. It is also an excellent choice for sophisticated "high end" applications that will benefit from its advanced architectural features: memory management, protection mechanisms, task management, and virtual memory support.
INTRODUCTION TO THE 80286 1.2 MODES OF OPERATION The 80286 can be operated in either of two different modes: Real Address Mode or Protected Virtual Address Mode (also referred to as Protected Mode). In either mode of operation, the 80286 represents an upwardly compatible addition to the 8086 family of processors. In Real Address Mode, the 80286 operates essentially as a very high-performance 8086.
INTRODUCTION TO THE 80286 The 80286, like all members of the 8086 series, supports a segmented memory architecture. The 80286 also fully integrates memory segmentation into a comprehensive protection scheme. This protection scheme includes hardware-enforced length and type checking to protect segments from inadvertent misuse. 1.3.2 Task Management The 80286 is designed to support multi-tasking systems. The architecture provides direct support for the concept of a task.
INTRODUCTION TO THE 80286 LEAST TRUSTED MOST TRUSTED G30108 Figure 1-1. Four Privilege Levels 1.3.4 Support for Operating Systems Most operating systems involve some degree of concurrency, with multiple tasks vying for system resources. The task management mechanisms described above provide the 80286 with inherent support for such multi-tasking systems. Moreover, the advanced memory management features of the 80286 allow the implementation of sophisticated virtual memory systems.
INTRODUCTION TO THE 80286 The chapters in Part I are: Chapter 2, "Architectural Features." This chapter discusses those features of the 80286 architecture that are significant for application programmers. The information presented can also function as an introduction to the machine for system programmers. Memory organization and segmentation, processor registers, addressing modes, and instruction formats are all discussed. Chapter 3, "Basic Instruction Set.
inter INTRODUCTION TO THE 80286 80286 Hardware Reference Manual, order number 210760 Microprocessor and Peripheral Handbook, order number 230843 PL/M-286 User's Guide, order number 121945 80287 Support Library Reference Manual, order number 122129 8086 Software Toolbox Manual, order number 122203 (includes information about 80287 Emulator Software) 1-6
80286 Base Architecture 2
CHAPTER 2 80286 BASE ARCHITECTURE This chapter describes the 80286 application programming environment as seen by assembly language programmers. It is intended to introduce the programmer to those features of the 80286 architecture that directly affect the design and implementation of 80286 application programs. 2.1 MEMORY ORGANIZATION AND SEGMENTATION The main memory of an 80286 system makes up its physical address space. This address space is organized as a sequence of 8-bit quantities, called bytes.
80286 BASE ARCHITECTURE r--------, 20000 CS 8000 r-----.., MAIN PROCEDURE 8600 PROCEDURE 0 _ _ _ _ _... _ _ ___I 0'"-_ _ _ _..1 DATA (A) L..-_ _- - I DATA (B) 0 .._ _ _ _--1 O~ I 7253051 0 _ _ _ _ _... 2000 r-----., A ~----.., o ___ ... ~- O~""';""';_ __I L _______ ...J CURRENTLY ACCESSIBLE G3010B Figure 2-1. Segmented Virtual Memory A byte is 8 contiguous bits starting on an addressable byte boundary. The bits are numbered 0 through 7, starting from the right.
80286 BASE ARCHITECTURE Each byte within a word has its own particular address, and the smaller of the two addresses is used as the address of the word. The byte at this lower address contains the eight least significant bits of the word, while the byte at the higher address contains the eight most significant bits. The arrangement of bytes within words is illustrated in figure 2-2. Note that a word need not be aligned at an even-numbered byte address. This allows maximum flexibility in data structures (e.
80286 BASE ARCHITECTURE Ordinal: An unsigned binary numeric value contained in an 8-bit byte or 16-bit word. Pointer: A 32-bit address quantity composed of a segment selector component and an offset component. Each component is a 16-bit word. String: A contiguous sequence of bytes or words. A string may contain from 1 byte to 64K bytes. ASCII: A byte representation of alphanumeric and control characters using the. ASCII standard of character representation.
80286 BASE ARCHITECTURE 7 SI~~~~ II I1 I I I 0 II SIGN BIT -lj I MAGNITUDE I 7 UNSI~~~~ I I I I I II I 0 ILMSB I MAGNITUDE +1 1514 s~~~g SIGNED 87 0 II Ii I IIi 0 I I Ii I I II SIGN BIT -I j L- MSB MAGNITUDE 31 +3 D~~~~ 11" I 1 +2 +1 1615 II II II I I II I I I Ii 0 0 I III I II II III I SIGN BIT ...
80286 BASE ARCHITECTURE Separate multiplication and division operations are provided for both signed and unsigned binary numbers. The same addition and subtraction instructions are used with signed or unsigned binary values. Conditional jump instructions, as well as an "interrupt on overflow" instruction, can be used following an unsigned operation on an integer to detect overflow into the sign bit. Unpacked decimal numbers are stored as unsigned byte quantities. One digit is stored in each byte.
inter 80286 BASE ARCHITECTURE 2.3 REGISTERS The 80286 contains a total of fourteen registers that are of interest to the application programmer. (Five additional registers used by system programmers are covered in section 10.1.) As shown in figure 2-4, these registers may be grouped into four basic categories: General registers. These eight 16-bit general-purpos~ registers are used primarily to contain operands for arithmetic and logical operations. Segment registers.
80286 BASE ARCHITECTURE stack frame. The use of these general-purpose registers for operand addressing is discussed in section 2.3.3, "Index, Pointer, and Base Registers." Register usage for individual instructions is discussed in chapters 3 and 4. As shown in figure 2-4, eight byte registers overlap four of the 16-bit general registers. These registers are named AH, BH, CH, and DH (high bytes); and AL, BL, CL, and DL (low bytes); they overlap AX, BX, CX, and DX.
80286 BASE ARCHITECTURE Beyond their code and stack requirements, most programs must also fetch and store data in memory. The DS and ES registers allow the specification of two data segments, each addressable by the currently executing program. Accessibility to two separate data areas supports differentiation and access requirements like local procedure data and global process data.
inl:el® 80286 BASE ARCHITECTURE SEG 3FFF SEG 3FFE SEG 3FFD SEG 3FFC SEG 3FFB , I SELECTOR I 1 GIGABYTE VIRTUAL ADDRESS SPACE SEG 4 SEG 3 1 TO 64K BYTES { SEG 2 SEG 1 SEG 0 NOTES: 1. A SELECTOR UNIQUELY IDENTIFIES (NAMES) ONE OF 16K POSSIBLE SEGMENTS IN THE TASK'S VIRTUAL ADDRESS SPACE. 2. THE SELECTOR VALUE DOES NOT SPECIFY THE SEGMENT'S LOCATION IN PHYSICAL MEMORY. 3.
inter 80286 BASE ARCHITECTURE l POP-UP LOGICAL TOP OF STACK + I SS I SP LOGICAL BOTTOM OF STACK (initial SP value) PUSH-DOWN I STACK SEGMENT BASE ADDRESS G3010B Figure 2-7_ 80286 Stack 80286 stack entries are 16 bits wide. Instructions operate on the stack by adding and removing stack items one word at a time, An item is pushed onto the stack (see figure 2-8) by decrementing SP by 2 and writing the item at the new TOS.
80286 BASE ARCHITECTURE STACK OPERATION FOR CODE SEQUENCE: STACK SEGMENT PUSH AX POP AX POPBX 1062 0 0 0 0 1"~~ 1060 SS I SELECTOR I I SP OFFSET I I lOSE 2 2 2 2 105C 3 3 3 3 105A 4 4 4 4 1058 5 5 5 5 6 1056 6 6 1054 7 7 1052 8 8 8 8 1050 9 9 9 9 OF STACK 6 7 I 00001 I NOT PRESENTL V USED EXISTING STACK BEFORE PUSH STACK SEGMENT SS I SELECTOR I I OFFSET SP I 1062 0 1060 1 0 0 0 lOSE 2 2 2 105C 3 3 3 3 105A 4 4 4 4 1
80286 BASE ARCHITECTURE BP IS A CONSTANT POINTER TO STACK BASED VARIABLES AND WORK SPACE, ALL REFERENCES USE BP AND ARE INDEPENDENT OF SP, WHICH MAY VARY DURING A ROUTINE EXECUTION, PROC N PUSH AX PUSH ARRA LSIZE CALL PROC_N+1 - - - - -.....~ PROC_N+1: PUSH BP PUSH CX MOV BP, SP SUB SP, WORK_SPACE "PROCEDURE BODY" MOV SP, BP POP CX POP BP RET BOTTO MOF S TACK t 1"'--'I PARAMETERS RETURN ADDR .- I BP L __ ..
80286 BASE ARCHITECTURE Table 2-1. Implied Segment Usage by Index, Pointer, and Base Registers Register SP BP BX SI 01 BP BX Implied Segment 55 SS OS OS OS, ES for String Operations SS OS + 51, 01 + SI, 01 NOTE: All implied Segment usage, except SP to SS and 01 to ES for String Operations, may be explicitly specified with a segment override prefix for any of the four segments. The prefix precedes the instruction for which explicit reference is desired.
80286 BASE ARCHITECTURE STATUS FLAGS: CARRY--------_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _- - , I PARITY - - - - - - - -_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _--, AUXILIARY CARRY _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _-'-..
80286 BASE ARCHITECTURE The DF flag, like the IF flag, is controlled by instructions (CLD = clear, STD = set) or flag register modification through the stack. Typically, routines that use string instructions will save the flags on the stack, modify DF as necessary via the instructions provided, and restore DF to its original state by restoring the Flag register from the stack before returning. Access or control of the DF flag is not inhibited by the protection mechanism in Protected Mode.
80286 BASE ARCHITECTURE One-operand instructions, such as INC or DEC. The location of the single operand can be specified implicitly, as in AAM (where the register AX contains the operand), or explicitly, as in INC (where the operand can be in any register or memory location). Explicitly specified operands are accessed via one of the addressing modes described in section 2.4.2. Two operand instructions such as MOV, ADD, XOR, etc., generally overwrite one of the two participating operands with the result.
80286 BASE ARCHITECTURE Most memory references do not require the instruction to specify a full 32-bit pointer address. Operands that are located within one of the currently addressable segments, as determined by the four segment registers (see section 2.3.2, "Segment Registers"), can be referenced very efficiently simply by means of the 16-bit offset. This form of address is called by short address.
80286 eASE ARCHITECTURE Table 2-2. Segment Register Selection Rules Memory Reference Needed Implicit Segment Selection Rule Segment Register Used Instructions Code (CS) Automatic with instruction prefetch. Stack Stack (SS) All stack pushes and pops. Any memory reference which uses BP as a base register. Local Data Data (OS) All data references except when relative to stack or string destination. External (Global) Data Extra (ES) Alternate data segment and destination of string operation.
80286 BASE ARCHITECTURE r---..., I I ODE MODULE A ~ DATA CPU CODE MODULE B L I- DATA I I I I CODE DATA STACK - PROCESS STACK I- EXTRA SEGMENT REGISTERS I I PROCESS DATA BLOCK 1 I I [l PRog~~~D BLOCK 2 I I L ___ .J MEMORY G301uo Figure 2-12. Use of Memory Segmentation 2.4.3.3 MEMORY MODE Two modes are !.!sed for simple scalar operands located in memory: Direct Address Mode. The offset of the operand is contained in the instruction as the displacement element.
80286 BASE ARCHITECTURE The following four modes are used for accessing complex data structures in memory (see figure 2-13): Based Mode. The operand is located within the selected segment at an offset computed as the sum of the displacement and the contents of a base register (BX or BP). Based mode is often used to access the same field in different copies of a structure (often called a record).
80286 BASE ARCHITECTURE , 'r 1. BASED MODE + DATE-CODE] MOV AX, [BP ADD [BX BALANCE], CX + I DISPL L BASE I SEGMENT ~ + OPERAND I + r 2. INDEXED MODE r MOV ID [SI], DX SUB BX, DATA_TBL[SI] I INDEX I DISPL L + ~ OPERAND J , 'I' MOV DX, [BP][ill] AND [aX + S~, 3FFH 1 1 FIXED ARRAY + SEGMENT 3. BASED INDEXED I ) INDEX + ~ OPERAND I BASED ARRAY BASE + SEGMENT MOV CX, [ap][si + CNT] SHR [ax 01 MASK] + + BASED STRUCTURE CONTAINING ARRAY G3010B Figure 2-13.
80286 BASE ARCHITECTURE 2.5.1 1/0 Address Space The 80286 provides a separate I/O address space, distinct from physical memory, to address the input/ output ports that are used for external devices. The I/0 address space consists of 216 (64K) individually addressable 8-bit ports. Any two consecutive 8-bit ports can be treated as a 16-bit port. Thus, the I/0 address space can accommodate up to 64K 8-bit ports or up to 32K 16-bit ports. I/0 port addresses 00F8H to OOFFH are reserved by Intel.
80286 BASE ARCHITECTURE MEMORY ADDRESS SPACE 110 DEVICE 1 INTERNAL REGISTER 1-------11-- =====~I. . ___. . . 110 DEVICE 2 INTERNAL REGISTER 1-------1 ======~I. . ___. . . G30108 Figure 2-14. Memory-Mapped 1/0 2.6 INTERRUPTS AND EXCEPTIONS The 80286 architecture supports several mechanisms for interrupting program execution. Internal interrupts are synchronous events that are the responses of the CPU to certain events detected during the execution of an instruction.
80286 BASE ARCHITECTURE The exceptions are: divide error, INTO detected overflow, bounds check, segment overrun, invalid operation code, and processor extension error (see table 2-4). A divide error exception results when the instructions DIY or IDlY are executed with a zero denominator; otherwise, the quotient will be too large for the destination operand (see section 3.3.4 for a discussion of DIY and IDlY).
80286 BASE ARCHITECTURE Table 2-4.
80286 BASE ARCHITECTURE 80186~ 80188 8ASIC INSTRUCTION SET 80286 ~ EXTENDED INSTRUCTION SET SYSTEM CONTROL INSTRUCTION SET G30108 Figure 2-15.
Basic Instruction Set 3
CHAPTER 3 BASIC INSTRUCTION SET ! The base architecture of the 80286 is identical to the complete instruction set of the 8086, 8088, 80188, and 80186 processors. The 80286 instruction set includes new forms of some instructions. These new forms reduce program size and improve the performance and ease of implementation of source code. This chapter describes the instructions which programmers can use to write application software for the 80286.
BASIC INSTRUCTION seT 3.1.2 Stack Manipulation Instructions PUSH (Push) decrements the stack pointer (SP) by two and then transfers a word from the source operand to the top of stack indicated by SP. See figure 3-1. PUSH is often used to place parameters on the stack before calling a procedure; it is also the basic means of storing temporary variables on the stack. The PUSH instruction operates on memory operands, immediate operands (new with the 80286), and register operands (including segment registers).
BASIC INSTRUCTION SET HIGH ADDRESS SS LIMIT SP SS LOW ADDRESS h BEFORE PUSHA AFTER PUSHA PUSHA copies Ihe conlenls of Ihe elghl general reglslers 10 Ihe slack In Ihe above order. The Inslrucllon decremenls SP by 16 bytes (8 words) 10 polnllo Ihe l.sl word pushed on Ihe slack. G30108 Figure 3-2. PUSHA POP (Pop) transfers the word at the current top of stack (indicated by SP) to the destination operand, and then increments SP by two to point to the new top of stack. See figure 3-3.
BASIC INSTRUCTION SET HIGH ADDRESS .. hm====i ~n\\\\\\n\\l\~\\\\\\\ ~\\\\\\\\\\\\\\\\\\\\\\\\ OPERANDS FROM PREVIOUS PUSH INSTRUCTIONS SP_ LOW ADDRESS OPERAND SS Ok , BEFORE POP OPERAND AFTER POP OPERAND POP copies the contents of the slsck location before SP to the operand In the Instruction. POP then Increments SP by 2 bytes (1 word). G3010e Figure 3-3. POP 3.2 FLAG OPERATION WITH THE BASIC INSTRUCTION SET 3.2.
BASIC INSTRUCTION SET 'r ,~y\ OPERANDS FROM PREVIOUS PUSH INSTRUCTIONS m ,~~~ SP "" AX SS LIMIT CX DX BX SP BP SI SP_ DI ~ 1-------4 ~ ~r SS LOW ADDRESS " AFTER BEFORE POPA , POPA POPA copies the contents of seven stack locations to the corresponding general regl.ters. POPA discards the .tored value of SP. G30108 Figure 3-4.
BASIC INSTRUCTION SET STATUS FLAGS: CARRY-----------------------------------------------------------, PARITY - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - , AUXILIARY CARRY - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - , I1 ZERO - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - , SIGN - - - - - - - - - - - - - - - - - - - - - - - - - - - - - , OVERFLOW 15 FLAGS:. 14 NT 13 12 Id.
inter BASIC INSTRUCTION SET Table 3·2. Control Flags' Functions Bit Position Name Function 8 TF Trap (Single Step) Flag-Once set, a single step interrupt occurs after the next instruction executes. TF is cleared by the single step interrupt. 9 IF Interrupt-enable Flag-When set, maskable interrupts will cause the CPU to transfer control to an interrupt vectorspecified location. 10 OF Direction Flag-Causes string instructions to auto deere· ment the appropriate index registers when set.
BASIC INSTRUCTION SET Example: SUB WORDOPRND, AX. Replaces the contents of the destination operand WORDOPRND with the result obtained by subtracting the contents of AX from the contents of the memory word labeled WORDOPRND. SBB (Subtract Integers with Borrow) subtracts the source operand from the destination operand, subtracts 1 if CF is set, and returns the result to the destination operand. The operands may be signed or unsigned bytes or words. SBB may be used to subtract numbers longer than 16 bits.
BASIC INSTRUCTION SET 3.3.4 Division Instructions DIV (Unsigned Integer Divide) performs an unsigned division of the accumulator by the source operand. If the source operand is a byte, it is divided into the double-length dividend assumed to be in registers AL and AH (AH = most significant byte; AL = least significant byte). The single-length quotient is returned in AL, and the single-length remainder is returned in AH.
BASIC INSTRUCTION SET Example: AND WORDOPRND, BX. Replaces the contents of WORDOPRND with the logical "and" of the contents of the memory word labeled WORDOPRND and the contents of BX. NOT (Not) inverts the bits in the specified operand to form a one's complement of the operand. NOT has no effect on the flags. Example: NOT BYTEOPRND. Replaces the original contents of BYTEOPRND with the one's complement of the contents of the memory word labeled BYTEOPRND.
BASIC INSTRUCTION SET SAL (Shift Arithmetic Left) shifts the destination byte or word operand left by one or by the number of bits specified in the count operand (an immediate value or the value contained in CL). The processor shifts zeros in from the right side of the operand as bits exit from the left side. See figure 3-6. Example: SAL BL,2. Shifts the contents of BL left by 2 bits and replaces the two low-order bits with zeros. Example: SAL BL,l.
BASIC INSTRUCTION SET 01, I, I aI a1,1, I, I, I a1,1,1, I aI alai' I BEFORE SHR 01 aI, I, I aI aI, I, I, I, I aI, I, 1,1 aI aI aI--Q~~;~:Y AFTER SHR BY 10 BITS OF CF OPERAND SHR shilts the bits In the register or memory operand to the right by the specified number of bit positions. CF receives the last bit shifted out of the right of the operand. SHR shifts in zeros to fill the vacated bit locations. This instruction operates on byte operands as well as word operands. G30108 Figure 3-7.
BASIC INSTRUCTION SET 3.4.2.2 ROTATE INSTRUCTIONS Rotate instructions allow bits in bytes and words to be rotated. Bits rotated out of an operand are not lost as in a shift, but are "circled" back into the other "end" of the operand. Rotates affect only the carry and overflow flags. CF may act as an extension of the operand in two of the rotate instructions, allowing a bit to be isolated and then tested by a conditional jump instruction (JC or 1NC).
BASIC INSTRUCTION SET 111 o 11 l' 11o 1o 111o 1111111o I o I o I BEFORE RDR 0 [I I 1I 1 I 0 1I 1 1I I I 1 I 1 I 1111010rrG o o o o AFTER RDR BY 1 BIT rl1 o 11I 1 l' o 1o 1o 1111 o 111111101°'TD AFTER RCR BY 8 BITS_ OPERAND CF ROR shifts the bits In the memory or register operand to the right by the specified number of bit positions. It caples each bit shifted out of the right of the operand Into the left of the operand.
BASIC INSTRUCTION SET [2J l' 1 1 1 1 rO--i 0 1 --/1 1 0 1 0 1 0 1 1 111 1 1 0 0 l' l' 0 o 1 l' 1 1 1 1 o 1 l' l' 1 1 0 1 0 1 1 1 1 l' l' 1 o 0 0 o 0 o l' 1 o 1 0 BEFORE RCL l' 1 0 o 1 o 1 1 l' 0 0 Il AFTER RCL BY 1 BIT _ 1 0 o 1 0 AFTER RCL BY 16 BITS OPERAND RCL rotates the bits in the memory or register operand to the left In the same way as ROL except that RCL treats CF as a I·bit extension of the operand.
BASIC INSTRUCTION SET 3.4.3 Type Conversion and No-Operation Instructions The type conversion instructions prepare operands for division. The NOP instruction is a I-byte filler instruction with no effect on registers or flags. CWD (Convert Word to Double-Word) extends the sign of the word in register AX throughout register DX. CWD does not affect any flags. CWD can be used to produce a double-length (double-word) dividend from a word before a word division.
BASIC INSTRUCTION SET 3.6.1 Unconditional Transfer Instructions JMP, CALL, RET, INT and IRET instructions transfer control from one code segment location to another. These locations can be within the same code segment or in different code segments. 3.6.1.1 JUMP INSTRUCTION JMP (Jump) unconditionally transfers control to the target location. JMP is a one-way transfer of execution; it does not save a return address on the stack.
BASIC INSTRUCTION SET Direct JMP outside of the current code segment. Direct JMP instructions that specify a target location outside the current code segment contain a full 32-bit pointer. This pointer consists of a selector for the new code segment and an offset within the new segment. Example: JMP F AR_NEWCODE_FOO. Places the selector contained in the instruction into CS and the offset into IP. The program resumes execution at this location in the new code segment.
BASIC INSTRUCTION SET Examples: CALL NEAR_NEW CODE , CALL SI CALL PTR. CALL CASE_TABLE [BP] CALL FAR-NEWCODE_FOO CALL NEWCODE CALL CALLGATE_FOO CALL CASE_TABLE [BX] .x See the previous treatment of JMP for a discussion of the operations of these instructions. 3.6.1.3 RETURN AND RETURN FROM INTERRUPT INSTRUCTION RET (Return From Procedure) terminates the execution of a procedure and transfers control through a back·link on the stack to the program that originally invoked the procedure.
BASIC INSTRUCTION SET 3.6.2.1 CONDITIONAL JUMP INSTRUCTIONS Table 3·3 shows the conditional transfer mnemonics and their interpretations. The conditional jumps that are listed as pairs are actually the same instruction. The assembler provides the alternate mnemonics for greater clarity within a program listing. 3.6.2.2 LOOP INSTRUCTIONS The loop instructions are conditional jumps that use a value placed in ex to specify the number of repetitions of a software loop.
BASIC INSTRUCTION SET LOOPE (Loop While Equal) and LOOPZ (Loop While Zero) are physically the same instruction. These instructions auto-decrement the ex register before testing ex and ZF for the branch conditions. If ex is non-zero and ZF= 1, the program branches to the target label specified in the instruction. If LOOPE or LOOPZ finds that ex=o or ZF=O, control transfers to the instruction immediately succeeding the LOOPE or LOOPZ instruction. Example: LOOPE START_LOOP (or LOOPZ START_LOOP).
