Intel 80286 Programmer'S Reference Manual Download

Page: 1 / 515

pcjs.org

Summary of Contents for 80286

Page 2: ...186 80188 MICROPROCESSOR AND PERIPHERAL HANDBOOK 2 Volume Set DEVELOPMENT TOOLS HANDBOOK OEM BOARDS AND SYSTEMS HANDBOOK MILITARY HANDBOOK COMPONENTS QUALITY RELIABILITY HANDBOOK SYSTEMS QUALITY RELIA...

Page 3: ...st Add Your Local Sales Tax Postage Total Pay by Visa MasterCard American Express Check Money Order or company purchase order payable to Intel Literature Sales Allow 2 4 weeks for delivery o Visa 0 Ma...

Page 4: ...and COMMENTS Maga zine Basic support includes updates and the subscription service Contracts are sold in environments which repre sent product groupings i e iRMX environment CONSULTING SERVICES Intel...

Page 5: ...80286 AND 80287 PROGRAMMER S REFERENCE MANUAL 1987 pcjs org...

Page 6: ...on inteligent Identifier inteligent Programming Intellec Intellink iOSP iPDS iPSC iRMK iRMX iSBC iSBX iSDM iSXM KEPROM Library Manager MAPNET MCS Megachassis MICROMAINFRAME MULTIBUS MULTICHANNEL MULTI...

Page 7: ...0287 NPX 80286 The 80286 contains a table of contents eleven chapters four appendices and an index For more information on the 80286 book s organization see its first chapter Chapter 1 Introduction to...

Page 8: ...pcjs org...

Page 9: ...6 Register and Immediate Modes 2 17 Memory Addressing Modes 2 17 Segment Selection 2 18 Offset Computation 2 19 Memory Mode 2 20 Input Output 2 21 I O Address Space 2 23 Memory Mapped I O 2 23 Interru...

Page 10: ...trol Instructions 3 25 Carry Flag Control Instructions 3 25 Direction Flag Control Instructions 3 25 Flag Transfer Instructions 3 26 Binary Coded Decimal Arithmetic Instructions 3 27 Packed BCD Adjust...

Page 11: ...Checks 7 5 Type Validation 7 6 Privilege Levels and Protection 7 8 Example of Using Four Privilege Levels 7 8 Privilege Usage 7 9 Segment Descriptor 7 10 Data Accesses 7 12 Code Segment Access 7 13 Da...

Page 12: ...CONTROL AND INITIALIZATION System Flags and Registers 10 1 Descriptor Table Registers 10 1 System Control Instructions 10 3 Machine Status Word 10 4 Other Instructions 10 5 Privileged and Trusted Inst...

Page 13: ...5 3 13 LAHF and SAHF 3 26 3 14 PUSHF and POPF 3 27 4 1 Formal Definition of the ENTER Instruction 4 3 4 2 Variable Access in Nested Procedures 4 4 4 2a Stack Frame for MAIN at Level 1 4 4 4 2b Stack F...

Page 14: ...Data Type for Global Descriptor Table and Interrupt Descriptor Table 10 3 11 1 Expand Down Segment 11 2 11 2 Dynamic Segment Relocation and Expansion of Segment Limit 11 3 11 3 Example of NPX Context...

Page 15: ...itions That Invalidate the TSS 9 12 10 1 MSW 8it Functions 10 4 10 2 Recommended MSW Encodings for Processor Extension Control 10 5 11 1 NPXContextSwitching 11 7 8 1 ModRM Values 8 3 8 2 Protection Ex...

Page 16: ...ides and COMMENTS Maga zine Basic support includes updates and the SUbscription service Contracts are sold in environments which repre sent product groupings Le iRMX environment CONSULTING SERVICES In...

Page 17: ...Introduction to the 80286 1 pcjs org...

Page 18: ...pcjs org...

Page 19: ...lity of the computer The 80286 processor can function in two modes of operation see section 1 2 of this chapter Modes of Operation In one of these modes only the base architecture is available to prog...

Page 20: ...ected Mode provides a number of advanced features including a greatly extended physical and logical address space new instructions and support for additional hardware recognized data structures The Pr...

Page 21: ...chy of trust Four privilege levels are distinguished ranging from Level 0 most trusted to Level 3 least trusted Level 0 is usually reserved for the operating system kernel The four levels may be visua...

Page 22: ...ndamenlal ulictions such as I O are built around the kernel This layered approach also makes program development and enhancement simpler and facilitates error detection and debugging The 80286 support...

Page 23: ...t support virtual memory Segment descriptors global and local descriptor tables and descriptor caches are discussed Chapter 7 Protection This chapter describes the protection features of the 80286 Pri...

Page 24: ...10760 Microprocessor and Peripheral Handbook order number 230843 PL M 286 User s Guide order number 121945 80287 Support Library Reference Manual order number 122129 8086 Software Toolbox Manual order...

Page 25: ...80286 Base Architecture 2 pcjs org...

Page 26: ...pcjs org...

Page 27: ...16 megabyte physical address space by the address trans lation mechanisms described in Chapter 6 The programmer views the virtual address space on the 80286 as a collection of up to sixteen thousand...

Page 28: ...dressable byte boundary The bits are numbered 0 through 7 starting from the right Bit 7 is the most significant bit o I I i BYTE I A word is defined as two contiguous bytes starting on an arbitrary by...

Page 29: ...than one Data structures e g stacks should therefore be designed in such a way that word operands are aligned on word boundaries whenever possible for maximum system performance Due to instruction pr...

Page 30: ...ecimal unsigned unpacked decimal and floating point Binary numbers may be 8 or 16 bits long Decimal numbers are stored in bytes two digits per byte for packed decimal one digit per byte for unpacked d...

Page 31: ...IIIIIII ASCII CHARACTERN 7 N 0 II I I II I I I MOST SIGNIFICANT DIGIT 7 1 07 0 0 II ill Iii 11111 1 I BCD BCD DIGIT 1 DIGIT 0 7 1 07 0 0 lilllllIlllIlllIl ASCII ASCII CHARACTER CHARACTERO 7 1 07 0 0 I...

Page 32: ...one decimal digit in each half byte nibble the digit in the high order half byte is the most significant Values 0 9 are valid in each half byte and the range of a packed decimal number is 0 99 Additi...

Page 33: ...ain general registers to specific uses BX and BP are often used to contain the base address of data structures in memory for example the starting address of an array for this reason they are often ref...

Page 34: ...umerous segments in memory which is to be immediately accessible at highest speed Thus the 16 bit contents of a segment register is called a segment selector Once a segment is selected a base address...

Page 35: ...a segment selector selects a segment of the user s virtual address space figure 2 6 An intervening level of logical to physical address translation converts the logical address to a physical memory ad...

Page 36: ...attd by the stack pointer SP stack frame base BP By specifying offsets into the current stack segment each of these registers provides access to data on the stack The SP register is the customary top...

Page 37: ...in the current stack segment Accessing data structures in data segments is facilitated by the BX register which has the same function in addressing operands within data segments that BP does for stac...

Page 38: ...0001 I EXISTING STACK BEFORE PUSH STACK SEGMENT 1062 0 0 0 0 1060 1 lOSE 2 2 2 105C 3 3 3 3 105A 4 4 4 4 1058 5 5 5 5 PUSH AX 1056 A A A A 4 A A A A I SS SP 1054 I SELECTOR I I 1052 8 8 8 8 OFFSET 105...

Page 39: ...C_N 1 PUSH BP PUSH CX MOV BP SP SUB SP WORK_SPACE PROCEDURE BODY MOF BOTTO STACK t I 1 I BP L __ I MOV SP BP POP CX POP BP RET PARAMETERS RETURN ADDR REGISTERS WORK_SPACE PARAMETERS RETURN ADDR REGIST...

Page 40: ...r register IP contains the offset address relative to the start of the current code segment of the next sequential instruction to be executed Together the CS IP registers thus define a 32 bit program...

Page 41: ...and DI 1 backward or auto decrement the address register s SI DI or SI and DI In general the interrupt enable flag may be set or reset with special instructions STI set CLI clear or by placing the fla...

Page 42: ...ribed below The exact format of 80286 instructions is specified in Appendix B The opcode is present in all instructions in fact it is the only required element Its principal function is the specificat...

Page 43: ...ons allow trans fer between memory operands and the memory based stack Thus the two operand instructions of the 80286 permit operations of the following sort Register to register Register to memory Me...

Page 44: ...truction need specify only the desired segment register and an offset in order to address a memory operand Most instructions need not explicitly specify which segment register is used The correct segm...

Page 45: ...he offset within the desired segment is calculated in accordance with the desired addressing mode The offset is calculated by taking the sum of up to three components the displacement element in the i...

Page 46: ...offset of the operand is contained in the instruction as the displacement element The offset is a 16 bit quantity Register Indirect Mode The offset of the operand is in one of the registers SI DI or B...

Page 47: ...i e an array whose base address can change during execution The base register points to the base of the array and the value of the index register is used to select one element See figure 2 13 example...

Page 48: ...D MOV DX BP ill AND aX 3FFH MOV CX ap si CNT SHR ax 01 MASK I L I I I L I 1 1 80286 BASE ARCHITECTURE r OPERAND DISPL I BASE SEGMENT r r OPERAND INDEX FIXED ARRAY DISPL SEGMENT J I OPERAND INDEX IBASE...

Page 49: ...as shown below In Protected Mode an operating system may prevent a program from executing these I 0 instructions Otherwise the function of the I 0 instructions and the structure of the I 0 space are...

Page 50: ...er rupts is their origin art internal interrupt is always repioducible by re executing vith the program and data that caused the interrupt whereas an external interrupt is generally independent of the...

Page 51: ...he effects of all interrupts is determined by the interrupt handler routines provided by the application program or as part of the system software provided by system programmers See Chapter 5 for more...

Page 52: ...5 BOUND Yes Invalid opcode exception 6 Any undefined Yes opcode Processor extension not available exception 7 ESC or WAIT Yes Interrupt table limit too small exception 8 INT vector is not Yes within...

Page 53: ...80286 BASE ARCHITECTURE 80188 8ASIC INSTRUCTION SET 80286 EXTENDED INSTRUCTION SET SYSTEM CONTROL INSTRUCTION SET G30108 Figure 2 15 Hierarchy of Instructions 2 27 pcjs org...

Page 54: ...pcjs org...

Page 55: ...Basic Instruction Set 3 pcjs org...

Page 56: ...pcjs org...

Page 57: ...p interrupt 6 3 1 DATA MOVEMENT INSTRUCTIONS These instructions provide convenient methods for moving bytes or words of data between memory and the registers of the base architecture 3 1 1 General Pur...

Page 58: ...h All Registers saves the contents of the eight general registers on the stack See figure 3 2 This instruction simplifies procedure calls by reducing the number of instructions required to retain the...

Page 59: ...increments SP by two to point to the new top of stack See figure 3 3 POP moves information from the stack to either a register or memory The only restriction on POP is that it cannot place a value in...

Page 60: ...of the FLAGS register reflect conditions that result from a previous instruction or instructions The arithmetic instructions use OF SF ZF AF PF and CF The SCAS Scan String CMPS Compare String and LOOP...

Page 61: ...lows the CPU to recognize external maskable interrupt requests Clear ing IF disables these interrupts IF has no effect on either internally generated interrupts nonmaskable external interrupts or proc...

Page 62: ...tions Bit Position Name Function 0 CF Carry Flag Set on high order bit carry or borrow cleared otherwise 2 PF Parity Flag Set if low order eight bits of result contain an even number of 1 bits cleared...

Page 63: ...tination operands ADD affects OF SF AF PF CF and ZF Example ADD BL BYTEOPRND Adds the contents of the memory byte labeled BYTEOPRND to the contents of BL and replaces BL with the resulting sum ADC Add...

Page 64: ...and returns the double length result to DX and AX MUL sets CF and OF to indicate that the upper half of the result is nonzero otherwise they are cleared This instruction leaves SF ZF AF and PF undefin...