BASIC INSTRUCTION SET Example: INT O. Transfers control to the interrupt service routine specified by a type 0 interrupt, which is reserved for a divide error. INTO (Interrupt on Overflow) invokes a type 4 interrupt if OF is set when the INTO instruction executes. The type 4 interrupt is reserved for this purpose. Example: INTO. If the result of a previous operation has set OF and no intervening operation has reset OF, then INTO invokes a type 4 interrupt.
BASIC INSTRUCTION SET 4. Adjust the memory pointers in DS:SI and ES:DI by incrementing SI and DI if DF is 0 or by decrementing SI and DI if DF is l. 5. Decrement CX (this step does not affect the flags). 6. For SCAS (Scan String) and CMPS(Compare String), check ZF for a match with the repeat condition and stop repeating if the ZF fails to match.
BASIC INSTRUCTION SET seAS (Scan String) subtracts the destination string element at ES:DI from AX or AL and updates the flags AF, SF, ZF, PF, CF and OF. If the values are equal, ZF= 1; otherwise, ZF=O. If DF=O, the processor increments the memory pointer (DI) for the string. The segment register used for the source address can be changed with a segment override prefix while the destination segment register . cannot be overridden. Example: SCASW.
intel" BASIC INSTRUCTION SET Example: LDS SI, STRING_X. Loads DS with the word identifying the segment pointed to by STRING-X, and loads the offset of STRING-X into SI. Specifying SI as the destination operand is a convenient way to prepare for a string operation on a source string that is not in the current data segment. LES (Load Pointer Using ES) operates identically to LDS except that ES receives the offset word rather than DS. Example: LES DI, DESTINATION-X.
BASIC INSTRUCTION SET 3.9.3 Flag Transfer Instructions Though specific instructions exist to alter CF and DF, there is no direct method of altering the other flags. The flag transfer instructions allow a program to alter the other flag bits with the bit manipulation instructions after transferring these flags to the stack or the AH register. The PUSHF and POPF instructions are also useful for preserving the state of the flag register before executing a procedure.
BASIC INSTRUCTION SET 15 14 13 12 11 10 9 8 7 6 5 4 3 2 STACK WORD PUSHF decrements SP by 2 bytes (1 word) and copies the contents of Ihe flag reglsler 10 Ihe lop of slack. POPF loads Ihe flag reg Isler wllh Ihe conlenls of Ihe lasl word pushed onlo Ihe stack. The bit position of each flag Is the same In the stack word as It Is In Ihe flag register. Only programs executing allhe hlghesl privilege level (level 0) may alter the 2-blt 10PL flag.
BASIC INSTRUCTION SET AAS (ASCII Adjust for Subtraction) changes the contents of register AL to a valid unpacked decimal number, and zeros the top 4 bits. AAS must always follow the subtraction of one unpacked decimal operand from another in AL. The carry flag will be set and AH decremented if a borrow was necessary. Example: AAS AAM (ASCII Adjust for Multiplication) corrects the result of a multiplication of two valid unpacked decimal numbers.
BASIC INSTRUCTION SET Example: STI. Sets IF= 1, which enables the processing of maskable external interrupts. Example: CLI. Sets IF=O to disable maskable interrupt processing. HLT (Halt) causes the processor to suspend processing operations pending an interrupt or a system reset. This trusted instruction provides an alternative to an endless software loop in situations where a program must wait for an interrupt.
BASIC INSTRUCTION SET A program contains instructions for the NPX in line with the instructions for the CPU. The system executes these instructions in the same order as they appear in the instruction stream. The NPX operates concurrently with the CPU to provide maximum throughput for numeric calculations. The software emulation of the NPX is transparent to application software but requires more time for execution. 3.12.
BASIC INSTRUCTION SET 3.12.2.4 DATA TRANSFER INSTRUCTIONS The data transfer instructions move operands among the registers and between a register and memory. This group includes the load, store, and exchange instructions. 3.12.2.5 CONSTANT INSTRUCTIONS Each of the constant instructions loads a commonly used constant into an NPX register. The values have a real precision of 64 bits and are accurate to approximately 19 decimal places. The constants loaded by these instructions include 0, 1, Pi, log.
Extended Instruction Set 4
CHAPTER 4 EXTENDED INSTRUCTION SET The instructions described in this chapter extend the capabilities of the base architecture instruction set described in Chapter 3. These extensions consist of new instructions and variations of some instructions that are not strictly part of the base architecture (in other words, not included on the 8086 and 8088). These instructions are also available on the 80186 and 80188.
EXTENDED INSTRUCTION SET OUTS (Output String to Port) transfers a byte or a word string element to an output port from memory. Combined with the REP prefix, OUTS moves a block of information from a series of consecutive memory locations indicated by DS:SI to an output port. Example: REP OUTS WSTRING. Assuming that the program declares WSTRING to be a wordlength string element, the assembler uses the 16-bit form of the OUTS instruction to create the object code for the program.
EXTENDED INSTRUCTION SET The Formal Definition Of The ENTER Instruction For All Cases Is Given By The Following Listing. LEVEL Denotes The Value Of The Second Operand. Push BP Set a temporary value FRAME_PTR : ~ SP If LEVEL> 0 then Repeat (LEVEL -1) times: BP:~ BP-2 Push the word pOinted to by BP End repeat Push FRAME_PTR End If BP : ~ FRAME_PTR SP : ~ SP - first operand. Figure 4-1.
EXTENDED INSTRUCTION SET MAIN PROGRAM (LEXICAL LEVEL 1) PROCEDURE A (LEXICAL LEVEL 2) PROCEDURE B (LEXICAL LEVEL 3) PROCEDURE C (LEXICAL LEVEL 3) PROCEDURE D (LEXICAL LEVEL 4) G30108 Figure 4-2. Variable Access in Nested Procedures 15 0 OLDBP BPFOR MAIN - BPM' } DISPLAY • DYNAMIC STORAGE SP_ 'BPM - BP VALUE FOR MAIN G30108 Figure 4-2a. Stack Frame jor MAiN at Levei 1 4. PROCEDURE C can access only the variables of PROCEDURE A and MAIN.
EXTENDED INSTRUCTION SET 15 0 OlOBP BPM I BPM BPFOR A - BPM DISPLAY BPA" OYNAMIC ) STORAGE SP_ "BPA ~ BP VALUE FOR PROCEOURE A G30108 Figure 4-2b. Stack Frame for Procedure A 15 0 OlO BP BPM BPM BPM BPA BPA BP_ BPM SPA )~~, BPB OYNAMIC ) STORAGE SP_ G30108 Figure 4-2c.
EXTENDED INSTRUCTION SET 15 0 OLDBP BPM BPM BPM BPA BP_ BPA BPM BPA BPB I DISPLAY DYNAMIC ) STORAGE SP_ G30108 Figure 4-2d. Stack Frame for Procedure C at Level 3 Called from B After PROCEDURE A calls PROCEDURE B, ENTER creates a new display for PROCEDURE B with the first word pointing to the previous value of BP, the second word pointing to the value of BP for MAIN, and the third word pointing to the value of BP for A and the last word pointing to the current BP.
EXTENDED INSTRUCTION SET BOUND (Detect Value Out of Range) verifies that the signed value contained in the specified register lies within specified limits. An interrupt (INT 5) occurs if the value contained in the register is less than the lower bound or greater than the upper bound. The BOUND instruction includes two operands. The first operand specifies the register being tested. The second operand contains the effective relative address of the two signed BOUND limit values.
Real Address Mode 5
CHAPTER 5 REAL ADDRESS MODE The 80286 can be operated in either of two modes according to the status of the Protection Enabled bit of the MSW status register. In contrast to the "modes" and "mode bits"
REAL ADDRESS MODE Whenever the 80286 accesses memory in Real Address Mode, it generates a 20-bit physical address from a segment selector and offset value. The segment selector value is left-shifted four bit positions to form the segment base address. The offset is extended with 4 high order zeroes and added to the base to form the physical address (see figure 5-1).
REAL ADDRESS MODE ----- T l 64K SEGMENT B T-. -_~_V_;_LA_-;_-t - -...... BASE OF -'1 SEGMENTB t - - - - - - t - - BASE OF SEGMENT A , G30108 Figure 5-2. Overlapping Segments to Save Physical Memory 5.2 INTERRUPT HANDLING Program interrupts may be generated in either of two distinct ways. An internal interrupt is caused directly by the currently executing program. The execution of a particular instruction results in the occurrence of an interrupt, whether intentionally (e.g.
REAL ADDRESS MODE POINTER TO INTERRUPT HANDLER FOR: PHYSICAL ADDRESS INTERRUPT 255 POINTER INTERRUPT 254 POINTER INTERRUPT 253 POINTER 1020 1016 . 1012 10 • ~~ ~ .. . . . . POINTER 4 INTERRUPT 0 POINTER 0 101 VECTOR 10 9 19 INTERRUPT 1 I 01 2 1 oj 0 G3010a Figure 5-3. Interrupt Vector Table for Real Address Mode Table 5-1. Interrupt Processing Order Order Interrupt 1. 2. 3. 4. 5.
inter REAL ADDRESS MODE 5.2.2 Interrupt Procedures When an interrupt occurs in Real Address Mode, the 8086 performs the following sequence of steps. First, the FLAGS register, as well as the old values of CS and IP, are pushed onto the stack (see figure 5-4). The IF and TF flag bits are cleared. The vector number is then used to read the address of the interrupt service routine from the interrupt table. Execution begins at this address.
REAL ADDRESS MODE Table 5-2.
REAL ADDRESS MODE INTO Detected Overflow (Interrupt 4). Execution of the INTO conditional software interrupt instruction will cause this interrupt to occur if the overflow bit (OF) of the FLAGS register is set. The saved value of CS:IP will point to the next instruction. BOUND Range Exceeded (Interrupt 5). Execution of the BOUND instruction will cause this interrupt to occur if the specified array index is found to be invalid with respect to the given array bounds.
REAL ADDRESS MODE Since the CS register contains FOOO (thus specifying a code segment starting at physical address FOOOO) and the instruction pointer contains FFFO, the processor will execute its first instruction at physical address FFFFOH. The uppermost 16 bytes of physical memory are therefore reserved for initial startup logic. Ordinarily, this location contains an intersegment direct JMP instruction whose target is the actual beginning of a system initialization or restart program.
·Memory Management and Virtual Addressing 6
CHAPTER 6 MEMORY MANAGEMENT AND VIRTUAL ADDRESSING In Protected Virtual Address Mode, the 80286 provides an advanced architecture that retains substantial compatibility with the 8086 and other processors in the 8086 family. In many respects, the baseline architecture of the processor remains constant regardless of the mode of operation. Application programmers continue to use the same set of instructions, addressing modes, and data types in Protected Mode as in Real Address Mode.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING is sufficient to think of a task as an ongoing process, or execution path, that is dedicated to a particular function. In a multi-user time-sharing environment, for example, the processing required to interact with a particular user may be considered as a single task, functionally independent of the other tasks (i.e., users) in the system. 6.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING The remaining 14 bits of the selector component uniquely designate a particular segment. The virtual address space of a program, therefore, may encompass as many as 16,384 (214) distinct segments. Segments themselves are of variable size, ranging from as small as a single byte to as large as 64K (2 16) bytes. Thus, a program's virtual address space may contain, altogether, up to a full gigabyte (2'0 = 214 X 2 16 ) of individually addressable byte locations.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING Within each of the two regions addressable by a program-either the global address space or a particular local address space-as many as 8,192 (2 13 ) distinct segments may be defined. The INDEX field of the segment selector allows for a unique specification of each of these segments.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING o . +7 i!:! m +5 ~a: 7 INTEL RESERVED' MUST BE 0 piDPll~1 TYPE +3 II A BASE23· 1e BASE,s·o t1 . -4 +2 LIMIT 15.0 15 B 7 ACCESS RIGHTS BYTES: P DPL S • • PRESENT DESCRIPTOR PRIVILEGE LEVEL = SEGMENT DESCRIPTOR TYPE - SEGhfENT TYPE AND ACCESS INFORMATION (I.e Figure 6·7) A = ACCESSED .MUST BE SET TO 0 FOR COMPATIBILITY WITH IApX 3B6 G30108 Figure 6·3.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING o 7 INTEL RESERVED' +7 MUST BE 0 pIDPLI~1 +5 I TYPE +3 BASE 23' 16 BASE 15.0 +1 +6 +4 +2 LlMIT 15·0 15 8 7 ACCESS RIGHTS BYTES: P - OPl 5 = = PRESENT DESCRIPTOR PRIVILEGE LEVEL :;::.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING , r ,J I C , RESERVED-ZERO ONE SEGMENT OF THE TASKS LOCAL 1. ADDRESS SPACE , RESERVED-ZERO I (private) 1- BASE 23-16 BASE 15-0 1- BASE"_'6 BASE,S_O SEGMENT LIMIT LIMIT '5-0 LIMIT '5-0 SEGMENT BASE LDT DESCRIPTOR IN THE GDT IN MEMORY ~ ~ ~ ~ DESCRIPTOR TABLES IN RAM SEGMENT IN RAM f-, h G3010B Figure 6-5. LOT Descriptor 6.5 SEGMENTS AND SEGMENT DESCRIPTORS Segments are the basic units of 80286 memory management.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING VIRTUAL ADDRESS I I SELECTOR OFFSET 0- TI DESCRIPTOR TABLE I I TARGET SEGMENT DATUM PHYSICAL ADDRESS I SEGMENT BASE SEGMENT DESCRIPTOR ---INDEX G3010B Figure 6-6. Virtual-to-Physical Address Translation As shown previously in figure 6-3, an 8-byte segment descriptor encodes the following information about a particular segment: Size.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING ' - - - - - - - - - DESCRIPTOR PRIVILEGE LEVEL ' - - - - - - - - - - - PRESENT (I-yes) DATA OR STACK SEGMENT MSB LSB ACCESSED (I-yes) WRITEABLE (I-yes) ' - - - - - EXPAND DOWN (I-down) ' - - - - - - EXECUTABLE (O-no for data) ' - - - - - - - (indicates segment descriptor) ' - - - - - - - - - DESCRIPTOR PRIVILEGE LEVEL '--_ _ _ _ _ _ _ _ PRESENT (I-yes) G30108 Figure 6-7. Segment Descriptor Access Bytes 6.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING, SEGMENT ADDRESS TRANSLATION REGISTERS 48-BIT HIDDEN DESCRIPTOR CACHE 16-BIT I,~_,m ''''~'" DATA SEGMENT REGISTER EXTRA SEGMENT REGISTER STACK SEGMENT REGISTER 63 48 47 4039 ACCESS RIGHTS 16 15 SEGMENT BASE ADDRESS 0 SEGMENT SIZE SYSTEM ADDRESS REGISTERS II------------t------,I 40-BIT EXPLICIT REGISTER GDTR IDTR _ 39 16-BIT VISIBLE SELECTOR INTERRUPT DESCRIPTOR TABLE REGISTER o 16 15 BASE GLOBAL DESCRIPTOR TABLE REGISTER LIMIT 40-BIT HIDDEN DESCRIP
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING Thus, so long as a particular selector value is valid (i.e., it points to a valid segment descriptor within the bounds of the d()scriptor table), it can be readily associated with an 8-byte descriptor. When a selector value is loaded into. the visible part of a segment register, the 80286 automatically loads 6 bytes of the associated descriptor into the hidden part of the register.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING Thus, in most cases, virtual-to-physical address translation is actually performed in two separate steps. First, when a program loads a new value into a segment register, the processor immediately performs a mapping operation; the physical base address of the selected segment (as well as certain additional information) is automatically loaded into the hidden portion of the register.
MEMORY MANAGEMENT AND VIRTUAL ADDRESSING automatically loads the hidden "descriptor" portion of LDTR with five bytes from the chosen LDT descriptor. Thus, size and base information about a particular LDT, as recorded in a memory-resident global descriptor table entry, is cached in the LDTR register. New values may be loaded into the visible portion of the LDTR (and, thus, into the hidden portion as well) in either of two ways.
Protection 7
CHAPTER 7 PROTECTION 7.1 INTRODUCTION In most microprocessor based products, the product's availability, quality, and reliability are determined by the software it contains. Software is often the key to a product's success. Protection is a tool used to shorten software development time, and improve software quality and reliability. Program testing is an important step in developing software. A system with protection will detect software errors more quickly and accurately than a system without protection.
PROTECTION Restricting the addressability of a software module enables an operating system to control system resources and priorities. This is especially important in an environment that supports multiple concurrent users. Multi-user, multi-tasking, and distributed processing systems require this complete control of system resources for efficient, reliable operation. The second aspect of protection is isolating users from each other.
inter PROTECTION ,---, I MODULEA I B S CODE CPU MODULEB DATA 'I I I L_ CODE DATA TASK STACK I I I STACK - - EXTRA SEGMENT REGISTERS TASK DATA BLOCK 1 o I TASK DATA BLOCK 2 I I I 1- _ _ ....1 MEMORY G3010B Figure 7-1. Addressing Segments of a Module within a Task Access control between programs and the operating system is implemented via address space separation and a privilege mechanism.
PROTECTION An important distinction exists between tasks and programs. Programs (e.g., instructions in code segments) are static and consist of a fixed set of code and data segments each with an associated privilege level. The privilege assigned to a program determines what the program may do when executed by a task. Privilege is assigned to a program w~en the system is built or when the program is loaded. Tasks are dynamic; they execute one or more programs.
PROTECTION Each reference into the segment defined by a segment register is checked by the hardware to verify that it is within the defined limits of the segment and is of the proper type. For example, a code segment or read-only data segment cannot be written. All these checks are made before the memory cycle is started; any violation will prevent that cycle from starting and cause an exception to occur. Since the checks are performed concurrently with address formation, there is no performance penalty.
PROTECTION 65535 65535 t + OFFSET 8191 ~>,-_.... o t OFFSET ! ,.--0......_ .... 0 L 65535 • 65535 I OFFSET OFFSET ~......_ ... o + ~,.I.-_.... o 65535 65535 t + OFFSET ...-."'-_-11) 8191 OFFSET I ,.--0......._ L I 65535 t r::loFlsET + LJol OFFSET .... 0 .... 0 8191 ,65535 '--1......._ I TASK B PRIVATE ADDRESS SPACE TASK A PRIVATE ADDRESS SPACE 10 ~ 8191 SHARED ADDRESS SPACE TASK C PRIVATE ADDRESS SPACE TASK B ADDRESS SPACE G30108 Figure 7-3.
PROTECTION 15 23 GOTR I -r I LOTR I I I I IL 23 l I 0 I-- GOT LIMIT LIT1 15 0 J -- LOT SELECTOR -15 - - ··· I GOT BASE I MEMORY I' CPU - "0 -, LOT BASE ··· I I I I LOT LIMIT LOT, -r r-; ..J-I ________ CURRENl LOT ~ I PROGRAM INVISIBLE I LOTn I ....II ·· G30108 Figure 7-4. Local and Global Descriptor Table Definitions 15 3 T I INDEX , o 2 I I 0 T E X T L o means that an event external to the program caused the exception (i.e.
PROTECTION 7.3 PRIVILEGE LEVELS AND PROTECTION As explained in section 6.2, each task has its own separate virtual address space defined by its LDT. All tasks share a common address space defined by the GDT. The system software then has direct access to task data and can treat all pointers in the same way. Protection is required to prevent programs from improperly using code or data that belongs to the operating system.
PROTECTION TASK C G3010B Figure 7-6. Code and Data Segments Assigned to a Privilege Level This is just one example of protection mechanism usage. Levels 1 and 2 may be used in many different ways. The usage (or non-usage) is up to the system designer. Programs at each privilege level are isolated from programs at outer layers, yet cannot affect programs in inner layers.
PROTECTION Task privilege is a dynamic value. It is derived from the code segment currently being executed. Task privilege can change only when a control transfers to a different code segment. Descriptor privilege, including code segment privilege, is assigned when the descriptor (and any associated segment) is created. The system designer assigns privilege directly when the system is constructed with the system builder (see the 80286 Builder User's GUide) or indirectly via a loader.
PROTECTION SELECTOR I~~~/ do 8 BITS I I LJ. 7 ITI~~ 2 1-0 REQUESTED PRIVILEGE LEVEL (RPL) INDICATES SELECTOR PRIVILEGE LEVEL DESIRED 2 TABLE INDICATOR (TI) TI ~ 0 USE GLOBAL DESCRIPTOR TABLE (GOT) INDEX SELECT DESCRIPTOR ENTRY IN TABLE 15-3 1 0 FUNCTION NAME TI ~ 1 USE LOCAL DESCRIPTOR TABLE (LOT) G30108 Figure 7-7. Selector Fields Table 7-1. Segment Access Rights Byte Format Bit Description Name 7 Present 1 means Present and addressable in real memory; 0 means not present.
PROTECTION P DPL 5 E C R A 1 0 1 0 I o 7 P DPL 5 E ED 1 01 1 0 0 W o 7 Readable Code Segment A Writable Code Segment G3010B Figure 7-8. Access Byte Examples Table 7-2.
PROTECTION Since stacks normally occupy different offset ranges (lower limit to OFFFFH) than data segments, the limit field of a segment descriptor can be interpreted in two ways. The Expand Down (ED) bit in the access byte allows offsets for stack segments to be greater than the limit field. When ED is 1, the allowed range of offsets within the segment is limit + 1 to OFFFFH. To allow a full stack segment, set ED to 1 and the limit to OFFFFH.
PROTECTION Three basic kinds of privilege level indicators are used when determining accessibility to a segment for reading and writing. They are termed Current Privilege Level (CPL), Descriptor Privilege Level (DPL), and Requested Privilege Level (RPL). The CPL is simply the privilege level of the code segment that is executing (except if the current code segment is conforming). The CPL is stored as bits 0 and 1 of the CS and SS registers. Bits 0 and 1 of DS and ES are not related to CPL.
PROTECTION Level 3 PUSH CALL Level 2: -E NTE R Level 2 MOV ARPL PUSH CALL SELECTOR LEVEL 2 RPL value doesn't matter at level 3 4, 0 AX, [BPJ+4 [BPJ+6, AX GET CS of return address, RPL=3 Put 3 in RPL field WORD PTR [BPJ+6j Pass selector Level 0 Level 0: -E NTE R Level 0 MOV ARPL 6,0 AX, [BPJ+4 [BPJ+6, AX Get CS of return address, RPL=2 Leaves RPL unchanged Figure 7-9.
PROTECTION To achieve control transfers, a special descriptor type called a gate is provided to mediate the change in privilege level. Control transfer instructions call the gate rather than transfer directly to a code segment. From the viewpoint of the program, a control transfer to a gate is the same as to another code segment. Gates allow programs to use other programs at more privileged levels in the same manner as a program at the same privilege level.
PROTECTION Gate Descriptor Fields Name TYPE P Value 4 5 6 7 0 1 D1 INTEL RESERVED' +7 +5 pi DPL \01 +3 TYPE jx X Xl IX X DPL +4 WORD COUNT +2 DESTINATION OFFSET,s-a IS Call Gate. Task Gate. Interrupt Gate. Trap Gate. Descriptor Contents are not valid. Descriptor Contents are valid. +6 WORD COUNT...., DESTINATION SELECTOR'5-2 +1 Description 0-3 Descriptor Privilege Level. 0-31 Number of words to copy from caller's stack to called procedure's stack. Only used with call gate.
PROTECTION The following is a description of the protection checks performed while transferring control (with the CALL instruction) through a call gate: Verifying that access to the call gate is allowed. One of the protection features provided by call gates is the access checks made to determine if the call gate may be used (i.e., checking if the privilege level of the calling program is adequate). Determining the destination address and whether a privilege transition is required.
inter PROTECTION If the IP value is not within the limit of the code segment, a general protection fault occurs with an error code of O. If a CALL instruction is used, the return address is saved in the normal manner. The only effect of the call gate is to place a different address into CS:IP than that specified in the destination address of the JMP or CALL instruction.