Page 65: ...IDlY uses the same registers as the DIY instruction For signed byte division the maximum positive quotient is 127 and the minimum negative quotient is 128 For signed word division the maximum positive...

Page 66: ...from negative to positive NEG updates OF SF ZF AF PF and CF Example NEG AX Replaces the original contents of AX with the two s complement of the contents of AX 3 4 2 Shift and Rotate Instructions The...

Page 67: ...he right side See figure 3 7 Example SHR BYTEOPRND CL Shifts the contents of the memory byte labeled BYTEOPRND right by the number of bits specified in CL and pads the left side of BYTEOPRND with an e...

Page 68: ...igure 3 7 SHR Dlalalalalalalalalalalalalalalal l c J I aI aIaIaI ala I aIaI aI aIaI aI aIaI aI aI Q 01 I aI aI aI I I I I aI aI aI I I aI I a1 0 D I I I I I I I 1a1a1aI I I I OF OPERAND CF BEFORE SAR...

Page 69: ...ue or the value contained in CL For each rotation specified the high order bit that exists from the left of the operand returns at the right to become the new low order bit of the operand See figure 3...

Page 70: ...from ROL in that it treats CF as a high order I bit extension of the destination operand Each high order bit that exits from the left side of the operand moves to CF before it returns to the operand...

Page 71: ...Note that a 16 bit RCL produces the same result as a I blt RCR though It takes much longer to execute This Instruction also operates on byte operands G30108 Figure 3 11 RCL l l l oI0 ol l 1 0 1 0 l l...

Page 72: ...tead these instructions perform operations that only set the appropriate flags to indicate the relationship between the two operands TEST Test performs the logical and of the two operands clears OF an...

Page 73: ...t code segment uses a relative displacement value contained in the instruction This can be either a 16 bit value or an 8 bit value sign extended to 16 bits The processor forms an effective address by...

Page 74: ...call gate CALL_GATE OO and the call gate actually provides the new contents of CS and IP to specify the address of the next instructions Indirect JMP outside the current code segment to a call gate I...

Page 75: ...e of IP pushed by the CALL instruction If the previous CALL instruction transferred control to a new segment RET restores the values of both IP and CS which were pushed on the stack by the CALL instru...

Page 76: ...rol transfers to the instruction immediately following the LOOP instruction If the value of ex is initially zero then the LOOP executes 65 536 times Example LOOP START_LOOP Each time the program encou...

Page 77: ...If ex o or ZF 1 the program continues with the instruction that follows the LOOPNE or LOOPNZ instruction 3 6 2 3 EXECUTING A LOOP OR REPEAT ZERO TIMES JCXZ Jump if CX Zero branches to the label specif...

Page 78: ...ation value Used with a LOOP instruction the XLAT instruc tion can translate a block of codes up to 64K bytes long Example XLAT Replaces the byte in AL with the byte from the translate table that is s...

Page 79: ...last element of the source string and to the destination address forthe last element respectively Example REP MOVSW The processor checks the value in CX for zero If this value is not zero the process...

Page 80: ...to scan the string pointed to by ES DI until it encoun ters a match with the byte value in AL or until CX decrements to zero LODS Load String places the source string element at DS SI into AX for wor...

Page 81: ...ion with rotate with carry instructions RCL and RCR They can initialize the carry flag CF to a known state before execution of a rotate that moves the carry bit into one end of the rotated operand STC...

Page 82: ...also provides 8080 8085 compatibility with the 8086 8088 80186 80188 and 80286 Example SAHF PUSHF Push Flags decrements SP by two and then transfers all flags to the word at the top of stack pointed...

Page 83: ...nly on AL or AH registers 3 10 1 Packed BCD Adjustment Instructions DAA Decimal Adjust corrects the result of adding two valid packed decimal operands in AL DAA must always follow the addition of two...

Page 84: ...d instructions only when executing at a level that is at least as privileged as that specified by 10PL Trusted instructions control I O operations interprocessor communications in a multiprocessor sys...

Page 85: ...ram specifies AX with the IN instruction the processor transfers 16 bits from the port to AX The program can specify the number of the port in two ways Using an immediate byte constant the program can...

Page 86: ...SY pin In a configuration that includes a numeric processor extension the NPX activates the BUSY pin to signal that it has completed its processing task and that the CPU may obtain the results Example...

Page 87: ...includes the load store and exchange instructions 3 12 2 5 CONSTANT INSTRUCTIONS Each of the constant instructions loads a commonly used constant into an NPX register The values have a real precision...

Page 88: ...pcjs org...

Page 89: ...Extended Instruction Set 4 pcjs org...

Page 90: ...pcjs org...

Page 91: ...empt by a less privileged program to use a trusted instruction results in a protection exception See Chapter 7 for information on protection concepts One of two possible opcodes represents each string...

Page 92: ...ious stack frames in the stack frame that ENTER creates for this procedure The ENTER instruction includes two parameters The first parameter specifies the number of bytes of dynamic storage to be allo...

Page 93: ...ously nested procedures operating at higher lexical levels The new stack frame does not include the pointer for addressing the calling procedure s stack frame ENTER treats a reentrant procedure as a p...

Page 94: ...AIN PROCEDURE D cannot access the variables of PROCEDURE B ENTER at the beginning of the MAIN PROGRAM creates dynami sturage space fuf MAIN but copies no pointers The first and only word in the displa...

Page 95: ...P _ 0 IDISPLAY OYNAMIC STORAGE BPA BP VALUE FOR PROCEOURE A Figure 4 2b Stack Frame for Procedure A 15 OlO BP BPM BPM BPM BPA BPA BP_ BPM SPA BPB SP_ 0 OYNAMIC STORAGE Figure 4 2c Stack Frame for Pro...

Page 96: ...he first word pointing to the previous value of BP the second word pointing to the value of BP for MAIN and the third word pointing to the BP value for A and the third word pointing to the current val...

Page 97: ...before using a new index value to access an element within the array BOUND provides a simple way to check the value of an index register before the program overwrites information in a location beyond...

Page 98: ...pcjs org...

Page 99: ...Real Address Mode 5 pcjs org...

Page 100: ...pcjs org...

Page 101: ...ter discusses certain additional topics addressing interrupt handling and system initialization that complete the system programmer s view of the 80286 in Real Address Mode 5 1 ADDRESSING AND SEGMENTA...

Page 102: ...as the high order 16 bits of a 20 bit segment base address No limit or access checks are performed by the 80286 in the Real Address Mode All segments are readable writable executable and have a limit...

Page 103: ...st for the moment from the currently executing program to the appropriate interrupt service routine By means of interrupt vectors the 80286 handles such control transfers uniformly for both kinds of i...

Page 104: ...bit offset and a 16 bit segment selector Interrupts 0 31 are reserved by Intel In Real Address Mode the interrupt table can be accessed directly at physical memory location othrough 1023 In the prote...

Page 105: ...ructions are intended for these operations Finally execution of the IRET instruction pops the old IP CS and FLAGS from the stack and resumes the execution of the interrupted program 5 2 3 Reserved and...

Page 106: ...nterrupt 16 ESC or WAIT N A Reserved 17 31 IUser defined 132 255 N A Not Applicable Single Step Interrupt 1 This interrupt will occur after each instruction if the Trap Flag TF bit of the FLAGS regist...

Page 107: ...nterrupt 8 This interrupt will occur if the limit of the inter rupt vector table was changed from 3FFH by the LIDT instruction and an interrupt whose vector is outside the limit occurs The saved value...

Page 108: ...a system initialization or restart program Some of the steps normally performed by a system initialization routine are as follows Allocate a stack Load programs and data from secondary storage into m...

Page 109: ...Memory Management and Virtual Addressing 6 pcjs org...

Page 110: ...pcjs org...

Page 111: ...spaces are independent of physical memory dynamically relocatable the mapping the assignment of real address space to virtual address space is transparent to software This allows the program developm...

Page 112: ...s are manipulated by programs in exactly the same way as the two component addresses of Real Address Mode After a program loads the segment selector component of an address into a segment register eac...

Page 113: ...commonly shared system services To application programs the operating system appears to be a set of service routines that are accessible to all tasks Global space is shared by all tasks to avoid unne...

Page 114: ...or table GDT this table provides a complete description of the global address space In addition there may be one or more local descriptor tables LDTs each describing the local address space of one or...

Page 115: ...state however is volatile its contents are automatically altered whenever a task switch is made from one task to another An alternate specification independent of changeable register contents must th...

Page 116: ...ctual mapping is performed on the selector component of the virtual address The 16 bit segment selector is mapped to a 24 bit segment base address via a segment descriptor maintained in one of the des...

Page 117: ...on moreover is consistent with the way a programmer naturally deals with his virtual address space programmers are encouraged to divide code and data into clearly defined modules and structures which...

Page 118: ...prohibited Base This 24 bit field comprising bytes 2 through 4 of a segment descriptor specifies the physi cal base address of the segment it thus defines the actual location of the segment within th...

Page 119: ...of the extended register structure that pertains to memory management For a complete summary of all Protected Mode registers refer to section 10 1 6 6 1 Segment Address Translation Registers Figure 6...

Page 120: ...ions such as LDS LES MOV POP etc can explicitly reference the SS DS or ES segment registers as the destination operand_ 2 Implied segment register load instructions These instructions such as interseg...

Page 121: ...abilistic caches of other architectures however the 80286 cache is completely deterministic the caching of descriptors is explicitly controlled by the program Most memory references do not require the...

Page 122: ...descriptors in the GDT from accessing beyond the end of the GDT and thus provides address space isolation at the system level as well as at the task level The register contents are hidden only in the...

Page 123: ...a multitasking environment After system startup explicit changes are not required since operations that automatically invoke a task switch described in section 8 4 appropriately manage the LDTR At all...

Page 124: ...pcjs org...

Page 125: ...Protection 7 pcjs org...

Page 126: ...pcjs org...

Page 127: ...rallel with the execution of the program But hardware protection has traditionally resulted in a design that is more expensive and slower than a system without protection However the 80286 provides ha...

Page 128: ...begin with its basic parts segments and tasks 80286 segments are the smallest region of memory which have unique protection attributes Modular programming automatically produces separate regions of me...

Page 129: ...rams to access code data and I O resources based on the associated protection level Trusted software that controls the whole system is typically placed at the most privileged level Ordinary applicatio...

Page 130: ...e g Code segment Data segment Descriptors may be created either by program development tools or by a loader in a dynamically loaded reprogrammabie environment The protection control Information consis...

Page 131: ...Since a task cannot reference descriptors in other LDTs and no descriptors in its LDT refer to data or code belonging to other tasks it cannot gain access to another tasks private code and data see fi...

Page 132: ...y the descriptor is checked against the destination reglster Since each segmt I1L n gisit ha 5 e2 ch 1l st to certain types of segments see section 7 4 1 An attempt to load a segment register in viola...

Page 133: ...e Definitions 3 2 o T I E INDEX I 0 X T T I L means that an event external to the program caused the exception i e external interrupt single step processor extension error o means that an exception oc...

Page 134: ...fer of control when needed see section 7 5 The four privilege levels of the 80286 are an extension of the typical two level user supervisor privilege mechanism Like user mode application programs in t...

Page 135: ...uter layers yet cannot affect programs in inner layers Programs written for each privilege level can be smaller easier to develop and easier to maintain than a monolithic system where all system softw...

Page 136: ...e A gate section 7 5 1 is required for access to code at more privileged levels 7 4 SEGMENT DESCRIPTOR Although the format of access control information discussed below is similar for both data and co...

Page 137: ...utable 1 means code 0 means data 2 C or ED If code Conforming 1 means yes 0 no If data Expand Down 1 yes 0 no normal case 1 RorW If code Readable 1 means readable 0 not If data Writable 1 means writab...

Page 138: ...table 7 2 If any test fails an error code is pushed onto the stack identifying the selector involved see figure 7 5 for the error code format A privilege check is made when the segment register is lo...

Page 139: ...cannot be loaded into SS and is never writable Any attempted write will cause a general protection fault with an error code of O The limit field of a code segment descriptor identifies the last byte i...