PROTECTION 7.5.1.4 STACK CHANGES CAUSED BY CALL GATES To maintain system integrity, each privilege level has a separate stack. Furthermore, each task normally uses separate stacks from other tasks for each privilege level. These stacks assure sufficient stack space to process calls from less privileged levels. Without them, trusted programs may not work correctly, especially if the calling program does not provide sufficient space on the caller's stack.
PROTECTION t SS:SP FROM TSS HIGHER ADDRESSES OLO SS OLDSP PARM3 DIRECTION OF STACK GROWTH PARM 2 LOWER ADDRESSES ~ PARM 3 PARM 1 PARM 2 OLDCS PARM 1 OLDSS:SP_ ...._ _ _ _... OLDIP NEW SS OLD STACK (AT "OUTER" PRIVILEGE LEVEL) + SP NEW STACK (AT "INNER" PRIVILEGE LEVEL) G30108 Figure 7-12. Stack Contents after an Inter-Level Call The old SS:SP value is then adjusted by the number of bytes indicated in the RET instruction and loaded into SS:SP. The new SP value is not checked for validity.
PROTECTION Table 7-4.
Tasks and State Transitions 8
CHAPTER 8 TASKS AND 5T ATE TRANSITIONS 8.1 INTRODUCTION An 80286 task is a single, sequential thread of execution. Each task can be isolated from all other tasks. There may be many tasks associated with an 80286 CPU, but only one task executes at any time. Switching the CPU from executing one task to executing another can occur as the result of either an interrupt or an inter-task CALL, JMP or IRET. A hardware-recognized data structure defines each task.
TASKS AND STATE TRANSITIONS CPU INTEL RESERVED , TYPE plop+1 TASK REGISTER 0--- T55 -... DESCRIPTOR TYPE I 8A5E 23 . 16 r---------,I I 8A5E,5_0 I LIMIT,S·O IS I I I :I 0 PROGRAM INVISIBLE 15 0 DESCRIPTION 1 AN AVAILABLE TASK STATE SEGMENT MAY BE USED AS THE DESTINATION OF A TASK SWITCH OPERATION. A BUSY TASK STATE SEGMENT CANNOT BE USED AS THE DESTINATION OF A TASK I LIMIT BASE I ____ L 0 --- ]i SWITCH. ------ -----------, I , _...
TASKS AND STATE TRANSITIONS Each TSS consists of two parts, a static portion and a dynamic portion. The static entries are never changed by the 80286, while the dynamic entries are changed by each task switch out of this task. The static portions of this segment are the task LDT selector and the initial SS:SP stack pointer addresses for levels 0-2.
inter TASKS AND STATE TRANSITIONS o +7 o 7 +6 INTEL RESERVED +5 P 1 I 01 0 11 I DPL 10_L B +3 TSS BASE,s_o +1 TSS LIMIT +4 TSS BASE 23 _'6 +2 o B ~ 1 MEANS TASK IS BUSY AND NOT AVAILABLE o 15 • MUST BE SET TO 0 FOR COMPATIBILITY WITH THE 80386 G3010B Figure 8-2. TSS Descriptor The P-bit (Present) flag indicates whether this descriptor contains currently valid information: 1 means yes, 0 no.
TASKS AND STATE TRANSITIONS No new instructions are required for a task switch operation. The standard 8086 JMP, CALL, IRET, or interrupt operations perform this function. The distinction between the standard instruction and a task switch is made either by the type of descriptor referenced (for CALL, JMP, or INT) or by the NT bit (for IRET) in flag word. Using the CALL or INT instruction to switch tasks implies a return is expected from the calIed task.
TASKS AND STATE TRANSITIONS Note that the state of the outgoing task is always saved. If execution of that task is resumed, it will start after the instruction that caused the task switch. The values of the registers will be the same as that when the task stopped running. Any task switch sets the Task Switched (TS) bit in the Machine Status Word (MSW). This flag is used when processor extensions such as the 80287 Numeric Processor Extension are present.
TASKS AND STATE TRANSITIONS 8.4 TASK LINKING The TSS has a field called "back link" which contains the selector of the TSS of a task that should be restarted when the current task completes. The back link field of an interrupt-initiated task is automatically written with the TSS selector of the interrupted task. A task switch initiated by a CALL instruction also points the back link at the outgoing task's TSS.
TASKS AND STATE TRANSITIONS The linking order of tasks may need to be changed to restart an interrupted task before the task that interrupted it completes. To remove a task from the list, trusted operating system software must change the backlink field in the TSS of the interrupting task first, then clear the busy bit in the TSS descriptor of the task removed from the list.
TASKS AND STATE TRANSITIONS Once access to the task gate has been verified, the TSS selector from the gate is read. The RPL of the TSS selector is ignored. From this point, all the checks and actions performed for a JMP or CALL to a TSS after access has been verified are performed (see section 8.4). Figure 8-4 illustrates an example of a task switch through a task gate.
Interrupts and Exceptions 9
CHAPTER 9 INTERRUPTS AND EXCEPTIONS Interrupts and exceptions are special cases of control transfer within a program. An interrupt occurs as a result of an event that is independent of the currently executing program, while exceptions are a direct result of the program currently being executed, Interrupts may be external or internal. External interrupts are generated by either the INTR or NMI input pins. Internal interrupts are caused by the INT instruction.
INTERRUPTS AND EXCEPTIONS Each IDT entry is a 4-word gate descriptor that contains a pointer to the handler. The three types of gates permitted in the IDT are interrupt gates, trap gates (discussed in section 9.3), and task gates (discussed in section 9.5). Interrupt and task gates process interrupts in the same task, while task gates cause a task switch. Any other descriptor type in the IDT will cause an exception if it is referenced by an interrupt.
INTERRUPTS AND EXCEPTIONS The type of gate placed into the IDT for the interrupt vector will control whether other maskable interrupts remain enabled or not during the servicing of that interrupt. The flag word that was saved on the stack reflects the maskable interrupt enable status of the processor prior to the interrupt. The procedure servicing a maskable interrupt can also prevent further maskable interrupts during its work by resetting the IF flag. Non-maskable interrupts are caused by the NMI input.
INTERRUPTS AND EXCEPTIONS +7 +5 INTEL RESERVED' PIDP21 0 10 1 1 +6 UNUSED T I +3 INTERRUPT CODE SEGMENT SELECTOR +1 INTERRUPT CODE OFFSET +4 +2 T = 1 FOR TRAP GATE 'MUST BE SET TO 0 FOR COMPATIBILITY WITH THE 80386 T = 0 FOR INTERRUPT GI\TE G30108 Figure 9-3. Trap/Interrupt Gate Descriptors The access byte contains the Present bit, the descriptor privilege level, and the type identifier. Bits 0-4 of the access byte have a value of 00110 for interrupt gates, 00111 for trap gates.
infel® INTERRUPTS AND EXCEPTIONS OLD SP - NO PRIVILEGE TRANSITION OLD FLAGS OLD CS OLD IP ERROR CODE SP ," SP FROM TSS -- " WITH PRIVILEGE TRANSITION OLD SS OLDSP OLD FLAGS OLDCS OLD IP ERROR CODE SP " SSFROMTSS--~.~'r~------ ______ " ~l! STACK SEGMENT G30108 Figure 9-4. Stack Layout after an Exception with an Error Code If an interrupt gate is used to handle an interrupt, it is assumed that the selected code segment has sufficient privilege to re-enable interrupts.
INTERRUPTS AND EXCEPTIONS Table 9-1, Trap and Interrupt Gate Checks Exception' Check GP Interrupt vector is in lOT limit Error Code lOT entry X 8 + 2 + EXT Trap, Interrupt, or Task Gate in lOT Entry GP IDTentry X 8 + 2 + EXT If INT instruction, gate OPL GP lOT entry X 8 + 2 + EXT P bit of gate is set NP lOT entry X 8 + 2 + EXT Code segment selector is in descriptor table limit GP CS selector X 8 + EXT CS selector refers to a code segment GP CS selector X 8 + EXT If code segment is non-
infer INTERRUPTS AND EXCEPTIONS Table 9-2 illustrates how the interrupt enable flag and interrupt type interact with the type of gate used. 9.5 TASK GATES AND INTERRUPT TASKS The 80286 allows interrupts to directly cause a task switch. When an interrupt vector selects an entry in the IDT which is a task gate, a task switch occurs. The format of a task gate is described in section 8.5.
INTERRUPTS AND EXCEPTIONS When an interrupt task is used, the task must be concerned with avoiding further interrupts while it is operating. A general protection exception will occur if a task gate referring to a busy TSS is used while processing an interrupt. If subsequent interrupts can occur while the task is executing, the IF bit in the flag word (saved in the TSS) must be zero. 9.5.
INTERRUPTS AND EXCEPTIONS 9.6 PROTECTION EXCEPTIONS AND RESERVED VECTORS A protection violation will cause an exception, i.e., a non-maskable interrupt. Such a fault can be handled by the task that caused it if an interrupt or trap gate is used, or by a different task if a task gate is used (in the IDT). Protection exceptions can be classified into program errors or implicit requests for service. The latter include stack overflow and not-present faults.
INTERRUPTS AND EXCEPTIONS All but two exceptions are restartable after the exceptional condition is removed. The two nonrestartable exceptions are the processor extension segment overrun and writing into read only segments with XCHG, ADC, SBB, RCL, and RCR instructions. The return address normally points to the failing instruction, including all leading prefixes. The instruction and data addresses for the processor extension segment overrun are contained in the processor extension status registers.
INTERRUPTS AND EXCEPTIONS The interrupt is generated by the processor extension data channel within the 80286 during the limit test performed on each transfer of data between memory and the processor extension. This interrupt can be handled in the same task but is not restartable. As with all external interrupts, Interrupt 9 is an asynchronous demand caused by the processor extension referencing something outside a segment boundary.
INTERRUPTS AND EXCEPTIONS Table 9-5.
INTERRUPTS AND EXCEPTIONS 9.6.7 General Protection Fault (Interrupt 13) If a protection violation occurs which is not covered in the preceding paragraphs, it is classed as Interrupt 13, a general protection fault. The error code is zero for limit violations, write to read-only segment violations, and accesses relative to DS or ES when they are zero or refer to a segment at a greater privilege level than CPL. Other access violations (e.g.
INTERRUPTS AND EXCEPTIONS 9.7.1 Single Step Interrupt (Interrupt 1) Interrupt 1 allows programs to execute one instruction at a time. This single-stepping is controlled by the TF bit in the flag word. Once this bit is set, an internal single step interrupt will occur after the next instruction has been executed. The interrupt saves the flags' and return address on the stack, clears theTF bit, and uses an internally supplied vector of 1 to transfer control to the service routine via the IDT.
System Control and Initialization 10
CHAPTER 10 SYSTEM CONTROL AND INITIALIZATION Special flags, registers, and instructions provide contol of the ~ritical processes and interaction in 80286 operations. The flag register includes 3 bits that represent the current I/O privilege level (IOPL: 2 bits) and the nested task bit (NT). Four additional registers support the virtual addressing and memory protection features, one points to the current Task State Segment and the other three point to the memory-based descriptor tables: GDT, LDT, and IDT.
SYSTEM CONTROL AND INITIALIZATION , MEMORY CPU 15 23 GDTR I -- J U! 0 - GDTLIMIT I GDTBASE 0-- 15 I LDTl LDT ~ELECTOR II r-------.,I 15 LDTR I I I I I IL 23 I I ·· I 0 LDTLIMIT LDTBASE PROGRAM INVISIBLE -I i 1 CURRENl LDT ..J i ________ ·· I I LDTn I ....II ·· ,~ G3010B Figure 10-1.
SYSTEM CONTROL AND INITIALIZATION 7 +5 o 07 INTEL RESERVED' I +4 BASE23·'6 BAS~'5.0 +3 +1 +2 o LIMIT,5'O 15 B 7 o 'MUST BE SET TO 0 FOR COMPA TlBIL/TY WITH THE 80386 G30108 Figure 10-3. Data Type for Global Descriptor Table and Interrupt Descriptor Table The task register (TR) points to the task state segment for the currently active task. It is similar to a segment register, with selector, base, and limit fields, of which.only the selector field is readable under normal circumstances.
SYSTEM CONTROL AND INITIALIZATION SLDT (store LDT) can be executed at any privilege level. SLDT stores the local descriptor table selector from the program visible portion of the LDTR register. Task Register loading or storing is again similar to that of the LDT. The LTR instruction, operating only at level 0, loads the LTR at initialization time with a selector for the initial TSS.
SYSTEM CONTROL AND INITIALIZATION The EM flag indicates a processor extension function is to be emulated by software. If EM = 1 and MP=O, all ESCAPE instructions will be trapped via the processor extension not-present exception (#7). MP flag tells whether a processor extension is present. If MP=l and TS=I, escape and wait instructions will cause exception 7. If ESC instructions are to be used, either the MP or the EM bit must be set, but not both.
SYSTEM CONTROL AND INITIALIZATION Other privileged instructions are: LIDT-Load interrupt descriptor table register LMSW-Load machine status word CL TS-Clear task switch flag HALT-Halt processor execution POPF (POP flags) or IRET can change the IF value only if the user is operating at a trusted privilege level. POPF does not change IOPL except at Level O. "Trusted" instructions are restricted to execution at a privilege level of CPL ;::: 10PL.
SYSTEM CONTROL AND INITIALIZATION After RESET, CS points to the top 64K bytes in the 16-Mbyte physical address space. Reloading CS register by a control transfer to a different code segment in real address mode will put zeros in the upper 4 bits. Since the initial IP is FFFOH, all of the upper 64K bytes of address space may be used for initialization. Sections 10.4.1 and 10.4.2 describe the steps needed to initialize the 80286 in the real address mode and the protected mode, respectively. 10.4.
SYSTEM CONTROL AND INITIALIZATION The example in Appendix A also illustrates the ability to allocate unused entries in descriptor tables to grow the tables dynamically during execution. Using suitable naming conventions, the builder can allocate alias data segments that are larger than the prototype. EPROM version. The code in the example will zero out the extra entries to permit later dynamic usage.
Advanced Topics 11
CHAPTER 11 ADVANCED TOPICS This chapter describes some of the advanced topics as virtual memory management, restartable instructions, special segment attributes, and the validation of descriptors and pointers. 11.1 VIRTUAL MEMORY MANAGEMENT When access to a segment is requested and the access byte in its descriptor indicates the segment is not present in real memory, the not-present fault occurs (exception 11, or 12 for stacks).
ADVANCED TOPICS Inter-segment Returns that refer to conforming code segments use the RPL field of the code selector of the return address to determine the new CPL. The RPL becomes the new CPL if the conforming code segment DPL::5RPL. If a conforming segment is readable, it can be read from any privilege level without restriction. This is the only exception to the protection rules. This allows constants to be stored with conforming code.
ADVANCED TOPICS BASE + 10000H -"''"''''"''""'''1 STACK SEG.B BASE + 10000H -..------1 SEG.B . STACK + ~t~ ~~~ NEW BASE -~,",,7777,","" -""*----1 OLD BASE G3010a Figure 11-2. Dynamic Segment Relocation and Expansion of Segment limit 11.3 POINTER VALIDATION Pointer validation is an important part of locating programming errors. Pointer validation is necessary for maintaining isolation between the privilege levels. Pointer validation consists of the following steps: 1.
ADVANCED TOPICS For both LAR and LSL, the zero flag (ZF) is set if the loading was performed; otherwise, the zero flag is cleared. Both instructions are undefined in real address mode, causing an invalid opcode exception (interrupt #6). 11.3.1 Descriptor Validation The 80286 has two instructions, VERR and VERW, which determine whether a selector points to a segment that can be read or written at the current privilege level. Neither instruction causes a protection fault if the result is negative.
ADVANCED TOPICS 11.4 NPX CONTEXT SWITCHING The context of a processor extension (such as the 80287 numerics processor) is not changed by the task switch operation. A processor extension context need only be changed when a different task attempts to use the processor extension (which still contains the context of a previous task). The 80286 detects the first use of a processor extension after a task switch by causing the processor extension not-present exception (#7) if the TS bit is set.
intel" ASSEJIIBLER LOC ADVANCED TOPICS INVOKED BV: DBJ ASM286,86 LI HE '.1 2 3 :FS:5WHPl.AB6 SOURCE "lllaC'Swltch the NPl Cont!!!t on Ftrst Use Af.ter "Task Switch') 5'111 teh_npx_conhxt ~ 5 publiC 6 utrn 7 8 nltch_"PCcontut lut_npl_task :word Thl! Interrupt hlndler '11111 !wltch thl! NPI cantu! If I new tuk '0 15 attU'lpt1ng to US! the NPl contelt of IInother task lifter 'a '"k switch. If the NPl context belong' \0 the current tuk. nothing hlppens.
ADVANCED TOPICS Table 11-1. NPX Context Switching Step 1. 2. 3. 4. 5. 6. If same owner: 7a. 7b. If owner is not current task: 8a. 8b.
Appendix 80286 System Initialization A
APPENDIX A 80286 SYSTEM INITIALIZATION flltl.('Swltch the 80286 from Re.1 Addr •• s Mode 10 Prolecled Mode') nom. 'witch 80286~mode. publiC ldl_de.c,gdt_d •• c Switch the 80286 from real addr ••• mod. Into protect.d mode. Th. lnilial EPROM GOT, lOT, TSS, .nd LOT (If any) con.tructed by BL0286 will be copied from EPROM In[o RAM. The RAM area • • ~e ~efln.d by data •• gm.nt. alloc.ted a. fixed entrle. In the GOT. The CPU r.gl.ter. for Ihe GOT, lOT, TSS, and LOT will be .el to point at the RAM-ba.ed ,"gm.
80286 SYSTEM INITIALIZATION Define layout of a des. limit bale_low b a I!_h I g h a •• ess res des. desc~l~tor! s t r uc dw dw db db dw ends Offset of last byte In segment Low 16 bits of 24-blt address Hlgh,8 bit. of 24-blt addrels ,Access rlg~tl byte Reserved wo'rd 'D e fin e 't h'e' fixe d GDT I! I e c tor, val u e s 1. 0 r the des c rip' tors ,t hat de fin e 't hO EP ROM - ba,l! d tab I e I. B LD2 86m us t be in. t r u,c ted top I ace the ~pproprlat. des~rl~tors Int,o the GDT. gdt_allas I d t_alla.
80286 SYSTEM .INITIALIZATION Define the templ.te for. temporary GDT u.ed to locate the Initial GDT and .tock. Thl. data will be copied to location O. Thl5 .pace Is 01.0 u.ed for a temporary stack and finally .erve' a. the T55 wrillen inlo when entering Ihe Initial T55. Place remaining code below power _u p org Inltlal_gdt gdt_de.c Idl_de!C lemp_de.c de.c de.c de. c de.c <) <) <) <) Fill e r and nul I IDT de.crlptor De.crlptor for EPROM GDT De.crlptor for EPROM IDT Temporary de.
80286 SYSTEM INITIALIZATION Form an adlij!lmenl faclor from Ihe r~al CS bale of FFOOOOH 10 Ihe !egmenl bale address assumed by ASM286 •. Any data reference made Inlo CS mij!1 add an Indexing lerm IBPI 10 compen!ale for Ihe difference belween Ihe off!el genera led by ASM286 and Ihe off!el reqijlred from Ihe bale of FFOOOOH.
inter 80286 SYSTEM INITIALIZATION I 9dI mov mov xor II d I mov IIr U.e I n I I I a I GDT I n RAM arel I em p_. I a c k [ bpi ax, lemp_. tac k -I n I I lal_gdl ; Selup SS wI I h vall d prolected mode .eleclor 10 Ihe RAM GDT and • I a ok !!IS,IIX Sel Ihe current LDT 10 null ax I ax Any references 10 I I will CIlU!!Ie ax an excepllon cau.lng .huld.wn a x, • a v e_ I •• - I n I I I a I_g d I Set I n I I I a I T S S I n I 0 I he 10. RAM The I a • k .wllch need. a vall d TSS ax Copy Ihe EPROM-ba.
intel· .Iarl 80286 SYSTEM INITIALIZATION endp If BX Copy Ihe and Ihe T55 and LDT for Ihe la.k ha. an LDT II will BP are Iran.parenl. I •• k polnled 01 by C5:BX. 01.0 be copied down. bad_I •• : hI I copy_lo.k. mov mov mov mov I. I mov I ar Hall here If TSS 15 Invalid proc Gel • I , g d I_a I I a • d. , • I • I , c. : I b x I • I •• _a Ila. addre5.ablllly 10 GDT 1n z d x I !!I 1 b a d_ 15. Gel .eleclor for TSS alia. Polnl ES al alia. dala .egmenl Gel lenglh of TSS alia.
80286 SYSTEM INITIALIZATION See If a valid LOT I. 'peclfled for the .tartup ta.k I f . 0 I hen cop Y I h e EPRO M ve .. .1 0 n I n lot heR AM a I I a •. mov mov and Jz Addre •• TSS 10 get LOT d • ,c. : [b x J . I •• _all a. .I,d.:word plr LOT_OFFSET Ignore TI and RPL .I,nol TJRPL_MASK Skip Ihl. If no LOT u.ed n a_I d I Save LDT .eleclor Te.1 de.crlplor Jump If Invalid .eleclor pu.h I ar J nz mov and cmp Jn e mov mov 151 call mov Save LDT de.crlplor acce •• byle [gnore privilege Be .ure II I.
80286 SYSTEM INITIALIZATION Telt Ihe ~elcrlptor lable Ilze In AX 10 yerlfy Ihat It II an even number of delcrlptor! In [englh. tel t_dt_Ilml I pUlh and cmp pop Jn! proc Save lenglh Look a I low order bit! MUlt be all one! Restore length ax 01·,7 a 1,7 ax b a d_d I_II mI I AII DK rei bad_dl_Ilmll: hit tell_dt_Ilmll Die! endp Copy the EPROM DT al leleclor ax In Ihe temporary GDT 10 Ihe allal data legmenl 01 lel~ctor 51.
80286 SYSTEM INITIALIZATION Copy the legment at DS to the legment at ES for length CX. Fill the end with AX-CX zerol. Ule word operatlonl for Ipeed but allow odd byte operatlonl. cop y_w I t h_ f I II xor xor lub add rcr rep proc I I •I I d I.
·"
Appendix The 80286 Instruction Set B
APPENDIX B THE 80286 INSTRUCTION SET This section presents the 80286 instruction set using Intel's ASM286 notation. All possible operand types are shown. Instructions are organized alphabetically according to generic operations. Within each operation, many different instructions are possible depending on the operand. The pages are presented in a standardized format, the elements of which are described in the following paragraphs.
THE 80286 INSTRUCTION SET pp/n Instruction Byte Format ModRM "mod" Field Bit Assignments mod Displacement 00 01 10 11 OISP = 0(2), disp-Iow and disp-high are absent OISP = disp-Iow sign-extended to 16-bits, disp-high is absent OISP = disp-high: disp-Iow rim is treated as a "reg" field "rim" Field Bit Assignments rIm Operand Address 000 001 010 011 100 101 110 111 (BX) + (SI) + OISP (BX) + (01) + OISP (BP) + (SI) + OISP (BP) + (01) + OISP (SI) + OISP (01) + OISP (BP) + 0ISP(2) (BX) + OISP OISP fol
THE 80286 INSTRUCTION SET Table B·1.
THE 80286 U\lSTRUCTION SET Ir Instruction Byte Format "mod" Field Bit Assignments mod Displacement 00 01 10 11 DISP - 0(2), disp-Iow and disp-high are absent OISP - disp-Iow sign-extended to 16-bits, disp-high is absent OISP - disp-high; disp-Iow rIm is treated as a "reg" field "r" Field Bit Assignments 16-Blt (w - 1) 000 001 010 011 100 101 110 111 AX CX OX BX SP BP SI 01 Segment B-Blt (w - 0) 000 AL 001 CL 010 OL 011 BL 100 AH 101 CH 1100H 111 BH 00 01 10 11 "rim" Field Bit Assignments rim Op
THE 80286 INSTRUCTION SET ° + rw: A register code from through 7 which is added to the hexadecimal byte given at the left of the plus sign to form a single opcode byte~ The codes are: AX=O, CX=I, DX=2, BX=3, SP=4, BP=5, SI=6, and DI=7. Instruction This column gives the instruction mnemonic and possible operands. The type of operand used will determine the opcode and operand encodings. The following entries list the type of operand which can be encoded in the format shown in the instruction column.
THE 80286 INSTRUCTION SET xb: a simple byte memory variable without a base or index register. MOY instructions between AL .. and memory have this optimized form if no indexing is required. xw: a simple word memory variable without a base or index register. MOY instructions between AX and memory have this optimized form if no indexing is required. Clocks This column gives the number of clock cycles that this form of the instruction .takes to execute.
THE 80286 INSTRUCTION SET Flags Undefined This is a list of the flags that have an undefined (meaningiess) setting after the instruction is executed. All flags not mentioned under "Flags Modified" or "Flags Undefined" are unchanged by the instruction. Operation This section fully describes the operation performed by the instruction. For some of the more complicated instructions, suggested usage is also indicated.
THE 80286 INSTRUCTION SET Table 8-2. Protection Ex~eptlons of the 80286 Abbreviation Interrupt Number Description #UD #NM #DF #MP #TS #NP #SS #GP #MF 6 Undefined Opcode No Math Unit Available Double Fault Math Unit Protection Fault Invalid Task State Segment Not Present Stack Fault General Protection Math Fault 7 8 9 10 11 12 13 16 The error code generally contains the selector of the segment that caused the protection violation.
THE 80286 INSTRUCTION SET If another exception is detected while attempting to perform the double fault exception, the 80286 will enter shutdown (see section 11.5). #GP 13 General Protection (Selector or Zero Error Code) This exception is generated for all protection violations not covered by the other exceptions in this section. Examples of this include: 1. An attempt to address a memory location by using an offset that exceeds the limit for the segment involved. 2.
THE 80286 INSTRUCTION SET The offending floating point instruction cannot be restarted; the task which attempted to execute the offending numeric instruction must be aborted. However, if exception 9 interrupted another ta~k, the interrupted task may be restarted. The exception 9 handler must execute FNINIT before executing any ESCAPE or WAIT instruction.
THE 80286 INSTRUCTION SET #SS 12 Stack Fault (Selector or Zero Error Code) This exception is generated when a limit violation is detected in addressing through the SS register. It can occur on stack-oriented instructions such as PUSH or POP, as well as other types of memory references using SS such as MOY AX,[BP+28].
THE 80286 INSTRUCTION SET #UD 6 Undefined Opcode (No Error Code) This exception is generated when an invalid operation code is detected in the instruction stream. Following are the cases in which #UD can occur: 1. The first byte of an instruction is completely invalid (e.g., 64H). 2. The first byte indicates a 2-byte opcode and the second byte is invalid (e.g., OFH followed by OFFH). 3. An invalid register is used with an otherwise valid opcode (e.g., MOV CS,AX). 4.
THE 80286 INSTRUCTION SET Set CPL to the RPL of the CS selector in the newTSS If new stack selector is null #TS(SS) SS selector must be within its descriptor table limits else #TS(SS) SS selector RPL must be equal to CPL else #TS(SS) OPL of SS descriptor must equal CPL else #TS(SS) SS descriptor AR byte must indicate writable data segment else #TS(SS) SS descriptor AR byte must indicate PRESENT else #SS(SS) Load SS cache with new stack segment and set valid bit New CS selector must not be null else #TS(CS)
THE 80286 INSTRUCTION SET Table B-3.
THE 80286 INSTRUCTION SET AAA - ASCII Adjust AL After Addition Opcode Instruction Clocks Description 37 AAA 3 ASCII adjust AL after addition FLAGS MODIFIED Auxiliary carry, carry FLAGS UNDEFINED Overflow, sign, zero, parity OPERATION AAA should be executed only after an ADD instruction which leaves a byte result in the AL register. The lower nibbles of the operands to the ADD instruction should be in the range 0 through 9 (BCD digits).
THE 80286 INSTRUCTION SET AAD - ASCII Adjust AX Before Division Opcode Instruction Clocks Description 05 AAO 14 ASCII adjust AX before division OA FLAGS MODIFIED Sign, zero, parity FLAGS UNDEFINED Overflow, auxiliary carry, carry OPERATION AAD is used to prepare two unpacked BCD digits (least significant in AL, most significant in AH) for a division operation which will yield an unpacked result. This is accomplished by setting AL to AL + (10 X AH), and then setting AH to O.
THE 80286 INSTRUCTION SET AAM - ASCII Adjust AX After Multiply · Opcode Instruction Clocks Description D4 AAM 16 ASCII adjust AX after multiply OA FLAGS MODIFIED Sign, zero, parity FLAGS UNDEFINED Overflow, auxiliary carry, carry OPERATION AAM should be used only after executing a MUL instruction between two unpacked BCD digits, leaving the result in the AX register. Since the result is less than one hundred, it is contained cntirely in the AL register.
THE 80286 INSTRUCTION SET AAS-ASCII Adjust AL After Subtraction Opcode Instruction Clocks Description 3F AAS 3 ASCII adjust AL after subtraction FLAGS MODIFIED Auxiliary carry, carry FLAGS UNDEFINED Overflow, sign, zero, parity OPERATION AASshould be executed only after a subtraction instruction which left the byte result in the AL register. The lower nibbles of the operands to the SUB instruction should have been in the range 0 through 9 (BCD digits).
THE 80286 INSTRUCTION SET ADC/ ADD-Integer Addition Opcode Instruction Clocks Description 10 11 12 13 14 15 80 81 83 00 01 02 03 04 05 80 81 83 ADC ADC ADC ADC ADC ADC ADC ADC ADC ADD ADD ADD ADD ADD ADD ADD ADD ADD 2,mem=7 2,mem=7 2,mem=7 2,mem=7 3 3 3,mem=7 3,mem=7 3,mem=7 2,mem=7 2,mem=7 2,mem=7 2,mem=7 3 3 3,mem=7 3,mem=7 3,mem=7 Add with carry byte register into EA byte Add with carry word register into EA word Add with carry EA byte into byte register Add with carry EA word into word register
THE 80286 INSTRUCTION SET AND-Logical AND Opcode Instruction Clocks Description 20 21 22 23 24 25 80 81 AND AND AND AND AND AND AND AND 2,mem=7 2,mem=7 2,mem=7 2,mem=7 3 3 3,mem=7 3,mem=7 Logical-AND byte register into EA byte Logical-AND word register into EA word Logical-AND EA byte into byte register Logical-AND EA word into word register Logical-AND immediate byte into AL Logical-AND immediate word into AX Logical-AND immediate byte into EA byte Logical-AND immediate word into EA word Ir Ir Ir
THE 80286 INSTRUCTION SET ARPL - Adjust RPL Field of Selector Opcode 63 Ir Instruction Clocks. Description ARPL ew,rw 10,mem=11 Adjust RPL of EA word not less than RPL of rw FLAGS MODIFIED Zero FLAGS UNDEFINED None OPERATION The ARPL instruction has two operands. The first operand is a 16-bit memory variable or word register that contains the value of a selector. The second operand is a word register.
THE 80286 INSTRUCTION SET BOUND-Check Array Index Against Bounds Opcode 62. /r Instruction Clocks Description BOUND rw,md noj=13 INT 5 if rw not within bounds FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION BOUND is used to ensure that a signed array index is within the limits defined by a two-word block of memory. The first operand (a register) tnustbe greater than or equal to the first word in memory, and ·less than or equal to the second word in memory.
THE 80286 INSTRUCTION SET CALL-Call Procedure Opcode cw /2 cd cd cd cd cd cd /3 /3 /3 /3 /3 E8 FF 9A 9A 9A 9A 9A 9A FF FF FF FF FF FF /3 Instruction CALL CALL CALL CALL CALL CALL CALL CALL CALL CALL CALL CALL CALL CALL cw ew cd cd cd cd cd cd ed ed ed ed ed ed Clocks' Description 7 7,mem=11 13,pm=26 41 82 86+4X 177 182 16,mem=29 44 83 90+4X 180 185 Call Call Call Call Call Call Call Call Call Call Call Call Call Call near, offset relative to next instruction near, offset absolute at EA word int
THE 80286 INSTRUCTION SET 2. Call Gate-The offset part of the pointer is ignored. Instead, the entire address of the procedure is taken from the call gate descriptor entry. If the routine being entered is more privileged, then a new stack (both SS and SP) is loaded from the task state segment for the new privilege level, and parameters determined by the word count field of the call gate are copied from the old stack to the new stack. 3.
THE 80286 INSTRUCTION SET CALL GATE TO MORE PRIVILEGE: Get new SS selector for new privilege level from TSS Check selector and descriptor for new SS: Selector must not be null else #TS(O) Selector index must be within its descriptor table limits else #TS (SS selector) Selector's RPL must equal DPL of code segment else #TS (SS selector) Stack segment DPL must equal DPL of code segment else #TS (SS selector) Descriptor must indicate writable data segment else #TS (SS selector) Segment PRESENT else #SS (SS se
THE 80286 INSTRUCTION SET NEAR indirect CALL: #GP(O) for an illegal memory operand effective address in the CS, DS, or ES segments; #SS(O) for an illegal address in the SS segment. #GP if the indirect offset obtained is beyond the code segment limits. REAL ADDRESS MODE EXCEPTIONS Interrupt l3 for a word operand at offset OFFFFH.
THE 80286 INSTRUCTION SET caw -Convert Byte into Word Opcode Instruction Clocks Description 98 C8W 2 Convert byte into word (AH = top bit of AL) FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION CBW converts the signed byte in AL to a signed word in AX. It does so by extending the top bit of AL into all of the bits of AH.
THE 80286 INSTRUCTION SET CLC-Clear Carry Flag Opcode Instruction Clocks Description F8 CLC 2 Clear carry flag FLAGS MODIFIED Carry=O FLAGS UNDEFINED None OPERATION CLC sets the carry flag to zero. No other flags or registers are affected.
THE 80286 INSTRUCTION SET CLD-Clear Direction Flag Opcode Instruction Clocks Description FC CLO 2 Clear direction flag. SI and 01 will increment FLAGS MODIFIED Direction = 0 FLAGS UNDEFINED None OPERATION CLD clears the direction flag. No other flags or registers are affected. After CLD is executed, string operations will increment the index registers (SI and/or DI) that they use.
THE 80286·INSTRUCTION SET ell-Clear Interrupt Flag Opcode Instruction Clocks Description FA CLI 3 Clear interrupt flag; interrupts disabled FLAGS MODIFIED Interrupt = 0 FLAGS UNDEFINED None OPERATION CLI clears the interrupt enable flag if the current privilege level is at least as privileged as 10PL. No other flags are affected. External interrupts will not be recognized at the end of the CLI instruction or thereafter until the interrupt flag is set.
THE 80286 INSTRUCTION SET CLTS-Clear Task Switched Flag Opcode Instruction Clocks Description OF CLTS 2 Clear task switched flag 06 FLAGS MODIFIED Task switched=O FLAGS UNDEFINED None OPERATION CLTS clears the task switched flag in the Machine Status Word. This flag is set by the 80286 every time a task switch occurs.
THE 80286 INSTRUCTION SET CMC-Complement Carry Flag Opcode Instruction F5 CMC . Clocks Description Complement carry flag 2 FLAGS MODIFIED Carry FLAGS UNDEFINED None OPERATION CMC reverses the setting of the carry flag. No other flags are affected. PROTECTED MODE.
THE 80286 INSTRUCTION SET CMP-Compare Two Operands Opcode Instruction Clocks Description 3C 3D 80 38 83 81 39 3A 38 CMP CMP CMP CMP CMP CMP CMP CMP CMP 3 3 3,mem=6 2,mem=7 3,mem=6 3,mem=6 2,mem=7 2,mem=6 2,mem=6 Compare Compare Compare Compare Compare Compare Compare Compare Compare db dw 17 db Ir 17 17 db dw Ir Ir Ir AL,db AX,dw eb,db eb,rb eW,db eW,dw eW,rw rb,eb rW,ew immediate byte from AL immediate word from AX immediate byte from EA byte byte register from EA byte immediate byte from
THE 80286 INSTRUCTION SET CMPS/CMPSB/CMPSW-Compare string operands Opcode A6 A6 A7 Instruction .CMPS mb,mb CMPS8 CMPSW Clocks Description 8 8 8 Compare bytes ES:[DI] from [SI] Compare bytes ES:[DI] from DS:[SI] Compare words ES:[DI] from DS:[SI] FLAGS MODIFIED Overflow, sign, zero, auxiliary carry, parity, carry FLAGS UNDEFINED None OPERATION CMPS compares the byte or word pointed to by SI with the byte or word pointed to by OI by performing the subtraction [SI] - [OI].
THE 80286 INSTRUCTION SET CWO-Convert Word to Doubleword Opcode Instruction Clocks Description 99 CWD 2 Convert word to daubleword (DX:AX = AX) FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION CWDconverts the signed word in AX to a signed doubleword in DX:AX. It does so by extending the top bit of AX into all the bits of DX.
THE 80286 INSTRUCTION SET DAA-Decimal Adjust AL After Addition Opcode Instruction Clocks Description 27 DAA 3 Decimal adjust AL after addition FLAGS MODIFIED Sign, zero, auxiliary carry, parity, carry FLAGS UNDEFINED Overflow OPERATION DAA should be executed only after an ADD instruction which leaves a two-BCD-digit byte result in the AL register. The ADD operands should consist of two packed BCD digits.
THE 80286 INSTRUCTION SET DAS-Decimal Adjust AL After Subtraction Opcode Instruction Clocks Description 2F DAS 3 Decimal adjust AL after subtraction FLAGS MODIFIED Sign, zero, auxiliary carry, parity, carry FLAGS UNDEFINED Overflow OPERATION DAS should be executed only after a subtraction instruction which leaves a two-BCD-digit byte result in the AL register. The operands should consist of two packed BCD digits.
THE 80286 INSTRUCTION SET DEC-Decrement by 1 Opcode I!'structlon Clocks Description FE FF 48+ DEC eb DEC ew DEC rw 2,mem=7 2,mem=7 Decrement EA byte by 1 Decrement EA word by 1 Decrement word register by 1 /1 /1 rw 2 FLAGS MODIFIED Overflow, sign, zero, auxiliary carry, parity FLAGS UNDEFINED None OPERATION 1 is subtracted from the operand. Note that the carry flag is not changed by this instruction. If you want the carry flag set, use the SUB instruction with a second operand of 1.
THE 80286 INSTRUCTION SET DIV -Unsigned Divide Opcode Instruction Clocks Description F6 F7 DIVeb DIVew 14,mem=17 22,mem=25 Unsigned divide AX by EA byte Unsigned divide DX:AX by EA word /6 /6 FLAGS MODIFIED None FLAGS UNDEFINED Overflow, sign, zero, auxiliary carry, parity, carry OPERATION DIY performs an unsigned divide. The dividend is implicit; only the divisor is given as an operand. If the source operand is a BYTE operand, divide AX by the byte.
THE 80286 INSTRUCTION SET ENTER-Make Stack Frame for Procedure Parameters Opcode C8 C8 C8 dw dw 00 01 dw db FLAGS MODIFIED Instruction Clocks Description ENTER dw,O ENTER dW,1 ENTER dW,db 11 15 12+4db Make stack frame for procedure parameters Make stack frame for procedure parameters Make stack frame for procedure parameters Cc None FLAGS UNDEFINED None OPERATION ENTER is used to create the stack frame required by most block-structured high-level languages.
THE 80286 INSTRUCTION SET PROTECTED MODE EXCEPTIONS #SS(O) if SP were to go outside of the stack limit within any part of the instruction execution.
THE 80286 INSTRUCTION SET HLT-Halt Opcode Instruction Clocks Description F4 HLT 2 Halt FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION Successful execution of HL T causes the 80286 to cease executing instructions and to enter a HALT state. Execution resumes only upon receipt of an enabled interrupt or a reset. If an interrupt is used to resume program execution after HLT, the saved CS:IP value will point to the instruction that follows HLT.
THE 80286 INSTRUCTION SET IDIV -Signed Divide Opcode Instruction Clocks Description F6 /7 IDIVeb 17,mem=20 F7 /7 IDIVew 25,mem=28 Signed divide AX byEA byte (AL=Quo, AH=Rem) Signed divide DX:AX by EA word (AX=Quo, DX=Rem) / FLAGS MODIFIED None FLAGS UNDEFINED Overflow, sign, zero, auxiliary carry, parity, carry OPERATION IDlY performs a signed divide. The dividend is implicit; only the divisor is given as an operand. If the source operand is a BYTE operand, divide AX by the byte.
THE 80286 INSTRUCTION SET IMUL-Signed Multiply Opcode F6 F7 68 69 68 15 15 db dw db Ir Ir Ir Instruction Clocks Description IMUL IMUL IMUL IMUL IMUL 13,mem=~6 21,mem=24 21,mem=24 21,mem=24 21,mem=24 Signed Signed Signed Signed Signed eb ew rw,db rw,ew,dw rw,ew,db multiply (AX = AL X EA byte) multiply (DXAX = AX X EA word) multiply imm. byte into word reg. multiply (rw = EA word X imm. word) multiply (rw = EA word X imm.
THE 80286 INSTRUCTION SET IN-Input from Port Opcode Instruction ClockS Description E4 EC E5 ED IN IN IN IN 5 5 5 5 Input byte from immediate port into AL Input byte from port OX into AL Input word from immediate port into AX Input word from port OX into AX db db AL,db AL,OX AX,db AX,OX FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION IN transfers a data byte or data word from the port numbered by the second operand into the register (AL or AX) given as the first operand.
THE 80286 INSTRUCTION SET INC-Increment by 1 Instruction Opcode FE FF /0 /0 40+rw INC eb "INC ew INC rw Clocks Description 2,mem=7 2,mem=7 Increment EA byte by 1 Increment EA word by 1 Increment word register by 1 2 FLAGS MODIFIED Overflow, sign, zero, auxiliary carry, parity FLAGS UNDEFINED None OPERATION 1 is added to the operand. Note that the carry flag is not changed by this instruction. If you want the carry flag;set, use the ADD instruction with a second operand of 1.
THE 80286 INSTRUCTION SET INS/INSB/INSW-Input from Port to String Opcode Instruction Clocks Description 6C INS eb,OX INS ew,OX INSB INSW 5 5 5 5 Input byte from port OX into ES:[OI) Input word from port OX into ES:[OI) Input byte from port OX into ES:[OI) Input word from port OX into ES:[OI) 60 6C 60 FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION INS transfers data from the input port numbered by the DX register to the memory byte or word at ES:DI.
THE 80286 INSTRUCTION SET INT IINTO-Call to Interrupt Procedure Opcode Instruction Clocks(1) Description CC CC CC CC CD CD CD CD CE .
THE 80286 INSTRUCTION SET In Protected mode, INT also resets the Trap Flag.
THE 80286 INSTRUCTION SET Index must be within GOT limits else #GP (TSS selector) AR byte must specify available TSS (bottom bits 00001) else #GP (TSS selector) Task State Segment must be PRESENT else #NP (TSS selector) SWITCH3ASKS with nesting to TSS If interrupt was caused by fault with error code then Stack limits must allow push of two more bytes else #SS(O) Push error code onto stack IP must be in CS limit else #GP(O) NOTE EXT is 1 if an external event (Le.
inter THE 80286 INSTRUCTION SET IRET -Interrupt Return Opcode Instruction Clock. Description CF CF CF IRET IRET IRET 17,pm=31 55 169 Interrupt return (far return and pop flags) Interrupt return, lesser privilege Interrupt return, different task (NT=1) "Add one clock for each byte in the next instruction executed.
THE 80286 INSTRUCTION SET If Nested Task Flag=O then INTERRUPT RETURN ON STACK: Second word on stack must be within stack limits else #SS(O) Return CS selector RPL must be ;::: CPL else #GP (Return selector) If return selector RPL = CPL then INTERRUPT RETURN TO SAME LEVEL: Top 6 bytes on stack must be within limits else #SS(O) Return CS selector (at SP+2) must be non-null else #GP(O) Selector index must be within its descriptor table limits else #GP( Return selector) AR byte mustJndicate code segment else
THE 80286 INSTRUCTION SET PROTECTED MODE EXCEPTIONS #GP, #NP, or #88, as indicated in the above listing. REAL ADDRESS MODE EXCEPTIONS Interrupt 13 if the stack is popped when it has offset OFFFFH.
THE 80286 INSTRUCTION SET Jcond-Jump Short If Condition Met Opcode Instruction Clocks· Description Jump short if above (CF=O and ZF=O) Jump short if above or equal (CF=O) Jump short if below (CF=1) Jump short if below or equal (CF=1 or ZF=1) Jump short if carry (CF=1) Jump short if CX register is zero Jump short if equal (ZF=1) Jump short if greater (ZF=O and SF=OF) Jump short if greater or equal (SF=OF) Jump short if less (SF/=OF) Jump short if less or equal (ZF=1 or SF/=OF) Jump short if not above (CF
THE 80286 INSTRUCTION SET If the given condition is true, then a short jump is made to the label provided as the operand. Instruction encoding is most efficient when the target for the conditional jump is in the current code segment and within -128 to + 127 bytes of the first byte of the next instruction. Alternatively, the opposite sense (e.g., JNZ has opposite sense to that of JZ) of the conditional jump can skip around an unconditional jump to the destination.
THE 80286 INSTRUCTION SET JMP-Jump Opcode Instruction Clocks' Description EB EA E9 EA EA EA 7 Jump short Jump to.
THE 80286 INSTRUCTION SET 2. 3. 4. Call gate-The offset part of the destination pointer is ignored. After checking for validity, the processor jumps to the location stored in the call gate descriptor. Task gate-The current task's state is saved in its Task State Segment (TSS), and the TSS named in the task gate is used to load a new context. The outgoing task is marked not busy, the new TSS is marked busy, and execution resumes at the point at which the new task was last suspended.
THE 80286 INSTRUCTION SET JUMP TASK STATE SEGMENT: TSS DPL must be 2: CPL else #GP (TSS selector) TSS DPL must be 2: TSS selector RPL else #GP (TSS selector) Descriptor AR byte must specify available TSS (bottom bits 00001) else #GP (TSS selector) Task State Segment must be PRESENT else #NP (TSS selector) SWITCH_TASKS with nesting to TS.
THE 80286 INSTRUCTION SET LAHF-load Flags into AH Register Opcode Instruction Clocks Description 9F LAHF 2 Load: AH = flags SF ZF xx AF xx PF xx CF FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The low byte of the flags word is transferred to AH. The bits, from MSB to LSB, are as follows: sign, zero, indeterminate; auxiliary carry, indeterminate, parity, indeterminate, and carry. See figure 3-5.
THE. 80286 INSTRUCTION SET LAR-Load Access Rights Byte Opcode OF 02 Ir Instruction Clocks Description LAR rW,ew 14,mem=16 Load: high(rw)= Access Rights byte, selector ew FLAGS MODIFIED Zero FLAGS UNDEFINED None OPERATION LAR expects the second operand (memory or register word) to contain a selector.
THE 80286 INSTRUCTION SET LOS/ LES-Load Doubleword Pointer Opcode C5 C4 If If Instruction Clocks Description LDS rw,ed LES rw,ed 7,pm=21 7,pm=21 Load EA doubleword into DS and word register Load EA doubleword into ES and word register FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The four-byte pointer at the memory location indicated by the second operand is loaded into a segment register and a word register.