Page 140: ...ndicating greater or equal privilege of the supplier otherwise access is denied and a general protection violation occurs Pointer validity testing is required in any system concerned with preventing p...

Page 141: ...rusted source The VERR Verify Read VERW Verify Write and LAR Load Access Rights instructions are provided for this purpose Although pointer validation is fully supported in the 80286 its use is an opt...

Page 142: ...e a gate The offset is ignored All that a program need know about the desired function is the selector required to invoke the gate The 80286 will automatically start the execution at the correct addre...

Page 143: ...oint within the target code segment G30108 Call gate descriptors are used by call and jump instructions in the same manner as a code segment descriptor The hardware automatically recognizes that the d...

Page 144: ...y not make a transition In this case a general protection fault occurs with an error code identifying the gate Otherwise the gate is accessible from the program executing the call and the control tran...

Page 145: ...d level will go to a valid entry point rather than possibly into the middle of a procedure or worse into the middle of an instruction See figure 7 11 Calls to more privileged levels may be performed o...

Page 146: ...zero no parameters are copied Before copying the parameters the new stack is checked to assure that it is large enough to hold the parameters if it is not a stack fault occurs with an error code of O...

Page 147: ...is not recognized until the first stack operation The SS SP value of the returning program is not saved Note this value normally is the same as that saved in the TSS The last step in the return is che...

Page 148: ...CS id Return CS Descriptor is a Code Segment GP Return CS id Return CS Segment is Present NP Return CS id DPL of Return Non Conforming Code Segment RPL of CS GP Return CS id 55 Selector at SP N 6 is n...

Page 149: ...Tasks and State Transitions 8 pcjs org...

Page 150: ...pcjs org...

Page 151: ...l programs prevents undesirable interactions between them The interrupt system can become more flexible since adding an interrupt handler is as safe and easy as adding a new task Every task is protect...

Page 152: ...CPL 2 SP FOR CPL 2 55 FOR CPL 1 SP FOR CPt 1 58 FOR CPL 0 5P FDA CPl 0 BACK LINK SELECTOR TO TSS 1 NEVER ALTERED STATIC AFTER INITIALIZATION BY 0 5 INITIAliZED FOR THIS TASK ARE ALWAYS VALID SS SP VAL...

Page 153: ...nd stack pointer off the current stack The stack pointer at that time will be the same as the initial value loaded from the TSS upon entry to the privilege level There is only one stack active at any...

Page 154: ...ent registers with a selector that refers to a control segment causes general protection trap This rule prevents the program from improperly changing the contents of a control segment TSS descriptors...

Page 155: ...IRET instruction 2 Check that the new TSS is present and that the new task is available Le not Busy A Not Present exception 11 is signaled if the new TSS descriptor is marked Not Present P 0 The Gener...

Page 156: ...and fixes any potential problems A task switch allows flexibility in the privilege level of the outgoing and incoming tasks The privilege level at which execution resumes in the incoming task is not r...

Page 157: ...selector value is fetched and verified as pointing to a valid accessible TSS The normal task switch operation described in section 8 3 then occurs After the task switch is complete the outgoing task...

Page 158: ...ate A task gate is identified by the access byte field in bits 0 through 4 being 00101 The gate provides an extra level of indirection between the destination address and theTSS selector value The off...

Page 159: ...erformed for a JMP or CALL to a TSS after access has been verified are performed see section 8 4 Figure 8 4 illustrates an example of a task switch through a task gate TASK A TASK B f f LOT DESCRIPTOR...

Page 160: ...pcjs org...

Page 161: ...Interrupts and Exceptions 9 pcjs org...

Page 162: ...pcjs org...

Page 163: ...o be performed and the level of isolation required 9 1 INTERRUPT DESCRIPTOR TABLE Many different events may cause an interrupt To allow the reason for an interrupt to be easily identi fied each interr...

Page 164: ...rved for use byInteL Some of the interrupts are used for instruction exceptions The IDT limit must be at least 255 32X8 1 to accommodate the minimum number of interrupts The remaining 224 interrupts a...

Page 165: ...rrupts are not maskable Two interrupt instructions exist which explicitly cause an interrupt INT nand INT 3 The first allows specification of any interrupt vector the second implies interrupt vector 3...

Page 166: ...ry a privilege level The DPL controls access to interrupts with the INT nand INT 3 instructions For access the CPL of the program must be less than Oi equal to the gate DPL If tile CPL is not a genera...

Page 167: ...is involved 0 otherwise EJ ternal events are maskable or non maskable interrupts single step interrupt processor extension segment overrun inter rupt numeric processor not present exception or numeric...

Page 168: ...CS selector X 8 EXT T8 88 selector X 8 EXT TS SS selector X 8 EXT TS Stack segment selector EXT SF Stack segment selector EXT SF SS selector EXT GP Code segment selector EXT NP Code segment selector E...

Page 169: ...in the flags of the new task The TSS selector of the interrupted task is saved in the back link field of the new TSS The interrupting task executes IRET to perform a task switch to return to the inter...

Page 170: ...it s backlink field in the TSS also points to an interrupted task The backlink field of each interrupt scheduled task should be set by the scheduler to point to a sched uling task that will reschedul...

Page 171: ...each interrupt serviced the machine state is saved The new CS IP is loaded from the gate or TSS If other interrupts remain enabled they are processed before the first instruction of the current inter...

Page 172: ...rencing a register operand or an LES instruction with a register source operand 9 6 2 Double Fault Interrupt 8 If two separate faults occur during a single instruction end if the first fault is any of...

Page 173: ...nsion without causing deadlock After the interrupt is cleared this restriction is lifted It is then possible to read the instruction and operand address via FSTENV or FSAVE causing the segment overrun...

Page 174: ...descriptors are checked The not present handler should not rely on being able to use the values found in ES SS and DS without causing another exception This is because the task switch itself may have...

Page 175: ...ection exception occurs the ES and DS segment registers may not be usable for referencing memory the selector vaues are loaded before the descriptors are checked The general protection handler should...

Page 176: ...es inside a task INT instructions however do clear TF Therefore software debuggers that single step code must recognize and emulate INT n or INT 0 rather than executing them directly System software s...

Page 177: ...System Control and Initialization 10 pcjs org...

Page 178: ...pcjs org...

Page 179: ...n a task is performed As discussed in Chapter 8 the nested task flag bit 14 of flags is set when a task initiates a task switch via a CALL or INT instruction The old and new task state segments are ma...

Page 180: ...I i J I LDTBASE I LDTn I PROGRAM INVISIBLE I I LDTR L ________ I Figure 10 1 Local and Global Descriptor Table Definition IDTR CPU 15 J IDTLIMIT I IDT BASE i 23 0 MEMORY GATE FOR INTERRUPT n GATE FOR...

Page 181: ...scriptor table register and the effective real memory address supplied see figure 10 3 The format of the 3 words is a 2 byte limit a 3 byte real base address followed by an unused byte These instructi...

Page 182: ...ange these bits If the bits are changed by the 286 software compatibility with the 80386 will be destroyed The TS flag is set under hardware control and reset under software control Once the TS flag i...

Page 183: ...are called privileged An attempt to execute the privileged instructions at any other privilege level causes a general protection exception 13 with an error code of zero The privileged instructions man...

Page 184: ...g as RESET is active Execution in real address mode begins after RESET becomes inactive and an internal processing interval 3 4 clocks occurs The initial state at reset is FLAGS 0002H MSW FFFOH IP FFF...

Page 185: ...ptor tables 2 Load valid GDT and IDT descriptor tables setting the GDTR and IDTR to their correct value 3 Set the PE bit to enter protected mode 4 Execute an intra segment JMP to clear the processor q...

Page 186: ...d entries in descriptor tables to grow the tables dynamically during execution Using suitable naming conventions the builder can allocate alias data segments that are larger than the prototype EPROM v...

Page 187: ...Advanced Topics 11 pcjs org...

Page 188: ...pcjs org...

Page 189: ...to it can continue its execution because all instructions that load a segment register are restartable Not present exceptions occur only on segment register load operations gate accesses and task swi...

Page 190: ...wn segment The size of the expand down segment can be changed by changing either the base or the limit An expand down segment with Limit O will have a size of 216 1 bytes With a limit value of FFFFH t...

Page 191: ...ted to by the selector used in the instruction If that selector is visible at the CPL the instruction loads the access byte into the specified destination register as the higher byte the low byte is z...

Page 192: ...ical procedure reads data from a file into a buffer overwriting whatever is there Normally FREAD would be available at the user level supplying only pointers to the file system procedures and data loc...

Page 193: ...must first save the existing NPX context in the save area of the old task It can then re establish the correct NPX context from the current task s save area The code example in figure 11 3 relies on...

Page 194: ...t I I omp I xchg odd ov hne f r 0 r llIme_iul p p p p lret dl IXtllg 11I _npx_tllt dl IX IX dllll t_npl_ill t uml_tllt IX d I l III t_npx_ t II k 11 8 dl 11 dl npl_Ilve_lru lnpI_ IVI_lrll d udp weCO I...

Page 195: ...R estore context of current task 45 restore working registers 46 and return 52 updated by a re entrant procedure that is invoked by an inter processor interrupt The handler must ensure that the segmen...

Page 196: ...pcjs org...

Page 197: ...Appendix A 80286 System Initialization pcjs org...

Page 198: ...pcjs org...

Page 199: ...placed at fixed GOT ntry Afler the Jump the CPU xe c ut e I n the s tate of t h fir t to k de fin d by BL0 28 6 Thl code will not us any of Ih EPROM bas d tables dlr ctly Such us would r sull In the 8...

Page 200: ...fine machine Itatus word bit pOs ltlonS PE MP EM DT_ACCESS DS_ACCESS I 2 4 Pro t e c t Ion en ab I e Monitor procelsor extension Emulate procelsor extension values of de crlptor byte equ 82 H Access b...

Page 201: ...I a I_g d t 1 0 0 DS_A CCE5S 0 Define the TS5 descriptor u ed to allow the t k wltch to the flr t task to overwrite thl region of memory The TS5 will overlay the Initial GDT and tack at Iocatlon D de...

Page 202: ...on error or Inlerrijpt Copy the EPROM ba ed lemporary GDT Inlo RAM lea mov maY I lnlllal_gdllbpl Selijp polnler 10 lemporary GDT templale In EPROM c x e nd_g d I I n III a I_g dI I 2 5e I len gI h es...

Page 203: ...copy_EPROM_dl a x 9d t _d esc I nit I a I_g d I d s a x bx gdt_allas b x I Gel size of GDT Be ure Ihe lasl enlry expecled by this code Is Inside Ihe GDT Jump If GDT I not big enough Form selector 10 E...

Page 204: ...TSS de5crlplor acce5 byle Ignore privilege See If T5S Jump If nol Gel lenglh of EPROM ba ed TSS Verify II 15 of proper Ize Jump if II 15 nol big enough Selup for moving Ihe EPROM ba5ed T55 10 RAM D5...

Page 205: ...IS X 1 5 1 Ie I_d t_ll m I I ex 1 IS X Gel LDT Ilmil Verify II i valld Save for later Examine Ihe LDT alia egment and If good copy 10 RAM mov mov I I call c a I I I c I bx I d I_alia 5 e l 51 IS X I l...

Page 206: ...X t II e II X 1 1bxl accell DS_ACCESS e I bx I rei 0 a x b x ex II I I e I t_d I_II mI I d I d I d I t em p_d e I c I nit I a I_g d I d I e d I b x endp A 8 Polnl ES DI at temporary delcrlptor Mark de...

Page 207: ...et copy_wi th_f III Inlt_code fB proc I I I I d I d I eltCI eXt 1 c x 1 aX cl even_copy Cit ex exit_copy c x c x 1 exit_copy endp endl end A 9 Start at beginning of legmentl Form fill count Convert li...

Page 208: ...pcjs org...

Page 209: ...Appendix B The 80286 Instruction Set pcjs org...

Page 210: ...pcjs org...