THE 80286 INSTRUCTION SET PROTECTED MODE EXCEPTIONS #GP or #NP, as indicated in the list above. #GP(O) or #S8(O) if operand lies outside segment limit. #UD if the source operand is a register. REAL ADDRESS MODE EXCEPTIONS Interrupt 13 for operand at offset OFFFFH or OFFFDH. #UD if the source operand is a register.
inter THE 80286 INSTRUCTION SET LEA-load Effective Address Offset Opcode 80 Ir Instruction Clocks Description LEA rW,m 3 Calculate EA offset given by m, place in rw FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The effective address (offset part) of the second operand is placed in the first (register) operand. PROTECTED MODE EXCEPTIONS #UD if second operand is a register. REAL ADDRESS MODE EXCEPTIONS #UD if second operand is a register.
THE 80286 INSTRUCTION SET LEAVE-High Level Procedure Exit Opcode Instruction Clocks Description C9 LEAVE 5 Set SP to BP, then POP 8P FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION LEAVE is the complementary operation to ENTER; it reverses the effects of that instruction. By copying BP to SP, LEAVE releases the stack space used by a procedure for its dynamics and display.
THE 80286 INSTRUCTION SET LGDT ILIDT -Load Global/Interrupt Descriptor Table Register Opcode OF OF 01 01 /2 /3 Instruction Clocks Description LGDT m LlDT m 11 12 Load m into Global Descriptor Table reg Load m into Interrupt Descriptor Table reg FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The Global or the Interrupt Descriptor Table Register is loaded from the six bytes of memory pointed to by the effective address operand (see figure 10.3).
THE 80286 INSTRUCTION SET LLDT -Load Local Descriptor Table Register Opcode OF 00 /2 Instruction Clocks Description LLDT ew 17,mem=19 Load selector ew into Local Descriptor Table register FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The word operand (memory or register) to LLDT should contain a selector pointing to the Global Descriptor Table. The GDT entry should be a Local Descriptor Table Descriptor. If so, then the Local Descriptor Table Register is loaded from the entry.
THE 80286 INSTRUCTION SET LMSW -Load Machine Status Word Opcode OF 01 /6 Instruction Clocks Description LMSWew 3,mem=6 Load EA word into Machine Status Word FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The Machine Status Word is loaded from the source operand. This instruction may be used to switch to protected mode. If so, then it must be followed byan intra-segment jump to flush the instruction queue. LMSW will not switch back to Real Address Mode.
THE 80286 INSTRUCTION SET LOCK-Assert BUS LOCK Signal Opcode Instruction Clocks Description FO LOCK o Assert BUSLOCK signal for the next instruction FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION LOCK is a prefix that will cause the BUS LOCK signal of the 80286 to be asserted for the duration of the instruction that it prefixes. In a multiprocessor environment, this signal should be used to ensure that the 80286 has exclusive use of any shared memory while BUS LOCK is asserted.
THE 80286 INSTRUCTION SET LODS/LODSB/LODSW-Load String Operand Opcode Instruction Clocks Description AC AD AC AD LODS mb LODS mw LODS8 LODSW 5 5 5 5 Load Load Load Load byte [SI] into AL word [SI] into AX byte DS:[SI] into AL word DS:[SI] into AX FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION LODS loads the AL or AX register with the memory byte or word at SI. After the transfer is made, SI is automatically advanced.
THE 80286 INSTRUCTION SET LOOP/LOOPcond-Loop Control with CX Counter Opcode Instruction Clocks Description DEC CX; jump short if CX;toO DEC CX; jump short if CX;to 0 and equal (ZF = 1) DEC CX; jump short if CX;to 0 and not equal (ZF=O) DEC CX; jump short if CX;toO and ZF=O DEC CX; jump short if CX;toO and zero (ZF=1) E2 E1 EO cb cb cb LOOP cb LOOPE cb LOOPNE cb 8,noj=4 8,noj=4 8,noj=4 EO E1 .
THE 80286 INSTRUCTION SET LSL-Load Segment Limit Opcode OF 03 /r Instruction Clocks Description LSL rw,ew 14,mem=16 Load: rw = Segment Limit, selector ew FLAGS MODIFIED Zero FLAGS UNDEFINED None OPERATION If the descriptor denoted by the selector in the second (memory or register) operand is visible at the CPL, a word that consists of the limit field of the descriptor is loaded into the left operand, which must be a register. The value is the limit field for that segment.
THE 80286 INSTRUCTION SET LTR-Load Task Register Opcode OF 00 /3 Instruction Clocks Description LTR ew 17,mem=19 Load EA word into Task Register FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The Task Register is loaded from the source register or memory location given by the operand. The loaded TSS is marked busy.. A task switch operation does not occ.ur. LTR appears.only in operating systems software. It is not used in applications programs.
THE 80286 INSTRUCTION SET MOV-Move Data Opcode Instruction Clocks Description 88 89 8A 88 8C 8C 8C 8C 8E 8E 8E 8E 8E 8E AO A1 A2 A3 80+ 88+ C6 C7 MOVeb,'rb MOVew,rw MOV rb,eb MOV rw,ew MOVew,ES MOVew,CS MOVew,SS MOVew,OS MOV ES,mw MOV ES,rw MOV SS,mw MOV SS,rw MOV OS,mw MOV OS,rw MOV AL,xb MOV AX,xw MOV xb,AL MOV xW,AX MOV rb,db MOV rw,dw MOVeb,db MOVew,dw 2,mem=3.
THE 80286 INSTRUCTION SET Following is a listing of the protected-mode checks and actions taken in the loading of a segment register: If SS is loaded: If selector is null then #GP(O) Selector index must be within its descriptor table limits else #GP (selector) Selector's RPL must equal CPL else #GP (selector) AR byte must indicate a writable data segment else #GP (selector) DPL in the AR byte must equal CPL else #GP (selector) Segment must be marked PRESENT else #SS (selector) Load SS with selector Load SS
THE 80286 INSTRUCTION SET MOVS/MOVSB/MOVSW-Move Data from String to String Opcode Instruction Clocks Description A4 A5 A4 A5 MOVS mb,mb MOVS mW,mw MOVS8 MOVSW 5 5 5 5 Move byte [SI] to ES:[OI] Move word [SI] to ES:[OI] Move byte OS:[SI] to ES:[OI] Move word OS:[SI] to ES:[OI] FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION MOYS copies the byte or word at [Sl]to the byte or word at ES:[DI). The destination operand must be addressable from the ESregister; no segment override is possible.
THE 80286 INSTRUCTION SET MUL-Unsigned Multiplication of AL or AX Opcode Instruction Clocks Description F6 F7 MUL eb MUL ew 13,mem=16 21,mem=24 Unsigned multiply (AX = AL X EA byte) Unsigned multiply (DXAX = AX X EA word) /4 /4 FLAGS MODIFIED Overflow, carry FLAGS UNDEFINED Sign, zero, auxiliary carry, parity OPERATION If MUL has a byte operand, then the byte is multiplied by AL, and the result is left in AX. Carry and overflow are set to 0 if AH is 0; they are set to 1 otherwise.
THE 80286 INSTRUCTION SET NEG-Two's Complement Negation Opcode Instruction Clocks Description F6 F7 NEG eb NEG ew 2',mem=7 2,mem=7 Two's complement negate EA byte Two's complement negate EA word /3 /3 FLAGS MODIFIED Overflow, sign, zero, auxiliary carry, parity, carry FLAGS UNDEFINED None OPERATION The two's complement of the register or memory operand replaces the old operand value. Likewise, the operand is subtracted from zero, and the result is placed in the operand.
THE 80286 INSTRUCTION SET NOP-No OPERATION Opcode Instruction Clocks Description 90 NOP 3 No OPERATION FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION Performs no operation. NOP is a one-byte filler instruction that takes up space but affects none of the machine context except IP.
THE 80286 INSTRUCTION SET NOT -One's Complement Negation Opcode Instruction Clocks Description F6 F7 NOT eb NOT ew 2,mem=7 2,mem=7 Reverse each bit of EA byte Reverse each bit of EA word /2 /2 FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The operand is inverted; that is, every 1 becomes a 0 and vice versa. PROTECTED MODE EXCEPTIONS #GP(O) if the result is in a non-writable segment.
THE 80286 INSTRUCTION SET OR - Logical Inclusive OR Opcode Instruction Clocks Description 08 09 OR OR OR OR OR OR OR OR 2,mem=7 2,mem=7 2,mem=7 2,mem=7 3 3 3,mem=7 3,mem=7 Logical-OR Logical-OR Logical-OR Logical-OR Logical-OR Logical-OR Logical-OR Logical-OR OA 08 OC 00 80 81 Ir Ir Ir Ir db dw 11 11 db dw eb,rb eW,rw rb,eb rw,ew AL,db AX,dw eb,db eW,dw byte register into EA byte word register into EA word EA byte into byte register EA word into word register immediate byte into AL immedia
THE 80286 INSTRUCTION SET OUT -Output to Port Opcode E6 E7 EE db db EF Instruction Clocks Description OUT OUT OUT OUT 3 3 3 3 Output Output Output Output db,AL db,AX OX,AL OX,AX byte AL to immediate port number db. word AX to immediate port number db byte AL to port number OX word AX to port number OX FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION OUT transfers a data byte or data word from the register CAL or AX) given.
THE 80286 INSTRUCTION SET OUTS/OUTSB/OUTSW-Output String to Port Opcode Instruction Clocks Description 6E 6F 6E 6F OUTS OX,eb OUTS OX,ew OUTSB OUTSW 5 5 5 5 Output byte [SI] to port number OX Output word [SI] to port number OX Output byte OS:[SI] to port number OX Output word OS:[SI] to port number OX FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION OUTS transfers data from the memory byte or word at SI to the output port numbered by the DX register.
THE 80286 INSTRUCTION SET POP-Pop a Word from the Stack Opcode Instruction Clocks Description 1F POP POP POP POP POP 5,pm=20 5,pm=20 5,pm=20 5 Pop top Pop top Pop top Pop top Pop top 07 17 SF /0 58+rw OS ES SS mw rw 5 of of of of of stack stack stack stack stack into OS into ES into SS into memory word into word register FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The word on the top of the 80286 stack, addressed by SS:SP, replaces the previous contents of the memory, register, or
inter THE 80286 INSTRUCTION SET If ES or OS is loaded with non-null selector: AR byte must indicate data or readable code segment else #GP (selector) If data or non-conforming code, then both the RPL and the CPL must be less than or equal to OPL in AR byte else #GP (selector) Segment must be marked PRESENT else #NP (selector) Load segment register with selector Load segment register cache with descriptor If ES or OS is loaded with a null selector: Load segment register with selector Clear valid bit in cac
THE 80286 INSTRUCTION SET POPA-Pop All General Registers Opcode Instruction Clocks Description 61 POPA 19 Pop in order: DI,SI,8P,SP,8X,DX,CX,AX FLAGS MODIFIED None FlAGS UNDEFINED None OPERATION POPA pops the eight general registers given in the description above, except that the SP value is discarded instead of loaded into SP. POPA reverses a previous PUSHA, restoring the general registers to their values before PUSHA was executed. The first register popped is DI.
THE 80286 INSTRUCTION SET POPF-Pop from Stack into the Flags Register Opcode Instruction Clocks Description 9D POPF 5 Pop top of stack into flags register FLAGS MODIFIED Entire flags register is popped from stack FLAGS UNDEFINED None OPERATION The top of the 80286 stack, pointed to by SS:SP, is copied into the 80286 flags register. The stack pointer SP is incremented by 2to point to the new top of stack.
THE 80286 INSTRUCTION SET PUSH-Push a Word onto the Stack Opcode Instruction Clocks Description 06 OE 16 1E PUSH PUSH PUSH PUSH PUSH PUSH PUSH PUSH 3 3 3 3 3 5 3 3 Push Push Push Push Push Push Push Push 50+ rw FF 68 6A /6 dw db ES CS SS DS rw mw dw db ES CS SS DS word register memory word immediate word immediate sign-extended byte FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The stack pointer SP is decremented by 2, and the operand is placed on the new top of stack, which is poi
THE 80286 INSTRUCTION SET PUSHA-Push All General Registers Opcode Instruction Clocks Description 60 PUSHA 17 Push in order: AX,CX,DX,8X,original SP,8P,SI,DI FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION PUSHA saves the registers noted above on the 80286 stack. The stack pointer SP is-decremented by 16 to hold the 8 word values. Since the registers are pushed onto the stack in the order in which they were given, they will appear in the 16 new stack bytes in the reverse order.
THE 80286 INSTRUCTION SET PUSHF-Push Flags Register onto the Stack Opcode Instruction Clocks Description 9C PUSHF 3 Push flag~ register FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The stack pointer SP is decremented by 2, and the 80286 flags register is copied to the new top of stack, which is pointed to by SS:SP.
THE 80286 INSTRUCTION SET RCLI RCR I ROLl ROR-Rotate Instructions Opcode Instruction Clocks-N° Description 00 02 CO 01 03 C1 00 02 CO 01 03 C1 00 02 CO 01 03 C1 00 02 CO 01 03 C1 RCL RCL RCL RCL RCL RCL RCR RCR RCR RCR RCR RCR ROL ROL ROL ROL ROL ROL ROR ROR ROR ROR ROR ROR 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 Rotate 9-bits (CF, EA byte) left once
THE 80286 INSTRUCTION SET The rotate is repeated the number of times indicated by the second operand, which is either an immediate number or the contents of the CL register. To reduce the maximum execution time, the 80286 does not allow rotation counts greater than 31. If a rotation count greater than 31 is attempted, only the bottom five bits of the rotation are used. The 8086 does not mask rotate counts. The overflow flag is set only for the single-rotate (second operand = 1) forms of the instructions.
THE 80286 INSTRUCTION SET REP IREPE/REPNE-Repeat Following.
THE 80286 INSTRUCTION SET The REP prefixes make sense only in the contexts listed above. They cannot be applied to anything other than string operations. Synonymous forms of REPE and REPNE are REPZ and REPNZ, respectively. The REP prefixes apply only to one string instruction at a time. To repeat a block of instructions, use a LOOP construct. The precise action for each iteration is as follows: 1. Check the CX register. If it is zero, exit the iteration and move to the next instruction. 2.
THE 80286 INSTRUCTION SET RET -Return from Procedure Opcode Instruction Clocks· Description CB CB C3 CA CA C2 RET RET RET RET dw RET dw RET dw 15,pm=25 55 11 15,pm=25 55 11 Return to far caller, same privilege Return, lesser privilege, switch stacks Return to near caller, same privilege RET (far), same privilege, pop dw bytes RET (far), lesser privilege, pop dw bytes RET (near), same privilege, pop dw bytes pushed before Call dw dw dw • Add 1 clock for each byte in the next instruction executed.
THE 80286 INSTRUCTION SET RETURN TO SAME LEVEL: Return selector must be non-null else #GP(O) Selector index must be within its descriptor table limits else #GP (selector) Descriptor AR byte must indicate code segment else #GP (selector) If non-conforming then code segment DPL must equal CPL else #GP (selector) If conforming then code segment DPL must be :s; CPL else #GP (selector) Code segment must be PRESENT else #NP (selector) Top word on stack must be within stack limits else #SS(O) IP must be in code s
THE 80286 INSTRUCTION SET SAHF -Store AH into Flags Opcode Instruction Clocks Description 9E SAHF 2 Store AH into flags SF ZF xx AF xx PF xx CF FLAGS MODIFIED Sign, zero, auxiliary carry, parity, carry FLAGS UNDEFINED None OPERATION The flags listed above are loaded with values from the AH register, from bits 7, 6, 4, 2, and 0, respectively.
THE 80286 INSTRUCTION SET SAL/SARISHL/SHR-Shift Instructions Opcode DO 02 CO 01 03 C1 DO 02 CO 01 03 C1 DO 02 CO 01 03 C1 /4 /4 /4 /4 /4 /4 /7 /7 /7 /7 /7 /7 /5 /5 /5 /5 /5 /5 db db db db db db Instruction Clocks-N' Description SAL SAL SAL SAL SAL SAL SAR SAR SAR SAR SAR SAR SHR SHR SHR SHR SHR SHR 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 2,mem=7 5,mem=8 5,mem=8 Multiply EA byte by 2, once Multiply EA byte by 2, CL
THE 80286 INSTRUCTION SET PROTECTED MODE EXCEPTIONS #GP(O) if the operand is in a non-writable segment. #GP(O) for an illegal memory operand effective address in the CS, DS, or ES segments; #SS(O) for an illegal address in the SS segment. REAL ADDRESS MODE EXCEPTIONS Interrupt 13 for a word operand at offset OFFFFH.
THE 80286 INSTRUCTION SET SBB-Integer Subtraction With Borrow Opcode Instruction Clocks Description 18 Ir SBB eb,rb 2,mem=7 19 jr SBB eW,rw 2,mem=7 1A Ir SBB rb,eb 2,mem=7 1B Ir SBB rW,ew 2,mem=7 1C 10 80 81 83 db dw SBB SBB SBB SBB SBB 3 3 3,mem=7 3,mem=7 3,mem=7 Subtract with borrow byte register from EA byte Subtract with borrow word register from EA word Subtract with borrow EA byte from byte register Subtract with borrow EA word from word register Subtract with borrow imm.
THE 80286 INSTRUCTION SET SCAS/SCASB/SCASW-Compare String Data Opcode Instruction Clocks Description AE SCAS mb SCAS mw SCASB SCASW 7 7 7 7 Compare Compare Compare Compare AF AE AF bytes AL - ES:[Olj, advance 01 words AX - ES:[Olj, advance 01 bytes AL - ES:[Olj, advance 01 words AX - ES:[Olj, advance 01 FLAGS MODIFIED Overflow, sigri, zero, auxiliary carry, parity, carry FLAGS UNDEFINED None OPERATION SCAS subtracts the memory byte or word at ES:OI from the AL or AX register.
THE 80286 INSTRUCTION SET SGDT /SIDT -Store Global/Interrupt Descriptor Table Register Opcode OF OF 01 01 /0 /1 Instruction Clocks Description SGDT m SIDT m 11 12 Store Global Descriptor Table register to m Store Interrupt Descriptor Table register to m FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The contents of the descriptor table register are copied to six bytes of memory indicated by the operand.
THE 80286 INSTRUCTION SET SLOT -Store Local Opcode OF 00 /0 Descriptor Table Register Instruction Clocks Description SLOT ew 2,mem=3 Store Local Descriptor Table register to EA word FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The Local Descriptor Table register is stored in the 2-byte register or memory location indicated by the effective address operand. This register is a selector that points into the Global Descriptor Table. SLDT appears only in operating systems software.
THE 80286 INSTRUCTION SET SMSW -Store Machine Status Word Opcode OF 01 /4 Instruction Clocks Description SMSWew 2,mem=3 Store Machine Status Word to EA word FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The Machine Status Word is stored in the 2-byte register or memory location indicated by the effective address operand. PROTECTED MODE EXCEPTIONS #GP(O) if the destination is in a non-writable segment.
THE 80286 INSTRUCTION SET STe-Set Carry Flag Opcode Instruction Clocks Description F9 STC 2 Set carry flag FLAGS MODIFIED Carry= 1 FLAGS UNDEFINED None OPERATION The carry flag is set to 1. .
THE 80286 INSTRUCTION SET STO"";'Set Direction Flag Opcode Instruction Clocks Description FO STO 2 Set direction flag 50 51 and 01 will decrement FLAGS MODIFIED Direction = 1 FLAGS UNDEFINED None OPERATION The direction flag is set to 1. This causes all subsequent string operations to decrement the index registers (SI and/or 01) on which they operate.
THE 80286 INSTRUCTION SET STI-Set Interrupt Enable Flag Opcode Instruction Clocks Description FB STI 2 Set interrupt enable flag, interrupts enabled FLAGS MODIFIED Interrupt = I (enabled) FLAGS UNDEFINED None OPERATION The interrupts-enabled flag is sct to 1. The 80286 will now respond to external interrupts after executing the STI instruction. PROTECTED MODE EXCEPTIONS #GP(O) if the current privilege level is bigger (has less privilege) than the I/O privilege level.
THE 80286 INSTRUCTION SET STOS/STOSB/STOSW-Store String Data Opcode Instruction Clocks Description AA AS AA AS STOS mb STOS mw STOSS STOSW 3 Store Store Store Store 3 3 3 AL to byte ES:[OI], advance 01 AX to word ES:[OI], advance 01 AL to byte ES:[OI], advance 01 AX to word ES:[OI], advance 01 FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION STOS transfers the contents the AL or AX register to the memory byte or word at ES:DI.
THE 80286 INSTRUCTION SET STR-Store Task Register Opcode OF 00 /1 Instruction Clocks Description STR ew 2,mem=3 Store Task Register to EA word FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The contents of the Task Register are copied to the 2-byte register or memory location indicated by the effective address operand. PROTECTED MODE EXCEPTIONS #GP(O) if the destination is in a non-writable segment.
THE 80286 INSTRUCTION SET SUB-Integer Subtraction Opcode Instruction Clocks Description 28 29 2A 2B 2C 20 80 81 83 SUB SUB SUB SUB SUB SUB SUB SUB SUB 2,mem=7 2,mem=7 2,mem=7 2,mem=7 3 3 3,mem=7 3,mem=7 3,mem=7 Subtract byte register from EA byte Subtract word register from EA word Subtract EA byte from byte register Subtract EA word from word register Subtract immediate byte from AL Subtract immediate word from AX Subtract immediate byte from EA byte Subtract immediate word from EA word Subtract im
THE 80286 INSTRUCTION SET TEST -Logical Compare Opcode 84 84 85 85 A8 A9 /r /r /r /r F6 F7 /0 /0 Instruction db dw db dw TEST TEST TEST . TEST TEST TEST TEST TEST eb,rb rb,eb eW,rw rw,ew AL,db AX,dw eb,db ew;dw Clocks Description 2,mem=6 2,mem=6 2,mem=6 2,mem=6 AND byte register into EA byte for flags only AND EA byte into byte.
THE 80286 INSTRUCTION SET VERR,VERW-Verifya Segment for Reading or Writing Opcode OF OF 00 00 /4 /5 Instruction Clocks Description VERR ew VERWew 14,mem=16 14,mem=16 Set ZF=1 if seg. can be read, selector ew Set ZF= 1 if seg. can be written, selector ew FLAGS MODIFIED Zero FLAGS UNDEFINED None OPERATION VERR and VERW expect the 2-byte register or memory operand to contain the value of a selector.
THE 80286 INSTRUCTION SET REAL ADDRESS MODE EXCEPTIONS Interrupt 6; VERR and VERW are not recognized in Real Address Mode.
THE 80286 INSTRUCTION SET WAIT -Wait Until BUSY Pin Is Inactive (HIGH) Opcode Instruction Clocks Description 98 WAIT 3 Wait until 8USY pin is inactive (HIGH) FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION WAIT suspends execution of 80286 instructions until the BUSY pin is inactive (high). The BUSY pin is driven by the 80287 numeric processor extension. WAIT is issued to ensure that the numeric instruc. tion being executed is complete, and to check for a possible numeric fault (see below).
THE 80286 INSTRUCTION SET XCHG - Exchange Memory/Register with Register Opcode Instruction Clocks Description 86 86 87 87 XCHG XCHG XCHG XCHG XCHG XCHG 3,mem=5 3,mem=5 3,mem=5 3,mem=5 Exchange Exchange Exchange Exchange Exchange Exchange Ir Ir Ir Ir 90+ rw 90+ rw eb,rb rb,eb eW,rw rW,ew AX,rw rW,AX 3 3 byte register with EA byte EA byte with byte register word register with EA word EA word with word register word register with AX with word register FLAGS MODIFIED None FLAGS UNDEFINED None O
THE 80286 INSTRUCTION SET XLAT -Table Look-up Translation Opcode Instruction Clocks Description 07 XLAT mb 5 07 XLATB 5 Set AL to memory byte OS:[BX AL] Set AL to memory byte OS:[BX AL] + unsigned + unsigned FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION When XLAT is executed, AL should be the unsigned index into a table addressed by DS:BX. XLAT changes the AL register from the table index into the table entry. BX is unchanged.
THE 80286 INSTRUCTION SET XOR-Logical Exclusive OR Opcode Instruction Clocks Description 30 31 32 33 34 35 80 81 XOR XOR XOR XOR XOR XOR XOR XOR 2,mem=7 2,mem=7 2,mem=7 2,mem=7 3 3 3,mem=7 3,mem=7 Exclusive-OR Exclusive-OR Exclusive-OR Exclusive-OR Exclusive-OR Exclusive-OR Exclusive-OR Exclusive-OR Ir Ir Ir Ir db dw 16 16 db dw eb,rb eW,rw rb,eb rw,ew AL,db AX,dw eb,db eW,dw byte register into EA byte word register into EA word EA byte into byte register EA word into word register immediate by
Appendix 8086/8088 Compatibility Considerations C
APPENDIX C 8086/8088 COMPATIBILITY CONSIDERATIONS SOFTWARE COMPATIBILITY CONSIDERATIONS In general, the real address mode 80286 will correctly execute ROM-based 8086/8088 software. The following is a list of the minor differences between 8086 and 80286 (Real mode). 1. Add Six Interrupt Vectors. The 80286 adds six interrupts which arise only if the 8086 program has a hidden bug. These interrupts occur only for instructions which were undefined on the 8086/8088 or if a segment wraparound is attempted.
8086/8088 COMPATIBILITY CONSIDERATIONS 4. Use Interrupt 16 for Numeric Exceptions. Any 80287 system must use interrupt vector 16 for the numeric error interrupt. If an 8086/8087 or 8088/8087 system uses another vector for the 8087 interrupt, both vectors should point at the numeric error interrupt handler. 5. Numeric Exception Handlers Should allow Prefixes. The saved CS:IP value in the NPX environment save area will point at any leading prefixes before an ESC instruction.
aOB6/aoaa COMPATIBILITY CONSIDERATIONS 13. Do not Rely on IDIV Exceptions for Quotients of 80H or 8000H. The 80286 can generate the largest negative number as a quotient for IDIV instructions. The 8086 will instead cause exception O. 14. Do not Rely on NMI Interrupting NMI Handlers. After an NMI is recognized, the NMI input and processor extension limit error interrupt is masked until the first IRET instruction is executed. 15.
Appendix 80286/80386 Software Compatibility Considerations D
APPENDIX D 80286/80386 SOFTVVARE COMPATIBILITY CONSIDERATIONS This appendix describes the considerations required in designing an Operating System for the protected mode 80286 so that it will operate on an 80386. An 80286 Operating System running on the 80386 would not use any of the advanced features of the 80386 (Le., paging or segments larger than 64K), but would run 80286 code faster. Use of the new 80386 features requires changes in the 80286 Operating System.
80286/80386 SOFTWARE COMPATIBILITY CONSIDERATIONS 6. Do not change bits 15-4 of MSW. The 80386 uses some of the undefined bits in the machine status word. 80286 software should ignore bits 15-4 of the MSW. To change the MSW on an 80286, read the old value first with LMSW, change bits 3-0 only, then write the new value with SMSW. 7. Use a restricted LOCK protocol for multiprocessor systems. The 80386 supports the 8086/80286 LOCK functions for simple instructions, but not the string move instructions.
INDEX AAA, 3-27, B-15 AAD, 3-28, B-16 AAM, 3-28, B-17 AAS, 3-28, B-18 ADC, 3-7, B-19 ADD, 3-7, B-19 Addressing Modes,· 2-16 Based Indexed Mode, 2-21 Based Indexed Mode with Displacement, 2-20 Based Mode (on BX or BP Registers), 2-20 Direct Address Mode, 2-20 Displacement, 2-16, B-1, B-2 Immediate Operand, 2-16, B-1, B-2, B-4, B-5 Indexed Mode (by DI or SI), 2-21 Opcode, 2-16 Register Indirect Mode, 2-20 Summary, 2-21 AF Flag, (see Flags) AH Register, 2-7, 2-8, 2-17,3-9,3-25,3-27, 3-28, B-56 AL Register, 2-
INDEX CWD Instruction, 3-16, B-35 CX Register, 2-7, 2-8, 2-17, 3-20, 3-22 - 3-24 DAA, 3-27, B-36 DAS, 3-27, B-37 Data Management Instructions, 4-1, 4-2, 5-5 Address Manipulation, 3-24 Arithmetic Instructions, 3-5 Addition Instructions, 3-7 Division Instructions, 3-9 MUltiplication Instructions, 3-8 Subtraction Instructions, 3-7 BCD Arithmetic, 2-4, 2-5 Character Transfer and String Instructions, 3-22 Repeat Prefixes, 3-22, 3-23 String Move, 3-23 - 3-25 String Translate, 3-22 Control Transfer Instructions,
INDEX Instructions, 2-14, 2-15, 3-4 - 3-7, 3-25, B-56 AF (Auxilliary Carry Flag), 2-14, 2-15, 3-6 - 3-10,3-16,3-23,3-26,3-27 CF (Carry Flag), 2-14, 3-4 - 3-16,3-20, 3-23 - 3-27, B-28, B-32, B-90, B-I04 DF (Direction Flag), 2-15, 3-6, 3-7, 3-22, 3-23,3-25 - 3-27, 4-1, B-29 IF (Interrupt Flag), 2-15, 3-5, 3-7, 3-28, 5-5, 5-6, 9-2, 9-3, B-30, B-I06 IOPL (Privilege Level), 2-15, 3-6, 3-28, 3-29, B-30 NT (Nested Task Flag), 2-15, 3-6, 8-7, 9-3, 9-5, 9-7, 10-1 OF (Overflow Flag), 2-15,2-25, 3-6 - 3-13, 3-16, 3-2
INDEX LOOPNZ, 3-21, B-70 LSL Instruction, 11-3, B-71 Interrupt 7 Processor Extension Not Available, 5-6, 5-7,9-9 Interrupt 8, Interrupt Table Limit Too Small, 5-6, 5-7, 9-9, 9-10 Interrupt Vectors, 5-3 - 5-7 Reserved Vectors, 5-5, 5-7 Interrupt Vector Table, 5-3 Interrupts and Exceptions, (see Interrupt Handling and Interrupt Priorities) INTO Detected Overflow (Interrupt 4), (see Interrupt Handling and Interrupt Priorities) INTO Instruction, 2-25, 3-22, B-48 INTR, 5-3, 5-4, 9-1, 9-2, 9-7, 11-7 Invalid opc
INDEX NT (Nested Task Flag), (see Flags) Numeric Data Processor Instructions, 3-30 OF (Overflow Flag), (see Flags) Offset Computation, 2-19 Operands, 2-16, 2-17 OR Instruction, 2-23, 3-10, B-80 OUT/OUTW, 2-23,3-29, 10-6, B-81 OUTS/OUTSB/OUTSW Instruction, 3-29, 4-1, B-82 PF (Parity Flag), (see Flags) Pointer, (see Data Types) POP Instruction, 3-3, B-83 POPA Instruction, 3-2, 3-5, B-85 POPF Instruction, 3-26, 3-28, B-86 Processor Extension Error (Interrupt 6), (see Interrupt Handling and Interrupt Prioritie
INDEX Single Step (Interrupt 1), (see Interrupt Priorities) SMSW Instruction, 10-4, B-I03 SP Register, 2-7 - 2-14,2-19, 3-24 - 3-26, 4-2, 7-20, 7-21, 10-7 SS Register, 2-7, 2-8, 2-10 - 2-14, 2-17 - 2-19, 5-7,6-9 - 6-11, 7-12 - 7-14, 7-16, 7-20 - 7-22, 8-5, 9-12, 10-7 Status and Control Registers, 2-14 - 2-16 Stack Flag, (see Flags) Stack Fault (Interrupt 12), (see Interrupt Priorities) Stack Manipulation Instructions, 3-2, 3-3 Stack Operations, 2-10 Grow Down, 2-11 Overview, 2-10 - 2-14 Segment Register Us
80287 Numeric Processor Extension (NPX)
PREFACE AN INTRODUCTION TO THE 80286 This supplement describes the 80287 Numeric Processor Extension (NPX) for the 80286 microprocessor. Below is a brief overview of 80286 concepts, along with some of the nomenclature used throughout this and other Intel publications. The 80286 Microsystem The 80286 is a new VLSI microprocessor system with exceptional capabilities for supporting largesystem applications.
PREFACE between 80286 and 8086 processor families reduces both the time and the cost of software development. The Organization of This Manual This manual describes the 80287 Numeric Processor Extension (NPX) for the 80286 microprocessor. The material in this manual is presented from the perspective of software designers, both at an applications and at a systems software level.
TABLE OF CONTENTS CHAPTER 1 Page OVERVIEW OF NUMERIC PROCESSING Introduction to the 80287 Numeric Processor Extension ............................................. 1-1 Performance ...................... ........... ....... ................................................ ............ ........... 1-1 Ease of Use ................................................................................................................. 1-2 Applications ....................................................................
TABLE OF CONTENTS Page Comparison Instructions ............................................................................................ Transcendental Instructions ....... ........ ......................... ............................. .................. Constant Instructions ................................................................................................. Processor Control Instructions ......... ........ ....... .................. ....... ....................... ..... .....
TABLE OF CONTENTS Page Avoiding Underflow and Overflow .......................................................................... Final Adjustments ............................ ....... .............. ........... .............. .......................... Output Format ................ .............. ............ ....................................... ......... .............. ..... Trigonometric Calculation Examples ...... ...... .............. ............ .............. .................. .......
inter Figure 3-1 4-1 4-2 4-3 4-4 4-5 4-6 4-7 TABLE OF CONTENTS Title Software Routine to Recognize the 80287 ............................................................. Conditional Branching for Compares ..................................................................... Conditional Branching for FXAM ............................................................................ Full-State Exception Handler ..................................................................................
Overview of Numeric Processing 1
CHAPTER 1 OVERVIEW OF NUMERIC PROCESSING The 80287 NPX is a high-performance numerics processing element that extends the 80286 architecture by adding significant numeric capabilities and direct support for floating-point, extended-integer, and BCD data types. The 80286 CPU with 80287 NPX easily supports powerful and accurate numeric applications through its implementation of the proposed IEEE 754 Standard for Binary Floating-Point Arithmetic.
OVERVIEW OF NUMERIC PROCESSING DOUBLE-PRECISION WHETSTONE PERFORMANCE (KOPS) ( 80286/80287 ) 200 .-------...../ ( 8086/8087) 100 STACK TOP POINTER'" 1980 1983 YEAR INTRODUCED G30108 Figure 1-1. Evolution and Performance of Numeric Processors Table 1-1.
OVERVIEW OF NUMERIC PROCESSING The 80287 delivers the correctly rounded result. Other typical examples of undesirable machine behavior in straightforward calculations occur when solving for the roots. of a quadratic equation: -b ± Vb 2 - 4ac 2a or computing financial rate of return, which involves the expression: (1 +i)n. On most machlnes, straightforward algorithms will not deliver consistently correct results (and will not indicate when they are incorrect).
OVERVIEW OF NUMERIC PROCESSING A few examples, which show how the 80287 might be used in specific numerics applications, are described below. In many cases, these types of systems have been implemented in the past with minicomputers. The advent of the 80287 brings the size and cost savings of microprocessor technology to these applications for the first time.
OVERVIEW OF NUMERIC PROCESSING all 80287 numeric instructions in software. This emulation is completely transparent to the application software-the same object code may be used by both 80286 and 80287 systems. No relinking or recompiling of application software is necessary; the same code will simply execute faster on the 80287 than on the 80286 system.
OVERVIEW OF NUMERIC PROCESSING Table 1-2. Numeric Data Types Data Type Bits Significant Digits (Decimal) Approximate Range (Decimal) Word integer 16 4 -32,768 ::s X ::s +32,767 Short integer 32 9 -2X10 9 ::S X::s +2X10 9 Long integer 64 18 -9X10 '8 ::S X::s +9X10'8 Packed decimal 80 18 -99 ... 99::S X::s +99 ... 99 (18 digits) Short real' 32 6-7 8.43X 10.37 ::s1 X I::s 3.37X1038 Long real' 64 15-16 4.19X 10.307 ::S I X I ::S 1.67X 10308 Temporary real 80 19 3.4 X 10.
OVERVIEW OF NUMERIC PROCESSING As shown in figure 1-2, the 80287 NPX is divided internally into two processing elements; the Bus Interface Unit (BIU) and the Numeric Execution Unit (NEU). The two units operate independently of one another: the BIU receives and decodes instructions, requests operand transfers with memory, and executes processor control instructions, whereas the NEU processes individual numeric instructions. The BIU handles all of the status and signal lines between the 80287 and the 80286.
OVERVIEW OF NUMERIC PROCESSING 80286 memory management and protection mechanisms. The 80286 Processor Extension Data Channel and the hardware interface between the 80286 and 80287 processors are described in Chapter Six of the 80286 Hardware Reference Manual. From the programmer's perspective, the 80287 can be considered just an extension of the 80286 processor. All interaction between the 80286 and the 80287 processors on the hardware level is handled .
OVERVIEW OF NUMERIC PROCESSING 80287 STACK: 79 Rl 78 SIGN TAG FIELD 64 63 EXPONENT 0 1 0 SIGNIFICAND R2 R3 r-- - R4 R5 R6 R7 R8 0 15 CONTROL REGISTER STATUS REGISTER TAG WORD t- INSTRUCTION POINTER DATA POINTER G3010B Figure 1-3_ 80287 Register Set Many numeric instructions have several addressing modes that permit the programmer to implicitly operate on the top of the stack, or to explicitly operate on specific registers relative to the ST.
OVERVIEW OF NUMERIC PROCESSING 15 I B I Co I ST I c" I c, I eoJEsl X I PE IUEIOEIZEIDEIIE I I EXCE PTION FLAGS (1 ~ EXCEPTION HAS OCCURRED) INVALID OPERATION' DENORMALIZED OPERAND' ZERO DIVIDE' OVERFLOW' UNDERFLOW' PRECISION' (RESE RVED) ERRO R SUMMARY STATUS(1) COND ITION CODE(2) STACK TOP POINTER(3) NEU BUSY (1) ES IS SET IF ANY UNMASKED EXCEPTION BIT IS SET, CLEARED OTHERWISE. (2) SEE TABLE 1-4 FOR CONDITION CODE INTERPRETATION.
OVERVIEW OF NUMERIC PROCESSING Table 1-4. Interpreting the NPX Condition Codes Instruction Type Compare, Test C. C. C, C. 0 0 0 0 0 0 1 X X X X Q, 0 Q. Q.
inter OVERVIEW OF NUMERIC PROCESSING 15 I xxx I IC I R cL PC I xI X IPMIUMIOMIZMIDMIIM I I EXCEPTION MASKS (1 ~EXCEPTION IS MASKED) INVALID OPERATION DENORMALIZED OPERAND ZERO DIVIDE OVERFLOW UNDERFLOW PRECISION (RESERVED) (RESERVED) PRECISION CONTROL (1) ROUNDING CONTROL(2 ) INFINITY CONTROL (0 (RESERVED) (1) ~ PROJECTIVE, 1 ~ AFFINE) (2) ROUNDING CONTROL PRECISION CONTROL 00 ~ ROUND TO NEAREST OR EVEN 00 ~ 24-BIT SIGNIFICAND 01 ~ ROUND DOWN (TOWARD -co) o1 ~ RESERVED 10 ~ ROUND UP (TOWA
OVERVIEW OF NUMERIC PROCESSING TAG VALUES: 00 ~ VALID 01 ~ ZERO 10 ~ INVALID OR INFINITY 11 ~ EMPTY G30108 Figure 1-6. 80287 Tag Word Format MEMORY OFFSET 15 MEMORY OFFSET 15 CONTROL WORD to CONTROL WORD '.
OVERVIEW OF NUMERIC PROCESSING The instruction address saved in the 80287 will point to any prefixes that preceded the instruction. This is different from the 8087, for which the instruction address pointed only to the ESC instruction opcode. COMPUTATION FUNDAMENTALS This section covers 80287 programming concepts that are common to all applications. It describes the 80287's internal number system and the various types of numbers that can be employed in NPX programs.
OVERVIEW OF NUMERIC PROCESSING NEGATIVE RANGE (NORMALIZED) 1'1 -5 L' -4 I , • I -3 -2 -1 POSITIVE RANGE (NORMALIZED) iii I : .J'" I'" 1''''1''''1'''''1' ] -1.67x10308 -4.19x10-a07 G30108 Figure 1-8. 80287 Number System From a practical standpoint, the 80287's set of real numbers is sufficiently large and dense so as not to limit the vast majority of microprocessor applications.
OVERVIEW OF NUMERIC PROCESSING _ _ INCREASING SIGNIFICANCE WORD INTEGER SHORT INTEGER lSi MAGNITUDE I 15 0 I~ I (TWO'S COMPLEMENT) MAGNITUDE (TWO'S L . ..1."--_ _ _ _ _ _ _ _ _ _...... COMPLEMENT) 31 II I U 0 (TWO'S LONG INTEGER LS..I"--_ _"--_ _ _ _ _ _ _ M_A_G_N_IT_U_D_E_ _ _ _ _ _ _ _ _- .
OVERVIEW OF NUMERIC PROCESSING Table 1-5. Real Number Notation Notation Value Ordinary Decimal 178.125 Scientific Decimal 1A78125E2 Scientific Binary 1A0110010001E111 Scientific Binary (Biased Exponent) 1A0110010001E10000110 80287 Short Real (Normalized) Sign Biased Exponent 0 10000110 Significand ~100100010000000000000 1A (implicit) BINARY INTEGERS The three binary integer formats are identical except for length, which governs the range that can be accommodated in each format.
OVERVIEW OF NUMERIC PROCESSING The NPX usually carries the digits of the significand in normalized form. This means that, except for the value zero, the significand is an integer and a fraction as follows: l~fff.. .ff where ~ indicates an assumed binary point. The number of fraction bits varies according to the real format: 23 for short, 52 for long, and 63 for temporary real. By normalizing real numbers so that their integer bit is always a 1, the 80287 eliminates leading zeros in small values (Ix! < 1).
inter OVERVIEW OF NUMERIC PROCESSING in arithmetic and store operations when the format of the destination cannot exactly represent the infinitely precise true result. For example, a real number may be rounded if it is stored in a shorter real format, or in an integer format. Or, the infinitely precise true result may be rounded when it is returned to a register. The NPX has four rounding modes, selectable by the RC field in the control word (see figure 1-5).
OVERVIEW OF NUMERIC PROCESSING o PROJECTIVE CLOSURE + -00 +00 .,~.~----~----~.~,. o AFFINE CLOSURE G30108 Figure 1-10. Projective versus Affine Closure means of closure is projective, and this is recommended for most computations. When projective closure is selected, the NPX treats the special values +00 and -00 as a single unsigned infinity (similar to its treatment of signed zeros). In the affine mode the NPX respects the signs of +00 and -00.
OVERVIEW OF NUMERIC PROCESSING and can express relevant information about the computations or operations that produced them. The various types of special values are Non-normal real numbers, including denormals unnormals Zeros and pseudo zeros Positive and negative infinity NaN (Not-a-Number) Indefinite The following description explains the ongms and significance of each of these special values.
OVERVIEW OF NUMERIC PROCESSING were long real or temporary real, since these formats can handle exponents down to -1023 and -16,383, respectively. Most computers underflow "abruptly:" they simply return a zero result, which is likely to produce an unacceptable final result if computatiol). continues. The 80287, on the other hand, underflows "gradually" when the underflow exception is masked.
OVERVIEW OF NUMERIC PROCESSING Denormals are rarely encountered in most applications. Typical debugged algorithms generate extremely small results during the evaluation of intermediate sub expressions; the final result is usually of an appropriate magnitude for its short or long real destination. If intermediate results are held in temporary real, as is recommended, the great range of this format makes underflow very unlikely.
OVERVIEW OF NUMERIC PROCESSING Table 1-9 shows how the instruction set deals with unnormal operands. Note that the unnormal may be the original operand or a temporary created by the 80287 from a denormal. ZEROS AND PSEUDO ZEROS The value zero in the real and decimal integer formats may be signed either positive or negative, although the sign of a binary integer zero is always positive.
inter OVERVIEW OF NUMERIC PROCESSING Pseudo zero operands behave like unnormals, except in the following cases where they produce the same results as true zeros: Compare and test instructions FRNDINT (round to integer) Division, where the dividend is either a true zero or a pseudo zero (the divisor is a pseudo zero) In addition and subtraction of a pseudo zero and a true zero or another pseudo zero, the pseudo zeroes) behaves like unnormals, except for the determination of the result's sign.
OVERVIEW OF NUMERIC PROCESSING handler could determine which element had been accessed, since the operand address field of the exception pointers would point to the NaN, and the NaN would contain the index number of the array element. Table 1-10. Zero Operands and Results Operation/Operands FLD, FBLD(1) +0 -0 FILD(2) +0 FST,FSTP +0 -0 +X(3) -X(3) FBSTP +0 -0 FIST, FISTP +0 -0 +X(4) _X(4) Addition +0 plus -0 plus +0 plus -X plus ±O plus Operation/ Operands Division ±o -;.±X -;.+0 -;.+0-;.-X -;.-X-;.
OVERVIEW OF NUMERIC PROCESSING (3) Severe underflows in storing to short or long real may generate zeros. (4) Small values ( Ixl < 1) stored into integers may round to zero. (5) (6) (7) (8) (9) Sign is determined by round mode: * = + for nearest, up, or chop * = - for down t = sign of X. Very small values of X and Y may yield zeros, after rounding of true result. NPX signals underflow to warn that zero has been yielded by nonzero operands.
OVERVIEW OF NUMERIC PROCESSING Table 1-12.
inter OVERVIEW OF NUMERIC PROCESSING t = sign is compler:nent of original operand's sign $ = sign is "exclusive or" original operand signs (+ if operands had same sign, different signs) if operands had INDEFINITE For every 80287 numeric data type, one unique encoding is reserved for representing the special value indefinite. The 80287 produces this encoding as its response to a masked invalid-operation exception.
OVERVIEW OF NUMERIC PROCESSING Table 1-14. Packed Decimal Encodings Magnitude Class . Sign I digit I ... I digit 1 · .. 1 0 0 1 digit o0 1 0 0 1 1 0 0 1 1 0 0 1 1 (Smallest) ·· · 0000000 0 0000000 o0 0 0 o0 0 0 o0 0 0 o0 0 0 · .. o0 0 1 Zero 0 0000000 000 0 o0 0 0 o0 0 0 o0 0 0 ... o0 0 0 Zero 1 0000000 o 000 o 0 0 0 o0 0 0 o0 0 0 ... o0 0 0 (Smallest) 1 0000000 o0 0 0/ o0 0 0 o0 0 0 · ..
OVERVIEW OF NUMERIC PROCESSING Table 1-15. Real and Long Real Encodings Sign Biased Exponent Signlficand· 0 ··· 11 ... 11 0 ··· 11 ... 11 11 ... 11 00... 01 0 11 ... 11 00... 00 0 ··· 11 ... 10 0 ·· · 11 ... 11 00 ... 01 00 ... 00 0 ·· · 00 ... 00 0 ··· 11 ... 11 00 ... 00 00 ... 01 Zero 0 00 ... 00 00 ... 00 Zero 1 00 ... 00 00 ... 00 1 ··· 00 ... 00 1 ··· 00 ... 01 00 ... 00 11 ... 11 1 ·· · 00 ... 01 1 ·· · 00 ... 00 11 ... 10 11 ... 11 1 11...