Page 211: ...t quantity immediately follows the ModRM and optional immediate field bytes The signed displacement is added to the effective address offset I r A ModRM byte that contains both a register operand and...

Page 212: ...disp Iow 11 rim is treated as a reg field rim Field Bit Assignments rIm Operand Address 000 BX SI OISP 001 BX 01 OISP 010 BP SI OISP 011 BP 01 OISP 100 SI OISP 101 01 OISP 110 BP 0ISP 2 111 BX OISP OI...

Page 213: ...O BS BX SI 016 3 81 89 91 99 A1 A9 B1 B9 BX 01 016 S2 8A 92 9A A2 AA B2 BA BP SI 016 mod 10 S3 SB 93 9B A3 AB B3 BB BP 01 016 S4 SC 94 9C A4 AC B4 BC SI 016 S5 SO 95 90 A5 AO B5 BO 01 016 S6 SE 96 9E...

Page 214: ...AX 000 AL 001 CX 001 CL 010 OX 010 OL 011 BX 011 BL 100 SP 100 AH 101 BP 101 CH 110 SI 1100H 111 01 111 BH rim Field Bit Assignments rim 000 001 010 011 100 101 110 111 OISP follows 2nd byte of instr...

Page 215: ...segment selector db a signed value between 128 and 127 inclusive which is an operand of the instruction For instructions in which the db is to be combined in some way with a word operand the immediate...

Page 216: ...more than the calculated cl ck count due to instruction sequences that execute faster than they can be fetched from memory Some instruction forms give two clock counts one unlabelled and one labelled...

Page 217: ...this mode One exception that is possible in many instructions is GP O Exception 13 is generated whenever a word operand is accessed from effective address OFFFFH in a segment This happens because the...

Page 218: ...3 10 contain the index into the IDT Bit 1 is 0 if the selector points to the Global or Local Descriptor Tables In this case bits 2 15 have their usual selector interpretation bit 2 selects the table 1...

Page 219: ...pin is tested at the beginning of most floating point instructions and when a WAIT instruction is executed with the EM bit of the Machine Status Word set to 0 Le no emulation of the math unit The floa...

Page 220: ...n occur in an LLDT instruction but the NP exception will not occur if the processor attempts to load the LDT register during a task switch A not present LDT encountered during a task switch causes the...

Page 221: ...present condition is detected while loading the SS register Therefore the SS exception handler should execute code such as the following to insure full loading of the segment registers MOY AX DS MOYD...

Page 222: ...lector associated with the new CS value The AR byte determines whether the long jump being made is through a gate or is a task switch or is a simple long jump to the same privilege level Table B 3 lis...

Page 223: ...else TS CS CS descriptor AR byte must indicate code segment else TS CS If non conforming then OPL must equal CPL else TS CS If conforming then OPL must be CPL else TS CS CS descriptor AR byte must ind...

Page 224: ...t 11 31 51 71 91 B1 01 F1 Expand up read only accessed Data Segment 12 32 52 72 92 B2 02 F2 Expand up writable ignored Data Segment 13 33 53 73 93 B3 03 F3 Expand up writable accessed Data Segment 14...

Page 225: ...decimal carry the AH register is incremented and the carry and auxiliary carry flags are set to 1 If there was no decimal carry the carry and auxiliary carry flags are set to 0 and AH is unchanged In...

Page 226: ...rry carry OPERATION AAD is used to prepare two unpacked BCD digits least significant in AL most significant in AH for a division operation which will yield an unpacked result This is accomplished by s...

Page 227: ...should be used only after executing a MUL instruction between two unpacked BCD digits leaving the result in the AX register Since the result is less than one hundred it is contained cntirely in the A...

Page 228: ...produced a decimal carry the AH register is decremented and the carry and auxiliary carry flags are set to 1 If there was no decimal carry the carry and auxiliary carry flags are set to 0 and AH is un...

Page 229: ...2 mem 7 Add EA word into word register 04 db ADD AL db 3 Add immediate byte into AL 05 dw ADD AX dw 3 Add immediate word into AX 80 10 db ADD eb db 3 mem 7 Add immediate byte into EA byte 81 10 dw AD...

Page 230: ...EA word Logical AND EA byte into byte register Logical AND EA word into word register Logical AND immediate byte into AL Logical AND immediate word into AX Logical AND immediate byte into EA byte Log...

Page 231: ...of the first operand is increased to match the second RPL Otherwise the zero flag is set to 0 and no change is made to the first operand ARPL appears in operating systems software not in applications...

Page 232: ...just before the array itself and therefore would be acces sible at a constant offset of 4 from the array simplifying the addressing PROTECTED MODE EXCEPTIONS INTERRUPT 5 if the bounds test fails as de...

Page 233: ...in the operand to be executed When the procedure is complete a return instruction is executed within the procedure execution continues at the instruc tion that follows the CALL instruction The CALL c...

Page 234: ...ection checks made and the actions taken is given by the following list CALL FAR If indirect then check access of EA doubleword GP O if limit violation New CS selector must not be null else GP O Check...

Page 235: ...must be in code segment limit else GP O Load CS IP from gate Push return address onto stack Load code segment descriptor into CS cache Set RPL of CS to CPL CALL TASK GATE Task gate DPL must be CPL el...

Page 236: ...emory operand effective address in the CS DS or ES segments SS O for an illegal address in the SS segment GP if the indirect offset obtained is beyond the code segment limits REAL ADDRESS MODE EXCEPTI...

Page 237: ...2 Convert byte into word AH top bit of AL FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION CBW converts the signed byte in AL to a signed word in AX It does so by extending the top bit of AL into al...

Page 238: ...LAGS MODIFIED Carry O Instruction CLC FLAGS UNDEFINED None OPERATION Clocks 2 Description Clear carry flag CLC sets the carry flag to zero No other flags or registers are affected PROTECTED MODE EXCEP...

Page 239: ...1 will increment FLAGS MODIFIED Direction 0 FLAGS UNDEFINED None OPERATION CLD clears the direction flag No other flags or registers are affected After CLD is executed string operations will increment...

Page 240: ...privilege level is at least as privileged as 10PL No other flags are affected External interrupts will not be recognized at the end of the CLI instruction or thereafter until the interrupt flag is se...

Page 241: ...is present and a task switch has been made since the last ESC instruction was begun the processor extension s context must be saved before a new instruc tion can be issued The fault routine will save...

Page 242: ...FLAGS MODIFIED Carry Instruction CMC FLAGS UNDEFINED None OPERATION Clocks 2 Description Complement carry flag CMC reverses the setting of the carry flag No other flags are affected PROTECTED MODE EX...

Page 243: ...te word from EA word Compare word register from EA word Compare EA byte from byte register Compare EA word from word regisler CMP subtracts the second operand from the first operand but it does not pl...

Page 244: ...s whether a segment override byte will be produced or whether the default segment register DS is used The second DI operand must be addressible from the ES register no segment override is possible Aft...

Page 245: ...2 Convert word to daubleword DX AX AX FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION CWDconverts the signed word in AX to a signed doubleword in DX AX It does so by extending the top bit of AX in...

Page 246: ...t of two packed BCD digits In this case the DAA instruction will adjust AL to contain the correct two digit packed decimal result The precise definition of DAA is as follows 1 If the lower 4 bits of a...

Page 247: ...onsist of two packed BCD digits In this case the DAS instruction will adjust AL to contain the correct packed two digit decimal result The precise definition of DAS is as follows 1 If the lower four b...

Page 248: ...d register by 1 1 is subtracted from the operand Note that the carry flag is not changed by this instruction If you want the carry flag set use the SUB instruction with a second operand of 1 PROTECTED...

Page 249: ...erand is a WORD operand diyide DX AX by the word The high order 16 bits of the dividend are kept in DX The quotient is stored in AX and the remainder is stored in DX Non integral quotients are truncat...

Page 250: ...e high level language source code It determines how many stack frame pointers are copied into the new stack frame from the preceding frame BP is used as the current stack frame pointer If the second o...

Page 251: ...THE 80286 INSTRUCTION SET PROTECTED MODE EXCEPTIONS SS O if SP were to go outside of the stack limit within any part of the instruction execution REAL ADDRESS MODE EXCEPTIONS None 8 41 pcjs org...

Page 252: ...ting instructions and to enter a HALT state Execution resumes only upon receipt of an enabled interrupt or a reset If an interrupt is used to resume program execution after HLT the saved CS IP value w...

Page 253: ...a WORD operand divide DX AX by the word The high order 16 bits of the dividend are in DX The quotient is stored in AX and the remainder is stored in DX Non integral quotients are truncated towards o...

Page 254: ...nd is multiplied by AX and the 32 bit signed result is left in DX AX DX contains the high order 16 bits of the product Carry and overflow are set to 0 if DX is a sign extension of AX they are set to 1...

Page 255: ...r AL or AX given as the first operand You can access any port from 0 to 65535 by placing the port number in the DX register then using an IN instruction with DXas the second parameter These I O instru...

Page 256: ...word register by 1 1 is added to the operand Note that the carry flag is not changed by this instruction If you want the carry flag set use the ADD instruction with a second operand of 1 PROTECTED MO...

Page 257: ...ransfer is made DI is automatically advanced If the direction flag is 0 CLD was executed DI increments if the direction flag is 1 STD was executed DI decrements DI increments or decre ments by 1 if a...

Page 258: ...errupt routine to be called In protected mode the IDT consists of 8 byte descriptors the descriptor for the interrupt invoked must indicate an interrupt gate a trap gate or a task gate In real address...

Page 259: ...al DPL of code segment else TS SS selector EXT Descriptor must indicate writable data segment else TS SS selector EXT Segment must be PRESENT else SS SS selector EXT New stack must have room for 10 by...

Page 260: ...low push of two more bytes else SS O Push error code onto stack IP must be in CS limit else GP O NOTE EXT is 1 if an external event Le a single step an external interrupt an MF exception or an MP exce...

Page 261: ...as indicated by the RPL bits of the CS selector popped from the stack If the destination code is of less privilege IRET then also pops SP and SS from the stack If NT 1 IRET reverses Jhe operation of a...

Page 262: ...te must indicate code segment else GP Return selector If non conforming then code segment OPL must CS selector RPL else GP Return selector If conforming then code segment OPL must be CPL else GP Retur...

Page 263: ...HE 80286 INSTRUCTION SET PROTECTED MODE EXCEPTIONS GP NP or 88 as indicated in the above listing REAL ADDRESS MODE EXCEPTIONS Interrupt 13 if the stack is popped when it has offset OFFFFH 8 53 pcjs or...

Page 264: ...7E cb JNG cb 7 noj 3 Jump short if not greater ZF 1 or SF OF 7C cb JNGE cb 7 noj 3 Jump short if not greater equal SF OF 70 cb JNL cb 7 noj 3 Jump short if not less SF OF 7F cb JNLE cb 7 noj 3 Jump sh...

Page 265: ...t of the conditional jump opcodes For example consider that a programmer who has just compared a character to another in AL might wish to jump if the two were equal JE while another programmer who had...

Page 266: ...cause a complete task switch to take place Control transfers within a segment use the JMP cw or JMP cb forms The operand is a relative offset added modulo 65536 to the offset of the instruction that...

Page 267: ...must be PRESENT else NP selector IP must be in code segment limit else GP O Load CS IP from destination pOinter Load CS cache with new segment descriptor Set RPL field of CS register to CPL JUMP TO C...

Page 268: ...must be PRESENT else NP TSS selector SWITCH_TASKS with nesting to TS IP must be in code segment limit else GP O Else GP selector PROTECTED MODE EXCEPTIONS For NEAR jumps GP O if the destination offset...

Page 269: ...xx PF xx CF FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The low byte of the flags word is transferred to AH The bits from MSB to LSB are as follows sign zero indeterminate auxiliary carry indet...

Page 270: ...hts byte of the descriptor is loaded into the high byte of the first register operand and the low byte is set to zero The zero flag is set if the loading was performed i e the selector index is within...