OVERVIEW OF NUMERIC PROCESSING Table 1-16. Temporary Real Encodings Class NaNs 00 Biased Exponent Significand· 18 ft .. Jf 0 ·· · 11...11 111...11 0 ·· · 11...11 100 ... 01 0 11...11 100 ... 00 0 11...10 Normals 111...11 0 00 ... 01 000 ... 00 0 ·· · 00 ... 00 Denormals 011...11 0 00 ... 00 000 ... 01 Zero 0 00 ... 00 000 ... 00 Zero 1 00 ... 00 000 ... 00 1 ··· 00 ... 00 Denormals 000 ... 01 1 00 ... 00 011...11 1 00 ... 01 Unnormals 000 ... 00 '" Q) 0 c..
inter OVERVIEW OF NUMERIC PROCESSING Table 1-16. Temporary Real Encodings (Cont'd.) Class 00 III Q) .~ iiiCl Q) z ~I Indefinite Sign Biased Exponent Significand· l,:lff ... ff 1 11 ... 11 100 ... 00 1 ·· 11 ... 11 · ··· 100 ... 00 1 11 ... 11 110 ... 00 0 0 ·· · ·· 11 ... 11 1 ··· ·· 111 ... 11 1..--15 bits ---.11-4..- - - 64 bits --~,.
OVERVIEW OF NUMERIC PROCESSING DENORMALIZED OPERAND If an instruction attempts to operate on a denormal, the NPX reports the denormalized operand exception. This exception allows users to implement in software an option of the proposed IEEE standard specifying that operands must be prenormalized before they are used. NUMERIC OVERFLOW AND UNDERFLOW If the exponent of a numeric result is too large for the destination real format, the 80287 signals a numeric overflow.
OVERVIEW OF NUMERIC PROCESSING Table 1-17. Exception Conditions and Masked Responses Condition Masked Response Invalid Operation Source register is tagged empty (usually due to stack underflow). Return real indefinite. Destination register is not tagged empty (usually due to stack overflow). Return real indefinite (overwrite destination value). One or both operands is a NaN. Return NaN with larger absolute value (ignore signs). (Compare and test operations only): one or both operands is a NaN.
OVERVIEW OF NUMERIC PROCESSING Table 1-17. Exception Conditions and Masked Responses (Cont'd.) Masked Response Condition Denormalized Operand (FLD instruction only): source operand is denormal. No special action; load as usual. (Arithmetic operations only): one or both operands is denormal. Convert (in a work area) the operand to the equivalent unnormal and proceed. (Compare and test operations only): one or both operands is denormal or unnormal (other than pseudo zero).
inter OVERVIEW OF NUMERIC PROCESSING Automatic Exception Handling As described in the previous section, when the 80287 NPX encounters an exception condition whose corresponding mask bit in the NPX control word is set, the NPX automatically performs an internal fix-up (masked-exception) response. The 80287 NPX has a default fix-up activity for every possible exception condition it may encounter..
OVERVIEW OF NUMERIC PROCESSING Software Exception Handling If the NPX encounters an unmasked exception condition, it signals the exception to the 80286 CPU using the ERROR status line between the two processors. The next time the 80286 CPU encounters aWAIT or ESC instruction in its instruction stream, the 80286 will detect the active condition of the ERROR status line and automatically trap to an exception response routine using interrupt #16-the Processor Extension Error exception.
Programming Numeric Applications 2
CHAPTER 2 PROGRAMMING NUMERIC APPLICATIONS Programmers developing applications for the 80287 have a wide range of instructions and programming alternatives from which to choose. The following sections describe the 80287 instruction set in detail, and follow up with a discussion of several of the programming facilities that are available to programmers of 80287. THE 80287 NPX INSTRUCTION SET This section describes the operation of all 80287 instructions.
PROGRAMMING NUMERIC APPLICATIONS Whether supplied by the programmer or utilized automatically, the two basic types of operands are sources and destinations. A source operand simply supplies one of the inputs to an instruction; it is not altered by the instruction. Even when an instruction converts the source operand from one format to another (e.g., real to integer), the conversion is actually performed in an internal work area to avoid altering the source operand.
PROGRAMMING NUMERIC APPLICATIONS Table 2-1.
PROGRAMMING NUMERIC APPLICATIONS FIST destination FIST (integer store) rounds the content of the stack top to an integer according to the RC field of the control word and transfers the result to the destination. The destination may define a word or short integer variable. Negative zero is stored in the same encoding as positive zero: 0000 ... 00. FISTP destination FISTP (integer and pop) operates like FIST and also pops the stack following the transfer.
PROGRAMMING NUMERIC APPLICATIONS Table 2-2.
PROGRAMMING NUMERIC APPLICATIONS Table 2-3.
PROGRAMMING NUMERIC APPLICATIONS The normal subtraction instructions (subtract real, subtract real and pop, integer subtract) subtract the source operand from the destination and return the difference to the destination.
PROGRAMMING NUMERIC APPLICATIONS Note that FSCALE assumes the scale factor in ST(l) is an integral value in the range -2 15 :sX<21'. If the value is not integral, but is in-range and is greater in magnitude than 1, FSCALE uses the nearest integer smaller in magnitude; i.e., it chops the value toward O.
PROGRAMMING NUMERIC APPLICATIONS Table 2-4. Condition Code Interpretation after FPREM Condition Code Interpretation after FPREM C3 C2 C1 CO X 1 X X Incomplete Reduction; further iteration is required for complete reduction.
PROGRAMMING NUMERIC APPLICATIONS FABS FABS (absolute value) changes the top stack element to its absolute value by making its sign positive. FCHS FCHS (change sign) complements (reverses) the sign of the top stack element. Comparison Instructions Each of these instructions (table 2-5) analyzes the top stack element, often in relationship to another operand, and reports the result in the status word condition code.
PROGRAMMING NUMERIC APPLICATIONS NaNs and co (projective) cannot be compared and return C3 =CO= 1 as shown in the table. FCOMP / /source FCOMP (compare real and pop) operates like FCOM, and in addition pops the stack. FCOMPP FCOMPP (compare real and pop twice) operates like FCOM and additionally pops the stack twice, discarding both operands. The comparison is of the stack top to ST(1); no operands may be explicitly coded.
PROGRAMMING NUMERIC APPLICATIONS Table 2-8.
PROGRAMMING NUMERIC APPLICATIONS Table 2-9. Transcendental Instructions FPTAN FPATAN F2XM1 FYL2X FYL2XP1 Partial tangent Partial arctangent 2X-1 Y ·log.X Y .log.(X + 1) The ratio result of FPTAN and the ratio argument of FPATAN are designed to optimize the calculatiori of the other trigonometric functions, including SIN, COS, ARCSIN, and ARCCOS. These can be derived from TAN and ARCTAN via standard trigonometric identities. FPATAN 0.
PROGRAMMING NUMERIC APPLICATIONS FYL2XP1 0::::; I ST(O) 1< (1-(y2l2» - co < ST(1) < co FYL2XPI (Y log base 2 of (X + 1)) calculates the function Z = Y·LOG 2 (X + 1). X is taken from the stack top and must be in the range 0 ::::; I X I < (1-( Y2/2)). Y is taken from ST(1) and must be in the range - co < Y < co. FYL2XPI pops the stack and returns Z at the (new) stack top, replacing Y.
PROGRAMMING NUMERIC APPLICATIONS FLDLG2 FLDLG2 (load log base 10 of 2) loads (pushes) the value LOG lO 2 onto the stack. FLDLN2 FLDLN2 (load log base e of 2) loads (pushes) the value LOGe 2 onto the stack. Processor Control Instructions The processor control instructions shown in table 2-11 are not typically used in calculations; they provide control over the 80287 NPX for system-level activities. These activities include initialization, exception handling, and task switching.
PROGRAMMING NUMERIC APPLICATIONS It should also be noted that the 8087 instructions FENI and FDISI perform no function in the 80287. If these opcodes are detected in an 80286/80287 instruction stream, the 80287 will perform no specific operation and no internal states will be affected.
PROGRAMMING NUMERIC APPLICATIONS FSTSW IFNSTSW destination FSTSW /FNSTCW (store status word) writes the current value of the 80287 status word to the destination operand in memory. The instruction is used to • Implement conditional branching following a comparison or FPREM instruction (FSTSW) • Poll the 80287 to determine if it is busy (FNSTSW) • Invoke exception handlers in environments that do not use interrupts (FSTSW). FSTSW checks for unmasked numeric exceptions, FNSTSW does not.
PROGRAMMING NUMERIC APPLICATIONS ~ 15 CONTROL WORD STATUS WORD INSTRUCTION { POINTER DATA POINTER (15-0) OPERAND { POINTER DATA POINTER (19-16) '"{ TOPSTA ELEMENT; ST NEXTSTAC K ELEMENT:ST(1 ) Sl +6 CS SELECTOR +8 0 ·10 DATA OPERAND OFFSET +10 .12 DATA OPERAND SELECTOR +12 SIGNIFICAND 15-0 +14 SIGNIFICAND 15-0 +14 +1. 51GNIFICAND 31·16 +1.
PROGRAMMING NUMERIC APPLICATIONS FRSTOR source FRSTOR (restore state) reloads the 80287 from the 94-byte memory area defined by the source operand. This information should have been written by a previous FSA VEjFNSA VE instruction and not altered by any other instruction. An FW AIT is not required after FRSTOR. FRSTOR will automatically wait and check for interrupts until all data transfers are completed before continuing to the next instruction.
PROGRAMMING NUMERIC APPLICATIONS FSTENV /FNSTENV must be allowed to complete before any other 80287 instruction is decoded. When FSTENV is coded, an explicit FWAIT, or assembler-generated WAIT, should precede any subsequent 80287 instruction. FLDENV source FLDENV (load environment) reloads the environment from the memory area defined by the source operand. This data should have been written by a previous FSTENV /FNSTENV instruction.
PROGRAMMING NUMERIC APPLICATIONS NOTE A CPU instruction should not attempt to access a memory operand until the 80287 instruction has completed. For example, the following coding shows how FWAIT can be used to force the CPU instruction to wait for the 80287: F 1ST FWAIT VALUE MDV AX,VALUE Walt for FIST to complete More information on when to code an FWAIT instruction is given in a following section of this chapter, "Concurrent Processing with the 80287." .
PROGRAMMING NUMERIC APPLICATIONS Instruction execution by the 80287 NPX Operand transfers between the 80287 NPX and memory or a CPU register The timing of these various activities is affected by the individual clock frequencies of the 80286 CPU and the 80287 NPX. In addition, slow memories requiring the insertion of wait states in bus cycles, and bus contention due to other processors in the system, may lengthen operand transfer times.
PROGRAMMING NUMERIC APPLICATIONS the operand in memory. In table 2-14, the first figure gives execution clocks for even-addressed operands, while the second gives the clock count for odd-addressed operands. For operands aligned at word boundaries, that is, based at even memory addresses, each word to be transferred requires one bus cycle between the 80286 data channel and memory, and one bus cycle to the NPX.
PROGRAMMING NUMERIC APPLICATIONS Table 2·14.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.) FIDIVR FIDIVR source Integer divide reversed Exceptions: I, D, Z, 0, U, P Execution Clocks Typical Range Operand Word Transfers Code Bytes 230 237 225-239 231-245 1 2 2-4 2-4 Operands word-integer short-integer FILD FILD source Integer load Coding Example FIDIVR [BPj.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.) FIST FIST destination Integer store Execution Clocks Range Operand Word Transfers Code Bytes Coding Example Typical 86 88 80-90 82-92 1 2 2-4 2-4 FIST OBS.COUNT[SI] FIST [BP;].
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.) FLO FLD source Load real Exceptions: I, D Execution Clocks Typical Range Operand Word Transfers Code Bytes 20 43 46 57 17-22 38-56 40-60 53-65 0 2 4 5 2 2-4 2-4 2-4 Operands 8T(i) short-real ' long-real temp-real FLOCW FLDCW source Load control word Execution Clocks 2-bytes FLOENV FLD FLD FLO FLO 8T(0) READING [81].PRE88URE [BPj.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2·14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.
PROGRAMMING NUMERIC APPLICATIONS Table 2-14. Instruction Set Reference Data (Cont'd.) FXCH FXCH //destination Exchange registers Exceptions: I Execution Clocks Typical Range Operand Word Transfers Code Bytes 12 10-15 0 2 Operands I/ST(i) FXTRACT FXTRACT (no operands) Extract exponent and significant Coding Example FXCH ST(2) Exceptions: I Execution Clocks Typical Range Operand Word Transfers Code Bytes 50 27-55 0 2 Operands (no operands) FYL2X FYL2X (no operands) y.
PROGRAMMING NUMERIC APPLICATIONS 10ccurs when one or both operands is "short"-it has 40 trailing zeros in its fraction (e.g., it was loaded from a short-real memory operand. 2The 80287 execution clock count for this instruction is not meaningful in determining overall instruction execution time. For typical frequency ratios of the 80286 and 80287 clocks, 80287 execution occurs in parallel with the operand transfers, with the operand transfers determining the overall execution time of the instruction.
PROGRAMMING NUMERIC APPLICATIONS PL/M-286 ProgrammersinPLfM-286 can access a very useful subset of the 80287's numeric capabilities. The PLfM-286 REAL data type corresponds to the NPX's short real (32-bit) format. This data type provides a range of about 8.43*10- 37 ~ ABS(X) :$ 3.38*1038 , with about seven significant decimal digits. This representation is adequate for the data manipulated by many microcomputer applications.
PROGRAMMING NUMERIC APPLICATIONS and SET$REAL$MODE procedures as well as arithmetic expressions. SAVE$REAL$STATUS saves the 80287 state (registers, status, and control words, etc.) on the CPU's stack. RESTORE$REAL$STATUS reloads the state information; the preempting task must invoke this procedure before terminating in order to restore the 80287 to its state at the time the running task was preempted. This enables the preempted task to resume execution from the point of its preemption.
PROGRAMMING NUMERIC APPLICATIONS The assembler does not, however, check the types of operands used in processor control instructions. Coding FRSTOR [BP] implies that the programmer has set up register BP to point to the stack location where the processor's 94-byte state record has been previously saved. The initial values for 80287 constants may be coded in several different ways. Binary integer constants may be specified as bit strings, decimal integers, octal integers, or hexadecimal strings.
PROGRAMMING NUMERIC APPLICATIONS ; RESERVE SPACE FOR STATUS WORD STAT ULW 0 RD ; LAY OUT STATUS WORD FIELDS STATUS RECORD BUS Y: 1, 6 CoND_CoDE3: 1, 6 STACK_TOP: 3, 6 CoND_CoDE2: 1, 6 CoND_CoDE1: 1, CoND_CoDED: 1, IN T_R E Q : 1, 6 RESERVED: 1, 6 P_FLAG: 1, U_FLAG: 1, o_F LAG: 1, Z_FLAG: 1, 6 D_FLAG: 1, 6 LF LAG: 1 POLL STATUS WORD UNTIL 80287 IS NOT BUSY POLL: FNSTSW STATUS_WORD TEST STATUS_WORD, MASK_BUSY HZ POLL Figure 2-4.
PROGRAMMING NUMERIC APPLICATIONS Table 2-17. Addressing Mode Examples Interpretation Coding FIAOO ALPHA ALPHA is a simple scalar (mode is direct). FOIVR ALPHA.BETA BETA is a field in a structure that is "overlaid" on ALPHA (mode is direct). FMUL aWORO PTR [BX] BX contains the address of a long real variable (mode is register indirect). FSUB ALPHA [SI] ALPHA is an array and SI contains the offset of an array element from the start of the array (mode is indexed). FILO [BP].
PROGRAMMING NUMERIC APPLICATIONS PL/M--;'~86 COt1P ILER ARRAYSUt1 SER IES-- I I I PL/M-286 V1. 0 Cot1P I LAT ION OF MODULE ARRAVSUM OBJECT MODULE PLACED It-l : F6: D. Du.) COMPILER IfNO KED BY PLM286 86 F6: D.
PROGRAMMING NUMERIC APPLICATIONS The ASM286 version (figure 2-7) defines the external procedure INIT287, which makes the different initialization requirements of the processor and its emulator transparent to the source code. After defining the data and setting up the segment registers and stack pointer, the program calls INIT287 and loads the control word. The computation begins with the next three instructions, which clear three registers by loading (pushing) zeros onto the stack.
intel" PROGRAMMING NUMERIC APPLICATIONS "iAPX286 MACRO ASSEMBLER EXAMPLE_ASM286_PROGRAM SERIES-I I I iAPX286 MACRO ASSEMBLER X10B ASSEMBLY OF MODULE EXAMPLE_ASM286_PROGRAM OBJECT MODULE PLACED IN : F6: 287EXP, OBJ ASSEMBLER INVOKED BY: ASM286.86: F6: 287EXP.
PROGRAMMING NUMERIC APPLICATIONS iAPX286 MACRO ASSEMBLER EXAMPLE~ASM286]ROGRAM XREF SYMBOL TABLE LISTING NAME TYPE CODE CONTROL_287 SEGMENT V WORD SEGMENT L FAR V WORD L NEAR STACK L NEAR V DWORD L NEAR V DWORD V DWORD V DWORD DATA. INIT287 N_OFJ. POP_RESULTS STACK START SUM_INDEXES SUM_NEXT.
PROGRAMMING NUMERIC APPLICATIONS No special programming techniques are required to gain the advantages of concurrent execution; numeric instructions for the NPX are simply placed in line with the instructions for the CPU. CPU and numeric instructions are initiated in the same order as they are encountered by the CPU in its instruction stream.
PROGRAMMING NUMERIC APPLICATIONS Instruction synchronization is guaranteed for most ESC instructions because the 80286 automatically checks the BUSY status line from the 80287 before commencing execution of most ESC instructions. No explicit WAIT instructions are necessary to ensure proper instruction synchronization. Data Synchronization Data synchronization addresses the issue of both the CPU and the NPX referencing the same memory values within a given block of code.
PROGRAMMING NUMERIC APPLICATIONS Case 1: Case 2: M0 V I , F I LD I F IL D FWAIT M0 V MOV AX,I FISTP I I., 5 F 1ST P FWAIT MOV AX,I Figure 2-9. Synchronizing References to Shared Data The data-synchronization function of any FW AIT or numeric instruction must be well-documented, as shown in figure 2-10. Otherwise, a change to the program at a later time may remove the synchronizing numeric instruction and cause program failure.
PROGRAMMING NUMERIC APPLICATIONS F 1ST P FMUL MOV AX,I Is updated before FMUL Is now safe to use Is executed Figure 2-10. Documenting Data Synchronization This Is an ASM286 code macro to redefine the Instruction to prevent any concurrency while the Instruction runs. A walt Instruction Is placed Immediately after the escape to ensure the store Is done before the pr09ram may continue. FIST ; CodeMacro FIST memop: RflxM 111B, memop ModRM 010B, memop RWf I x EndM Mw FIgure 2-11.
PROGRAMMING NUMERIC APPLICATIONS INCORRECT ERROR SYNCHRONIZATION An example of how some instructions written without error synchronization will work initially, but fail when moved into a new environment is shown in figure 2-12. In figure 2-12, three instructions are shown to load an integer, calculate its square root, then increment the integer. The NPX interface and synchronous execution of the NPX emulator will allow this program to execute correctly when no errors occur on the FILD instruction.
System-Level Numeric Programming 3
CHAPTER 3 SYSTEM-LEVEL NUMERIC PROGRAMMING System programming for 80287 systems requires a more detailed understanding of the 80287 NPX than does application programming. Such things as emulation, initialization, exception handling, and datil and error synchronization are all the responsibility of the systems programmer. These topics are covered in detail in the sections that follow. ./ 80287 ARCHITECTURE On a software level, the 80287 NPX appears as an extension of the 80286 CPU.
SYSTEM-LEVEL NUMERIC PROGRAMMING Dedicated and Reserved 1/0 Locations The 80287 NPX does not require that any memory addresses be set aside for special purposes. The 80287 does make use of 1/0 port addresses in the range 00F8H through OOFFH, although these 1/0 operations are completely transparent to the 80286 software. 80286 programs must not reference these reserved 1/0 addresses directly.
SYSTEM-LEVEL NUMERIC PROGRAMMING 8086/87/88/186 MACRO ASSEMBLER Test for presence of 8 Nuner;cs Chip, Revision 1.0 PAGE DOS 3.20 (033·N) 8086/87/88/186 MACRO ASSEMBLER V2.0 ASSEMBLY OF MOOULE TEST_NPX OBJECT MOOULE PLACEO IN FINDNPX.OBJ LOC OBJ LINE 1 +1 SOURCE Stitle('Test for presence of a Nuner;cs Chip, Revision 1.
SYSTEM-LEVEL NUMERIC PROGRAMMING 8086/87/88/186 MACRO ASSEMBLER LOC OBJ Test for presence of a NUIIOr;cs Chip. Rev;slon 1.0 LINE PAGE SOURCE An 80387 Is present. they "",t be mosked. 60 61 6Z If denormol e.cepttons are used for an 8087/Z87, Th. 80387 will automatically normalize denormol operands faster than an exception handler can. 63 0039 EB0790 D03C 003C EB0490 003F j"" 64 founct387 65 66 67 68 69 70 71 set up for no NPX j"" e.tt found_87_Z87: .
SYSTEM-LEVEL NUMERIC PROGRAMMING information on software emulation for the 80287 NPX is described in the "80287 Emulation" section later in this chapter. In any case, if ESC instructions are to be executed, either the MP or EM bit must be set, but not both. Initializing the 80287 Initializing the 80287 NPX simply means placing the NPX in a known state unaffected by any activity performed earlier.
inter SYSTEM-LEVEL NUMERIC PROGRAMMING As described previously, whenever the 80286 CPU encounters an ESC instruction, and its MP and EM status bits are set appropriately (MP=O, EM = I), the 80286 will automatically trap to interrupt #7, the Processor Extension Not Available exception. The return link stored on the stack points to the first byte of the ESC instruction, including the prefix byte(s), if any.
SYSTEM-LEVEL NUMERIC PROGRAMMING As discussed previously, the 80287 NPX can take one of two actions when it recognizes a numeric exception: • If the exception is masked, the NPX will automatically perform its own masked exception response, correcting the exception condition according to fixed rules, and then continuing with its instruction execution. • If the exception is unmasked, the NPX signals the exception to the 80286 CPU using the ERROR status line between the two processors.
SYSTEM-LEVEL NUMERIC PROGRAMMING Table 3-2. Precedence of NPX Exceptions Signaled First: Denormalized operand (if unmasked) Invalid operation Zero divide Denormalized (if masked) Over/U nderflow Precision Signaled Last: number of numeric registers. The arithmetic of the NPX can be changed to automatically extend the precision and range of variables when exceeded.
Numeric Programming Examples 4
CHAPTER 4 NUMERIC PROGRAMMING EXAMPLES The following sections contain examples of numeric programs for the 80287 NPX written in ASM286. These examples are intended to illustrate some of the techniques for programming the 80287 computing system for numeric applications. CONDITIONAL BRANCHING EXAMPLES As discussed in Chapter Two, several numeric instructions post their results to the condition code bits of the 80287 status word.