Page 271: ...descriptor table entry for the selector given A null selector values 0000 0003 can be loaded into DS or ES without a protection exception Any memory reference using such a segment register value will...

Page 272: ...NP as indicated in the list above GP O or S8 O if operand lies outside segment limit UD if the source operand is a register REAL ADDRESS MODE EXCEPTIONS Interrupt 13 for operand at offset OFFFFH or OF...

Page 273: ...UNDEFINED None OPERATION Clocks Description 3 Calculate EA offset given by m place in rw The effective address offset part of the second operand is placed in the first register operand PROTECTED MODE...

Page 274: ...g BP to SP LEAVE releases the stack space used by a procedure for its dynamics and display The old frame pointer is now popped into BP restoring the caller s frame and a subsequent RET nn instruction...

Page 275: ...ree bytes go to the BASE field of the register the last byte is ignored LGDT and LIDT appear in operating systems software they are not used in application programs These are the only instructions tha...

Page 276: ...anged The selector operand is allowed to be zero In that case the Local Descriptor Table Register is marked invalid All descriptor references except by LAR VERR VERW or LSL instructions will cause a G...

Page 277: ...de If so then it must be followed byan intra segment jump to flush the instruction queue LMSW will not switch back to Real Address Mode LMSW appears only in operating systems software It does not appe...

Page 278: ...y shared memory while BUS LOCK is asserted The read modify write sequence typically used to implement TEST AND SET in the 80286 is the XCHG instruction The 80286 LOCK prefix activates the lock signal...

Page 279: ...h the memory byte or word at SI After the transfer is made SI is automatically advanced If the direction flag is 0 CLD was executed SI increments if the direction flag is 1 STD was executed SI decreme...

Page 280: ...checked as given in the description above for the form of LOOP being used If the conditions are met then an intra segment jump is made The destination to LOOP is in the range from 126 decimal bytes be...

Page 281: ...if the selector is non null the selector index is within the descriptor table limits the descriptor is a non conforming segment descriptor with DPL CPL and the descriptor DPL selector RPL the zero fl...

Page 282: ...eration does not occ ur LTR appears only in operating systems software It is not used in applications programs PROTECTED MODE EXCEPTIONS GP for an illegal memory operand effective address in the CS DS...

Page 283: ...Move word variable offset dw into AX A2 dw MOV xb AL 3 Move AL into byte variable offset dw A3 dw MOV xW AX 3 Move AX into word register offset dw 80 rb db MOV rb db 2 Move immediate byte into byte re...

Page 284: ...elector AR byte must indicate data or readable code segment else GP selector If data or non conforming code then both the RPL and the CPL must be less than or equal to DPL in AR byte else GP selector...

Page 285: ...er the data movement is made both SI and DI are automatically advanced If the direction flag is o CLD was executed the registers increment if the direction flag is 1 STD was executed the registers dec...

Page 286: ...y AL and the result is left in AX Carry and overflow are set to 0 if AH is 0 they are set to 1 otherwise If MUL has a word operand then the word is multiplied by AX and the result is left in DX AX DX...

Page 287: ...emory operand replaces the old operand value Likewise the operand is subtracted from zero and the result is placed in the operand The carry flag is set to 1 except when the input operand is zero iii w...

Page 288: ...90 NOP 3 No OPERATION FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION Performs no operation NOP is a one byte filler instruction that takes up space but affects none of the machine context except I...

Page 289: ...of EA byte Reverse each bit of EA word The operand is inverted that is every 1 becomes a 0 and vice versa PROTECTED MODE EXCEPTIONS GP O if the result is in a non writable segment GP O for an illegal...

Page 290: ...al OR EA word into word register Logical OR immediate byte into AL Logical OR immediate word into AX Logical OR immediate byte into EA byte Logical OR immediate word into EA word This instruction comp...

Page 291: ...CAL or AX given as the second operand to the output port numbered by the first operand You can output to any port from 65535 by placing the port number in the DX register then using an OUT instruction...

Page 292: ...e SI is automatically advanced If the direction flag is 0 CLD was executed SI increments if the direction flag is 1 STD was executed SI decrements SI increments or decre ments by 1 if a byte was moved...

Page 293: ...ster loading also initiates validation of both the selector and the descriptor information A null value 0000 0003 may be loaded into the DS or ES register without causing a protection excep tion Attem...

Page 294: ...e with descriptor If ES or OS is loaded with a null selector Load segment register with selector Clear valid bit in cache PROTECTED MODE EXCEPTIONS If a segment register is being loaded GP SS and NP a...

Page 295: ...rs given in the description above except that the SP value is discarded instead of loaded into SP POPA reverses a previous PUSHA restoring the general registers to their values before PUSHA was execut...

Page 296: ...O privilege level 2 bits overflow direc tion interrupts enabled trap sign zero undefined auxiliary carry undefined parity undefined and carry The I O privilege level will be altered only when executin...

Page 297: ...pointer SP is decremented by 2 and the operand is placed on the new top of stack which is pointed to by SS SP The 80286 PUSH SP instruction pushes the value of SP as it existed before the instruction...

Page 298: ...SP is decremented by 16 to hold the 8 word values Since the registers are pushed onto the stack in the order in which they were given they will appear in the 16 new stack bytes in the reverse order T...

Page 299: ...w top of stack which is pointed to by SS SP The flags from the top bit 15 to the bottom bit 0 are as follows undefined nested task I O privilege level 2 bits overflow direction interrupts enabled trap...

Page 300: ...w db 5 mem 8 Rotate 16 bit EA word left db times 00 1 ROR eb 1 2 mem 7 Rotate 8 bit EA byte right once 02 1 ROR eb CL 5 mem 8 Rotate 8 bit EA byte right CL times CO 1 db ROR eb db 5 mem 8 Rotate 8 bit...

Page 301: ...t to be accurate if a shift of length 1 is done Since it is undefined for all other values including a zero shift it can always be set for the count of 1 case regardless of the actual count For left s...

Page 302: ...I and SI F3 A7 REPE CMPS mW mw 5 9 N Find nonmatching words in ES OI and SI F3 A6 REPE CMPSB 5 9 N Find nonmatching bytes in ES OI and OS SI F3 A7 REPE CMPSW 5 9 N Find nonmatching words in ES OI and...

Page 303: ...last comparison was equal 6 Go to step 1 for the next iteration As defined by the individual string ops the direction of movement through the block is determined by the direction flag If the direction...

Page 304: ...return the address on the stack is a 2 byte quantity popped into IP The CS register is unchanged For the inter segment return the address on the stack is a 4 byte long pointer The offset is popped fir...

Page 305: ...e PRESENT else NP selector Examine return SS selector at SP 6 imm and associated descriptor Selector must be non null elSe GP O Selector index must be within its descriptor table limits else GP select...

Page 306: ...AH into flags SF ZF xx AF xx PF xx CF FLAGS MODIFIED Sign zero auxiliary carry parity carry FLAGS UNDEFINED None OPERATION The flags listed above are loaded with values from the AH register from bits...

Page 307: ...FIED Overflow only for single shift form carry zero parity sign FLAGS UNDEFINED Auxiliary carry also overflow for multibit shifts only OPERATION SAL or its synonym SHL shifts the bits of the operand u...

Page 308: ...the operand is in a non writable segment GP O for an illegal memory operand effective address in the CS DS or ES segments SS O for an illegal address in the SS segment REAL ADDRESS MODE EXCEPTIONS Int...

Page 309: ...Subtract with borrow imm byte from AL Subtract with borrow imm word from AX Subtract with borrow imm byte from EA byte Subtract with borrow imm word from EA word Subtract with borrow imm byte from EA...

Page 310: ...t be addressable from the ES register no segment override is possible After the comparison is made 01 is automatically advanced If the direction flag is 0 CLO was executed 01 increments if the directi...

Page 311: ...hree bytes get the BASE field of the register and the last byte is undefined SGDT and SIDT appear only in operating systems software they are not used in applications programs PROTECTED MODE EXCEPTION...

Page 312: ...tion indicated by the effective address operand This register is a selector that points into the Global Descriptor Table SLDT appears only in operating systems software It is not used in applications...

Page 313: ...chine Status Word is stored in the 2 byte register or memory location indicated by the effective address operand PROTECTED MODE EXCEPTIONS GP O if the destination is in a non writable segment GP O for...

Page 314: ...Carry Flag Opcode F9 FLAGS MODIFIED Carry 1 Instruction STC FLAGS UNDEFINED None OPERATION The carry flag is set to 1 PROTECTED MODE EXCEPTIONS None Clocks 2 REAL ADDRESS MODE EXCEPTIONS None 8 104 De...

Page 315: ...ag 50 51 and 01 will decrement FLAGS MODIFIED Direction 1 FLAGS UNDEFINED None OPERATION The direction flag is set to 1 This causes all subsequent string operations to decrement the index registers SI...

Page 316: ...ODIFIED Interrupt I enabled FLAGS UNDEFINED None OPERATION The interrupts enabled flag is sct to 1 The 80286 will now respond to external interrupts after execut ing the STI instruction PROTECTED MODE...

Page 317: ...possible After the transfer is made DI is automatically advanced If the direction flag is 0 CLD was executed DI increments if the direction flag is 1 STD was executed DI decrements DI increments or d...

Page 318: ...ask Register are copied to the 2 byte register or memory location indicated by the effective address operand PROTECTED MODE EXCEPTIONS GP O if the destination is in a non writable segment GP O for an...

Page 319: ...ct EA word from word register Subtract immediate byte from AL Subtract immediate word from AX Subtract immediate byte from EA byte Subtract immediate word from EA word Subtract immediate byte from EA...

Page 320: ...EA word into word register for flags only AND immediate byte into AL for flags only AND immediate word into AX for flags only AND immediate byte into EA byte for flags only AND immediate word into EA...

Page 321: ...a segment 3 If the instruction is VERR the segment must be readable If the instruction is VERW the segment must be a writable data segment 4 If the code segment is readable and conforming the descript...

Page 322: ...THE 80286 INSTRUCTION SET REAL ADDRESS MODE EXCEPTIONS Interrupt 6 VERR and VERW are not recognized in Real Address Mode 8 112 pcjs org...

Page 323: ...0286 instructions until the BUSY pin is inactive high The BUSY pin is driven by the 80287 numeric processor extension WAIT is issued to ensure that the numeric instruc tion being executed is complete...

Page 324: ...with AX 90 rw XCHG rW AX 3 Exchange with word register FLAGS MODIFIED None FLAGS UNDEFINED None OPERATION The two operands are exchanged The order of the operands is immaterial BUS LOCK is asserted fo...

Page 325: ...None OPERATION When XLAT is executed AL should be the unsigned index into a table addressed by DS BX XLAT changes the AL register from the table index into the table entry BX is unchanged PROTECTED M...

Page 326: ...EA word into word register Exclusive OR immediate byte into AL Exclusive OR immediate word into AX Exclusive OR immediate byte into EA byte Exclusive OR immediate word into EA word XOR computes the e...

Page 327: ...Appendix C 8086 8088 Compatibility Considerations pcjs org...

Page 328: ...pcjs org...

Page 329: ...k into are delays between I 0 operations and assumed delays in 8086 8088 operating in parallel with an 8087 3 Divide Exceptions Point at the DIV Instruction Any interrupt on the 80286 will always leav...

Page 330: ...code functions as the 8086 8088 PUSH SP instruction on the 80286 9 Do not Shift or Rotate by More than 31 Bits The 80286 masks all shift rotate counts to the low 5 bits This MOD 32 operation limits th...

Page 331: ...on In real mode or protected mode the 80286 always forms a physical address by adding a l6 bit offset with a 24 bit segment base value 8086 has 20 bit base value Therefore if the 80286 in real mode ha...

Page 332: ...pcjs org...

Page 333: ...Appendix D 80286 80386 Software Compatibility Considerations pcjs org...

Page 334: ...pcjs org...

Page 335: ...on code Such code can be extended to include programming of operating parameters before executing the initial protected mode task 2 Avoid wraparound of 80286 24 bit physical address space Since the 80...

Page 336: ...before using the string move instruction Any attempt to execute a locked string move will cause a protection exception on the 80386 The general 80286 LOCK protocol does not efficiently extend to large...

Page 337: ...Arithmetic see Data Management Instructions BH Register 2 7 2 8 2 17 3 9 BL Register 2 7 2 8 2 17 BOUND Instruction see Extended Instruction Set Bound Range Exceeded Interrupt 5 see Interrupt Handlin...

Page 338: ...pes 2 1 2 6 ASCII 2 4 2 6 B 15 B 18 BCD 2 4 Byte 2 2 2 4 Floating Point 2 4 Integer 2 4 Packed BCD 2 4 Pointer 2 4 INDEX Strings 2 4 Word 2 2 2 3 DEC Instruction 2 17 3 8 B 38 Dedicated Interrupt Vect...

Page 339: ...86 186 286 Instruction Sets 2 25 2 27 Basic Instruction Set 2 25 2 27 3 1 3 31 Extended Instruction Set Chapter 4 Instruction Set Overview 2 25 2 27 System Control Register Set Chapter 4 Chapter 10 1...

Page 340: ...Instruction 5 6 5 7 10 3 10 6 B 65 LLDT Instruction 6 12 10 3 10 5 B 66 LMSW Instruction 10 4 10 6 B 67 LOCK Prefix 3 29 B 68 LODS LODSB LODSW 3 24 B 69 LOOP Instruction 3 4 3 20 3 21 B 70 LOOPE Instr...

Page 341: ...s Register 2 14 2 15 General Registers 2 7 Index Registers DI SI 2 9 Overview 2 7 Pointer Registers BP and SP 2 9 Segment Registers 2 8 Status and Control 2 14 Register Direct Mode 2 20 Register and I...

Page 342: ...n see Flags Stack Fault Interrupt 12 see Interrupt Priorities Stack Manipulation Instructions 3 2 3 3 Stack Operations 2 10 Grow Down 2 11 Overview 2 10 2 14 Segment Register Usage 2 11 Segment Usage...

Page 343: ...80287 Numeric Processor Extension NPX pcjs org...

Page 344: ...pcjs org...

Page 345: ...es of physical address space to support today s application require ments This large physical memory enables the 80286 to keep many large programs and data struc tures simultaneously in memory for hig...

Page 346: ...nal branching the conversion between floating point values and their ASCII representations and the calculation of several trigonometric functions These examples illustrate assembly language programmin...

Page 347: ...cision Control 1 19 Infinity Control 1 19 Special Computational Situations 1 20 Special Numeric Values 1 21 Nonnormal Real Numbers 1 21 Denormals and Gradual Underflow 1 21 Unnormals Descendents of De...

Page 348: ...Synchronization 2 52 Proper Error Synchronization 2 52 CHAPTER 3 SYSTEM LEVEL NUMERIC PROGRAMMING 80287 Architecture 3 1 Processor Extension Data Channel 3 1 Real Address Mode and Protected Virtual A...

Page 349: ...80287 NPX Block Diagram 1 7 1 3 80287 Register Set 1 9 1 4 80287 Status Word 1 10 1 5 80287 Control Word Format 1 12 1 6 80287 Tag Word Format 1 13 1 7 80287 Instruction and Data Pointer Image in Memo...

Page 350: ...s 1 28 1 13 Binary Integer Encodings 1 29 1 14 Packed Decimal Encodings 1 30 1 15 Real and Long Real Encodings 1 31 1 16 Temporary Real Encodings 1 32 1 17 Exception Conditions and Masked Responses 1...

Page 351: ...Overview of Numeric Processing 1 pcjs org...

Page 352: ...pcjs org...

Page 353: ...and 80286 80287 systems in executing numerics oriented applications Performance Table 1 1 compares the execution times of several 80287 instructions with the equivalent operations executed in software...

Page 354: ...Stack O assumed Exponentiation 1 41 Ease of Use The 80287 NPX offers more than raw execution speed for computation intensive tasks The 80287 brii g3 the f ncticn lity power of Accurate numeric computa...

Page 355: ...nity directed rounding gradual underflow and either automatic or programmed exception handling facilities These automatic exception handling facilities permit a high degree of flexibility in numeric p...

Page 356: ...ese include rotation scaling and inter polation By also using an 82720 Graphics Display Controller to perform high speed data transfers very powerful and highly self sufficient terminals can be built...

Page 357: ...d in programming the NPX allowing convenient access to record structures numeric arrays and other memory based data structures All of the memory management and protection features of the CPU are exten...

Page 358: ...Status Word Load Environment Store Environment Save Restore Clear Exceptions Initialize Set Protected Mode In addition all of the development tools supporting the 8086 and 8087 can also be used to dev...

Page 359: ...executing most ESC instructions the 80286 tests the BUSY pin and before initiating the command waits until the 80287 indicates that it is not busy Once initiated the 80286 continues program execution...

Page 360: ...sed to protect the integrity of 80287 computations in multiuser reprogrammable applications preventing any accidental or other tampering with the 80287 see Chapter Eight of the 80286 Operating System...

Page 361: ...ST 2 The stack organization and top relative addressing of the numeric registers simplify subroutine programming by allowing routines to pass parameters on the register stack By using the stack to pa...

Page 362: ...r to the flags in a CPU the 80287 updates these bits to reflect the outcome of arithmetic operations The effect of these instructions on the condition code bits is summarized in table 1 4 These condit...

Page 363: ...t affected by instruction 3 U value is undefined following instruction 4 Qn Quotient bit n following complete reduction C O The low order byte of this control word configures the 80287 error and excep...

Page 364: ...are discussed in the section on Computation Fundamentals The NPX Tag Word The tag word indicates the contents of each register in the register stack as shown in figure 1 6 The tag word is used by the...

Page 365: ...FFSET DATA OPERAND SELECTOR PROTECTED MODE G30108 MEMORY OFFSET 0 2 4 6 8 10 12 G30108 Figure 1 7 80287 Instruction and Data POinter Image in Memory When stored in memory the instruction and data poin...

Page 366: ...and continuous This sequence is a subset of the numbers that is designed to form a useful approximation of the real number system Figure 1 8 superimposes the basic 80287 real number system on a real n...

Page 367: ...act arithmetic on integer operands That is an operation on two integers returns an exact integral result provided that the true result is an integer and is in range For example 4 2 yields an exact int...

Page 368: ...O 79 72 SHORT REAL LONG REAL S 63 BIASED EXPONENT SIGNIFICAND o 1 TEMPORARY REAL LIS lI __ __ _________ S_IG_N_1_F_IC_A_N_D ________ 79 0 NOTES 5 Sign bit 0 positive 1 negative dn Decimal digit two pe...

Page 369: ...he number is the leftmost digit All digits must be in the range OH 9H REAL NUMBERS The 80287 stores real numbers in a three field binary format that resembles scientific or exponential notation The nu...

Page 370: ...mat and sign to be compared as if they are unsigned binary integers That is when comparing them bitwise from left to right begin ning with the leftmost exponent bit the first bit position that differs...

Page 371: ...interval may be computed by executing an algorithm twice rounding up in one pass and down in the other Precision Control The 80287 allows results to be calculated with either 64 53 or 24 bits of preci...

Page 372: ...obally with affine mode reserved for local computations where the programmer can take advantage of the sign and knows for certain that the nature of the computations will not produce a misleading resu...

Page 373: ...lt of a calculation yields a value that is too small to be represented in normal form Nonnormal values can exist in one of two forms The floating point exponent may be stored at its most negative valu...

Page 374: ...nderflow response allows program mers to treat underflows in a similar manner the computation continues and the programmer can examine the final result to determine if an underflow has had important c...

Page 375: ...erands and do not check for exceptions In all other cases the NPX converts denormals to unnor mals and the rules governing unnormal arithmetic then apply are described in the follow ing section Unnorm...

Page 376: ...is nonzero true zeros have a zero exponent Neither is a pseudo zero s exponent all ones since this encoding is reserved for infinities and NANs A pseudo zero result will be produced if two unnormals...

Page 377: ...es that exist in the real formats only A NaN has an exponent of 11 11B may have either sign and may have any significand except I lOO OOB which is assigned to the infinities A NaN in a register is tag...

Page 378: ...0 rem X 0 rem X 0 FIST FISTP X rem Y X rem Y 0 9 0 0 X rem V X rem Y 0 9 0 0 X 4 0 FSQRT _X 4 0 0 0 0 0 Addition 0 plus 0 0 Compare 0 plus 0 0 O X A B 0 plus 0 0 plus 0 0 5 o o A B X plus X X plus X...

Page 379: ...t could supply a NaN as the result of the erroneous instruction and that NaN could point to its associated diagnostic area in memory The program would then continue creating a different NaN for each e...

Page 380: ...oo O Invalid operation Invalid operation Division oo oo Invalid operation Invalid operation oo X E9 E9 X oo E9 E9 FSQRT 00 Invalid operation Invalid operation 00 Invalid operation 00 FPREM oo rem oo...

Page 381: ...be ambiguous the invalid operation exception flag can be examined to see if the value was produced by an exception response When this encoding is loaded or used by an integer arithmetic or compare op...

Page 382: ...000 o 000 o 0 0 0 o 0 0 0 o 0 0 0 o 0 0 0 III GI Smallest 1 0000000 o 0 0 0 o 0 0 0 o 0 0 0 o 0 0 0 o 0 0 1 10 Dl GI z Largest 1 0000000 1 o 0 1 1 o 0 1 1 0 0 1 1 001 1 0 0 1 Indefinite 1 1111111 1 1...

Page 383: ...jj Normals 0 a 0 00 01 00 00 0 00 00 11 11 Denormals 0 00 00 00 01 III Zero 0 00 00 00 00 10 GI a Zero 1 00 00 00 00 1 00 00 00 01 Denormals 1 00 00 11 11 1 00 01 00 00 Normals 0 1 11 10 11 11 GI 1ii...

Page 384: ...1 NaNs 0 11 11 100 01 00 0 11 11 100 00 0 11 10 Normals 111 11 Q 100 00 E r Unnormals 0 c 011 11 0 00 01 000 00 Denormals 0 00 00 011 11 0 00 00 000 01 Zero 0 00 00 000 00 I OJ Q a Zero 1 00 00 000 00...

Page 385: ...ceptions while executing numeric instructions 1 Invalid operation 2 Divide by zero 3 Denormalized operand 4 Numeric overflow 5 Numeric underflow 6 Inexact result precision INVALID OPERATION The 80287...

Page 386: ...rithmetic only HANDLING NUMERIC ERRORS When numeric errors occur the NPX takes one of two possible courses of action The NPX can itself handle the error producing the most reasonable result and allowi...

Page 387: ...operand is 00 or closure is projective and operand is 00 Compare operations only closure is projec tive and 00 is being compared with 0 a normal or 00 FTST instruction only closure is projective and o...

Page 388: ...erflow Arithmetic operations only exponent of true Denormalize until exponent rises to 16 382 result 16 382 true true round significand to 64 bits If denor malized rounded significand 0 then return tr...

Page 389: ...lity for most exceptions to the NPX reserving the most severe exceptions for programmed exception handlers Exception handling software is often difficult to write and the NPX s masked responses have b...

Page 390: ...s Aborting further execution Using the exception pointers to build an instruction that will run without exception and executing it Application programmers on 80286 systems having systems software supp...

Page 391: ...Programming Numeric Applications 2 pcjs org...

Page 392: ...pcjs org...

Page 393: ...286 programmer who is coding a program Appendix A covers the actual machine instruction encodings which are princi pally of use to those reading unformatted memory dumps monitoring instruction fetches...

Page 394: ...ind that memory operands may be coded with any of the CPU s memory addressing modes To review these modes direct register indirect based indexed based indexed refer to the 80286 Programmer s Reference...

Page 395: ...op operates identically to FST except that the stack is popped following the transfer This is done by tagging the top stack element empty and then incrementing ST FSTP permits storing to a temporary r...