NUMERIC PROGRAMMING EXAMPLES A B DQ DQ FLD FCOMP FSTSW A B AX , LOAD A ONTO TOP OF 287 STACK COMPARE A:B, POP A STORE RESULT TO CPU AX REGISTER ; CPU AX REGISTER CONTAINS CONDITION CODES (RESULTS OF ; COMPARE> ; LOAD CONDITION CODES INTO CPU FLAGS SAHF ; ; USE CONDITIONAL JUMPS TO DETERMINE ORDERING OF A TO ; B , TE ST C2 LLU NOR DERE D TE ST CO LLESS LEQUAL ; TE ST C3 o , C3 CO (C F> JP JB JE LG REA TE R: CO ( CF ) CO ( CF ) C2 (PF) LLUNORDERED: · · o, · 1, (P F> ( CF) (Z F) ( ZF) C3 (ZF
NUMERIC PROGRAMMING EXAMPLES CALCULATE OFFSET INTO JUMP TABLE BH,O i CLEAR UPPER HALF OF BX, Bl,AH i lOAD CONDITION CODE INTO BL BL,OOOOOIIIB i CLE~R ALL BITS EXCEPT C2-CO AH,01000000B i CLEAR ALL BITS EXCEPT C3 AH,2 SHIFT C3 TWO PLACES RIGHT BX,1 SHIFT C2-CO 1 PLACE LEFT (MULTIPLY BY 2) OR Bl,AH DROP C3 BACK IN ADJACENT TO C2 (OOOXXXXO) i MOV MOV AND AND SHR SAL JMP JUMP TO THE ROUTINE 'ADDRESSED' BY CONDITION CODE FXAM_TBLIBXl i HERE ARE THE JUMP TARGETS, ONE TO HANDLE EACH POSSIBLE RESULT OF fXAM
t,jUMERIC PROGRAMMING EXAMPLES At the beginning of the prologue, CPU interrupts have been disabled. The prologue performs all functions that must be protected from possible interruption by higher-priority sources. Typically, this will involve saving CPU registers and transferring diagnostic information from the 80287 to memory. When the critical processing has been completed, the prologue may enable CPU interrupts to allow higher-priority interrupt handlers to preempt the exception handler.
NUMERIC PROGRAMMING EXAMPLES CLEAR EXCEPTION FLAGS IN STATUS WORD RESTORE MODIFIED STATE IMAGE BYTE PTR IBP-921, OH MOV IBP-941 FRSTOR DE-ALLOCATE STACK SPACE, RtSTORE CPU REGISTERS SP,BP MOV POP BP / RETURN TO INTERRUPTED CALCULATION IRET SAVE_ALL ENDP Figure 4-3. Full-State Exception Handler (Cont'd.
NUMERIC PROGRAMMING EXAMPLES ASSUME INITIALIZED REENTRANT PROC SAVE CPU REGISTERS, ALLOCATE STACK SPACE FOR 80287 STATE IMAGE PUSH BP MOV BP,SP SUB SP,94 SAVE STATE, LOAD NEW CONTROL WORD, FOR COMPLETION, ENABLE CPU INTERRUPTS FNSAVE [BP-941 FLDCW LOCAL_CONTROL ST I APPLICATION EXCEPTION HANDLING CODE GOES HERE. AN UNMASKED EXCEPTION GENERATED HERE WILL CAUSE THE EXCEPTION HANDLER TO BE REENTERED. IF LOCAL STORAGE IS NEEDED, IT MUST BE ALLOCATED ON THE CPU STACK.
NUMERIC PROGRAMMING EXAMPLES FLOATING-POINT TO ASCII CONVERSION EXAMPLES Numeric programs must typically format their results at some point for presentation and inspection by the program user. In many cases, numeric results are formatted as ASCII strings for printing or display. This example shows how floating-.point values can be converted to decimal ASCII character strings. The function shown in figure 4-6 can be invoked from PL/M-286, Pascal-286, FORTRAN-286, or ASM2lS6 routines.
NUMERIC PROGRAMMING EXAMPLES iAPX2Sb MACRO ASSEMBLER LOC aSJ 80287 Floating-Point to IS-Digit ASCII LINE '8 59 60 61 63 64 65 66 67 68 69 0004[1 0006[] OOOSt] CODAr] oOOetl OOOEt] 78 79 80 81 82 83 The following OOOA 0012 0002 OOOA 0001 0004 0006 0003 0008 -0002 -0004 -0006 -oooa 0000 0002 90 91 92 93 94 95 .6 97 98 9.
NUMERIC PROGRAMMING EXAMPLES iAPX286 MACRO ASSEMBLER LOC DB..
NUMERIC PROGRAMMING EXAMPLES iAPX2B6 MACRO ASSEMBLER Loe OBJ 10: 12: 89 80287 Floating-Point to IS-Digit ASCII Conversion LINE 09/25/83 PAGE SOURCE fxtratt 0083 09F4 0085 80FAFB 0088 7240 228 22. cmp dl,UNNDRMAL 230 Jb normal_value OOBA eOEAFB 232 sub d 1, UNNORMAL-NORMAL J Separate exponent f'T'om significand , Test for unnormal value 231 Return normal status with correct Sign 233 Normalize the fraction. the denormal count value.
NUMERIC PROGRAMMING EXAMPLES iAPX286 MACRO ASSEMBLER LOC OBJ 0007 98 8S46FA 0000 2DCl aooa 0000 7722 OODF 00E2 00E4 aOE7 OOEA aOEe OOEe OOFO OOFe! 00F6 DF46FC SaFe! BOEAFE DB6EFO D9FD 0001 D9FC 0809 9BDD7EFE F146FE0040 00F9 7550 OOFO 0008 DOFF BnOb 0101 0101 8907 0103 F708 0105 EBOOOO 0108 OD6EFO 010/3 DEC9 0100 813FI 0101=' 01E6 0111 01E6 011:3 0lE6 0115 OF46FC 0118 DEC2 OIIA D9FD 011C 0009 80287 Floating-Point to is-Digit ASCII Conversion LINE 011E 2EDC940eoo 0123 9BDFEO 0126 A90041 0129
NUMERIC PROGRAMMING EXAMPLES iAPX286 MACRO ASSEMBLER LOC ODJ 0153 B9040F 0156 0159 DISC 015E 0160 0161 0163 0166 80287 Floatlnll-Paint to IS-Digit ASCII Conve,.si!)" LINE 416 417 418 419 4.0 421 4.2 423 424 4 •• 426 4.7 BBOI00 BD7EOC BCDS eEeD Fe B02B F6(:201 7402 0168 802D 016A 4.B cx.Of04h bll,l di. ~trinIlJt,. ax. ds mov cld mov tnt JI 016E 98 .. I, '+' dl.I1INUS positive_result stosb .
NUMERIC PROGRAMMING EXAMPLES 12: 11: IAPX2B6 _AD _,",LEA os· 09/25183 PAQE SEAlES-III IAPX2S6 "",CRD ASSEKILEA XlOS ASSEKILY OF I10IIULE OET.,pOWER_10 aaJECT I'IDDULE PLACED IN : F3: PDW10. a ... ASSEJ1BLER INVOKED IV: A8M286.86: F3: PDWIO. AP~ LOC . DI~ LINE 1+1 SOURCE .UU.C-C.lcuhh th v.lua a,1 lo*••• ·~ 2 3 Thh lub1'DUUnW will c.leul.t. the v.lue of 10 ••••. 4 5 6 7 a .J I Fa," ..,alu •• of 0 c- a. < I', the " •• ult 111111 . . . ct. All 80286 ".ght." • •". 'II,..n., • .,..nt .nd th. v.
NUMERIC PROGRAMMING EXAMPLES iAPX2Bb MACRO ASSEMBLER LOC LINE OBJ ooce 60 61 6. 63 6' 65 66 67 68 6. 70 71 7. 73 7. 75 76 77 78 0006 D9bEFC 0009 DaDa DODD OOEO 00E2 D9CA 08E2 BB46FE D9FD D9FO 00E4 C9 ODES DEE1 OOE7 Dcca 00E9 C3 A8SEMBL V COMPLETE, PAGE -Fchs n. st( 1) I COPV power value in base two word ptr [bp-4J fIldcw f'rndint mav word ptr [bp-4], ax fidew wOl'd ptr [bp-4J st(2) Fxch st, st(2) hub ax, Cbp-2J mov I v. l ... fsubl' get_power _10 code TOS .. X. 91(U "" -1.0. TOS. F -..
NUMERIC PROGRAMMING EXAMPLES Exception Considerations Care is taken inside the function to avoid generating exceptions. Any possible numeric value will be accepted. The only exceptions possible would occur if insufficient space exists on the numeric register stack. The value passed in the numeric stack is checked for existence, type (NaN or infinity), and status (unnormal, denormal, zero, sign). The string size is tested for a minimum and maximum value.
NUMERIC PROGRAMMING EXAMPLES Implementing each of these three steps requires attention to detail. To begin with, not all floating-point values have a numeric meaning. Values such as infinity, indefinite, or Not a Number (NaN) may be encountered by the conversion routine. The conversion routine should recognize these values and identify them uniquely. Special cases of numeric values also exist.
inter NUMERIC PROGRAMMING EXAMPLES FINAL ADJUSTMENTS It is possible that the power function (GeLPowec10) could produce a scaling value such that it forms a scaled result larger than the ASCII field could allow. For example, scaling 9.9999999999999999 X 104900 by 1.00000000000000010 X 10- 4883 would produce 1.00000000000000009 X 10". The scale factor is within the accuracy of the NPX and the result is within the conversion accuracy, but it cannot be represented in BCD format.
NUMERIC PROGRAMMING EXAMPLES Cosine Uses Sine Code To save code space, the cosine function uses most of the sine function code. The relation sin ( I A I + 7r /2) = cos (A) is used to convert the cosine a.rgument into a sine argument. Adding 7r /2 to the angle is performed by adding 010 2 to the FPREM quotient bits identifying the argument's octant. It would be very inaccurate to add 7r /2 to the cosine argument if it was very much different from 7r/2.
NUMERIC PROGRAMMING EXAMPLES iAPX286 MACRO ASSEMBLER LOC OS,) 10: 13: 51 80287 Trillnometric Function5 LINE ,. 091:25/83 PAGE SOURCE 20 21 22 23 This subroutine calculate. the 51ne OT' cosina of th. 4I"gle. giv.n in Nldi.nll. Tha angle is in SHO), thll T'llturnod valu. will ba in STeO), Th. r •• ult h ju:c:u"at. to within 7 unUs of th. lI'i!IIst significant three bitll of th. NPX utend&d ,.ul format. Tha PL.M/B6 d.flinition ill: .7 sina: prot_durl (angla) 1'1.
NUMERIC PROGRAMMING EXAMPLES iAPX286 MACRO ASSEMBLER LaC OBJ 002F ODDS 0031 09E8 0033 C3 LINE 0034 09E5 0036 'rOOFED 0039 2E082EOOOO 003E 9E 003F 7249 0041 D9C9 0043 13100 0045 7Ee7 128 12. 130 131 132 133 13. 135 136 137 138 13. 140 141 142 "3 0047 0047 D9FB 0049 93 004A 9BDFEO 0040 93 004E F6C704 0051 7544 0053 09El 0055 OAe9 0057 740F 0059 eOE4FD Dose BOeFBQ 005F 0062 0064 0066 120 121 122 123 12.
NUMERIC PROGRAMMING EXAMPLES i AP X:286 MACRO ASSEMBLER LOC 08,) 007F 007F D9F2 10: 13: 51 B0287 T1'ignometl'ic Functioni; LINE 207 20B 20. 210 211 212 09/25/83 PAGE SOURCE , Assert:: 0 ( steOl <- PII4 dD_sine_fphn: , flpten TAN 9nO) • STeu/snol ... V/X 213 OOBI 0081 F6C742 0094 ?BIA .14 210 21. .17 21B IIfte" _sine_flpten: .1. OOBS EllA OOSA DOBA DDDS OOSC 7404 OOBE 7002 0090 D9FB 0092 0092 0092 C3 'Id Jmp , 0o,3 2 •• .
NUMERIC PROGRAMMING EXAMPLES iAPX2B6 MACRO ASSEMBLER LOC DB'" LINE least three signUieant bits of an extended T'eal format number, PLM/S6 c.alling fOTmat is: tangent: OOBD D9E5 DOOF 9BDFEO OOC:;!: 2EDB2EOOOO OOC7 9E OOCS 72CO PI\QE The proceduT'1! Cangle) 1'8al external; declare angle reall end tangentl TIIIO stack registers are used. The re5ult of the tangent function is defined for the follollling cases: angle Tll'sult vali.
NUMERIC PROGRAMMING EXAMPLES iAPX286 MACRO ASSEMBLER lOC ODJ 80287 rrignometric Functions LINE 39. 00E9 E83300 OOEe EDEO OOEE OOEE C3 COEF DOEF D9E4 OOF! 91 OOF2 '9BDFEO OOF5 91 OOF6 DDD9 OOFS F6C'40 OOFS 7515 caFD 3.7 3.8 3 •• 400 401 402 403 404 40S 40. 407 408 40. 410 411 412 413 414 415 41. 417 OOFD D9F2 "B 41. DOFF 420 .21 .
Append~ Machine Instruction Encoding and Decoding A
APPENDIX A MACHINE INSTRUCTION ENCODING AND DECODING Machine instructions for the 80287 come in one of five different forms as shown in table A-I. In all cases, the instructions are at least two bytes long and begin with the bit pattern 11011B, which identifies the ESCAPE class of instructions. Instructions that reference memory operands are encoded much like similar CPU instructions, because all of the CPU memory-addressing modes may be used with ESCAPE instructions.
MACHINE INSTRUCTION ENCODING AND DECODING P: 0 = do not pop stack 1 = pop stack after operation REG: register stack element 000 = stack top 001 = next on stack 010 = third stack element, etc. Table A-2 lists all 80287 machine instructions in binary sequence. This table may be used to "disassemble" instructions in unformatted memory dumps or instructions monitored from the data bus. Users writing exception handlers may also find this information useful to identify the offending instruction. Table A·2.
MACHINE INSTRUCTION ENCODING AND DECODING Table A-2. Machine Instruction Decoding Guide (Cont'd.
MACHINE INSTRUCTION ENCODING AND DECODING Table A-2. Machine Instruction Decoding Guide (Cont'd.
MACHINE INSTRUCTION ENCODING AND DECODING Table A-2. Machine Instruction Decoding Guide (Cont'd.) 1st Byte 2nd Byte Bytes 3, 4 Binary Hex DF OF OF OF OF 1101 1101 1101 1101 1101 1111 1111 1111 1111 1111 1100 1101 1101 1110 1111 ASM286 Instruction Format *(7) *(8) *(9) FSTSWAX reserved 1REG OREG 1REG 000 XXX NOTE: * The marked encodings are not generated by the language translators.
Appendix Compatibility Between the 80287 NPX and the 8087 B
APPENDIX B COMPATIBILITY BETWEEN THE 80287 NPX AND THE 8087 The 80286/80287 operating in Real-Address mode will execute 8087 programs without major modification. However, because of differences in the handling of numeric exceptions by the 80287 NPX and the 8087 NPX, exception-handling routines may need to be changed. This appendix summarizes the differences between the 80287 NPX and the 8087 NPX, and provides details showing how 8087 programs can be ported to the 80287. 1.
COMPATIBILITY BETWEEN THE 80287 NPX AND THE 8087 The processor control instructions for the 80287 may be coded using either a WAIT or No-WAIT form of mnemonic. The WAIT forms of these instructions cause ASM286 to precede the ESC instruction with a CPU WAIT instruction, in the identical manner as does ASM86. 10. A recommended way to detect the presence of an 80287 in an 80286 system (or an 8087 in an 8086 system) is shown below.
Appendix Implementing the IEEE P754 Standard c·
APPENDIX C IMPLEMENTING THE IEEE P754 STANDARD The 80287 NPX and standard support library software, provides an implementation of the IEEE "A Proposed Standard for Binary Floating-Point Arithmetic," Draft 10.0, Task P754, of December 2, 1982. The 80287 Support Library, described in 80287 Support Library Reference Manual, Order Number 122129, is an example of such a support library. This appendix describes the relationship between the 80287 NPX and the IEEE Standard.
IMPLEMENTING THE IEEE P754 STANDARD 1. The Standard requires that a Normalizing Mode be provided, in which any nonnormal operands to functions are automatically normalized before the function is performed. The NPX provides a "Denormal operand" exception for this case, allowing the exception handler the opportunity to perform the normalization specified by the Standard. The Denormal operand exception handler provided by EH287.
inter IMPLEMENTING THE IEEE P754 STANDARD In designing the EH287.LIB, it was felt that it would be a disadvantage to most users to increase the size of the Normalizing routine by the amount necessary to provide this expanded arithmetic. Because the TEMP_REAL exponent field is so much larger than the LONG_REAL exponent field, it is extremely unlikely that TEMP_REAL underflow will be encountered in most applications.
Glossary of 80287 and Floating-Point Terminology
GLOSSARY OF 80287 AND FLOATING-POINT TERMINOLOGY This glossary defines many terms that have precise technical meanings as specified in the IEEE 754 Standard. Where these terms are used, they have been capitalized to emphasize the precision of their meanings. In reading these definitions, you may therefore interpret any capitalized terms or phrases as cross-references. Affine Mode: a state of the 80287, selected in the 80287 Control Word, in which infinities are treated as having a sign.
inter GLOSSARY OF 80287 AND FLOATING-POINT TERMINOLOGY Denormal: a special form of Floating-Point Number, produced when an Underflow occurs. On the 80287, a Denormal is defined as a number with a Biased Exponent that is zero. By providing a Significand with leading zeros, the range of possible negative Exponents can be extended by the number of bits in the Significand. Each leading zero is a bit of lost accuracy, so the extended Exponent range is obtained by reducing significance.
GLOSSARY OF 80287 AND FLOATING-POINT TERMINOLOGY Integer: a number (positive, negative, or zero) that is finite and has no fractional part. Integer can also mean the computer representation for such a number: a sequence of data bytes, interpreted in a standard way. It is perfectly reasonable for Integers to be represented in a Floating-Point format; this is what the 80287 does whenever an Integer is pushed onto the 80287 stack.
GLOSSARY OF 80287 AND FLOATING-POINT TERMINOLOGY Precision Exception: an 80287 error condition that results when a calculation does not return an exact answer. This exception is usually Masked and ignored; it is used only in extremely critical applications, when the user must know if the results are exact. Projective Mode: a state of the 80287, selected in the 80287 Control Word, in which infinities are treated as not having a sign. Thus the values + INFINITY and - INFINITY are considered the same.
GLOSSARY OF 80287 AND FLOATING-POINT TERMINOLOGY Trapping NaN: a NaN that causes an I error whenever it enters into a calculation or comparison, even a nonordered comparison. Two's Complement: a method of representing Integers. If the uppermost bit is 0, the number is considered positive, with the value given by the rest of the bits. If the uppermost bit is 1, the number is negative, with the value obtained by subtracting (2 b;t count) from all the given bits.
INDEX Address Modes, 2-42, 3-1 Architecture, 1-8, 3-1 Arithmetic Instructions, 2-4 - 2-9 ASM 286, 2-40 Automatic Exception Handling, 1-37 Binary Integers, 1-17 Comparison Instructions, 2-9 - 2-11 Compatibility Between the 80287 and 8087, 2-1, Appendix B Computation Fundamentals, 1-14 Concurrent (80286 and 80287) Processing, 2-45 - 2-51 Condition Codes Interpretation, 1-9 - 1-11 Constant Instructions, 2-14 Control Word, 1-10 - 1-12 Data Synchronization, 2-49 Data Transfer Instructions, 2-2 - 2-4 Data Types
INDEX FENIjFNENI, 2-15, B-1 FFREE (Free Register), 2-15, 2-20, 2-27 FIADD (Integer Add), 2-5, 2-6, 2-25 FICOM (Integer Compare), 2-10, 2-25 FICOMP (Integer Compare and Pop), 2-10, 2-25 FIDIV (Integer Divide), 2-5, 2-7, 2-26 FIDIVR (Integer Divide Reversed), 2-5, 2-7,2-26 FILD (Integer Load), 2-3, 2-28 FIMUL (Integer Multiply), 2-5, 2-7, 2-28 FINCSTP (Increment Stack Pointer), 2-20, 2-28 FINIT jFNINIT (Initialize Processor), 2-16,2-28 FIST (Integer Store), 1-34, 1-35,2-2,2-3, 2-27 FISTP (Integer Store and P
INDEX GET$REAL$ERROR (Store, then Clear, Exception Flags), 2-37 Handling Numeric Errors, 1-34 Hardware Interface, 1-6 I/O Locations (Dedicated and Reserved), 3-2 IEEE P754 Standard, Implementation, Appendix C Indefinite, 1-29 Inexact Result, 1-34 Infinity, 1-25 Infinity Control, 1-19 INIT$REAL$MATH$UNIT (Initialize Processor Procedure), 2-37 Initialization and Control, 3-2 - 3-7 Instruction Coding and Decoding, A-I Instruction Executiori Times, 2-21 Instruction Length, 2-23 - 2-38 Integer Bit, 1-16, 1-17,
INDEX Underflow, 1-20, 1-33,4-16 Un normals, 1-23 Upgradability, 1-4 WAIT Form, 2-14 Word Integer Format, 1-16 Zero Divisor, 1-33, 1-35 Zeros, 1-24 Index-4
inter DOMESTIC SALES OFFICES ALABAMA GEORGIA NEW MEXICO TEXAS !~1tgl ~~tOrd Dr., #2 !1~81~:!:e Parkway Intel Corp. 8500 Manual Boulevard N.E. SuiteB295 tlntel Corp. 313 E. Anderson Lana Suite 314 Austin 78752 Tel: (512)454-3628 ILUNOIS NEW YORK tntelC0M:'" tlntel Corp: 12300 Ford Road Suite Dallas 75234 rel,131213¥O-.031 Intel Corp.
inter DOMESTIC DISTRIBUTORS CAUFORNIA (Cont'd) ALABAMA Arrow Bectronlcs. Inc. 1015 Henderson Road Huntsville 35805 Tel: (205)837-6955 CONNECTICUT ILLINOIS (Conl'd) f:r=u~~;:~~ Inc. ~110S~~:lmT~:'=le Walll~ford 06492 ~J~7~~~6-Ts?~~~ Haminon Electro Sales 1381 B West 190th Street Gardena 90248 Tel: (213) 558·2131 1~::~~~::n~~~~~":taI8S Hamllton/Avnet Electronics Commerce Industrial Park Commerce Drive Danbu~ 06810 ~J~71b?t9~~704 Costa Mesa 92626 ~JJ1~e:9~~~8 ~r:~:s~ro.:Jreet 221).
intJ DOMESTIC DISTRIBUTORS NEW JERSEY (Cont'dl NEW YORK (Cont'd) OREGON (Cont'd) UTAH BAmSH COWMBIA (Cont'd) t~~.:~~~:,vnet Electronics tPloneer Northeast Electronics ~~g ~~~~i~~:~~~~~~arkway tHamiltonlAvnet Electronics 1585 West 2100 South Zentronics ~~~b~6°o.~~3 Fairfield 07006 ~~~J~~~:8~ 840 Fairport Park Fairport 14450 ~fJ~b~285~?7'b'0~ tPioneEN" Northeast Electronics 45 Route 48 Pinebrook 07058 NORTH CAROUNA tArrow Electronics, loc.
EUROPEAN SALES OFFICES BELGIUM WEST GERMANY ISRAEL SPAIN ~~~ geo~g~:~~~ ~t· Inlel Semiconductor GmbH' Intel Semiconductor Ltd' Attidim Industrial Park Neve Sharet Dvora Hanevla Bldg. No. 13. 4th Floor P.O. Bo)( 43202 Tel Aviv 61430 Tel: (3) 491·099, 491·098 TLX: 371215 Intellberls Calle Zurbaran 28·IZODA 28010 Madrid Tel: (1)410-4004 TLX: 46880 8·1180 Brussels Tel: (02) 347-0666 DENMARK Seidlstrassa 27 0·8000 Muenchen 2 +~~:(~W.~~~~j INTL 0 Intel Semiconductor GmbH ~~;16~ 1~~C6.