Page 396: ...then chopping Users who arc concerned about rounding may precede FBSTP with FRNDINT Arithmetic Instructions The 80287 s arithmetic instruction set table 2 2 provides a wealth of variations on the basi...

Page 397: ...ge sign Five basic instruction forms may be used across all six operations as shown in table 2 3 The classicial stack form may be used to make the 80287 operate like a classical stack machine No opera...

Page 398: ...operands of ST 1 ST with a register pop mnemonic is equivalent to a classical stack operation the top is popped and the result is left at the new top The two memory forms increase the flexibility of...

Page 399: ...tent of the stack top NORMAL DIVISION FDIV source destination source FDIVP destination source FIDIV source The normal division instructions divide real divide real and pop integer divide divide the de...

Page 400: ...REM and re execute the instruction using the partial remainder in ST as the dividend until C2 is cleared Alternatively a program can determine when the function is complete by comparing ST to ST 1 If...

Page 401: ...iased exponent expressed as a real number If the original operand is zero FXTRACT produces zeros in ST and ST l and both are signed as the original operand To clarify the operation of FXTRACT assume S...

Page 402: ...memory for inspection Note that instructions other than those in the comparison group may update the condition code To ensure that the status word is not altered inadvertently store it immediately fo...

Page 403: ...ally to FICOM and additionally discards the value in ST by popping the stack FTST FTST test tests the top stack element by comparing it to zero The result is posted to the condition codes as shown in...

Page 404: ...return their results to the stack also NOTE The transcendental instructions assume that their operands are valid and in range The instruction descriptions in this section provide the allowed operand r...

Page 405: ...tion Y 2X 1 X is taken from the stack top and must be in the range 0 5 X 5 0 5 The result Y replaces X at the stack top This instruction is designed to produce a very accurate result even when X is cl...

Page 406: ...pushes a commonly used constant onto the stack The values have full temporary real precision 64 bits and are accurate to approximately 19 decimal digits Because a temporary real constant occupies 10...

Page 407: ...does not precede the ESC instruction with a wait instruction and the CPU does not test the ERROR status line from the NPX before executing the processor control instruction Only the processor control...

Page 408: ...ension Segment Overrun Exception Interrupt 9 is detected by the CPU FSETPM FSETPM set Protected mode sets the operating mode of the 80287 to Protected Virtual Address mode When the 80287 is first init...

Page 409: ...flags the error status flag and the busy flag in the status word As a consequence the 80287 s ERROR line goes inactive FCLEX checks for unmasked numeric exceptions FNCLEX does not FSAVE FNSAVE destin...

Page 410: ...C ELEMENT ST 1 L LAST STAC ELEMENT ST Sl SIGNIFICAND 15 0 2 SIGNIFICANO 31 16 2 51GNIFICAND 47 32 28 SIGNIFICAND 63 48 30 EXPONENT 14 0 32 SIGNIFICAND 15 0 84 SIGNIFICAND 31 16 8 SIGNIFfCAND 47 32 88...

Page 411: ...saved on the CPU stack FSTENVjFNSTENV is often used by exception handlers because it provides access to the exception pointers that identify the offending instruction and operand After saving the env...

Page 412: ...er ST in the status word It does not alter tags or register contents nor does it transfer data It is not equivalent to popping the stack because it does not set the tag of the previous stack top to em...

Page 413: ...nd identifiers allowed in table 2 14 Following this entry are columns that provide execution time in clocks the number of bus transfers run during the operation the length of the instruction in bytes...

Page 414: ...rand values that normally characterize most applications The range encompasses best and worst case operand values that may be found in extreme circumstances The operand transfer time required to trans...

Page 415: ...gned operands Additional transfer time is required if slow memories are being used requiring the insertion of wait states into the CPU bus cycle In multiprocessor environments the bus may not be avail...

Page 416: ...4 FADD AIR_TEMP SI long real 110 95 125 4 2 4 FADD BX MEAN FADDP FADDP destination source Exceptions I D 0 U P Add real and pop Execution Clocks Operands Operand Word Code Coding Example Typical Range...

Page 417: ...real Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfers Bytes jjST i 45 40 50 0 2 FCOM ST 1 short real 65 60 70 2 2 4 FCOM BP UPPER_LlMIT long real 70 65 75 4 2 4 FCOM...

Page 418: ...FDIVP destination source Exceptions I D Z 0 U P Divide real and pop Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfers Bytes ST i ST 202 197 207 0 2 FDIVP ST 4 ST FDIVR...

Page 419: ...ons I D Integer compare Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfers Bytes word integer 80 72 86 1 2 4 FICOM TOOL N_PASSES short integer 85 78 91 2 2 4 FICOM BP 4...

Page 420: ...56 52 60 2 2 4 FILD STANDOFF DI long integer 64 60 68 4 2 4 FILD RESPONSE COUNT FIMUL FIMUL source Exceptions I D 0 P Integer multiply Execution Clocks Operands Operand Word Code Coding Example Typica...

Page 421: ...s word integer 88 82 92 1 2 4 FISTP BX ALPHA_COUNT SI short integer 90 84 94 2 2 4 FISTP CORRECTED_TIME long integer 100 94 105 4 2 4 FISTP PANEL N_READINGS FISUB FISUB source Exceptions 1 0 0 P Integ...

Page 422: ...erands Operand Word Code Coding Example Typical Range Transfers Bytes 2 bytes 10 7 14 1 2 4 FLDCW CONTROLWORD FLOENV FLDENV source Exceptions None Load environment Execution Clocks Operands Operand Wo...

Page 423: ...pical Range Transfers Bytes no operands 19 16 22 0 2 FLOL2T FLDPI FLOPI no operands Exceptions I Load 11 Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfers Bytes no ope...

Page 424: ...op Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfers Bytes ST i ST1 100 94 108 0 2 FMULP ST 1 ST ST i ST 142 134 148 0 2 FMULP ST 1 ST FNOP FNOP no operands Exceptions...

Page 425: ...ypical Range Transfers Bytes no operands 45 16 50 0 2 FRNDINT FRSTOR FRSTOR source Exceptions None Restore saved state Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfer...

Page 426: ...tination Exceptions 1 0 U P Store real Execution Clocks Operands Operand Word Code Transfers Bytes Coding Example Typical Range ST i 18 15 22 0 2 FST ST 3 short real 87 84 90 2 2 4 FST CORRELATION 01...

Page 427: ...sfers Bytes 2 bytes 15 12 18 1 2 4 FSTSW SAVE_STATUS FSTSW AX FSTSW AX Exceptions None FNSTSWAX Store status word to AX Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfe...

Page 428: ...perands Operand Word Code Coding Example Typical Range Transfers Bytes ST i ST 90 75 105 0 2 FSUBRP ST 1 ST FTST FTST no operands Exceptions I D Test stack top against 0 0 Execution Clocks Operands Op...

Page 429: ...operands 50 27 55 0 2 FXTRACT FYL2X FYL2X no operands Exceptions P operands not checked y Log2X Execution Clocks Operands Operand Word Code Coding Example Typical Range Transfers Bytes no operands 950...

Page 430: ...80286 CPU This section describes how programmers in ASM286 and in a variety of higher level languages can work with the 80287 The level of detail in this section is intended to give programmers a basi...

Page 431: ...M 286 program will set up the NPX after power up using the INIT REAL MATH UNIT procedure and then issue SET REAL MODE to configure the NPX SET REAL MODE loads the 80287 control word and its 16 bit par...

Page 432: ...ith these directives The type value is equal to the length of the storage unit in bytes 10 for DT 8 for DQ etc The assembler checks the type of any variable coded in an instruction to be certain that...

Page 433: ...ords so that no storage is wasted if blocks of variables are defined together and preceded by a single EVEN declarative RECORDS AND STRUCTURES The ASM286 RECORD and STRUC structure declaratives can be...

Page 434: ...NTEGER DQ LONG REAL ARRAY OF TEST_SCORES OBSERVATIONS WORD INTEGER DW 1000 DUP SAMPLE ENDS Figure 2 5 Structure Definition ADDRESSING MODES 80287 memory data can be accessed with any of the CPU s five...

Page 435: ...etc SUM SQUARES the sum of each array element squared A true program of course would go beyond these steps to store and use the results of these calcula tions The control word is set with the recomme...

Page 436: ...m indexes x array i float i l 12 13 2 2 sum sli uares sum squares x array i x array i end 1 etc 1 14 end array sumi PLlM 286 COMP I LER ARRAYSUM CROSS REFERENCE LISTING DEFN ADDR SIZE NAME ATTRIBUTES...

Page 437: ...80286 and is made much easier by the existence of an 80287 emulator for 80286 systems The Intel E80287 emulator offers a complete software counterpart to the 80287 hardware NPX instructions can be si...

Page 438: ...16 stack stackseg 400 17 Ie Begi n code 19 code segment eT public dup 1 20 assume ds data 55 stack es nothing 21 22 23 24 25 26 Z7 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50...

Page 439: ...NO ERRORS Figure 2 7 Sample ASM286 Program Cont d ST O ST l ST 2 ST O ST l ST 2 ST 3 ST O ST l ST 2 ST 3 ST 4 ST O ST l ST 2 ST 3 FLOZ FLOZ FLOZ 0 0 0 0 0 0 FAOO 5TO 5T 2 5 0 0 0 0 2 5 FMUL 5T 5T 6 25...

Page 440: ...rogram control and arithmetic The program control part performs activities such as deciding what functions to perform calculating addresses of numeric operands and loop control The arithmetic part sim...

Page 441: ...he examples of the first case the CPU will finish with the operand before the 80287 can reference it The NPX interface guarantees this In the examples of the second case the CPU must wait for the 8028...

Page 442: ...Synchronization Almost any numeric instruction can under the wrong circumstances produce a numeric error Concur rent execution of the CPU and NPX requires synchronization for these errors just as it d...

Page 443: ...nstruction the CPU traps to a software excep tion handler Some ESC instructions do not check for errors These are the nonwaited forms FNINIT FNSTENV FNSAVE FNSTSW FNSTCW and FNCLEX When the NPX signal...

Page 444: ...OUNT is incremented before the exception handler is invoked the recovery routine will load an incorrect value of COUNT causing the program to fail or behave unreliably PROPER ERROR SYNCHRONIZATION Err...

Page 445: ...System Level Numeric Programming 3 pcjs org...

Page 446: ...pcjs org...

Page 447: ...memory accessible to the 80286 CPU is accessible by the 80287 The Processor Extension Data Channel is described in more detail in Chapter Six of the 80286 Hardware Reference Manual Real Address Mode...

Page 448: ...rol are described including recognition of the NPX emulation of the 80287 NPX in software if the hardware is not available and the handling of exceptions that may occur during the execution of the 802...

Page 449: ...it form moy si offset dgroup tefl1J mov word ptr si SASAH Initial ize tenp to non zero value fnstsw si Must use non wait form of fstsw It is not necessary to use a WAIT instruction after fnstsw or fns...

Page 450: ...e 80287 numeric instructions The Math Present MP flag of the 80286 machine status word indicates to the CPU whether an 80287 NPX is physically avaiiabie in the system The MP flag controls the function...

Page 451: ...has been switched to Protected mode using the FSETPM instruction only another hardware RESET can switch the 80287 back to Real Address mode The FNINIT instruction does not switch the operating state o...

Page 452: ...that runs on 80286 systems is available from Intel in the 8086 Software Toolbox Order Number 122203 This emulation package operates in both Real and Protected mode providing a complete functional equi...

Page 453: ...s and tag words operand and instruction pointers as it existed at the time of the exception Clear the exception bits in the status word Enable interrupts on the CPU Identify the exception by examining...

Page 454: ...ction The exception handler must obtain from the NPX the address of the offending instruction in thetask that initiated it make a copy of it execute the copy in the context of the offending task and t...

Page 455: ...Numeric Programming Examples 4 pcjs org...

Page 456: ...pcjs org...

Page 457: ...espond to the CPU s zero parity and carry flags ZF PF and CF when the byte is written into the flags The code fragment sets ZF PF and CF of the CPU status word to the values of C3 C2 and CO of the NPX...

Page 458: ...JB J E LLU NOR DERE D LLESS LEQUAL TE ST C2 P F TE ST CO CF TE ST C3 Z F LG REA TE R CO C F o C3 ZF 0 CO CF o C3 ZF 1 CO CF 1 C3 ZF 0 LLUNORDERED C2 PF 1 Figure 4 1 Conditional Branching for Compares...

Page 459: ...P FXAM_TBLIBXl HERE ARE THE JUMP TARGETS ONE TO HANDLE i EACH POSSIBLE RESULT OF fXAM PO LU NNOR M POS_NAN NELU NNOR M NELN AN PO LN 0 RM POLINFINITY NELH 0RM NELINFINITY PO LZ E R0 EMPTY NELZERO PO L...

Page 460: ...oice of instructions to save and restore the 80287 The tradeoff here is between the increased diagnostic information provided by FNSAVE and the faster execution of FNSTENV For applications that are se...

Page 461: ...C SAVE CPU REGISTERS ALLOCATE STACK SPACE FOR 80287 ENVIRONMENT PUSH BP MOV BP SP SUB SP 14 SAVE ENVIRONMENT WAIT FOR COMPLETION ENABLE CPU INTERRUPTS FNSTENV IBP 141 FWAIT ST I APPLICATION EXCEPTION...

Page 462: ...PPLICATION EXCEPTION HANDLING CODE GOES HERE AN UNMASKED EXCEPTION GENERATED HERE WILL CAUSE THE EXCEPTION HANDLER TO BE REENTERED IF LOCAL STORAGE IS NEEDED IT MUST BE ALLOCATED ON THE CPU STACK CLEA...

Page 463: ...ine will t onvert the floating poiflt numbeT in tne top of the 80287 tack to IiIn ASCII string and sepiilrate power oP 10 aling value in binaf The maximum width of the ASCII string POf med is controll...

Page 464: ...n is also used for scaling thIJ value into the range acceptable for the BCD data The rounding mode in effect on entrv to the subroutine is used for thIJ conversion The following are not transpart nt D...

Page 465: ...AN or indefinite Store the value in memory and look at the fraction field to separate indefinite from an ordinary NAN fstp fraction test ai MINUS fwait JZ exit JIroc mov bx OCOOOH sub bx word ptr frac...

Page 466: ...diJ is not u ed by convert integer OK to letJve running tub dl NDRMAL P5UEDO_ZERD Set return value saving thf sign bit Jmp convert_i nteger Put zero value into memory The number is a real zero iet the...

Page 467: ...range allowed by the BCD form at The scaling operation 5hould produce a numb r within one decimal order of magnitUde of the largut decim ll number repra ntabla within the given string width nl seal i...

Page 468: ...for aign Get ddre of start of ASCII string I CoPu ds to es Set utoinere ent mode I C r sign fhld Look or ne ative v lue I Bump string pointer past sign I Turn off sign bit I W it for fbstp to finish...

Page 469: ...a a 1 lo Thh lub1 DUUnW will c leul t the v lue of 10 Fa alu of 0 c a I the ult 111111 ct All 80286 ght II n nt nd th v lu is tu n d on J th TDB two nu_b r pon nt in STet nd cUon in STeO I Th on nt v...

Page 470: ...5 0002 9BDFEO 0005 8AC4 0007 250740 OOOA COEC03 0000 OAC4 OOOF B400 0011 C3 LINE SOURCE 1 1 TOS register contents 2 3 This subr outine will return a value from 0 15 in AX corres ponding 4 to the conte...

Page 471: ...y limited range of BCD values To print a 9 digit result requires accurately scaling the given value to an integer between 108 and 109 For example the number 0 123456789 requires a scaling factor of 10...

Page 472: ...sufficient accuracy Ignoring the fraction value can introduce a maximum error of 0 32 in the result Using the magnitude of the value and size of the number string the scaling factor can be calculated...

Page 473: ...ETRIC CALCULATION EXAMPLES The 80287 instruction set does not provide a complete set of trigonometric functions that can be used directly in calculations Rather the basic building blocks for implement...

Page 474: ...begin by looking at the value given to them Not a Number NaN infinity or empty registers must be specially treated Unnormals need to be converted to normal values before the FPTAN instruction will wo...

Page 475: ...enormal ind inite indeHnit e NAN Itmpty Thi fUnc tion il b ud on the NPX fptan instruction The fptan in truction IUlll only lUork with an angle of from 0 to PI 4 With th l i in truction the ine or cOl...

Page 476: ...e angle is too big to be meaningful 2 62 radians Any roundoff error in the calculation of the angle given could completellJ change the result of this function It is safE st to call this verlJ rare c a...

Page 477: ...uT n_empt T tuT n NAN Remove PII4 I Return empt l if no paT m I Jump if st OI is NAN st O is infinit R tuT n an indefinite value pT em I STell can be n lthing T etuT n NAN T etuT n_emp tV t I Ok to hi...

Page 478: ...Four possible l et R a langle HOD PI 41 B lor 1 depend ing the sign of the angle 1 l teneR 2 tan1PI 4 Rl 3 l tanlR 4 l tanCPI 4 R The fo1101111 g table is used to decide which relation to use dependi...

Page 479: ...an_zero Test for zero engle I C3 1 H st O 0 I Removtt PI 4 J ttm sno ST ST O aft r_tangent Decide on the o der of the op rands and their sign for the divide operation while the fptan instruction is wo...

Page 480: ...pcjs org...

Page 481: ...A Machine Instruction Encoding and Decoding pcjs org...

Page 482: ...pcjs org...

Page 483: ...the 80286 CPU and an explicit WAIT instruction though allowed is not necessary Table A 1 80287 Instruction Encoding Lower Addressed Byte 1 1 1 0 1 1 OP A 2 1 1 0 1 1 FORMAT 3 1 1 0 1 1 R P 4 1 1 0 1...

Page 484: ...1101 1000 M0011 1R M disp Io disp hi FOIVR short real 08 1101 1000 1100 OREG FAOO ST ST i 08 1101 1000 1100 1REG FMUL ST ST i 08 1101 1000 1101 OREG FCOM ST i 08 1101 1000 1101 1REG FCOMP ST i 08 110...

Page 485: ...t integer DA 1101 1010 MOD10 OR M disp Io disp hi FISUB short integer DA 1101 1010 MOD10 1R M disp Io disp hi FISUBR short integer DA 1101 1010 MOD11 OR M disp Io disp hi FIDIV short integer DA 1101 1...

Page 486: ...eserved DE 1101 1110 MODOO OR M disp Io disp hi FIADD word integer DE 1101 1110 MODOO 1R M disp Io disp hi FIMUL word integer DE 1101 1110 MOD01 OR M disp Io disp hi FICOM word integer DE 1101 1110 MO...

Page 487: ...1101 1111 1101 1REG 9 OF 1101 1111 1110 000 FSTSWAX OF 1101 1111 1111 XXX reserved NOTE The marked encodings are not generated by the language translators If however the 80287 encounters one of these...

Page 488: ...pcjs org...

Page 489: ...Appendix B Compatibility Between the 80287 NPX and the 8087 pcjs org...

Page 490: ...pcjs org...

Page 491: ...s not saved in Protected mode exception handlers will have to retrieve the opcode from memory if needed 6 Interrupt 7 will occur in the 80286 when executing ESC instructions with either TS task switch...

Page 492: ...he data lines during the FSTSW Store 80287 Status Word instruction FND_287 FNI NIT FSTSTW STAT MOV AX STAT OR AL AL JZ GOL2 87 No 80287 Pre5ent SMSW AX OR AX 0004H LMSW AX JMP CONTINUE initialize nume...

Page 493: ...Appendix Implementing the IEEE P754 Standard c pcjs org...

Page 494: ...pcjs org...

Page 495: ...the same as the Standard s Double Extended format The Standard allQws a choice of Bias in representing the exponent the 80287 uses the Bias 16383 decimal For the Double Extended format the Standard co...

Page 496: ...d for this action to occur 4 The Standard requires that all functions that convert real numbers to integer formats automati cally normalize the inputs if necessary The integer conversion functions con...

Page 497: ...umbers are considered Denormal by the NPX whenever the Biased Exponent is o minimum exponent This is true even if the explicit integer bit of the significand is 1 Such numbers can occur as the result...

Page 498: ...pcjs org...

Page 499: ...Glossary of 80287 and Floating Point Terminology pcjs org...

Page 500: ...pcjs org...

Page 501: ...ou must subtract the Bias from the given Exponent For example the Short Real format has a Bias of 127 whenever the given Exponent is nonzero If the 8 bit Exponent field contains 10000011 which IS 131...

Page 502: ...ting Point Numbers are more versatile than Integer representations in two ways First they include fractions Second their Exponent parts allow a much wider range of magni tude than possible with fixed...

Page 503: ...at does not represent any numeric or infinite quantity NaNs should be returned by functions that encounter serious errors If created during a sequence of calculations they are transmitted to the final...

Page 504: ...t an Implicit Integer Bit and a 23 bit Significand a total of 32 explicit bits Significand the part of a Floating Point Number that consists of the most significant nonzero bits of the number if the n...

Page 505: ...he right Underflow an error condition in which the correct answer is nonzero but has a magnitude too small to be represented as a Normal number in the destination Floating Point format The Standard sp...

Page 506: ...pcjs org...

Page 507: ...Error Synchronization 2 50 Exception Handling Examples 4 3 4 6 Exception Handling Numeric Processing 3 6 3 7 Exceptions Numeric 1 32 1 37 Automatic Exception Handling 1 36 Handling Numeric Errors 1 3...

Page 508: ...VlUILlP1Y J Cillj J 1 JV FMULP Multiply Real and Pop 2 5 2 7 2 30 FNOP No Operation 2 15 2 20 2 32 FPATAN Partial Arctangant 1 2 2 12 2 30 FPREM Partial Remainder 2 5 2 8 2 32 4 17 FPTAN Partial Tange...

Page 509: ...34 Numeric Processor Overview 1 1 Output Format 4 17 Overflow 1 20 1 33 4 16 INDEX Packed Decimal Notation 1 15 1 16 Precision Control 1 19 1 36 PLM 286 2 39 Pointers INstruction Data 1 12 Processor C...

Page 510: ...Underflow 1 20 1 33 4 16 Unnormals 1 23 Upgradability 1 4 WAIT Form 2 14 INDEX Word Integer Format 1 16 Zero Divisor 1 33 1 35 Zeros 1 24 Index 4 pcjs org...

Page 511: ...260 Corporate Center 75 Uvlngston Avenue First Floor Roseland 07088 Tel 201 740 0111 NEW MEXICO Intel Corp 8500 Manual Boulevard N E SuiteB295 NEW YORK Intel Corp 127 Main Street Binghamton 13905 Tel...

Page 512: ...on 80241 tMicrocomputer System Technical Dtttrlbutor Centers CONNECTICUT Inc 06492 Hamllton Avnet Electronics Commerce Industrial Park Commerce Drive 06810 FLORIDA GEORGIA Suite A Norcross 30071 Pione...

Page 513: ...Electronics Bldg E Tel 281 4150 tPioneer Electronics 261 Gibraltar Aoad Horsham 19044 TEXAS tArrow Electronics Inc 3220 Commander Drive carrollton 75006 tArrow Electronics Inc 10899 Kinghurst Suite 1...

Page 514: ...AC Delft Tel 15 609 906 TLX 38250 DENMARK FINLAND Oy Flntronlc AB Melkonkalu 24A SF OQ210 Helsinki 21 Tel 0 692 60 22 TLX 124224 FTRON SF FRANCE Fleld Application Location FRANCE Cont d Tekelec Alrtr...

Page 515: ...pcjs org...

Search results

Summary of Contents for 80286

Reviews:

Related manuals for 80286

Brands by name

Popular brands

Intel 80286, Programmer'S Reference Manual

Search results

Summary of Contents for 80286

Reviews:

Related manuals for 80286

Brands by name

Popular brands